@jeffjassky/oauth-host 0.3.0 → 0.4.0

package/dist/index.js

@@ -1,6 +1,7 @@
 import mongoose from 'mongoose';
 import express2 from 'express';
 import { createHash, randomBytes, createPrivateKey, createPublicKey, generateKeyPairSync, timingSafeEqual, sign, createHmac } from 'crypto';
+import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from 'jose';
 
 // src/server/models.ts
 var DEFAULT_NAMES = {
@@ -35,6 +36,18 @@ function clientSchema() {
       metadataUrl: String,
       metadataFetchedAt: Date,
       metadataEtag: String,
+      // The usable (intersected) token endpoint auth method set for a CIMD
+      // client — absent on a manual registration, whose behavior derives from
+      // `type` exactly as before. A row with no value here supports no
+      // assertion-based method; see `authenticateClient`'s fallback rule.
+      tokenEndpointAuthMethods: [String],
+      // Exactly one of these two is set when `private_key_jwt` is in
+      // `tokenEndpointAuthMethods` — `validateMetadataDocument` refuses a
+      // document declaring both. Neither is ever required at the schema
+      // level: a manual client, or a CIMD client that only offers `none`,
+      // legitimately has neither.
+      jwksUri: String,
+      jwks: mongoose.Schema.Types.Mixed,
       trusted: { type: Boolean, default: false },
       // An array, not a string: rotation needs two live secrets at once or it
       // cannot be deployed without downtime.
@@ -378,7 +391,10 @@ function resolveCimd(input, scopeIndex) {
     fetchTimeoutMs: 5e3,
     maxBytes: 65536,
     allowedScopes: [],
-    failures: /* @__PURE__ */ new Map()
+    failures: /* @__PURE__ */ new Map(),
+    jwksCache: /* @__PURE__ */ new Map(),
+    jwksForceRefetchAt: /* @__PURE__ */ new Map(),
+    assertionReplay: /* @__PURE__ */ new Map()
   };
   if (!input || !input.enabled) return off;
   if (!Array.isArray(input.allowedHosts) || input.allowedHosts.length === 0) {
@@ -411,7 +427,10 @@ function resolveCimd(input, scopeIndex) {
     fetchTimeoutMs: positive(input.fetchTimeoutMs, "fetchTimeoutMs", 5e3),
     maxBytes: positive(input.maxBytes, "maxBytes", 65536),
     allowedScopes: [...allowedScopes],
-    failures: /* @__PURE__ */ new Map()
+    failures: /* @__PURE__ */ new Map(),
+    jwksCache: /* @__PURE__ */ new Map(),
+    jwksForceRefetchAt: /* @__PURE__ */ new Map(),
+    assertionReplay: /* @__PURE__ */ new Map()
   };
 }
 function resolveConfig(config) {
@@ -659,15 +678,19 @@ function authorizationServerMetadata(ctx, mountPath) {
     // S256 only. `plain` is not implemented anywhere in this package, so
     // advertising it would be a lie a client would discover at redemption.
     code_challenge_methods_supported: ["S256"],
-    // `none` is advertised only when CIMD is on. Listing it unconditionally
-    // would tell every client that secretless authentication is available here,
-    // and the only clients that can use it are the ones this server would then
-    // refuse to register.
+    // `none` and `private_key_jwt` are advertised only when CIMD is on.
+    // Listing either unconditionally would tell every client that secretless
+    // authentication is available here, and the only clients that can use it
+    // are the ones this server would then refuse to register.
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
-      ...ctx.cimd.enabled ? ["none"] : []
+      ...ctx.cimd.enabled ? ["none", "private_key_jwt"] : []
     ],
+    // RFC 7523 §2.2 — the only two algorithms `authenticateClient` accepts
+    // for a `client_assertion` signature. Same gate as the line above: it
+    // names a capability that only exists for a CIMD client.
+    ...ctx.cimd.enabled ? { token_endpoint_auth_signing_alg_values_supported: ["RS256", "ES256"] } : {},
     // What tells Claude and ChatGPT to skip registration entirely and send
     // their metadata document URL as `client_id`.
