@cloudflare/workers-oauth-provider 1.2.0 → 1.2.2

package/dist/oauth-provider.js

@@ -107,15 +107,27 @@ function negotiateTokenEndpointAuthMethod(options) {
 	const advertised = [...new Set([...preferredMethod === void 0 ? [] : [preferredMethod], ...advertisedMethods])];
 	throw new Error(`${context} does not support an accepted token endpoint authentication method. Supported methods: ${acceptedMethods.join(", ")}. Client advertised: ${advertised.length > 0 ? advertised.join(", ") : "(none)"}`);
 }
-function negotiateCimdTokenEndpointAuthMethod(server, preferredMethod, supportedMethods) {
+/** Asymmetric method a CIMD client may use when its document supplies usable keys. */
+const PRIVATE_KEY_JWT = "private_key_jwt";
+/**
+* Every token endpoint authentication method a CIMD client may use with this server, in the
+* server's order of preference.
+*
+* A metadata document has no registration response, so the client learns nothing about which
+* method this server picked. It chooses one per request from this server's metadata. So every
+* method both sides support stays usable: a document that offers `none` and `private_key_jwt`
+* (ChatGPT's does) works with either, and a document that offers only `private_key_jwt` must
+* use it.
+*/
+function negotiateCimdTokenEndpointAuthMethods(server, preferredMethod, supportedMethods, privateKeyJwt) {
 	if (preferredMethod !== void 0 && SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS.has(preferredMethod)) throw new Error(`CIMD clients cannot use symmetric token endpoint authentication method: ${preferredMethod}`);
-	return negotiateTokenEndpointAuthMethod({
-		acceptedMethods: server.tokenEndpointAuthMethods.filter((method) => !SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS.has(method)),
-		defaultMethod: "none",
-		preferredMethod,
-		supportedMethods,
-		context: "CIMD client"
-	});
+	if (preferredMethod !== void 0 && supportedMethods !== void 0 && !supportedMethods.includes(preferredMethod)) throw new Error("token_endpoint_auth_method must be included in token_endpoint_auth_methods_supported");
+	const acceptedMethods = [...server.tokenEndpointAuthMethods.filter((method) => !SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS.has(method)), ...privateKeyJwt ? [PRIVATE_KEY_JWT] : []];
+	const advertisedMethods = supportedMethods ?? [preferredMethod ?? "none"];
+	const methods = acceptedMethods.filter((method) => advertisedMethods.includes(method));
+	if (methods.length > 0) return methods;
+	const advertised = [...new Set([...preferredMethod === void 0 ? [] : [preferredMethod], ...advertisedMethods])];
+	throw new Error(`CIMD client does not support an accepted token endpoint authentication method. Supported methods: ${acceptedMethods.join(", ")}. Client advertised: ${advertised.length > 0 ? advertised.join(", ") : "(none)"}`);
 }
 /**
 * Negotiates choice-valued authentication metadata while keeping DCR grant and
@@ -146,13 +158,18 @@ function negotiateDynamicClientRegistrationCapabilities(server, client) {
 * The effective subset is still checked for grant/response consistency, and
 * token endpoint authentication must have a mutually supported method.
 */
-function negotiateCimdClientCapabilities(server, client) {
+function negotiateCimdClientCapabilities(server, client, options = { privateKeyJwt: false }) {
+	const tokenEndpointAuthMethods = negotiateCimdTokenEndpointAuthMethods(server, client.tokenEndpointAuthMethod, client.tokenEndpointAuthMethodsSupported, options.privateKeyJwt);
 	const effective = {
 		grantTypes: client.grantTypes.filter((grantType) => server.grantTypes.includes(grantType)),
 		responseTypes: client.responseTypes.filter((responseType) => server.responseTypes.includes(responseType)),
-		tokenEndpointAuthMethod: negotiateCimdTokenEndpointAuthMethod(server, client.tokenEndpointAuthMethod, client.tokenEndpointAuthMethodsSupported)
+		tokenEndpointAuthMethod: tokenEndpointAuthMethods[0],
+		tokenEndpointAuthMethods
 	};
-	validateClientCapabilities(server, effective);
+	validateClientCapabilities({
+		...server,
+		tokenEndpointAuthMethods: [...server.tokenEndpointAuthMethods, PRIVATE_KEY_JWT]
+	}, effective);
 	return effective;
 }
 function validateAuthorizationResponseType(server, responseType, clientResponseTypes) {
@@ -190,6 +207,10 @@ function isValidOAuthScopeToken(scopeToken) {
 	return OAUTH_SCOPE_TOKEN_PATTERN.test(scopeToken);
 }
 
+//#endregion
+//#region package.json
+var version = "1.2.2";
+
 //#endregion
 //#region src/oauth-http.ts
 /**
@@ -197,6 +218,13 @@ function isValidOAuthScopeToken(scopeToken) {
 * and the resource-server host (`OAuthResourceServer`), so the two can't drift apart.
 */
 /**
+* `User-Agent` sent on the library's own outbound fetches (EMA JWKS, Client ID Metadata Documents).
+* Workers' `fetch` sends none by default, and common WAF rule sets (AWS WAF's `NoUserAgent_HEADER`,
+* for one) block requests without it, so an IdP or client behind one would answer `403`. The RFC 9110
+* product token carries the release, and the comment points an operator at who is calling.
+*/
+const OUTBOUND_USER_AGENT = `workers-oauth-provider/${version} (+https://github.com/cloudflare/workers-oauth-provider)`;
+/**
 * Adds CORS headers for a browser client. The request's `Origin` is reflected: bearer tokens are
 * not ambient credentials, so any origin may present one it holds. Browser OAuth and MCP clients
 * need `WWW-Authenticate` (discovery, step-up) and `Retry-After` (backoff) exposed. Headers the
@@ -307,925 +335,1200 @@ var OAuthError = class extends Error {
 };
 
 //#endregion
-//#region src/oauth-resource.ts
+//#region src/ema/constants.ts
 /**
-* Loopback hosts where a plain `http` scheme is accepted for local development.
-* Matches RFC 8252 §7.3 loopback handling: 127.0.0.0/8, ::1, and `localhost`.
+* Constants for MCP Enterprise-Managed Authorization (EMA).
+*
+* Co-located so that anyone touching the EMA code path sees every magic
+* number in one place. Public-facing defaults can be overridden via
+* `EmaOptions`.
 */
-function isLoopbackHostname(hostname) {
-	const host = hostname.toLowerCase();
-	if (host === "localhost" || host === "::1" || host === "[::1]") return true;
-	const ipv4 = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-	return ipv4 !== null && ipv4.slice(1).every((octet) => Number(octet) <= 255);
-}
+/** JWT `typ` header value required for ID-JAG assertions (RFC 8725 §3.11). */
+const EMA_ID_JAG_JWT_TYPE = "oauth-id-jag+jwt";
 /**
-* Whether a canonical resource, issuer, or endpoint URL uses an accepted
-* scheme: `https`, or `http` on a loopback host so `wrangler dev` works on
-* http://localhost. Workers are always served over `https`, so there is no
-* deployment in which cleartext OAuth traffic to a remote host is correct,
-* and no option exists to allow it.
+* Grant-profile URN advertised in `authorization_grant_profiles_supported`
+* when EMA is configured (MCP Enterprise-Managed Authorization spec).
 */
-function hasAcceptedCanonicalScheme(url) {
-	return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
-}
-/** Validate an RFC 3986-safe HTTP(S) resource identifier for RFC 8707. */
-function validateResourceUri(uri) {
-	if (!uri || typeof uri !== "string") return false;
-	if (!/^[\x21-\x7e]+$/.test(uri) || /["\\#]/.test(uri) || !/^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]+(?:\/[^?#]*)?(?:\?[^#]*)?$/.test(uri) || /%(?![0-9A-Fa-f]{2})/.test(uri) || !/^[A-Za-z0-9:/?@!$&'()*+,;=._~%\[\]-]+$/.test(uri)) return false;
-	try {
-		const parsed = new URL(uri);
-		return parsed.protocol === "http:" || parsed.protocol === "https:";
-	} catch {
-		return false;
-	}
-}
+const EMA_ID_JAG_GRANT_PROFILE = "urn:ietf:params:oauth:grant-profile:id-jag";
+/** Maximum compact JWT assertion size accepted at the token endpoint. */
+const EMA_MAX_JWT_BYTES = 16 * 1024;
+/** Maximum JWKS response size accepted from a trusted enterprise IdP. */
+const EMA_JWKS_MAX_SIZE_BYTES = 64 * 1024;
+/** Request timeout for JWKS fetches. */
+const EMA_JWKS_FETCH_TIMEOUT_MS = 1e4;
+/** Default JWKS cache TTL. */
+const EMA_DEFAULT_JWKS_CACHE_TTL_SECONDS = 300;
+/** Default allowed clock skew for ID-JAG time claim validation. */
+const EMA_DEFAULT_CLOCK_SKEW_SECONDS = 60;
+/** Default maximum accepted ID-JAG lifetime. */
+const EMA_DEFAULT_MAX_ASSERTION_LIFETIME_SECONDS = 300;
 /**
-* Whether a requested resource identifies a granted or configured resource.
-* Only ASCII case in the URI scheme and host is ignored, and an empty path is
-* equivalent to `/` (RFC 3986 §6.2.3), so a client that round-trips
-* `https://example.com` through a URL parser as `https://example.com/` still
-* names it. Port, path, query, a trailing slash after a path segment, user
-* information, and every other byte remain significant.
+* Minimum cool-down between JWKS force-refreshes per issuer.
+* Defends against attackers that send many assertions with random `kid`
+* values to amplify load on the IdP's JWKS endpoint.
 */
-function resourceMatches(requested, granted) {
-	const foldedRequested = foldResourceSchemeAndHost(requested);
-	const foldedGranted = foldResourceSchemeAndHost(granted);
-	if (foldedRequested === void 0 || foldedGranted === void 0) return false;
-	return normalizeEmptyPath(foldedRequested) === normalizeEmptyPath(foldedGranted);
-}
+const EMA_JWKS_FORCE_REFRESH_COOLDOWN_SECONDS = 30;
+/** Floor for the `jti` replay marker's KV TTL; KV rejects a sub-60s expiration. */
+const EMA_JTI_MIN_TTL_SECONDS = 60;
+/** Default JWT signing algorithm assumed for a trusted issuer. */
+const EMA_DEFAULT_JWT_ALGORITHM = "RS256";
+/** JWT signing algorithms supported by the built-in WebCrypto verifier. */
+const EMA_SUPPORTED_JWT_ALGORITHMS = new Set(["RS256", "ES256"]);
+
+//#endregion
+//#region src/ema/result.ts
+const ok = (value) => ({
+	ok: true,
+	value
+});
+const err = (error) => ({
+	ok: false,
+	error
+});
 /**
-* Fold only the URI components whose comparison is ASCII case-insensitive: the
-* scheme and the host. A configured identifier is canonical when folding it is
-* the identity.
+* Map an internal `EmaValidationError` to its public OAuth error code and
+* description. Most validation failures collapse to a single generic message
+* to avoid leaking which check failed to attackers probing the IdP. The
+* exceptions are RFC-prescribed distinct codes (`invalid_target` for
+* RFC 8707 resource issues, `invalid_request` for malformed input).
 */
-function foldResourceSchemeAndHost(resource) {
-	const schemeSeparator = resource.indexOf("://");
-	if (schemeSeparator <= 0) return void 0;
-	const authorityStart = schemeSeparator + 3;
-	const authorityEndOffset = resource.slice(authorityStart).search(/[/?#]/);
-	const authorityEnd = authorityEndOffset === -1 ? resource.length : authorityStart + authorityEndOffset;
-	const authority = resource.slice(authorityStart, authorityEnd);
-	const hostStart = authority.lastIndexOf("@") + 1;
-	let hostEnd;
-	if (authority[hostStart] === "[") {
-		const closingBracket = authority.indexOf("]", hostStart + 1);
-		if (closingBracket === -1) return void 0;
-		hostEnd = closingBracket + 1;
-	} else {
-		const portSeparator = authority.indexOf(":", hostStart);
-		hostEnd = portSeparator === -1 ? authority.length : portSeparator;
+function emaErrorToWire(e) {
+	switch (e.reason) {
+		case "assertion_missing": return {
+			code: "invalid_request",
+			message: "assertion is required"
+		};
+		case "invalid_scope_param": return {
+			code: "invalid_request",
+			message: "Invalid scope parameter format"
+		};
+		case "resource_invalid":
+		case "resource_mismatch": return {
+			code: "invalid_target",
+			message: "Invalid resource"
+		};
+		case "mapper_denied":
+		case "mapper_threw": return {
+			code: "invalid_grant",
+			message: "Assertion was not authorized"
+		};
+		case "invalid_mapped_user": return {
+			code: "invalid_grant",
+			message: "Invalid mapped user"
+		};
+		case "invalid_mapped_scope": return {
+			code: "invalid_grant",
+			message: "Invalid mapped scope"
+		};
+		case "invalid_mapped_props": return {
+			code: "invalid_grant",
+			message: "Invalid mapped props"
+		};
+		case "invalid_mapped_ttl": return {
+			code: "invalid_grant",
+			message: "Invalid access token TTL"
+		};
+		case "assertion_expired_after_processing": return {
+			code: "invalid_grant",
+			message: "Assertion has expired"
+		};
+		case "assertion_too_large":
+		case "assertion_malformed":
+		case "invalid_typ":
+		case "invalid_alg":
+		case "issuer_not_trusted":
+		case "no_matching_key":
+		case "signature_failed":
+		case "jwks_fetch_failed":
+		case "invalid_claim":
+		case "aud_mismatch":
+		case "unsupported_claim":
+		case "expired":
+		case "iat_in_future":
+		case "nbf_in_future":
+		case "lifetime_too_long":
+		case "replayed":
+		case "client_id_mismatch": return {
+			code: "invalid_grant",
+			message: "Invalid assertion"
+		};
 	}
-	const asciiLower = (value) => value.replace(/[A-Z]/g, (character) => character.toLowerCase());
-	return asciiLower(resource.slice(0, schemeSeparator)) + "://" + authority.slice(0, hostStart) + asciiLower(authority.slice(hostStart, hostEnd)) + authority.slice(hostEnd) + resource.slice(authorityEnd);
-}
-/** RFC 3986 §6.2.3: for http and https an empty path is equivalent to "/". */
-function normalizeEmptyPath(resource) {
-	const authorityStart = resource.indexOf("://") + 3;
-	const pathOffset = resource.slice(authorityStart).search(/[/?#]/);
-	if (pathOffset === -1) return `${resource}/`;
-	const pathStart = authorityStart + pathOffset;
-	return resource[pathStart] === "/" ? resource : `${resource.slice(0, pathStart)}/${resource.slice(pathStart)}`;
 }
+
+//#endregion
+//#region src/ema/util.ts
 /**
-* Whether a request carries every query parameter of a canonical resource. A
-* query-bearing resource identifier names a more specific resource: a request
-* may add parameters of its own but must preserve the resource's.
