@cloudflare/workers-oauth-provider 1.2.0 → 1.2.2

package/README.md

@@ -2,7 +2,7 @@
 
 `@cloudflare/workers-oauth-provider` adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers running on Cloudflare Workers.
 
-> **Upgrading from 0.x, 1.0 or 1.1?** Read the [migration guide](docs/migration-1.0.md), which covers every change since 0.10 with code, or point your coding agent at [`skills/migrate-to-1.0/`](skills/migrate-to-1.0/SKILL.md), which also ships in the npm package.
+> **Upgrading from 0.x, 1.0 or 1.1?** Read the [migration guide](docs/migration-1.x.md), which covers every change since 0.10 with code, or point your coding agent at [`skills/migrate-to-1.x/`](skills/migrate-to-1.x/SKILL.md), which also ships in the npm package.
 
 ## Install
 

package/dist/oauth-provider.d.ts

@@ -255,7 +255,13 @@ interface EmaTrustedIssuer {
   issuer: string;
   /** HTTPS JWKS endpoint used to validate assertion signatures. */
   jwksUri: string;
-  /** Allowed JWT signing algorithms for this issuer. Defaults to `['RS256']`. */
+  /**
+   * Allowed JWT signing algorithms for this issuer: `RS256`, `ES256`, or both.
+   * Defaults to `['RS256']`, so an IdP that signs ID-JAGs with `ES256` must list it.
+   * Use the algorithm the IdP signs ID-JAGs with, which its documentation or a
+   * sample assertion's `alg` header shows. `id_token_signing_alg_values_supported`
+   * describes ID tokens and may differ.
+   */
   algorithms?: string[];
   /** Expected authorization server audience. Defaults to this provider's issuer URL. */
   audience?: string;
@@ -1098,9 +1104,11 @@ interface OAuthProviderOptions<Env = Cloudflare.Env> {
     request?: Request;
   }) => Response | void;
   /**
-   * Accept RFC 8252 private-use URI scheme redirect URIs (for example `com.example.app:/oauth`)
-   * for native apps. By default redirect URIs must use `https`, or `http` on a loopback host, as
-   * MCP and OAuth 2.1 require; remote `http` is never accepted. Leave this off for MCP servers.
+   * Let authorization requests use RFC 8252 private-use URI scheme redirect URIs (for example
+   * `com.example.app:/oauth`), for native apps. By default a request's redirect URI must use
+   * `https`, or `http` on a loopback host, as MCP and OAuth 2.1 require; remote `http` is never
+   * accepted. Without this option a client can still register private-use URIs next to a compliant
+   * one (Cursor does), but no request can use them.
    */
   allowPrivateUseRedirectUris?: boolean;
   /**