     ...ctx.cimd.enabled ? { client_id_metadata_document_supported: true } : {},
@@ -1270,135 +1293,537 @@ function createKeyManager(ctx) {
   };
 }
 
-// src/server/services/admin.ts
-var MAX_LIST = 200;
-var DEFAULT_LIST = 50;
-function clampLimit(requested) {
-  const n = typeof requested === "number" && Number.isFinite(requested) ? Math.floor(requested) : DEFAULT_LIST;
-  if (n < 1) return 1;
-  return Math.min(n, MAX_LIST);
+// src/server/services/cimd.ts
+var NEGATIVE_TTL_MS = 6e4;
+var MAX_REMEMBERED_FAILURES = 1e3;
+function refuse(description) {
+  return new UnredirectableError("invalid_client", description);
 }
-function clampSkip(requested) {
-  const n = typeof requested === "number" && Number.isFinite(requested) ? Math.floor(requested) : 0;
-  return n > 0 ? n : 0;
+function isMetadataUrl(clientId) {
+  return /^https:\/\//i.test(clientId);
 }
-function notFound(clientId) {
-  return new Error(`oauth-host: no client registered with clientId '${clientId}'`);
+function hostAllowed(rules, url) {
+  const hostname = url.hostname.toLowerCase();
+  return rules.some((rule) => {
+    if (url.port !== rule.port) return false;
+    if (hostname === rule.host) return true;
+    return rule.subdomains && hostname.endsWith(`.${rule.host}`);
+  });
 }
-function toPublicClient(doc) {
+function assertFetchableUrl(ctx, clientId) {
+  let url;
+  try {
+    url = new URL(clientId);
+  } catch {
+    throw refuse(`client_id is not a valid URL: '${clientId}'`);
+  }
+  if (url.protocol !== "https:") {
+    throw refuse(`client_id metadata must be served over https (got '${url.protocol}')`);
+  }
+  if (url.username || url.password) {
+    throw refuse("client_id must not contain URL credentials");
+  }
+  if (url.hash) {
+    throw refuse("client_id must not contain a fragment");
+  }
+  if (!hostAllowed(ctx.cimd.allowedHosts, url)) {
+    throw refuse(`client_id host '${url.host}' is not in clientIdMetadata.allowedHosts`);
+  }
+  return url;
+}
+var JSON_CONTENT_TYPE = /^application\/(?:[\w.+-]+\+)?json\s*(?:;|$)/i;
+async function readCapped(res, maxBytes, docSubject) {
+  const body = res.body;
+  if (!body) throw refuse(`${docSubject} was empty`);
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      void reader.cancel();
+      throw refuse(`${docSubject} exceeds ${maxBytes} bytes`);
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function hardenedFetch(ctx, url, opts) {
+  const { subject, redirectAdvice, etag } = opts;
+  const docSubject = `${subject} document`;
+  let res;
+  try {
+    res = await fetch(url.toString(), {
+      method: "GET",
+      // The single most important line in this file. A 3xx is a failure below,
+      // not a hop: following redirects would let an allowlisted host forward us
+      // to any address it likes, allowlist intact.
+      redirect: "manual",
+      headers: {
+        accept: "application/json",
+        ...etag ? { "if-none-match": etag } : {}
+      },
+      signal: AbortSignal.timeout(ctx.cimd.fetchTimeoutMs)
+    });
+  } catch (err) {
+    const name = err?.name;
+    if (name === "TimeoutError" || name === "AbortError") {
+      throw refuse(`${subject} fetch timed out after ${ctx.cimd.fetchTimeoutMs}ms`);
+    }
+    throw refuse(`${subject} could not be fetched: ${err?.message ?? "network error"}`);
+  }
+  if (res.status === 304) return { document: null };
+  if (res.status >= 300 && res.status < 400) {
+    throw refuse(`${subject} returned a ${res.status} redirect, which is not followed \u2014 ${redirectAdvice}`);
+  }
+  if (res.status !== 200) {
+    throw refuse(`${subject} returned HTTP ${res.status}`);
+  }
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!JSON_CONTENT_TYPE.test(contentType)) {
+    throw refuse(`${subject} must be JSON (got content-type '${contentType || "none"}')`);
+  }
+  const text = await readCapped(res, ctx.cimd.maxBytes, docSubject);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw refuse(`${docSubject} is not valid JSON`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw refuse(`${docSubject} must be a JSON object`);
+  }
   return {
-    clientId: doc.clientId,
-    name: doc.name,
-    type: doc.type,
-    // Defaulted rather than read straight through: rows written before the
-    // field existed have no value, and `undefined` here would read as "unknown
-    // provenance" on a client that plainly was registered by hand.