+* Tiny utility helpers used by EMA adapters.
+*
+* Lives in `src/ema/util.ts` rather than `src/util.ts` to keep the EMA
+* module self-contained — the main `oauth-provider.ts` reaches into here
+* only through the adapters' public interfaces.
 */
-function requestCarriesResourceQuery(requestUrl, resourceUrl) {
-	for (const [name, value] of resourceUrl.searchParams) if (!requestUrl.searchParams.getAll(name).includes(value)) return false;
-	return true;
+/** SHA-256 a string and return its hex digest. */
+async function sha256Hex$1(input) {
+	const data = new TextEncoder().encode(input);
+	const buffer = await crypto.subtle.digest("SHA-256", data);
+	return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 
 //#endregion
-//#region src/oauth-client-metadata.ts
-const CIMD_MAX_SIZE_BYTES = 5 * 1024;
-const CIMD_FETCH_TIMEOUT_MS = 1e4;
-const CIMD_CACHE_NAME = "workers-oauth-provider:cimd:v1";
-const CIMD_CACHE_MAX_TTL_SECONDS = 10080 * 60;
-function requireJsonObject(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("Client metadata must be a JSON object");
-	return value;
-}
-function optionalString(value, fieldName) {
-	if (value === void 0) return void 0;
-	if (typeof value !== "string") throw new Error(`Invalid ${fieldName}: expected string, got ${typeof value}`);
-	return value;
-}
-function optionalStringArray(value, fieldName) {
-	if (value === void 0) return void 0;
-	if (!Array.isArray(value)) throw new Error(`Invalid ${fieldName}: expected array, got ${typeof value}`);
-	if (!value.every((item) => typeof item === "string")) throw new Error(`Invalid ${fieldName}: array must contain only strings`);
-	return [...value];
-}
-function optionalHttpUri(value, fieldName) {
-	const uri = optionalString(value, fieldName);
-	if (uri === void 0) return void 0;
-	let parsed;
-	try {
-		parsed = new URL(uri);
-	} catch {
-		throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
-	return uri;
-}
-const I18N_FIELDS = {
-	client_name: "string",
-	client_uri: "uri",
-	logo_uri: "uri",
-	tos_uri: "uri",
-	policy_uri: "uri"
-};
-function extractI18nFields(raw) {
-	const result = {};
-	for (const key of Object.keys(raw)) {
-		const hashIndex = key.indexOf("#");
-		if (hashIndex <= 0 || hashIndex === key.length - 1) continue;
-		const kind = I18N_FIELDS[key.slice(0, hashIndex)];
-		if (!kind) continue;
-		const value = kind === "uri" ? optionalHttpUri(raw[key], key) : optionalString(raw[key], key);
-		if (value !== void 0) result[key] = value;
-	}
-	return Object.keys(result).length > 0 ? result : void 0;
-}
-function validateChoiceConsistency(preferredName, preferredValue, choicesName, choices) {
-	if (preferredValue !== void 0 && choices !== void 0 && !choices.includes(preferredValue)) throw new Error(`${preferredName} must be included in ${choicesName}`);
-}
-function parseOAuthClientMetadata(raw) {
-	const tokenEndpointAuthMethod = optionalString(raw.token_endpoint_auth_method, "token_endpoint_auth_method");
-	const tokenEndpointAuthMethodsSupported = optionalStringArray(raw.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported");
-	const tokenEndpointAuthSigningAlg = optionalString(raw.token_endpoint_auth_signing_alg, "token_endpoint_auth_signing_alg");
-	const tokenEndpointAuthSigningAlgValuesSupported = optionalStringArray(raw.token_endpoint_auth_signing_alg_values_supported, "token_endpoint_auth_signing_alg_values_supported");
-	validateChoiceConsistency("token_endpoint_auth_method", tokenEndpointAuthMethod, "token_endpoint_auth_methods_supported", tokenEndpointAuthMethodsSupported);
-	validateChoiceConsistency("token_endpoint_auth_signing_alg", tokenEndpointAuthSigningAlg, "token_endpoint_auth_signing_alg_values_supported", tokenEndpointAuthSigningAlgValuesSupported);
-	return {
-		clientId: optionalString(raw.client_id, "client_id"),
-		redirectUris: optionalStringArray(raw.redirect_uris, "redirect_uris"),
-		clientName: optionalString(raw.client_name, "client_name"),
-		clientUri: optionalHttpUri(raw.client_uri, "client_uri"),
-		logoUri: optionalHttpUri(raw.logo_uri, "logo_uri"),
-		policyUri: optionalHttpUri(raw.policy_uri, "policy_uri"),
-		tosUri: optionalHttpUri(raw.tos_uri, "tos_uri"),
-		jwksUri: optionalHttpUri(raw.jwks_uri, "jwks_uri"),
-		i18n: extractI18nFields(raw),
-		contacts: optionalStringArray(raw.contacts, "contacts"),
-		grantTypes: optionalStringArray(raw.grant_types, "grant_types"),
-		responseTypes: optionalStringArray(raw.response_types, "response_types"),
-		tokenEndpointAuthMethod,
-		tokenEndpointAuthMethodsSupported,
-		tokenEndpointAuthSigningAlg,
-		tokenEndpointAuthSigningAlgValuesSupported
-	};
-}
-function pickDisplayMetadata(metadata) {
-	const { clientName, clientUri, logoUri, policyUri, tosUri, jwksUri, i18n, contacts } = metadata;
-	return {
-		clientName,
-		clientUri,
-		logoUri,
-		policyUri,
-		tosUri,
-		jwksUri,
-		i18n,
-		contacts
-	};
+//#region src/ema/jti.ts
+/**
+* Default `EmaJtiStore`: KV-backed `jti` replay marker.
+*
+* KV is eventually-consistent and does not provide compare-and-set, so two
+* concurrent requests with the same `jti` can both observe "not seen" and
+* succeed — the trade-off accepted here. Surrounding claim checks
+* (signature, `exp`, `nbf`, `aud`, `resource`, client binding) constrain
+* the practical attack window.
+*/
+/** Storage key prefix for replay markers. Stable across versions. */
+const EMA_JTI_KV_PREFIX = "enterprise-jti:";
+/**
+* Create the default KV-backed JTI store. KV TTL handles cleanup.
+*
+* @param keyPrefix Storage key prefix, so each kind of assertion keeps its own replay namespace.
+*/
+function createKvJtiStore(keyPrefix = EMA_JTI_KV_PREFIX) {
+	return { async markUsed({ issuer, jti, exp, now, env }) {
+		const ttl = Math.max(EMA_JTI_MIN_TTL_SECONDS, exp - now);
+		const key = `${keyPrefix}${await sha256Hex$1(`${issuer}\n${jti}`)}`;
+		if (await env.OAUTH_KV.get(key)) return err({
+			reason: "replayed",
+			jti
+		});
+		await env.OAUTH_KV.put(key, "1", { expirationTtl: ttl });
+		return ok(void 0);
+	} };
 }
+
+//#endregion
+//#region src/ema/jwks.ts
 /**
-* The checks every listed redirect URI passes, whatever the policy: no control characters, a
-* scheme, and not a dangerous one (`javascript:`, `data:` and the like). A Client ID Metadata
-* Document is held to these alone; the URI a request uses is then held to {@link validateRedirectUri}.
-* @throws Error when the redirect URI is not safe to store
+* Default `EmaJwksProvider`: fetches IdP signing keys with caching and a
+* force-refresh cool-down. The cool-down defends against attackers that
+* spam random `kid` values to amplify load on the IdP's JWKS endpoint.
+*
+* The cache lives inside the returned provider closure, so each
+* `OAuthProvider` instance has its own cache — no cross-instance bleed.
 */
-function validateRedirectUriSafety(redirectUri) {
-	const dangerousSchemes = [
-		"javascript:",
-		"data:",
-		"vbscript:",
-		"file:",
-		"mailto:",
-		"blob:"
-	];
-	const normalized = redirectUri.trim();
-	for (let i = 0; i < normalized.length; i++) {
-		const code = normalized.charCodeAt(i);
-		if (code >= 0 && code <= 31 || code >= 127 && code <= 159) throw new Error("Invalid redirect URI");
-	}
-	const colonIndex = normalized.indexOf(":");
-	if (colonIndex === -1) throw new Error("Invalid redirect URI");
-	const scheme = normalized.slice(0, colonIndex + 1).toLowerCase();
-	if (dangerousSchemes.includes(scheme)) throw new Error("Invalid redirect URI");
+/** Create the default JWKS provider — a closure with its own private cache. */
+function createDefaultJwksProvider(opts = {}) {
+	const cache = /* @__PURE__ */ new Map();
+	const cacheTtl = opts.cacheTtlSeconds ?? EMA_DEFAULT_JWKS_CACHE_TTL_SECONDS;
+	return { async fetch(issuer, { forceRefresh, now }) {
+		const cached = cache.get(issuer.issuer);
+		if (!forceRefresh && cached && cached.expiresAt > now) return ok(cached.jwks);
+		if (forceRefresh && cached && cached.nextForceRefreshAllowedAt > now) return ok(cached.jwks);
+		const abortController = new AbortController();
+		const timeoutId = setTimeout(() => abortController.abort(), EMA_JWKS_FETCH_TIMEOUT_MS);
+		try {
+			const response = await fetch(issuer.jwksUri, {
+				headers: {
+					Accept: "application/json",
+					"User-Agent": OUTBOUND_USER_AGENT
+				},
+				signal: abortController.signal,
+				cf: { cacheEverything: true }
+			});
+			if (!response.ok) return err({
+				reason: "jwks_fetch_failed",
+				status: response.status
+			});
+			const contentLength = response.headers.get("content-length");
+			if (contentLength && parseInt(contentLength, 10) > EMA_JWKS_MAX_SIZE_BYTES) return err({
+				reason: "jwks_fetch_failed",
+				status: response.status
+			});
+			const rawJwks = await readJsonWithSizeLimit$1(response, EMA_JWKS_MAX_SIZE_BYTES);
+			if (!rawJwks.ok) return err({ reason: "jwks_fetch_failed" });
+			if (!Array.isArray(rawJwks.value.keys)) return err({ reason: "jwks_fetch_failed" });
+			const jwks = { keys: rawJwks.value.keys };
+			cache.delete(issuer.issuer);
+			if (opts.maxEntries !== void 0 && cache.size >= opts.maxEntries) {
+				const oldest = cache.keys().next();
+				if (!oldest.done) cache.delete(oldest.value);
+			}
+			cache.set(issuer.issuer, {
+				jwks,
+				expiresAt: now + cacheTtl,
+				nextForceRefreshAllowedAt: now + EMA_JWKS_FORCE_REFRESH_COOLDOWN_SECONDS
+			});
+			return ok(jwks);
+		} catch {
+			return err({ reason: "jwks_fetch_failed" });
+		} finally {
+			clearTimeout(timeoutId);
+		}
+	} };
 }
 /**
-* Validates a redirect URI against the MCP / OAuth 2.1 redirect policy: `https`, or `http` on a
-* loopback host (`localhost`, `127.0.0.0/8`, `::1`), with no userinfo and no fragment (not even an
-* empty `#`). RFC 8252 private-use schemes are accepted only when the server enables
-* `allowPrivateUseRedirectUris`; remote `http` never is. The {@link validateRedirectUriSafety}
-* checks always apply.
-* @throws Error describing why the redirect URI is not acceptable
+* Streaming JSON reader that rejects responses exceeding `maxBytes`.
+* Bounds memory consumption before we attempt to JSON-parse the body.
 */
-function validateRedirectUri(redirectUri, server) {
-	validateRedirectUriSafety(redirectUri);
-	const normalized = redirectUri.trim();
-	let url;
+async function readJsonWithSizeLimit$1(response, maxBytes) {
+	if (!response.body) return { ok: false };
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
 	try {
-		url = new URL(normalized);
-	} catch {
-		throw new Error("Invalid redirect URI");
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				reader.cancel();
+				return { ok: false };
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
 	}
-	if (normalized.includes("#") || url.username || url.password) throw new Error("Invalid redirect URI");
-	if (url.protocol === "https:") return;
-	if (url.protocol === "http:") {
-		if (isLoopbackHostname(url.hostname)) return;
-		throw new Error("Redirect URI must use https, or http on a loopback host");
+	const merged = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		merged.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		const parsed = JSON.parse(new TextDecoder().decode(merged));
+		if (typeof parsed !== "object" || parsed === null) return { ok: false };
+		return {
+			ok: true,
+			value: parsed
+		};
+	} catch {
+		return { ok: false };
 	}
-	if (!server.allowPrivateUseRedirectUris) throw new Error("Redirect URI must use https, or http on a loopback host");
-}
-function requireValidRedirectUris(redirectUris, validate) {
-	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
-	for (const redirectUri of redirectUris) validate(redirectUri);
-	return redirectUris;
 }
+
+//#endregion
+//#region src/ema/parser.ts
 /**
-* Resolves a Dynamic Client Registration request into the complete metadata
-* shape that can be stored, applying RFC 7591 defaults and server capability
-* validation exactly once.
+* Pure JWT parsing for ID-JAG assertions.
+*
+* Splits a compact JWS (`<base64url-header>.<base64url-payload>.<base64url-signature>`)
+* into its three parts, decodes header and payload as JSON, and exposes the
+* raw signing input + signature bytes for downstream signature verification.
+*
+* No I/O. No `this`. Returns `Result<ParsedIdJag, EmaValidationError>`.
 */
-function resolveDynamicClientRegistrationMetadata(raw, server) {
-	const metadata = parseOAuthClientMetadata(raw);
-	const capabilities = negotiateDynamicClientRegistrationCapabilities(server, {
-		tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
-		tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
-		grantTypes: metadata.grantTypes ?? ["authorization_code"],
-		responseTypes: metadata.responseTypes ?? ["code"]
+/**
+* Parse a compact JWS assertion.
+*
+* @param assertion The raw assertion string from the token request body.
+* @param maxBytes Reject assertions whose length exceeds this many bytes.
+*   Guards against memory exhaustion before any JSON parsing happens.
+*/
+function parseIdJag(assertion, maxBytes) {
+	if (typeof assertion !== "string" || assertion.length === 0) return err({ reason: "assertion_missing" });
+	if (assertion.length > maxBytes) return err({
+		reason: "assertion_too_large",
+		size: assertion.length,
+		max: maxBytes
+	});
+	const parts = assertion.split(".");
+	if (parts.length !== 3 || parts.some((part) => part.length === 0)) return err({ reason: "assertion_malformed" });
+	const [encodedHeader, encodedClaims, encodedSignature] = parts;
+	let header;
+	let rawClaims;
+	let signature;
+	try {
+		header = parseJwtJsonPart(encodedHeader);
+		rawClaims = parseJwtJsonPart(encodedClaims);
+		signature = base64UrlToBytes(encodedSignature);
+	} catch {
+		return err({ reason: "assertion_malformed" });
+	}
+	const signingInput = new TextEncoder().encode(`${encodedHeader}.${encodedClaims}`);
+	return ok({
+		header,
+		rawClaims,
+		signingInput,
+		signature
 	});
-	return {
-		...pickDisplayMetadata(metadata),
-		redirectUris: requireValidRedirectUris(metadata.redirectUris, (uri) => validateRedirectUri(uri, server)),
-		...capabilities,
-		authMethodExplicit: metadata.tokenEndpointAuthMethod !== void 0 || metadata.tokenEndpointAuthMethodsSupported !== void 0
-	};
 }
 /**
-* Path component of the raw client ID string. Deliberately not
-* `new URL().pathname`: WHATWG parsing collapses the `.` and `..` segments
-* that CIMD §3 requires rejecting, and normalizes `\` and scheme-relative
-* forms this validation must see verbatim.
+* Decodes a base64url-encoded string to bytes.
 */
-function rawPath(clientId) {
-	const schemeEnd = clientId.indexOf("://");
-	if (schemeEnd === -1) return "";
-	const authorityStart = schemeEnd + 3;
-	const authorityEndOffset = clientId.slice(authorityStart).search(/[/?#]/);
-	if (authorityEndOffset === -1) return "";
-	const pathStart = authorityStart + authorityEndOffset;
-	if (clientId[pathStart] !== "/") return "";
-	const pathEndOffset = clientId.slice(pathStart).search(/[?#]/);
-	return pathEndOffset === -1 ? clientId.slice(pathStart) : clientId.slice(pathStart, pathStart + pathEndOffset);
+function base64UrlToBytes(base64Url) {
+	const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+	const binaryString = atob(padded);
+	const bytes = new Uint8Array(binaryString.length);
+	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
+	return bytes;
 }
-function validateClientIdentifierUrl(clientId) {
-	if (clientId !== clientId.trim() || /[\x00-\x20\x7f-\x9f\\]/.test(clientId)) throw new Error("Client Identifier URL contains invalid whitespace or characters");
-	if (!/^https:\/\//i.test(clientId)) throw new Error("Client Identifier URL must use an absolute HTTPS URL");
-	let parsed;
+/**
+* Parses a base64url-encoded JWT JSON part into an object.
+*/
+function parseJwtJsonPart(encoded) {
 	try {
-		parsed = new URL(clientId);
+		const json = new TextDecoder().decode(base64UrlToBytes(encoded));
+		const parsed = JSON.parse(json);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("JWT part must be an object");
+		return parsed;
 	} catch {
-		throw new Error("Client Identifier URL must be a valid HTTPS URL");
+		throw new Error("Malformed JWT part");
 	}
-	if (parsed.protocol !== "https:") throw new Error("Client Identifier URL must use HTTPS");
-	if (parsed.username || parsed.password) throw new Error("Client Identifier URL must not contain userinfo");
-	if (parsed.hash) throw new Error("Client Identifier URL must not contain a fragment");
-	const path = rawPath(clientId);
-	if (!path) throw new Error("Client Identifier URL must contain a path component");
-	for (const segment of path.split("/")) {
-		let decodedSegment;
-		try {
-			decodedSegment = decodeURIComponent(segment);
-		} catch {
-			throw new Error("Client Identifier URL contains invalid percent encoding");
-		}
-		if (decodedSegment === "." || decodedSegment === "..") throw new Error("Client Identifier URL must not contain dot path segments");
+}
+
+//#endregion
+//#region src/ema/signature.ts
+/**
+* Pick a signing key from a JWKS that matches the assertion header.
+*
+* Filters by:
+*   - `kid` (if the assertion header carries one)
+*   - JWK `use === 'sig'` (when present)
+*   - JWK `key_ops` containing `verify` (when present)
+*   - JWK `alg` matching (when present)
+*   - `kty` compatible with the requested `alg`
+*
+* If the assertion has a `kid`, the first matching key wins. Without a `kid`,
+* we only return a key if exactly one candidate matches — otherwise the
+* selection is ambiguous and we reject (caller may then force-refresh JWKS).
+*/
+function selectJwk(jwks, alg, kid) {
+	const matching = (jwks.keys ?? []).filter((key) => {
+		if (kid && key.kid !== kid) return false;
+		if (key.alg && key.alg !== alg) return false;
+		if (key.use && key.use !== "sig") return false;
+		if (Array.isArray(key.key_ops) && !key.key_ops.includes("verify")) return false;
+		if (alg.startsWith("RS") && key.kty !== "RSA") return false;
+		if (alg.startsWith("ES") && key.kty !== "EC") return false;
+		return true;
+	});
+	if (kid) {
+		const picked = matching[0];
+		if (!picked) return err({
+			reason: "no_matching_key",
+			kid
+		});
+		return ok(picked);
 	}
+	if (matching.length !== 1) return err({ reason: "no_matching_key" });
+	return ok(matching[0]);
 }
-/** Returns whether a client ID has the URL shape this package resolves through CIMD. */
-function isClientIdMetadataDocumentUrl(clientId) {
+/**
+* Verify an ID-JAG's compact-JWS signature using WebCrypto.
+*
+* Returns `false` on any WebCrypto-level failure (import or verify).
+* The caller is responsible for mapping `false` to the appropriate
+* `EmaValidationError`.
+*/
+async function verifyIdJagSignature(input) {
 	try {
-		return new URL(clientId).protocol === "https:" && rawPath(clientId) !== "";
+		const { importAlgorithm, verifyAlgorithm } = getJwtCryptoAlgorithms(input.alg);
+		const key = await crypto.subtle.importKey("jwk", input.jwk, importAlgorithm, false, ["verify"]);
+		return await crypto.subtle.verify(verifyAlgorithm, key, input.signature, input.signingInput);
 	} catch {
 		return false;
 	}
 }
-function containsPrivateJwkMaterial(value) {
-	if (value === void 0) return false;
-	const jwks = requireJsonObject(value);
-	if (!Array.isArray(jwks.keys)) throw new Error("Invalid jwks: keys must be an array");
-	const privateMembers = new Set([
-		"d",
-		"p",
-		"q",
-		"dp",
-		"dq",
-		"qi",
-		"oth",
-		"k"
-	]);
-	for (const value$1 of jwks.keys) {
-		const key = requireJsonObject(value$1);
-		if (Object.keys(key).some((member) => privateMembers.has(member))) return true;
-	}
-	return false;
-}
-function resolveClientIdMetadataDocument(metadataUrl, value, server) {
-	const raw = requireJsonObject(value);
-	const metadata = parseOAuthClientMetadata(raw);
-	if (metadata.clientId !== metadataUrl) throw new Error(`client_id "${metadata.clientId}" does not match metadata URL "${metadataUrl}"`);
-	if (!metadata.clientName?.trim()) throw new Error("client_name is required and must not be empty");
-	const redirectUris = requireValidRedirectUris(metadata.redirectUris, validateRedirectUriSafety);
-	if ("client_secret" in raw || "client_secret_expires_at" in raw) throw new Error("CIMD documents must not contain client secrets");
-	if (containsPrivateJwkMaterial(raw.jwks)) throw new Error("CIMD documents must not contain private key material");
-	const capabilities = negotiateCimdClientCapabilities(server, {
-		tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
-		tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
-		grantTypes: metadata.grantTypes ?? ["authorization_code"],
-		responseTypes: metadata.responseTypes ?? ["code"]
-	});
-	return {
-		...pickDisplayMetadata(metadata),
-		clientId: metadata.clientId,
-		clientName: metadata.clientName,
-		redirectUris,
-		...capabilities
-	};
-}
-function readStreamChunk(reader, signal) {
-	if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
-	return new Promise((resolve, reject) => {
-		const abort = () => {
-			reader.cancel().catch(() => void 0);
-			reject(new DOMException("Aborted", "AbortError"));
+/**
+* Gets WebCrypto import and verify parameters for supported JOSE algorithms.
+*/
+function getJwtCryptoAlgorithms(alg) {
+	if (alg === "RS256") {
+		const algorithm = {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: "SHA-256"
 		};
-		signal.addEventListener("abort", abort, { once: true });
-		reader.read().then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
-	});
-}
-async function readJsonWithSizeLimit$1(response, maxBytes, signal) {
-	const contentLength = response.headers.get("Content-Length");
-	if (contentLength !== null) {
-		const declaredSize = Number(contentLength);
-		if (Number.isFinite(declaredSize) && declaredSize > maxBytes) {
-			await response.body?.cancel().catch(() => void 0);
-			throw new Error(`Client metadata exceeds size limit: ${contentLength} bytes (max ${maxBytes})`);
-		}
-	}
-	const reader = response.body?.getReader();
-	if (!reader) throw new Error("Client metadata response body is empty");
-	const chunks = [];
-	let totalSize = 0;
-	while (true) {
-		const { done, value } = await readStreamChunk(reader, signal);
-		if (done) break;
-		if (!value) continue;
-		totalSize += value.length;
-		if (totalSize > maxBytes) {
-			await reader.cancel().catch(() => void 0);
-			throw new Error(`Response exceeded size limit of ${maxBytes} bytes`);
-		}
-		chunks.push(value);
-	}
-	if (signal.aborted) throw new DOMException("Aborted", "AbortError");
-	const bytes = new Uint8Array(totalSize);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.length;
-	}
-	let text;
-	try {
-		text = new TextDecoder("utf-8", {
-			fatal: true,
-			ignoreBOM: false
-		}).decode(bytes);
-	} catch {
-		throw new Error("Client metadata response is not valid UTF-8");
-	}
-	try {
 		return {
-			value: JSON.parse(text),
-			bytes
+			importAlgorithm: algorithm,
+			verifyAlgorithm: algorithm
 		};
-	} catch {
-		throw new Error("Client metadata response is not valid JSON");
 	}
-}
-function fetchCimdOrigin(metadataUrl, signal) {
-	return fetch(metadataUrl, {
-		headers: {
-			Accept: "application/json",
-			"Cache-Control": "no-store"
+	if (alg === "ES256") return {
+		importAlgorithm: {
+			name: "ECDSA",
+			namedCurve: "P-256"
 		},
-		signal,
-		cache: "no-store"
-	});
-}
-async function openCimdCache() {
-	if (typeof caches === "undefined") return void 0;
-	try {
-		return await caches.open(CIMD_CACHE_NAME);
-	} catch {
-		return;
-	}
+		verifyAlgorithm: {
+			name: "ECDSA",
+			hash: "SHA-256"
+		}
+	};
+	throw new Error(`Unsupported JWT alg: ${alg}`);
 }
+
+//#endregion
+//#region src/client-assertion.ts
+/** RFC 7523 §2.2 `client_assertion_type` for a JWT client assertion. */
+const JWT_BEARER_CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/** JWS algorithms accepted on a client assertion. */
+const CLIENT_ASSERTION_ALGORITHMS = ["RS256", "ES256"];
+/** Largest compact JWS accepted as a client assertion. */
+const CLIENT_ASSERTION_MAX_BYTES = 16 * 1024;
+/** Allowed clock skew on `exp`, `nbf`, and `iat`. */
+const CLIENT_ASSERTION_CLOCK_SKEW_SECONDS = 60;
 /**
-* Shared-cache lifetime derived from the origin's Cache-Control directives,
-* bounded by the server-side cap the CIMD draft permits (§5.2 "MAY define its
-* own upper and/or lower bounds on an acceptable cache lifetime"). Returns
-* undefined when the response must not be stored.
+* Longest remaining lifetime accepted on an assertion. A client assertion is minted per request,
+* and the bound caps how long its replay marker stays in KV.