-    registration: doc.registration ?? "manual",
-    ...doc.metadataUrl ? { metadataUrl: doc.metadataUrl } : {},
-    trusted: Boolean(doc.trusted),
-    redirectUris: [...doc.redirectUris ?? []],
-    allowedScopes: [...doc.allowedScopes ?? []],
-    allowedResources: [...doc.allowedResources ?? []],
-    branding: { ...doc.branding ?? {} },
-    status: doc.status,
-    createdAt: doc.createdAt
+    document: parsed,
+    ...res.headers.get("etag") ? { etag: res.headers.get("etag") } : {}
   };
 }
-function assertRedirectUri(value) {
-  if (typeof value !== "string" || !value) {
-    throw new TypeError(`oauth-host: every redirectUri must be a string (got ${JSON.stringify(value)})`);
+async function fetchMetadata(ctx, url, etag) {
+  return hardenedFetch(ctx, url, {
+    subject: "client_id metadata",
+    redirectAdvice: "serve the document at the client_id URL itself",
+    etag
+  });
+}
+async function fetchJwks(ctx, jwksUri) {
+  const url = new URL(jwksUri);
+  const { document } = await hardenedFetch(ctx, url, {
+    subject: "jwks_uri",
+    redirectAdvice: "serve the JWK Set at the jwks_uri URL itself"
+  });
+  if (!document) throw refuse("jwks_uri fetch returned no document");
+  return document;
+}
+var SERVER_CIMD_AUTH_METHODS = ["none", "private_key_jwt"];
+function assertJwksUri(ctx, value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw refuse("client_id metadata field 'jwks_uri' must be a non-empty string");
   }
   let url;
   try {
     url = new URL(value);
   } catch {
-    throw new TypeError(`oauth-host: redirectUri must be an absolute URI: '${value}'`);
+    throw refuse(`client_id metadata field 'jwks_uri' is not a valid URL: '${value}'`);
   }
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
-    throw new TypeError(
-      `oauth-host: redirectUri must be https (http is allowed only on localhost/127.0.0.1): '${value}'`
-    );
+  if (url.protocol !== "https:") {
+    throw refuse(`client_id metadata field 'jwks_uri' must be served over https (got '${url.protocol}')`);
+  }
+  if (url.username || url.password) {
+    throw refuse("client_id metadata field 'jwks_uri' must not contain URL credentials");
   }
   if (url.hash) {
-    throw new TypeError(`oauth-host: redirectUri must not contain a fragment: '${value}'`);
+    throw refuse("client_id metadata field 'jwks_uri' must not contain a fragment");
   }
-  return value;
-}
-function assertRedirectUris(input) {
-  if (!Array.isArray(input) || input.length === 0) {
-    throw new TypeError("oauth-host: a client needs at least one redirectUri");
+  if (!hostAllowed(ctx.cimd.allowedHosts, url)) {
+    throw refuse(`client_id metadata field 'jwks_uri' host '${url.host}' is not in clientIdMetadata.allowedHosts`);
   }
-  return input.map(assertRedirectUri);
+  return url.href;
 }
-function assertScopes(ctx, input) {
-  if (!Array.isArray(input) || input.length === 0) {
-    throw new TypeError("oauth-host: a client needs at least one entry in allowedScopes");
+function assertInlineJwks(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw refuse("client_id metadata field 'jwks' must be a JSON object");
   }
-  for (const id of input) {
-    if (typeof id !== "string" || !ctx.scopeIndex.has(id)) {
-      throw new TypeError(
-        `oauth-host: allowedScopes contains '${String(id)}', which is not in the configured scope catalog`
-      );
+  const keys = value.keys;
+  if (!Array.isArray(keys) || keys.length === 0) {
+    throw refuse("client_id metadata field 'jwks' must contain a non-empty 'keys' array");
+  }
+  for (const key of keys) {
+    if (!key || typeof key !== "object" || Array.isArray(key)) {
+      throw refuse("client_id metadata field 'jwks' contains a non-object entry in 'keys'");
     }
   }
-  return [...input];
+  return value;
 }
-function assertResources(ctx, input) {
-  const declared = new Set(ctx.resources.map((r) => r.id));
-  if (input === void 0) return ctx.resources.map((r) => r.id);
-  if (!Array.isArray(input) || input.length === 0) {
-    throw new TypeError("oauth-host: allowedResources, when given, must list at least one resource");
-  }
-  for (const id of input) {
-    if (typeof id !== "string" || !declared.has(id)) {
-      throw new TypeError(