 */
-function cacheTtlSeconds(response) {
-	const cacheControl = response.headers.get("Cache-Control");
-	if (cacheControl === null || /(?:^|,)\s*(?:no-cache|no-store|private)\b/i.test(cacheControl)) return void 0;
-	const directive = /(?:^|,)\s*s-maxage\s*=\s*"?(\d+)/i.exec(cacheControl) ?? /(?:^|,)\s*max-age\s*=\s*"?(\d+)/i.exec(cacheControl);
-	if (!directive) return void 0;
-	const ttl = Math.min(Number(directive[1]), CIMD_CACHE_MAX_TTL_SECONDS);
-	return ttl > 0 ? ttl : void 0;
-}
-async function cacheValidatedDocument(cache, metadataUrl, response, bytes) {
-	if (!cache) return;
-	const ttl = cacheTtlSeconds(response);
-	if (ttl === void 0) return;
-	const headers = new Headers({ "Cache-Control": `public, max-age=${ttl}` });
-	for (const name of [
-		"Content-Type",
-		"ETag",
-		"Last-Modified"
-	]) {
-		const value = response.headers.get(name);
-		if (value !== null) headers.set(name, value);
-	}
-	try {
-		await cache.put(metadataUrl, new Response(bytes, {
-			status: 200,
-			headers
-		}));
-	} catch {}
+const CLIENT_ASSERTION_MAX_LIFETIME_SECONDS = 3600;
+/** Most client JWKS kept in the per-isolate cache; their URLs come from client metadata. */
+const CLIENT_JWKS_CACHE_MAX_ENTRIES = 256;
+/** KV prefix for client assertion replay markers. Stable across versions. */
+const CLIENT_ASSERTION_JTI_KV_PREFIX = "client-assertion-jti:";
+/** draft-ietf-oauth-rfc7523bis explicit type. A typed assertion must use the issuer as its sole audience. */
+const CLIENT_AUTHENTICATION_JWT_TYPES = new Set(["client-authentication+jwt", "application/client-authentication+jwt"]);
+/** Whether a public JWK could verify an assertion signed with `alg`, by key type and curve. */
+function isKeyUsableForAlgorithm(key, alg) {
+	if (key.use !== void 0 && key.use !== "sig") return false;
+	if (key.alg !== void 0 && key.alg !== alg) return false;
+	if (Array.isArray(key.key_ops) && !key.key_ops.includes("verify")) return false;
+	return alg === "RS256" ? key.kty === "RSA" : key.kty === "EC" && key.crv === "P-256";
 }
 /**
-* Resolves a previously validated cache entry. A stored document that stops
-* validating (changed server capabilities, stricter rules after an upgrade)
-* is evicted so the caller re-resolves from origin in the same request;
-* timeout aborts propagate instead.
+* Reads the unverified `iss` of a client assertion, so a request that omits `client_id` can still
+* locate the client. The assertion is verified against that client's keys before it is trusted.
 */
-async function tryResolveFromCache(cache, metadataUrl, server, signal) {
-	let cached;
-	try {
-		cached = await cache?.match(metadataUrl);
-	} catch {
-		return;
+function readClientAssertionIssuer(assertion) {
+	if (typeof assertion !== "string") return void 0;
+	const parsed = parseIdJag(assertion, CLIENT_ASSERTION_MAX_BYTES);
+	if (!parsed.ok) return void 0;
+	const iss = parsed.value.rawClaims.iss;
+	return typeof iss === "string" && iss.length > 0 ? iss : void 0;
+}
+/** Creates a verifier with its own JWKS cache and replay store. */
+function createClientAssertionVerifier() {
+	const jwksProvider = createDefaultJwksProvider({ maxEntries: CLIENT_JWKS_CACHE_MAX_ENTRIES });
+	const jtiStore = createKvJtiStore(CLIENT_ASSERTION_JTI_KV_PREFIX);
+	return { async verify(input) {
+		if (typeof input.assertion !== "string") return err({ reason: "assertion_missing" });
+		const parsed = parseIdJag(input.assertion, CLIENT_ASSERTION_MAX_BYTES);
+		if (!parsed.ok) return parsed;
+		const header = validateHeader(parsed.value.header, input.keys.algorithms);
+		if (!header.ok) return header;
+		const now = Math.floor(Date.now() / 1e3);
+		const claims = validateClaims(parsed.value.rawClaims, input, header.value.typed, now);
+		if (!claims.ok) return claims;
+		const verified = await verifySignature({
+			parsed: parsed.value,
+			alg: header.value.alg,
+			kid: header.value.kid,
+			keys: input.keys,
+			jwksProvider,
+			now
+		});
+		if (!verified.ok) return verified;
+		return jtiStore.markUsed({
+			issuer: input.clientId,
+			jti: claims.value.jti,
+			exp: claims.value.exp + CLIENT_ASSERTION_CLOCK_SKEW_SECONDS,
+			now: Math.floor(Date.now() / 1e3),
+			env: input.env
+		});
+	} };
+}
+function validateHeader(header, algorithms) {
+	if (header.crit !== void 0 || header.b64 !== void 0) return err({ reason: "assertion_malformed" });
+	const alg = header.alg;
+	if (typeof alg !== "string" || !algorithms.includes(alg)) return err({
+		reason: "invalid_alg",
+		got: alg
+	});
+	const typ = header.typ;
+	let typed = false;
+	if (typ !== void 0) {
+		const normalized = typeof typ === "string" ? typ.toLowerCase() : "";
+		typed = CLIENT_AUTHENTICATION_JWT_TYPES.has(normalized);
+		if (!typed && normalized !== "jwt") return err({
+			reason: "invalid_typ",
+			got: typ
+		});
 	}
-	if (!cached) return void 0;
-	try {
-		const { value } = await readJsonWithSizeLimit$1(cached, CIMD_MAX_SIZE_BYTES, signal);
-		return resolveClientIdMetadataDocument(metadataUrl, value, server);
-	} catch (error) {
-		if (signal.aborted) throw error;
-		try {
-			await cache?.delete(metadataUrl);
-		} catch {}
-		return;
+	const kid = header.kid;
+	if (kid !== void 0 && (typeof kid !== "string" || kid.length === 0)) return err({ reason: "assertion_malformed" });
+	return ok({
+		alg,
+		kid,
+		typed
+	});
+}
+function validateClaims(claims, input, typed, now) {
+	if (claims.iss !== input.clientId) return err({
+		reason: "client_id_mismatch",
+		expected: input.clientId,
+		got: String(claims.iss)
+	});
+	if (claims.sub !== input.clientId) return err({
+		reason: "client_id_mismatch",
+		expected: input.clientId,
+		got: String(claims.sub)
+	});
+	const aud = claims.aud;
+	if (!(typed ? aud === input.issuer : aud === input.issuer || aud === input.tokenEndpoint || Array.isArray(aud) && aud.every((value) => typeof value === "string") && (aud.includes(input.issuer) || aud.includes(input.tokenEndpoint)))) return err({
+		reason: "aud_mismatch",
+		expected: input.issuer,
+		got: Array.isArray(aud) ? aud.map(String) : String(aud)
+	});
+	const exp = claims.exp;
+	if (typeof exp !== "number" || !Number.isInteger(exp)) return err({
+		reason: "invalid_claim",
+		claim: "exp"
+	});
+	if (exp + CLIENT_ASSERTION_CLOCK_SKEW_SECONDS <= now) return err({
+		reason: "expired",
+		exp,
+		now
+	});
+	if (exp - now > CLIENT_ASSERTION_MAX_LIFETIME_SECONDS) return err({
+		reason: "lifetime_too_long",
+		lifetime: exp - now,
+		max: CLIENT_ASSERTION_MAX_LIFETIME_SECONDS
+	});
+	const nbf = claims.nbf;
+	if (nbf !== void 0) {
+		if (typeof nbf !== "number" || !Number.isInteger(nbf)) return err({
+			reason: "invalid_claim",
+			claim: "nbf"
+		});
+		if (nbf > now + CLIENT_ASSERTION_CLOCK_SKEW_SECONDS) return err({
+			reason: "nbf_in_future",
+			nbf,
+			now,
+			skew: CLIENT_ASSERTION_CLOCK_SKEW_SECONDS
+		});
 	}
+	const iat = claims.iat;
+	if (iat !== void 0) {
+		if (typeof iat !== "number" || !Number.isInteger(iat)) return err({
+			reason: "invalid_claim",
+			claim: "iat"
+		});
+		if (iat > now + CLIENT_ASSERTION_CLOCK_SKEW_SECONDS) return err({
+			reason: "iat_in_future",
+			iat,
+			now,
+			skew: CLIENT_ASSERTION_CLOCK_SKEW_SECONDS
+		});
+	}
+	const jti = claims.jti;
+	if (typeof jti !== "string" || jti.length === 0) return err({
+		reason: "invalid_claim",
+		claim: "jti"
+	});
+	return ok({
+		jti,
+		exp
+	});
 }
+async function verifySignature(args) {
+	const { keys, alg, kid, parsed } = args;
+	const verifyWith = async (jwks) => {
+		const jwk = selectJwk(jwks, alg, kid);
+		if (!jwk.ok) return jwk;
+		return await verifyIdJagSignature({
+			alg,
+			jwk: jwk.value,
+			signingInput: parsed.signingInput,
+			signature: parsed.signature
+		}) ? ok(void 0) : err({ reason: "signature_failed" });
+	};
+	if (keys.jwks) return verifyWith(keys.jwks);
+	if (!keys.jwksUri) return err({ reason: "no_matching_key" });
+	const source = {
+		issuer: keys.jwksUri,
+		jwksUri: keys.jwksUri
+	};
+	const initial = await args.jwksProvider.fetch(source, {
+		forceRefresh: false,
+		now: args.now
+	});
+	if (!initial.ok) return initial;
+	const result = await verifyWith(initial.value);
+	if (result.ok) return result;
+	const refreshed = await args.jwksProvider.fetch(source, {
+		forceRefresh: true,
+		now: args.now
+	});
+	if (!refreshed.ok) return refreshed;
+	return verifyWith(refreshed.value);
+}
+
+//#endregion
+//#region src/oauth-resource.ts
 /**
-* Fetches, bounds, parses, validates, and negotiates a Client ID Metadata
-* Document into the single effective client configuration used by OAuth flows.
+* Loopback hosts where a plain `http` scheme is accepted for local development.
+* Matches RFC 8252 §7.3 loopback handling: 127.0.0.0/8, ::1, and `localhost`.
 */
-async function fetchClientIdMetadataDocument(metadataUrl, server) {
-	validateClientIdentifierUrl(metadataUrl);
-	const abortController = new AbortController();
-	const timeoutId = setTimeout(() => abortController.abort(), CIMD_FETCH_TIMEOUT_MS);
+function isLoopbackHostname(hostname) {
+	const host = hostname.toLowerCase();
+	if (host === "localhost" || host === "::1" || host === "[::1]") return true;
+	const ipv4 = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	return ipv4 !== null && ipv4.slice(1).every((octet) => Number(octet) <= 255);
+}
+/**
+* Whether a canonical resource, issuer, or endpoint URL uses an accepted
+* scheme: `https`, or `http` on a loopback host so `wrangler dev` works on
+* http://localhost. Workers are always served over `https`, so there is no
+* deployment in which cleartext OAuth traffic to a remote host is correct,
+* and no option exists to allow it.
+*/
+function hasAcceptedCanonicalScheme(url) {
+	return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
+}
+/** Validate an RFC 3986-safe HTTP(S) resource identifier for RFC 8707. */
+function validateResourceUri(uri) {
+	if (!uri || typeof uri !== "string") return false;
+	if (!/^[\x21-\x7e]+$/.test(uri) || /["\\#]/.test(uri) || !/^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]+(?:\/[^?#]*)?(?:\?[^#]*)?$/.test(uri) || /%(?![0-9A-Fa-f]{2})/.test(uri) || !/^[A-Za-z0-9:/?@!$&'()*+,;=._~%\[\]-]+$/.test(uri)) return false;
 	try {
-		const cache = await openCimdCache();
-		const cachedDocument = await tryResolveFromCache(cache, metadataUrl, server, abortController.signal);
-		if (cachedDocument) return cachedDocument;
-		const response = await fetchCimdOrigin(metadataUrl, abortController.signal);
-		if (!response.ok) throw new Error(`Failed to fetch client metadata: HTTP ${response.status}`);
-		const { value, bytes } = await readJsonWithSizeLimit$1(response, CIMD_MAX_SIZE_BYTES, abortController.signal);
-		const resolved = resolveClientIdMetadataDocument(metadataUrl, value, server);
-		clearTimeout(timeoutId);
-		await cacheValidatedDocument(cache, metadataUrl, response, bytes);
-		return resolved;
-	} catch (error) {
-		if (abortController.signal.aborted) throw new Error(`Client metadata fetch timed out after ${CIMD_FETCH_TIMEOUT_MS}ms`);
-		throw error;
-	} finally {
-		clearTimeout(timeoutId);
+		const parsed = new URL(uri);
+		return parsed.protocol === "http:" || parsed.protocol === "https:";
+	} catch {
+		return false;
 	}
 }
-
-//#endregion
-//#region src/ema/constants.ts
 /**
-* Constants for MCP Enterprise-Managed Authorization (EMA).
-*
-* Co-located so that anyone touching the EMA code path sees every magic
-* number in one place. Public-facing defaults can be overridden via
-* `EmaOptions`.
+* Whether a requested resource identifies a granted or configured resource.
+* Only ASCII case in the URI scheme and host is ignored, and an empty path is
+* equivalent to `/` (RFC 3986 §6.2.3), so a client that round-trips
+* `https://example.com` through a URL parser as `https://example.com/` still
+* names it. Port, path, query, a trailing slash after a path segment, user
+* information, and every other byte remain significant.
 */
-/** JWT `typ` header value required for ID-JAG assertions (RFC 8725 §3.11). */
-const EMA_ID_JAG_JWT_TYPE = "oauth-id-jag+jwt";
+function resourceMatches(requested, granted) {
+	const foldedRequested = foldResourceSchemeAndHost(requested);
+	const foldedGranted = foldResourceSchemeAndHost(granted);
+	if (foldedRequested === void 0 || foldedGranted === void 0) return false;
+	return normalizeEmptyPath(foldedRequested) === normalizeEmptyPath(foldedGranted);
+}
 /**
-* Grant-profile URN advertised in `authorization_grant_profiles_supported`
-* when EMA is configured (MCP Enterprise-Managed Authorization spec).
+* Fold only the URI components whose comparison is ASCII case-insensitive: the
+* scheme and the host. A configured identifier is canonical when folding it is
+* the identity.
 */
-const EMA_ID_JAG_GRANT_PROFILE = "urn:ietf:params:oauth:grant-profile:id-jag";
-/** Maximum compact JWT assertion size accepted at the token endpoint. */
-const EMA_MAX_JWT_BYTES = 16 * 1024;
-/** Maximum JWKS response size accepted from a trusted enterprise IdP. */
-const EMA_JWKS_MAX_SIZE_BYTES = 64 * 1024;
-/** Request timeout for JWKS fetches. */
-const EMA_JWKS_FETCH_TIMEOUT_MS = 1e4;
-/** Default JWKS cache TTL. */
-const EMA_DEFAULT_JWKS_CACHE_TTL_SECONDS = 300;
-/** Default allowed clock skew for ID-JAG time claim validation. */
-const EMA_DEFAULT_CLOCK_SKEW_SECONDS = 60;
-/** Default maximum accepted ID-JAG lifetime. */
-const EMA_DEFAULT_MAX_ASSERTION_LIFETIME_SECONDS = 300;
+function foldResourceSchemeAndHost(resource) {
+	const schemeSeparator = resource.indexOf("://");
+	if (schemeSeparator <= 0) return void 0;
+	const authorityStart = schemeSeparator + 3;
+	const authorityEndOffset = resource.slice(authorityStart).search(/[/?#]/);
+	const authorityEnd = authorityEndOffset === -1 ? resource.length : authorityStart + authorityEndOffset;
+	const authority = resource.slice(authorityStart, authorityEnd);
+	const hostStart = authority.lastIndexOf("@") + 1;
+	let hostEnd;
+	if (authority[hostStart] === "[") {
+		const closingBracket = authority.indexOf("]", hostStart + 1);
+		if (closingBracket === -1) return void 0;
+		hostEnd = closingBracket + 1;
+	} else {
+		const portSeparator = authority.indexOf(":", hostStart);
+		hostEnd = portSeparator === -1 ? authority.length : portSeparator;
+	}
+	const asciiLower = (value) => value.replace(/[A-Z]/g, (character) => character.toLowerCase());
+	return asciiLower(resource.slice(0, schemeSeparator)) + "://" + authority.slice(0, hostStart) + asciiLower(authority.slice(hostStart, hostEnd)) + authority.slice(hostEnd) + resource.slice(authorityEnd);
+}
+/** RFC 3986 §6.2.3: for http and https an empty path is equivalent to "/". */
+function normalizeEmptyPath(resource) {
+	const authorityStart = resource.indexOf("://") + 3;
+	const pathOffset = resource.slice(authorityStart).search(/[/?#]/);
+	if (pathOffset === -1) return `${resource}/`;
+	const pathStart = authorityStart + pathOffset;
+	return resource[pathStart] === "/" ? resource : `${resource.slice(0, pathStart)}/${resource.slice(pathStart)}`;
+}
 /**
-* Minimum cool-down between JWKS force-refreshes per issuer.
-* Defends against attackers that send many assertions with random `kid`
-* values to amplify load on the IdP's JWKS endpoint.
+* Whether a request carries every query parameter of a canonical resource. A
+* query-bearing resource identifier names a more specific resource: a request
+* may add parameters of its own but must preserve the resource's.
 */
-const EMA_JWKS_FORCE_REFRESH_COOLDOWN_SECONDS = 30;
-/** Floor for the `jti` replay marker's KV TTL; KV rejects a sub-60s expiration. */
-const EMA_JTI_MIN_TTL_SECONDS = 60;
-/** Default JWT signing algorithm assumed for a trusted issuer. */
-const EMA_DEFAULT_JWT_ALGORITHM = "RS256";
-/** JWT signing algorithms supported by the built-in WebCrypto verifier. */
-const EMA_SUPPORTED_JWT_ALGORITHMS = new Set(["RS256", "ES256"]);
+function requestCarriesResourceQuery(requestUrl, resourceUrl) {
+	for (const [name, value] of resourceUrl.searchParams) if (!requestUrl.searchParams.getAll(name).includes(value)) return false;
+	return true;
+}
 
 //#endregion
-//#region src/ema/result.ts
-const ok = (value) => ({
-	ok: true,
-	value
-});
-const err = (error) => ({
-	ok: false,
-	error
-});
+//#region src/oauth-client-metadata.ts
+const CIMD_MAX_SIZE_BYTES = 5 * 1024;
+const CIMD_FETCH_TIMEOUT_MS = 1e4;
+const CIMD_CACHE_NAME = "workers-oauth-provider:cimd:v1";
+const CIMD_CACHE_MAX_TTL_SECONDS = 10080 * 60;
+function requireJsonObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("Client metadata must be a JSON object");
+	return value;
+}
+function optionalString(value, fieldName) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string") throw new Error(`Invalid ${fieldName}: expected string, got ${typeof value}`);
+	return value;
+}
+function optionalStringArray(value, fieldName) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) throw new Error(`Invalid ${fieldName}: expected array, got ${typeof value}`);
+	if (!value.every((item) => typeof item === "string")) throw new Error(`Invalid ${fieldName}: array must contain only strings`);
+	return [...value];
+}
+function optionalHttpUri(value, fieldName) {
+	const uri = optionalString(value, fieldName);
+	if (uri === void 0) return void 0;
+	let parsed;
+	try {
+		parsed = new URL(uri);
+	} catch {
+		throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
+	return uri;
+}
+const I18N_FIELDS = {
+	client_name: "string",
+	client_uri: "uri",
+	logo_uri: "uri",
+	tos_uri: "uri",
+	policy_uri: "uri"
+};
+function extractI18nFields(raw) {
+	const result = {};
+	for (const key of Object.keys(raw)) {
+		const hashIndex = key.indexOf("#");
+		if (hashIndex <= 0 || hashIndex === key.length - 1) continue;
+		const kind = I18N_FIELDS[key.slice(0, hashIndex)];
+		if (!kind) continue;
+		const value = kind === "uri" ? optionalHttpUri(raw[key], key) : optionalString(raw[key], key);
+		if (value !== void 0) result[key] = value;
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function validateChoiceConsistency(preferredName, preferredValue, choicesName, choices) {
+	if (preferredValue !== void 0 && choices !== void 0 && !choices.includes(preferredValue)) throw new Error(`${preferredName} must be included in ${choicesName}`);
+}
+function parseOAuthClientMetadata(raw) {
+	const tokenEndpointAuthMethod = optionalString(raw.token_endpoint_auth_method, "token_endpoint_auth_method");
+	const tokenEndpointAuthMethodsSupported = optionalStringArray(raw.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported");
+	const tokenEndpointAuthSigningAlg = optionalString(raw.token_endpoint_auth_signing_alg, "token_endpoint_auth_signing_alg");
+	const tokenEndpointAuthSigningAlgValuesSupported = optionalStringArray(raw.token_endpoint_auth_signing_alg_values_supported, "token_endpoint_auth_signing_alg_values_supported");
+	validateChoiceConsistency("token_endpoint_auth_method", tokenEndpointAuthMethod, "token_endpoint_auth_methods_supported", tokenEndpointAuthMethodsSupported);
+	validateChoiceConsistency("token_endpoint_auth_signing_alg", tokenEndpointAuthSigningAlg, "token_endpoint_auth_signing_alg_values_supported", tokenEndpointAuthSigningAlgValuesSupported);
+	return {
+		clientId: optionalString(raw.client_id, "client_id"),
+		redirectUris: optionalStringArray(raw.redirect_uris, "redirect_uris"),
+		clientName: optionalString(raw.client_name, "client_name"),
+		clientUri: optionalHttpUri(raw.client_uri, "client_uri"),
+		logoUri: optionalHttpUri(raw.logo_uri, "logo_uri"),
+		policyUri: optionalHttpUri(raw.policy_uri, "policy_uri"),
+		tosUri: optionalHttpUri(raw.tos_uri, "tos_uri"),
+		jwksUri: optionalHttpUri(raw.jwks_uri, "jwks_uri"),
+		i18n: extractI18nFields(raw),
+		contacts: optionalStringArray(raw.contacts, "contacts"),
+		grantTypes: optionalStringArray(raw.grant_types, "grant_types"),
+		responseTypes: optionalStringArray(raw.response_types, "response_types"),
+		tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported,
+		tokenEndpointAuthSigningAlg,
+		tokenEndpointAuthSigningAlgValuesSupported
+	};
+}
+function pickDisplayMetadata(metadata) {
+	const { clientName, clientUri, logoUri, policyUri, tosUri, jwksUri, i18n, contacts } = metadata;
+	return {
+		clientName,
+		clientUri,
+		logoUri,
+		policyUri,
+		tosUri,
+		jwksUri,
+		i18n,
+		contacts
+	};
+}
 /**
-* Map an internal `EmaValidationError` to its public OAuth error code and
-* description. Most validation failures collapse to a single generic message
-* to avoid leaking which check failed to attackers probing the IdP. The
-* exceptions are RFC-prescribed distinct codes (`invalid_target` for
-* RFC 8707 resource issues, `invalid_request` for malformed input).
+* The checks every listed redirect URI passes, whatever the policy: no control characters, a
+* scheme, and not a dangerous one (`javascript:`, `data:` and the like). A Client ID Metadata
+* Document is held to these alone; the URI a request uses is then held to {@link validateRedirectUri}.
+* @throws Error when the redirect URI is not safe to store
 */
-function emaErrorToWire(e) {
-	switch (e.reason) {
-		case "assertion_missing": return {
-			code: "invalid_request",
-			message: "assertion is required"
-		};
-		case "invalid_scope_param": return {
-			code: "invalid_request",
-			message: "Invalid scope parameter format"
-		};
-		case "resource_invalid":
-		case "resource_mismatch": return {
-			code: "invalid_target",
-			message: "Invalid resource"
-		};
-		case "mapper_denied":
-		case "mapper_threw": return {
-			code: "invalid_grant",
-			message: "Assertion was not authorized"
-		};
-		case "invalid_mapped_user": return {
-			code: "invalid_grant",
-			message: "Invalid mapped user"
-		};
-		case "invalid_mapped_scope": return {
-			code: "invalid_grant",
-			message: "Invalid mapped scope"
-		};
-		case "invalid_mapped_props": return {
-			code: "invalid_grant",
-			message: "Invalid mapped props"
-		};
-		case "invalid_mapped_ttl": return {
-			code: "invalid_grant",
-			message: "Invalid access token TTL"
-		};
-		case "assertion_expired_after_processing": return {
-			code: "invalid_grant",
-			message: "Assertion has expired"
-		};
-		case "assertion_too_large":
-		case "assertion_malformed":
-		case "invalid_typ":
-		case "invalid_alg":
-		case "issuer_not_trusted":
-		case "no_matching_key":
-		case "signature_failed":
-		case "jwks_fetch_failed":
-		case "invalid_claim":
-		case "aud_mismatch":
-		case "unsupported_claim":
-		case "expired":
-		case "iat_in_future":
-		case "nbf_in_future":
-		case "lifetime_too_long":
-		case "replayed":
-		case "client_id_mismatch": return {
-			code: "invalid_grant",
-			message: "Invalid assertion"
-		};
+function validateRedirectUriSafety(redirectUri) {
+	const dangerousSchemes = [
+		"javascript:",
+		"data:",
+		"vbscript:",
+		"file:",
+		"mailto:",
+		"blob:"
+	];
+	const normalized = redirectUri.trim();
+	for (let i = 0; i < normalized.length; i++) {
+		const code = normalized.charCodeAt(i);
+		if (code >= 0 && code <= 31 || code >= 127 && code <= 159) throw new Error("Invalid redirect URI");
+	}
+	const colonIndex = normalized.indexOf(":");
+	if (colonIndex === -1) throw new Error("Invalid redirect URI");
+	const scheme = normalized.slice(0, colonIndex + 1).toLowerCase();
+	if (dangerousSchemes.includes(scheme)) throw new Error("Invalid redirect URI");
+}
+/**
+* The checks every redirect URI a client registers passes, whether or not this server would send a
+* code to it: the {@link validateRedirectUriSafety} checks, a parseable URI, and no fragment (not
+* even an empty `#`) or userinfo.
+* @throws Error when the redirect URI can't be registered at all
+*/
+function validateListedRedirectUri(redirectUri) {
+	validateRedirectUriSafety(redirectUri);
+	const normalized = redirectUri.trim();
+	let url;
+	try {
+		url = new URL(normalized);
+	} catch {
+		throw new Error("Invalid redirect URI");
 	}
+	if (normalized.includes("#") || url.username || url.password) throw new Error("Invalid redirect URI");
+	return url;
 }
-
-//#endregion
-//#region src/ema/util.ts
 /**
-* Tiny utility helpers used by EMA adapters.
-*
-* Lives in `src/ema/util.ts` rather than `src/util.ts` to keep the EMA
-* module self-contained — the main `oauth-provider.ts` reaches into here
-* only through the adapters' public interfaces.
+* Validates a redirect URI against the MCP / OAuth 2.1 redirect policy: `https`, or `http` on a
+* loopback host (`localhost`, `127.0.0.0/8`, `::1`), with no userinfo and no fragment (not even an
+* empty `#`). RFC 8252 private-use schemes are accepted only when the server enables
+* `allowPrivateUseRedirectUris`; remote `http` never is. The {@link validateRedirectUriSafety}
+* checks always apply.