-        `oauth-host: allowedResources contains '${String(id)}', which is not a configured resource`
+function offeredAuthMethods(doc) {
+  const plural = doc.token_endpoint_auth_methods_supported;
+  if (plural !== void 0) {
+    if (!Array.isArray(plural) || plural.length === 0 || !plural.every((entry) => typeof entry === "string" && entry.length > 0)) {
+      throw refuse(
+        "client_id metadata field 'token_endpoint_auth_methods_supported' must be a non-empty array of strings"
       );
     }
+    return [...new Set(plural)];
   }
-  return [...input];
-}
-function assertClientType(value) {
-  if (value === void 0) return "confidential";
-  if (value !== "confidential" && value !== "public") {
-    throw new TypeError(
-      `oauth-host: client type must be 'confidential' or 'public' (got ${JSON.stringify(value)})`
-    );
+  const singular = doc.token_endpoint_auth_method;
+  if (singular !== void 0) {
+    if (typeof singular !== "string" || !singular) {
+      throw refuse("client_id metadata field 'token_endpoint_auth_method' must be a string");
+    }
+    return [singular];
   }
-  return value;
+  return ["none"];
 }
-function assertName(value) {
+function requireString(doc, field) {
+  const value = doc[field];
   if (typeof value !== "string" || !value.trim()) {
-    throw new TypeError("oauth-host: a client needs a non-empty `name` \u2014 it is what the consent screen shows");
+    throw refuse(`client_id metadata field '${field}' must be a non-empty string`);
   }
   return value.trim();
 }
-async function revokeGrantsMatching(ctx, filter, by) {
-  const res = await ctx.models.Grant.updateMany(
-    { ...filter, revokedAt: null },
-    { $set: { revokedAt: /* @__PURE__ */ new Date(), revokedBy: by } }
-  );
-  return { grantsRevoked: res.modifiedCount ?? 0 };
+function optionalHttpsUri(doc, field) {
+  const value = doc[field];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "string" || !value.trim()) {
+    throw refuse(`client_id metadata field '${field}' must be a string`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw refuse(`client_id metadata field '${field}' must be an absolute URL: '${value}'`);
+  }
+  if (url.protocol !== "https:") {
+    throw refuse(`client_id metadata field '${field}' must be https (got '${url.protocol}')`);
+  }
+  return value;
 }
-async function revokeTokensMatching(ctx, filter) {
-  const res = await ctx.models.Token.updateMany(
-    { ...filter, revokedAt: null },
-    { $set: { revokedAt: /* @__PURE__ */ new Date() } }
-  );
-  return res.modifiedCount ?? 0;
+function assertRedirectUris(doc) {
+  const value = doc.redirect_uris;
+  if (!Array.isArray(value) || value.length === 0) {
+    throw refuse("client_id metadata field 'redirect_uris' must be a non-empty array");
+  }
+  return value.map((entry) => {
+    if (typeof entry !== "string" || !entry) {
+      throw refuse(`client_id metadata 'redirect_uris' entries must be strings (got ${JSON.stringify(entry)})`);
+    }
+    let url;
+    try {
+      url = new URL(entry);
+    } catch {
+      throw refuse(`client_id metadata 'redirect_uris' entry must be an absolute URI: '${entry}'`);
+    }
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+      throw refuse(
+        `client_id metadata 'redirect_uris' entry must be https (http is allowed only on localhost/127.0.0.1): '${entry}'`
+      );
+    }
+    if (url.hash) {
+      throw refuse(`client_id metadata 'redirect_uris' entry must not contain a fragment: '${entry}'`);
+    }
+    return entry;
+  });
 }
-function createClientsApi(ctx) {
-  async function create(spec) {
-    if (!spec || typeof spec !== "object") {
-      throw new TypeError("oauth-host: clients.create(spec) requires a spec object");
+function validateMetadataDocument(ctx, url, doc) {
+  const declared = requireString(doc, "client_id");
+  let declaredUrl;
+  try {
+    declaredUrl = new URL(declared);
+  } catch {
+    throw refuse(`client_id metadata field 'client_id' is not a URL: '${declared}'`);
+  }
+  if (declaredUrl.href !== url.href) {
+    throw refuse(
+      `client_id metadata field 'client_id' is '${declared}', which is not the URL it was fetched from ('${url.href}')`
+    );
+  }
+  const offered = offeredAuthMethods(doc);
+  let usableMethods = offered.filter((m) => SERVER_CIMD_AUTH_METHODS.includes(m));