+* @throws Error describing why the redirect URI is not acceptable
 */
-/** SHA-256 a string and return its hex digest. */
-async function sha256Hex$1(input) {
-	const data = new TextEncoder().encode(input);
-	const buffer = await crypto.subtle.digest("SHA-256", data);
-	return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+function validateRedirectUri(redirectUri, server) {
+	const url = validateListedRedirectUri(redirectUri);
+	if (url.protocol === "https:") return;
+	if (url.protocol === "http:") {
+		if (isLoopbackHostname(url.hostname)) return;
+		throw new Error("Redirect URI must use https, or http on a loopback host");
+	}
+	if (!server.allowPrivateUseRedirectUris) throw new Error("Redirect URI must use https, or http on a loopback host");
 }
-
-//#endregion
-//#region src/ema/jti.ts
 /**
-* Default `EmaJtiStore`: KV-backed `jti` replay marker.
-*
-* KV is eventually-consistent and does not provide compare-and-set, so two
-* concurrent requests with the same `jti` can both observe "not seen" and
-* succeed — the trade-off accepted here. Surrounding claim checks
-* (signature, `exp`, `nbf`, `aud`, `resource`, client binding) constrain
-* the practical attack window.
+* Validates the redirect URIs a client registers (dynamic registration, `createClient()`,
+* `updateClient()`). A client may list callbacks for surfaces this server won't send codes to:
+* Cursor lists `cursor://anysphere.cursor-mcp/oauth/callback` next to its https and loopback
+* callbacks. So each URI is held to {@link validateListedRedirectUri}, and at least one must satisfy
+* {@link validateRedirectUri} so the client can sign in. The URI a request uses is held to the full
+* policy by `parseAuthRequest()` and `completeAuthorization()`.
+* @throws Error when a URI can't be registered, or none of them could ever receive a code
 */
-/** Storage key prefix for replay markers. Stable across versions. */
-const EMA_JTI_KV_PREFIX = "enterprise-jti:";
-/** Create the default KV-backed JTI store. KV TTL handles cleanup. */
-function createKvJtiStore() {
-	return { async markUsed({ issuer, jti, exp, now, env }) {
-		const ttl = Math.max(EMA_JTI_MIN_TTL_SECONDS, exp - now);
-		const key = `${EMA_JTI_KV_PREFIX}${await sha256Hex$1(`${issuer}\n${jti}`)}`;
-		if (await env.OAUTH_KV.get(key)) return err({
-			reason: "replayed",
-			jti
-		});
-		await env.OAUTH_KV.put(key, "1", { expirationTtl: ttl });
-		return ok(void 0);
-	} };
+function validateRegisteredRedirectUris(redirectUris, server) {
+	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
+	for (const redirectUri of redirectUris) validateListedRedirectUri(redirectUri);
+	let firstRefusal;
+	for (const redirectUri of redirectUris) try {
+		validateRedirectUri(redirectUri, server);
+		return redirectUris;
+	} catch (error) {
+		firstRefusal ??= error;
+	}
+	throw firstRefusal instanceof Error ? firstRefusal : /* @__PURE__ */ new Error("Invalid redirect URI");
+}
+function requireValidRedirectUris(redirectUris, validate) {
+	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
+	for (const redirectUri of redirectUris) validate(redirectUri);
+	return redirectUris;
 }
-
-//#endregion
-//#region src/ema/jwks.ts
 /**
-* Default `EmaJwksProvider`: fetches IdP signing keys with caching and a
-* force-refresh cool-down. The cool-down defends against attackers that
-* spam random `kid` values to amplify load on the IdP's JWKS endpoint.
-*
-* The cache lives inside the returned provider closure, so each
-* `OAuthProvider` instance has its own cache — no cross-instance bleed.
+* Resolves a Dynamic Client Registration request into the complete metadata
+* shape that can be stored, applying RFC 7591 defaults and server capability
+* validation exactly once.
 */
-/** Create the default JWKS provider — a closure with its own private cache. */
-function createDefaultJwksProvider(opts = {}) {
-	const cache = /* @__PURE__ */ new Map();
-	const cacheTtl = opts.cacheTtlSeconds ?? EMA_DEFAULT_JWKS_CACHE_TTL_SECONDS;
-	return { async fetch(issuer, { forceRefresh, now }) {
-		const cached = cache.get(issuer.issuer);
-		if (!forceRefresh && cached && cached.expiresAt > now) return ok(cached.jwks);
-		if (forceRefresh && cached && cached.nextForceRefreshAllowedAt > now) return ok(cached.jwks);
-		const abortController = new AbortController();
-		const timeoutId = setTimeout(() => abortController.abort(), EMA_JWKS_FETCH_TIMEOUT_MS);
+function resolveDynamicClientRegistrationMetadata(raw, server) {
+	const metadata = parseOAuthClientMetadata(raw);
+	const capabilities = negotiateDynamicClientRegistrationCapabilities(server, {
+		tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
+		grantTypes: metadata.grantTypes ?? ["authorization_code"],
+		responseTypes: metadata.responseTypes ?? ["code"]
+	});
+	return {
+		...pickDisplayMetadata(metadata),
+		redirectUris: validateRegisteredRedirectUris(metadata.redirectUris, server),
+		...capabilities,
+		authMethodExplicit: metadata.tokenEndpointAuthMethod !== void 0 || metadata.tokenEndpointAuthMethodsSupported !== void 0
+	};
+}
+/**
+* Path component of the raw client ID string. Deliberately not
+* `new URL().pathname`: WHATWG parsing collapses the `.` and `..` segments
+* that CIMD §3 requires rejecting, and normalizes `\` and scheme-relative
+* forms this validation must see verbatim.
+*/
+function rawPath(clientId) {
+	const schemeEnd = clientId.indexOf("://");
+	if (schemeEnd === -1) return "";
+	const authorityStart = schemeEnd + 3;
+	const authorityEndOffset = clientId.slice(authorityStart).search(/[/?#]/);
+	if (authorityEndOffset === -1) return "";
+	const pathStart = authorityStart + authorityEndOffset;
+	if (clientId[pathStart] !== "/") return "";
+	const pathEndOffset = clientId.slice(pathStart).search(/[?#]/);
+	return pathEndOffset === -1 ? clientId.slice(pathStart) : clientId.slice(pathStart, pathStart + pathEndOffset);
+}
+function validateClientIdentifierUrl(clientId) {
+	if (clientId !== clientId.trim() || /[\x00-\x20\x7f-\x9f\\]/.test(clientId)) throw new Error("Client Identifier URL contains invalid whitespace or characters");
+	if (!/^https:\/\//i.test(clientId)) throw new Error("Client Identifier URL must use an absolute HTTPS URL");
+	let parsed;
+	try {
+		parsed = new URL(clientId);
+	} catch {
+		throw new Error("Client Identifier URL must be a valid HTTPS URL");
+	}
+	if (parsed.protocol !== "https:") throw new Error("Client Identifier URL must use HTTPS");
+	if (parsed.username || parsed.password) throw new Error("Client Identifier URL must not contain userinfo");
+	if (parsed.hash) throw new Error("Client Identifier URL must not contain a fragment");
+	const path = rawPath(clientId);
+	if (!path) throw new Error("Client Identifier URL must contain a path component");
+	for (const segment of path.split("/")) {
+		let decodedSegment;
 		try {
-			const response = await fetch(issuer.jwksUri, {
-				headers: { Accept: "application/json" },
-				signal: abortController.signal,
-				cf: { cacheEverything: true }
-			});
-			if (!response.ok) return err({
-				reason: "jwks_fetch_failed",
-				status: response.status
-			});
-			const contentLength = response.headers.get("content-length");
-			if (contentLength && parseInt(contentLength, 10) > EMA_JWKS_MAX_SIZE_BYTES) return err({
-				reason: "jwks_fetch_failed",
-				status: response.status
-			});
-			const rawJwks = await readJsonWithSizeLimit(response, EMA_JWKS_MAX_SIZE_BYTES);
-			if (!rawJwks.ok) return err({ reason: "jwks_fetch_failed" });
-			if (!Array.isArray(rawJwks.value.keys)) return err({ reason: "jwks_fetch_failed" });
-			const jwks = { keys: rawJwks.value.keys };
-			cache.set(issuer.issuer, {
-				jwks,
-				expiresAt: now + cacheTtl,
-				nextForceRefreshAllowedAt: now + EMA_JWKS_FORCE_REFRESH_COOLDOWN_SECONDS
-			});
-			return ok(jwks);
+			decodedSegment = decodeURIComponent(segment);
 		} catch {
-			return err({ reason: "jwks_fetch_failed" });
-		} finally {
-			clearTimeout(timeoutId);
+			throw new Error("Client Identifier URL contains invalid percent encoding");
 		}
-	} };
+		if (decodedSegment === "." || decodedSegment === "..") throw new Error("Client Identifier URL must not contain dot path segments");
+	}
+}
+/** Returns whether a client ID has the URL shape this package resolves through CIMD. */
+function isClientIdMetadataDocumentUrl(clientId) {
+	try {
+		return new URL(clientId).protocol === "https:" && rawPath(clientId) !== "";
+	} catch {
+		return false;
+	}
+}
+const PRIVATE_JWK_MEMBERS = new Set([
+	"d",
+	"p",
+	"q",
+	"dp",
+	"dq",
+	"qi",
+	"oth",
+	"k"
+]);
+/** Parses an inline `jwks`, refusing private or symmetric key material, which a public document must never carry. */
+function parsePublicJwks(value) {
+	if (value === void 0) return void 0;
+	const jwks = requireJsonObject(value);
+	if (!Array.isArray(jwks.keys)) throw new Error("Invalid jwks: keys must be an array");
+	return { keys: jwks.keys.map((value$1) => {
+		const key = requireJsonObject(value$1);
+		if (Object.keys(key).some((member) => PRIVATE_JWK_MEMBERS.has(member))) throw new Error("CIMD documents must not contain private key material");
+		return key;
+	}) };
 }
 /**
-* Streaming JSON reader that rejects responses exceeding `maxBytes`.
-* Bounds memory consumption before we attempt to JSON-parse the body.
+* The keys and algorithms a document offering `private_key_jwt` supplies, or why they can't be used.
+* An unusable offer only matters when `private_key_jwt` is the document's sole method.
 */
-async function readJsonWithSizeLimit(response, maxBytes) {
-	if (!response.body) return { ok: false };
-	const reader = response.body.getReader();
-	const chunks = [];
-	let total = 0;
+function resolvePrivateKeyJwtKeys(metadata, jwks) {
+	const { jwksUri } = metadata;
+	if (jwks && jwksUri) return { problem: "jwks and jwks_uri must not both be present" };
+	if (!jwks && !jwksUri) return { problem: "private_key_jwt requires jwks or jwks_uri" };
+	if (jwks && (jwks.keys ?? []).length === 0) return { problem: "private_key_jwt jwks must contain a key" };
+	if (jwksUri) {
+		const url = new URL(jwksUri);
+		if (url.protocol !== "https:" || url.username || url.password || url.hash) return { problem: "private_key_jwt jwks_uri must be an https: URL without userinfo or a fragment" };
+	}
+	const signingAlgorithms = CLIENT_ASSERTION_ALGORITHMS.filter((alg) => (metadata.tokenEndpointAuthSigningAlg === void 0 || metadata.tokenEndpointAuthSigningAlg === alg) && (metadata.tokenEndpointAuthSigningAlgValuesSupported === void 0 || metadata.tokenEndpointAuthSigningAlgValuesSupported.includes(alg)));
+	if (signingAlgorithms.length === 0) return { problem: `private_key_jwt requires a token_endpoint_auth_signing_alg of ${CLIENT_ASSERTION_ALGORITHMS.join(" or ")}` };
+	const algorithms = jwks ? signingAlgorithms.filter((alg) => (jwks.keys ?? []).some((key) => isKeyUsableForAlgorithm(key, alg))) : signingAlgorithms;
+	if (algorithms.length === 0) return { problem: `private_key_jwt jwks has no key for ${signingAlgorithms.join(" or ")}` };
+	return { keys: jwks ? {
+		jwks,
+		algorithms
+	} : {
+		jwksUri,
+		algorithms
+	} };
+}
+function resolveClientIdMetadataDocument(metadataUrl, value, server) {
+	const raw = requireJsonObject(value);
+	const metadata = parseOAuthClientMetadata(raw);
+	if (metadata.clientId !== metadataUrl) throw new Error(`client_id "${metadata.clientId}" does not match metadata URL "${metadataUrl}"`);
+	if (!metadata.clientName?.trim()) throw new Error("client_name is required and must not be empty");
+	const redirectUris = requireValidRedirectUris(metadata.redirectUris, validateRedirectUriSafety);
+	if ("client_secret" in raw || "client_secret_expires_at" in raw) throw new Error("CIMD documents must not contain client secrets");
+	const jwks = parsePublicJwks(raw.jwks);
+	const privateKeyJwt = metadata.tokenEndpointAuthMethod === "private_key_jwt" || !!metadata.tokenEndpointAuthMethodsSupported?.includes("private_key_jwt") ? resolvePrivateKeyJwtKeys(metadata, jwks) : void 0;
+	const clientAssertionKeys = privateKeyJwt && "keys" in privateKeyJwt ? privateKeyJwt.keys : void 0;
+	let capabilities;
 	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			total += value.byteLength;
-			if (total > maxBytes) {
-				reader.cancel();
-				return { ok: false };
-			}
-			chunks.push(value);
+		capabilities = negotiateCimdClientCapabilities(server, {
+			tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+			tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
+			grantTypes: metadata.grantTypes ?? ["authorization_code"],
+			responseTypes: metadata.responseTypes ?? ["code"]
+		}, { privateKeyJwt: clientAssertionKeys !== void 0 });
+	} catch (error) {
+		if (privateKeyJwt && "problem" in privateKeyJwt) throw new Error(privateKeyJwt.problem);
+		throw error;
+	}
+	return {
+		...pickDisplayMetadata(metadata),
+		clientId: metadata.clientId,
+		clientName: metadata.clientName,
+		redirectUris,
+		...capabilities,
+		...capabilities.tokenEndpointAuthMethods.includes("private_key_jwt") ? { clientAssertionKeys } : {}
+	};
+}
+function readStreamChunk(reader, signal) {
+	if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
+	return new Promise((resolve, reject) => {
+		const abort = () => {
+			reader.cancel().catch(() => void 0);
+			reject(new DOMException("Aborted", "AbortError"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		reader.read().then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+	});
+}
+async function readJsonWithSizeLimit(response, maxBytes, signal) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength !== null) {
+		const declaredSize = Number(contentLength);
+		if (Number.isFinite(declaredSize) && declaredSize > maxBytes) {
+			await response.body?.cancel().catch(() => void 0);
+			throw new Error(`Client metadata exceeds size limit: ${contentLength} bytes (max ${maxBytes})`);
 		}
-	} finally {
-		reader.releaseLock();
 	}
-	const merged = new Uint8Array(total);
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("Client metadata response body is empty");
+	const chunks = [];
+	let totalSize = 0;
+	while (true) {
+		const { done, value } = await readStreamChunk(reader, signal);
+		if (done) break;
+		if (!value) continue;
+		totalSize += value.length;
+		if (totalSize > maxBytes) {
+			await reader.cancel().catch(() => void 0);
+			throw new Error(`Response exceeded size limit of ${maxBytes} bytes`);
+		}
+		chunks.push(value);
+	}
+	if (signal.aborted) throw new DOMException("Aborted", "AbortError");
+	const bytes = new Uint8Array(totalSize);
 	let offset = 0;
 	for (const chunk of chunks) {
-		merged.set(chunk, offset);
-		offset += chunk.byteLength;
+		bytes.set(chunk, offset);
+		offset += chunk.length;
+	}
+	let text;
+	try {
+		text = new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(bytes);
+	} catch {
+		throw new Error("Client metadata response is not valid UTF-8");
 	}
 	try {
-		const parsed = JSON.parse(new TextDecoder().decode(merged));
-		if (typeof parsed !== "object" || parsed === null) return { ok: false };
 		return {
-			ok: true,
-			value: parsed
+			value: JSON.parse(text),
+			bytes
 		};
 	} catch {
-		return { ok: false };
+		throw new Error("Client metadata response is not valid JSON");
 	}
 }
-
-//#endregion
-//#region src/ema/parser.ts
-/**
-* Pure JWT parsing for ID-JAG assertions.