+  if (usableMethods.length === 0) {
+    throw refuse(
+      `client_id metadata offers token endpoint auth methods [${offered.join(", ")}]; this server supports [${SERVER_CIMD_AUTH_METHODS.join(", ")}] for CIMD clients \u2014 no usable method in the intersection`
+    );
+  }
+  let jwksUri;
+  let jwks;
+  if (usableMethods.includes("private_key_jwt")) {
+    const hasJwksUri = doc.jwks_uri !== void 0 && doc.jwks_uri !== null;
+    const hasJwks = doc.jwks !== void 0 && doc.jwks !== null;
+    if (hasJwksUri && hasJwks) {
+      throw refuse("client_id metadata must not contain both 'jwks' and 'jwks_uri'");
     }
-    const name = assertName(spec.name);
-    const type = assertClientType(spec.type);
-    const redirectUris = assertRedirectUris(spec.redirectUris);
-    const allowedScopes = assertScopes(ctx, spec.allowedScopes);
-    const allowedResources = assertResources(ctx, spec.allowedResources);
-    const clientId = spec.clientId ?? generateClientId();
+    if (hasJwksUri) {
+      jwksUri = assertJwksUri(ctx, doc.jwks_uri);
+    } else if (hasJwks) {
+      jwks = assertInlineJwks(doc.jwks);
+    } else if (usableMethods.includes("none")) {
+      usableMethods = usableMethods.filter((m) => m !== "private_key_jwt");
+    } else {
+      throw refuse("client_id metadata offers private_key_jwt but carries no 'jwks' or 'jwks_uri'");
+    }
+  }
+  const name = requireString(doc, "client_name");
+  const redirectUris = assertRedirectUris(doc);
+  const permitted = new Set(ctx.cimd.allowedScopes.filter((id) => ctx.scopeIndex.has(id)));
+  let allowedScopes;
+  if (doc.scope === void 0 || doc.scope === null) {
+    allowedScopes = [...permitted];
+  } else {
+    if (typeof doc.scope !== "string") {
+      throw refuse("client_id metadata field 'scope' must be a space-delimited string");
+    }
+    const requested = new Set(doc.scope.split(/\s+/).filter(Boolean));
+    allowedScopes = [...permitted].filter((id) => requested.has(id));
+  }
+  if (allowedScopes.length === 0) {
+    throw refuse(
+      "client_id metadata field 'scope' has no overlap with what this server offers \u2014 there is nothing this client could be granted"
+    );
+  }
+  const branding = {};
+  const logoUrl = optionalHttpsUri(doc, "logo_uri");
+  const homepageUrl = optionalHttpsUri(doc, "client_uri");
+  const tosUrl = optionalHttpsUri(doc, "tos_uri");
+  const privacyUrl = optionalHttpsUri(doc, "policy_uri");
+  if (logoUrl) branding.logoUrl = logoUrl;
+  if (homepageUrl) branding.homepageUrl = homepageUrl;
+  if (tosUrl) branding.tosUrl = tosUrl;
+  if (privacyUrl) branding.privacyUrl = privacyUrl;
+  return {
+    name,
+    redirectUris,
+    allowedScopes,
+    branding,
+    usableMethods,
+    ...jwksUri ? { jwksUri } : {},
+    ...jwks ? { jwks } : {}
+  };
+}
+function rememberFailure(ctx, key, message) {
+  const { failures } = ctx.cimd;
+  if (failures.size >= MAX_REMEMBERED_FAILURES) {
+    const oldest = failures.keys().next();
+    if (!oldest.done) failures.delete(oldest.value);
+  }
+  failures.set(key, { until: Date.now() + NEGATIVE_TTL_MS, message });
+}
+function rememberedFailure(ctx, key) {
+  const found = ctx.cimd.failures.get(key);
+  if (!found) return null;
+  if (found.until <= Date.now()) {
+    ctx.cimd.failures.delete(key);
+    return null;
+  }
+  return found.message;
+}
+function isFresh(ctx, client) {
+  const fetchedAt = client.metadataFetchedAt?.getTime();
+  if (fetchedAt === void 0) return false;
+  return Date.now() - fetchedAt < ctx.cimd.cacheTtlMs;
+}
+async function persist(ctx, clientId, url, registration, etag) {
+  const unset = {};
+  const jwksFields = {};
+  if (registration.jwksUri) jwksFields.jwksUri = registration.jwksUri;
+  else unset.jwksUri = "";
+  if (registration.jwks) jwksFields.jwks = registration.jwks;
+  else unset.jwks = "";
+  const doc = await ctx.models.Client.findOneAndUpdate(
+    { clientId },
+    {
+      $set: {
+        name: registration.name,
+        redirectUris: registration.redirectUris,
+        allowedScopes: registration.allowedScopes,
+        // Every declared resource. A CIMD client cannot express an audience
+        // preference, and RFC 8707 validation at `/authorize` narrows it anyway.