-*
-* Splits a compact JWS (`<base64url-header>.<base64url-payload>.<base64url-signature>`)
-* into its three parts, decodes header and payload as JSON, and exposes the
-* raw signing input + signature bytes for downstream signature verification.
-*
-* No I/O. No `this`. Returns `Result<ParsedIdJag, EmaValidationError>`.
-*/
-/**
-* Parse a compact JWS assertion.
-*
-* @param assertion The raw assertion string from the token request body.
-* @param maxBytes Reject assertions whose length exceeds this many bytes.
-*   Guards against memory exhaustion before any JSON parsing happens.
-*/
-function parseIdJag(assertion, maxBytes) {
-	if (typeof assertion !== "string" || assertion.length === 0) return err({ reason: "assertion_missing" });
-	if (assertion.length > maxBytes) return err({
-		reason: "assertion_too_large",
-		size: assertion.length,
-		max: maxBytes
-	});
-	const parts = assertion.split(".");
-	if (parts.length !== 3 || parts.some((part) => part.length === 0)) return err({ reason: "assertion_malformed" });
-	const [encodedHeader, encodedClaims, encodedSignature] = parts;
-	let header;
-	let rawClaims;
-	let signature;
-	try {
-		header = parseJwtJsonPart(encodedHeader);
-		rawClaims = parseJwtJsonPart(encodedClaims);
-		signature = base64UrlToBytes(encodedSignature);
-	} catch {
-		return err({ reason: "assertion_malformed" });
-	}
-	const signingInput = new TextEncoder().encode(`${encodedHeader}.${encodedClaims}`);
-	return ok({
-		header,
-		rawClaims,
-		signingInput,
-		signature
+function fetchCimdOrigin(metadataUrl, signal) {
+	return fetch(metadataUrl, {
+		headers: {
+			Accept: "application/json",
+			"Cache-Control": "no-store",
+			"User-Agent": OUTBOUND_USER_AGENT
+		},
+		signal,
+		cache: "no-store"
 	});
 }
-/**
-* Decodes a base64url-encoded string to bytes.
-*/
-function base64UrlToBytes(base64Url) {
-	const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-	const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
-	const binaryString = atob(padded);
-	const bytes = new Uint8Array(binaryString.length);
-	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
-	return bytes;
-}
-/**
-* Parses a base64url-encoded JWT JSON part into an object.
-*/
-function parseJwtJsonPart(encoded) {
+async function openCimdCache() {
+	if (typeof caches === "undefined") return void 0;
 	try {
-		const json = new TextDecoder().decode(base64UrlToBytes(encoded));
-		const parsed = JSON.parse(json);
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("JWT part must be an object");
-		return parsed;
+		return await caches.open(CIMD_CACHE_NAME);
 	} catch {
-		throw new Error("Malformed JWT part");
+		return;
 	}
 }
-
-//#endregion
-//#region src/ema/signature.ts
 /**
-* Pick a signing key from a JWKS that matches the assertion header.
-*
-* Filters by:
-*   - `kid` (if the assertion header carries one)
-*   - JWK `use === 'sig'` (when present)
-*   - JWK `key_ops` containing `verify` (when present)
-*   - JWK `alg` matching (when present)
-*   - `kty` compatible with the requested `alg`
-*
-* If the assertion has a `kid`, the first matching key wins. Without a `kid`,
-* we only return a key if exactly one candidate matches — otherwise the
-* selection is ambiguous and we reject (caller may then force-refresh JWKS).
+* Shared-cache lifetime derived from the origin's Cache-Control directives,
+* bounded by the server-side cap the CIMD draft permits (§5.2 "MAY define its
+* own upper and/or lower bounds on an acceptable cache lifetime"). Returns
+* undefined when the response must not be stored.
 */
-function selectJwk(jwks, alg, kid) {
-	const matching = (jwks.keys ?? []).filter((key) => {
-		if (kid && key.kid !== kid) return false;
-		if (key.alg && key.alg !== alg) return false;
-		if (key.use && key.use !== "sig") return false;
-		if (Array.isArray(key.key_ops) && !key.key_ops.includes("verify")) return false;
-		if (alg.startsWith("RS") && key.kty !== "RSA") return false;
-		if (alg.startsWith("ES") && key.kty !== "EC") return false;
-		return true;
-	});
-	if (kid) {
-		const picked = matching[0];
-		if (!picked) return err({
-			reason: "no_matching_key",
-			kid
-		});
-		return ok(picked);
+function cacheTtlSeconds(response) {
+	const cacheControl = response.headers.get("Cache-Control");
+	if (cacheControl === null || /(?:^|,)\s*(?:no-cache|no-store|private)\b/i.test(cacheControl)) return void 0;
+	const directive = /(?:^|,)\s*s-maxage\s*=\s*"?(\d+)/i.exec(cacheControl) ?? /(?:^|,)\s*max-age\s*=\s*"?(\d+)/i.exec(cacheControl);
+	if (!directive) return void 0;
+	const ttl = Math.min(Number(directive[1]), CIMD_CACHE_MAX_TTL_SECONDS);
+	return ttl > 0 ? ttl : void 0;
+}
+async function cacheValidatedDocument(cache, metadataUrl, response, bytes) {
+	if (!cache) return;
+	const ttl = cacheTtlSeconds(response);
+	if (ttl === void 0) return;
+	const headers = new Headers({ "Cache-Control": `public, max-age=${ttl}` });
+	for (const name of [
+		"Content-Type",
+		"ETag",
+		"Last-Modified"
+	]) {
+		const value = response.headers.get(name);
+		if (value !== null) headers.set(name, value);
 	}
-	if (matching.length !== 1) return err({ reason: "no_matching_key" });
-	return ok(matching[0]);
+	try {
+		await cache.put(metadataUrl, new Response(bytes, {
+			status: 200,
+			headers
+		}));
+	} catch {}
 }
 /**
-* Verify an ID-JAG's compact-JWS signature using WebCrypto.
-*
-* Returns `false` on any WebCrypto-level failure (import or verify).
-* The caller is responsible for mapping `false` to the appropriate
-* `EmaValidationError`.
+* Resolves a previously validated cache entry. A stored document that stops
+* validating (changed server capabilities, stricter rules after an upgrade)
+* is evicted so the caller re-resolves from origin in the same request;
+* timeout aborts propagate instead.
 */
-async function verifyIdJagSignature(input) {
+async function tryResolveFromCache(cache, metadataUrl, server, signal) {
+	let cached;
 	try {
-		const { importAlgorithm, verifyAlgorithm } = getJwtCryptoAlgorithms(input.alg);
-		const key = await crypto.subtle.importKey("jwk", input.jwk, importAlgorithm, false, ["verify"]);
-		return await crypto.subtle.verify(verifyAlgorithm, key, input.signature, input.signingInput);
+		cached = await cache?.match(metadataUrl);
 	} catch {
-		return false;
+		return;
+	}
+	if (!cached) return void 0;
+	try {
+		const { value } = await readJsonWithSizeLimit(cached, CIMD_MAX_SIZE_BYTES, signal);
+		return resolveClientIdMetadataDocument(metadataUrl, value, server);
+	} catch (error) {
+		if (signal.aborted) throw error;
+		try {
+			await cache?.delete(metadataUrl);
+		} catch {}
+		return;
 	}
 }
 /**
-* Gets WebCrypto import and verify parameters for supported JOSE algorithms.
+* Fetches, bounds, parses, validates, and negotiates a Client ID Metadata
+* Document into the single effective client configuration used by OAuth flows.
 */
-function getJwtCryptoAlgorithms(alg) {
-	if (alg === "RS256") {
-		const algorithm = {
-			name: "RSASSA-PKCS1-v1_5",
-			hash: "SHA-256"
-		};
-		return {
-			importAlgorithm: algorithm,
-			verifyAlgorithm: algorithm
-		};
+async function fetchClientIdMetadataDocument(metadataUrl, server) {
+	validateClientIdentifierUrl(metadataUrl);
+	const abortController = new AbortController();
+	const timeoutId = setTimeout(() => abortController.abort(), CIMD_FETCH_TIMEOUT_MS);
+	try {
+		const cache = await openCimdCache();
+		const cachedDocument = await tryResolveFromCache(cache, metadataUrl, server, abortController.signal);
+		if (cachedDocument) return cachedDocument;
+		const response = await fetchCimdOrigin(metadataUrl, abortController.signal);
+		if (!response.ok) throw new Error(`Failed to fetch client metadata: HTTP ${response.status}`);
+		const { value, bytes } = await readJsonWithSizeLimit(response, CIMD_MAX_SIZE_BYTES, abortController.signal);
+		const resolved = resolveClientIdMetadataDocument(metadataUrl, value, server);
+		clearTimeout(timeoutId);
+		await cacheValidatedDocument(cache, metadataUrl, response, bytes);
+		return resolved;
+	} catch (error) {
+		if (abortController.signal.aborted) throw new Error(`Client metadata fetch timed out after ${CIMD_FETCH_TIMEOUT_MS}ms`);
+		throw error;
+	} finally {
+		clearTimeout(timeoutId);
 	}
-	if (alg === "ES256") return {
-		importAlgorithm: {
-			name: "ECDSA",
-			namedCurve: "P-256"
-		},
-		verifyAlgorithm: {
-			name: "ECDSA",
-			hash: "SHA-256"
-		}
-	};
-	throw new Error(`Unsupported JWT alg: ${alg}`);
 }
 
 //#endregion
@@ -1258,9 +1561,11 @@ function validateIdJagHeader(header, expectedTyp, supportedAlgs) {
 * validate the returned configuration before signature verification ever
 * runs against it.
 *
-* Every failure here collapses to `issuer_not_trusted` so an attacker
+* Every trust failure here collapses to `issuer_not_trusted` so an attacker
 * cannot distinguish "unknown IdP" from "resolver returned a malformed
-* config" from "alg not in the IdP's allowlist".
+* config". An `alg` outside the issuer's allowlist is reported as
+* `invalid_alg` so the deployer can see it in `onError`; both reach the
+* client as the same generic `invalid_grant` "Invalid assertion".
 *
 * The resolver's returned `issuer` field MUST equal the input `iss`.
 * Otherwise a buggy resolver could be tricked into returning a config
@@ -1301,8 +1606,8 @@ async function resolveTrustedIssuer(input) {
 		iss
 	});
 	if (!(resolved.algorithms ?? [EMA_DEFAULT_JWT_ALGORITHM]).includes(alg)) return err({
-		reason: "issuer_not_trusted",
-		iss
+		reason: "invalid_alg",
+		got: alg
 	});
 	return ok(resolved);
 }
@@ -2141,11 +2446,19 @@ let GrantType = /* @__PURE__ */ function(GrantType$1) {
 const DEFAULT_AUTHORIZE_PATH = "/authorize";
 const DEFAULT_TOKEN_PATH = "/oauth/token";
 function toPublicClientInfo(client) {
-	const { authMethodExplicit: _explicit, registrationExpiresAt: _expiry, ...publicClient } = client;
+	const { authMethodExplicit: _explicit, registrationExpiresAt: _expiry, tokenEndpointAuthMethods: _methods, clientAssertionKeys: _keys, ...publicClient } = client;
 	return publicClient;
 }
+/** Token endpoint parameters that carry client authentication (RFC 6749 §2.3, RFC 7521 §4.2). */
+const CLIENT_AUTHENTICATION_PARAMETERS = new Set([
+	"client_id",
+	"client_secret",
+	"client_assertion",
+	"client_assertion_type"
+]);
 function isClientAuthMethodAllowed(client, presentedMethod, isClientMetadataDocument) {
 	if (presentedMethod === client.tokenEndpointAuthMethod) return true;
+	if (isClientMetadataDocument && client.tokenEndpointAuthMethods?.includes(presentedMethod)) return true;
 	const isSecretMethod = (method) => method === "client_secret_basic" || method === "client_secret_post";
 	return !isClientMetadataDocument && client.authMethodExplicit === void 0 && isSecretMethod(client.tokenEndpointAuthMethod) && isSecretMethod(presentedMethod);
 }
@@ -2374,6 +2687,7 @@ var OAuthProviderImpl = class {
 			this.jwksProvider = createDefaultJwksProvider({ cacheTtlSeconds: this.options.enterpriseManagedAuthorization.jwksCacheTtlSeconds });
 			this.jtiStore = createKvJtiStore();
 		}
+		if (this.options.clientIdMetadataDocumentEnabled) this.clientAssertionVerifier = createClientAssertionVerifier();
 	}
 	/**
 	* Validates that an endpoint is either an absolute path or a full URL
@@ -2587,7 +2901,7 @@ var OAuthProviderImpl = class {
 			if (parsed instanceof Response) return withCorsHeaders(parsed, request);
 			let response;
 			if (parsed.isRevocationRequest) response = await this.revokeToken(parsed.body, parsed.clientInfo, env);
-			else response = await this.handleTokenRequest(parsed.body, parsed.clientInfo, env, url, request);
+			else response = await this.handleTokenRequest(parsed.body, parsed.clientInfo, parsed.clientAuthMethod, env, url, request);
 			if (response.ok && !this.errorResponses.has(response)) await this.renewClientRegistrationIfDue(env, parsed.clientInfo, Math.floor(Date.now() / 1e3));
 			return withCorsHeaders(response, request);
 		}
@@ -2773,10 +3087,11 @@ var OAuthProviderImpl = class {
 			});
 		}
 		const processedKeys = /* @__PURE__ */ new Set();
-		for (const [key, value] of formData.entries()) {
+		for (const key of formData.keys()) {
 			if (processedKeys.has(key)) continue;
 			processedKeys.add(key);
-			const allValues = formData.getAll(key);
+			const allValues = CLIENT_AUTHENTICATION_PARAMETERS.has(key) ? formData.getAll(key).filter((entry) => entry !== "") : formData.getAll(key);
+			if (allValues.length === 0) continue;
 			if (key !== "resource" && allValues.length > 1) return this.createErrorResponse("invalid_request", {
 				description: `Request parameter "${key}" must not be repeated`,
 				statusCode: 400
@@ -2785,14 +3100,16 @@ var OAuthProviderImpl = class {
 				reason: "repeated_parameter",
 				detail: { parameter: key }
 			});
-			body[key] = allValues.length > 1 ? allValues : value;
+			body[key] = allValues.length > 1 ? allValues : allValues[0];
 		}
 		const basicAuthorization = parseBasicAuthorizationHeader(request.headers.get("Authorization"));
 		const basicAuthenticationAttempted = basicAuthorization.kind !== "not-basic";
+		const sent = (name) => body[name] !== void 0;
+		const clientAssertionAttempted = sent("client_assertion") || sent("client_assertion_type");
 		let clientId = "";
 		let clientSecret = "";
 		if (basicAuthenticationAttempted) {
-			if (formData.has("client_id") || formData.has("client_secret")) return this.createErrorResponse("invalid_request", {
+			if (sent("client_id") || sent("client_secret") || clientAssertionAttempted) return this.createErrorResponse("invalid_request", {
 				description: "Client must not use multiple authentication methods",
 				statusCode: 400
 			}, {
@@ -2805,6 +3122,22 @@ var OAuthProviderImpl = class {
 			});
 			clientId = basicAuthorization.clientId;
 			clientSecret = basicAuthorization.clientSecret;
+		} else if (clientAssertionAttempted) {
+			if (sent("client_secret")) return this.createErrorResponse("invalid_request", {
+				description: "Client must not use multiple authentication methods",
+				statusCode: 400
+			}, {
+				category: "client-authentication",
+				reason: "multiple_authentication_methods"
+			});
+			if (!sent("client_assertion") || !sent("client_assertion_type")) return this.createErrorResponse("invalid_request", {
+				description: "client_assertion and client_assertion_type must be sent together",
+				statusCode: 400
+			}, {
+				category: "client-authentication",
+				reason: "client_assertion_incomplete"
+			});
+			clientId = body.client_id || readClientAssertionIssuer(body.client_assertion) || "";
 		} else {
 			clientId = body.client_id;
 			clientSecret = body.client_secret || "";
@@ -2831,7 +3164,7 @@ var OAuthProviderImpl = class {
 			category: "client-authentication",
 			reason: "client_not_found"
 		});
-		const presentedAuthMethod = basicAuthenticationAttempted ? "client_secret_basic" : formData.has("client_secret") ? "client_secret_post" : "none";
+		const presentedAuthMethod = basicAuthenticationAttempted ? "client_secret_basic" : clientAssertionAttempted ? "private_key_jwt" : sent("client_secret") ? "client_secret_post" : "none";
 		const registeredAuthMethod = clientInfo.tokenEndpointAuthMethod;
 		if (!isClientAuthMethodAllowed(clientInfo, presentedAuthMethod, !!this.options.clientIdMetadataDocumentEnabled && isClientIdMetadataDocumentUrl(clientInfo.clientId))) return this.createInvalidClientResponse("Client authentication failed", basicAuthenticationAttempted, {
 			category: "client-authentication",
@@ -2842,7 +3175,10 @@ var OAuthProviderImpl = class {
 				presentedMethod: presentedAuthMethod
 			}
 		});
-		if (presentedAuthMethod !== "none") {
+		if (presentedAuthMethod === "private_key_jwt") {
+			const failure = await this.verifyClientAssertion(body, clientInfo, env, request);
+			if (failure) return failure;
+		} else if (presentedAuthMethod !== "none") {
 			if (!clientSecret) return this.createInvalidClientResponse("Client authentication failed: missing client_secret", basicAuthenticationAttempted, {
 				category: "client-authentication",
 				reason: "client_secret_missing"
@@ -2860,10 +3196,47 @@ var OAuthProviderImpl = class {
 		return {
 			body,
 			clientInfo,
+			clientAuthMethod: presentedAuthMethod,
 			isRevocationRequest
 		};
 	}
 	/**
+	* Authenticates a `private_key_jwt` request (RFC 7523 §2.2). The method check has already
+	* confirmed that the client registered the method, which only a CIMD client with usable keys can.
+	* @returns An `invalid_client` response, or `undefined` once the assertion verified and was consumed
+	*/
+	async verifyClientAssertion(body, clientInfo, env, request) {
+		const keys = clientInfo.clientAssertionKeys;
+		const verifier = this.clientAssertionVerifier;
+		if (!keys || !verifier) throw new Error("private_key_jwt client resolved without keys or a verifier");
+		if (body.client_assertion_type !== JWT_BEARER_CLIENT_ASSERTION_TYPE) return this.createInvalidClientResponse("Client authentication failed", false, {
+			category: "client-authentication",
+			reason: "client_assertion_type_unsupported",
+			detail: {
+				clientId: clientInfo.clientId,
+				clientAssertionType: String(body.client_assertion_type)
+			}
+		});
+		const requestUrl = new URL(request.url);
+		const verified = await verifier.verify({
+			assertion: body.client_assertion,
+			clientId: clientInfo.clientId,
+			keys,
+			issuer: this.getAuthorizationServerIssuer(requestUrl),
+			tokenEndpoint: this.getFullEndpointUrl(this.options.tokenEndpoint, requestUrl),
+			env
+		});
+		if (verified.ok) return void 0;
+		return this.createInvalidClientResponse("Client authentication failed", false, {
+			category: "client-authentication",
+			reason: "client_assertion_invalid",
+			detail: {
+				clientId: clientInfo.clientId,
+				...verified.error
+			}
+		}, request);
+	}
+	/**
 	* Checks if a URL matches a specific API route
 	* @param url - The URL to check
 	* @param route - The API route to check against
@@ -2922,6 +3295,7 @@ var OAuthProviderImpl = class {
 		const responseTypesSupported = this.serverCapabilities.responseTypes;
 		const grantTypesSupported = this.serverCapabilities.grantTypes;
 		const authorizationGrantProfilesSupported = this.options.enterpriseManagedAuthorization ? [EMA_ID_JAG_GRANT_PROFILE] : [];
+		const cimdSupported = !!this.options.clientIdMetadataDocumentEnabled && this.hasGlobalFetchStrictlyPublic();
 		const metadata = {
 			issuer: this.getAuthorizationServerIssuer(requestUrl),
 			authorization_endpoint: authorizeEndpoint,
@@ -2933,11 +3307,12 @@ var OAuthProviderImpl = class {
 			response_modes_supported: ["query"],
 			grant_types_supported: grantTypesSupported,
 			...authorizationGrantProfilesSupported.length > 0 ? { authorization_grant_profiles_supported: authorizationGrantProfilesSupported } : {},
-			token_endpoint_auth_methods_supported: this.serverCapabilities.tokenEndpointAuthMethods,
+			token_endpoint_auth_methods_supported: [...this.serverCapabilities.tokenEndpointAuthMethods, ...cimdSupported ? ["private_key_jwt"] : []],
+			...cimdSupported ? { token_endpoint_auth_signing_alg_values_supported: [...CLIENT_ASSERTION_ALGORITHMS] } : {},
 			revocation_endpoint: tokenEndpoint,
 			code_challenge_methods_supported: this.serverCapabilities.codeChallengeMethods,
 			authorization_response_iss_parameter_supported: true,
-			client_id_metadata_document_supported: !!this.options.clientIdMetadataDocumentEnabled && this.hasGlobalFetchStrictlyPublic()
+			client_id_metadata_document_supported: cimdSupported
 		};
 		return new Response(JSON.stringify(metadata), { headers: { "Content-Type": "application/json" } });
 	}
@@ -2976,7 +3351,7 @@ var OAuthProviderImpl = class {
 	* @param env - Cloudflare Worker environment variables
 	* @returns Response with token data or error
 	*/
-	async handleTokenRequest(body, clientInfo, env, requestUrl, request) {
+	async handleTokenRequest(body, clientInfo, clientAuthMethod, env, requestUrl, request) {
 		try {
 			const grantType = body.grant_type;
 			if (!(grantType === GrantType.AUTHORIZATION_CODE || grantType === GrantType.REFRESH_TOKEN || grantType === GrantType.TOKEN_EXCHANGE && !!this.options.allowTokenExchangeGrant || grantType === GrantType.JWT_BEARER && !!this.options.enterpriseManagedAuthorization)) return this.createErrorResponse("unsupported_grant_type", { description: "Grant type not supported" }, {
@@ -2994,7 +3369,7 @@ var OAuthProviderImpl = class {
 			if (grantType === GrantType.AUTHORIZATION_CODE) return await this.handleAuthorizationCodeGrant(body, clientInfo, env);
 			else if (grantType === GrantType.REFRESH_TOKEN) return await this.handleRefreshTokenGrant(body, clientInfo, env);
 			else if (grantType === GrantType.TOKEN_EXCHANGE && this.options.allowTokenExchangeGrant) return await this.handleTokenExchangeGrant(body, clientInfo, env);
-			else if (grantType === GrantType.JWT_BEARER) return await this.handleJwtBearerGrant(body, clientInfo, env, requestUrl, request);
+			else if (grantType === GrantType.JWT_BEARER) return await this.handleJwtBearerGrant(body, clientInfo, clientAuthMethod, env, requestUrl, request);
 			throw new Error("Unreachable supported grant type");
 		} catch (error) {
 			const response = this.createOAuthErrorResponse(error);
@@ -3632,13 +4007,13 @@ var OAuthProviderImpl = class {
 	* standard OAuth wire response. All validation logic lives in pure
 	* functions in `src/ema/`.
 	*/
-	async handleJwtBearerGrant(body, clientInfo, env, requestUrl, request) {
+	async handleJwtBearerGrant(body, clientInfo, clientAuthMethod, env, requestUrl, request) {
 		const enterpriseOptions = this.options.enterpriseManagedAuthorization;
 		if (!enterpriseOptions) return this.createErrorResponse("unsupported_grant_type", { description: "Grant type not supported" }, {
 			category: "enterprise-managed-authorization",
 			reason: "grant_disabled"
 		});
-		if (clientInfo.tokenEndpointAuthMethod === "none" && !enterpriseOptions.allowPublicClients) return this.createErrorResponse("invalid_client", {
+		if (clientAuthMethod === "none" && !enterpriseOptions.allowPublicClients) return this.createErrorResponse("invalid_client", {
 			description: "Enterprise-managed authorization requires client authentication",
 			statusCode: 401
 		}, {
@@ -5309,7 +5684,7 @@ var OAuthHelpersImpl = class {
 			tokenEndpointAuthMethod,
 			...authMethodWasExplicit ? { authMethodExplicit: true } : {}
 		};
-		for (const uri of newClient.redirectUris) validateRedirectUri(uri, this.provider.serverCapabilities);
+		validateRegisteredRedirectUris(newClient.redirectUris, this.provider.serverCapabilities);
 		validateClientCapabilities(this.provider.serverCapabilities, {
 			grantTypes: newClient.grantTypes,
 			responseTypes: newClient.responseTypes,
@@ -5359,7 +5734,7 @@ var OAuthHelpersImpl = class {
 		if (!client) return null;
 		if (updates.redirectUris !== void 0) {
 			if (!Array.isArray(updates.redirectUris) || updates.redirectUris.length === 0) throw new Error("redirectUris must not be empty");
-			for (const uri of updates.redirectUris) validateRedirectUri(uri, this.provider.serverCapabilities);
+			validateRegisteredRedirectUris(updates.redirectUris, this.provider.serverCapabilities);
 		}
 		const authMethodWasExplicit = updates.tokenEndpointAuthMethod !== void 0;
 		const authMethod = updates.tokenEndpointAuthMethod || client.tokenEndpointAuthMethod || "client_secret_basic";