+        allowedResources: ctx.resources.map((r) => r.id),
+        branding: registration.branding,
+        metadataUrl: url.href,
+        metadataFetchedAt: /* @__PURE__ */ new Date(),
+        tokenEndpointAuthMethods: registration.usableMethods,
+        ...jwksFields,
+        ...etag ? { metadataEtag: etag } : {}
+      },
+      ...Object.keys(unset).length ? { $unset: unset } : {},
+      $setOnInsert: {
+        type: "public",
+        registration: "cimd",
+        trusted: false,
+        secrets: [],
+        status: "active"
+      }
+    },
+    { upsert: true, returnDocument: "after", setDefaultsOnInsert: false }
+  ).exec();
+  return doc;
+}
+async function resolveCimdClient(ctx, clientId) {
+  const url = assertFetchableUrl(ctx, clientId);
+  const existing = await ctx.models.Client.findOne({ clientId }).exec();
+  if (existing) {
+    if (existing.status !== "active") {
+      throw refuse(`client '${clientId}' is disabled`);
+    }
+    if (existing.registration !== "cimd") return existing;
+    if (isFresh(ctx, existing)) return existing;
+  }
+  const remembered = rememberedFailure(ctx, url.href);
+  if (remembered) throw refuse(remembered);
+  try {
+    const { document, etag } = await fetchMetadata(ctx, url, existing?.metadataEtag);
+    if (!document) {
+      if (existing) {
+        existing.metadataFetchedAt = /* @__PURE__ */ new Date();
+        await existing.save();
+        return existing;
+      }
+      throw refuse("client_id metadata returned 304 with nothing cached to answer from");
+    }
+    const registration = validateMetadataDocument(ctx, url, document);
+    const client = await persist(ctx, clientId, url, registration, etag);
+    ctx.logger.debug?.({ clientId }, "oauth-host: client_id metadata document resolved");
+    return client;
+  } catch (err) {
+    const message = err instanceof UnredirectableError ? err.description ?? "client_id metadata could not be resolved" : "client_id metadata could not be resolved";
+    rememberFailure(ctx, url.href, message);
+    ctx.logger.warn?.({ clientId, err }, "oauth-host: client_id metadata resolution failed");
+    throw err instanceof UnredirectableError ? err : refuse(message);
+  }
+}
+
+// src/server/services/admin.ts
+var MAX_LIST = 200;
+var DEFAULT_LIST = 50;
+function clampLimit(requested) {
+  const n = typeof requested === "number" && Number.isFinite(requested) ? Math.floor(requested) : DEFAULT_LIST;
+  if (n < 1) return 1;
+  return Math.min(n, MAX_LIST);
+}
+function clampSkip(requested) {
+  const n = typeof requested === "number" && Number.isFinite(requested) ? Math.floor(requested) : 0;
+  return n > 0 ? n : 0;
+}
+function notFound(clientId) {
+  return new Error(`oauth-host: no client registered with clientId '${clientId}'`);
+}
+function toPublicClient(doc) {
+  return {
+    clientId: doc.clientId,
+    name: doc.name,
+    type: doc.type,
+    // Defaulted rather than read straight through: rows written before the
+    // field existed have no value, and `undefined` here would read as "unknown
+    // provenance" on a client that plainly was registered by hand.
+    registration: doc.registration ?? "manual",
+    ...doc.metadataUrl ? { metadataUrl: doc.metadataUrl } : {},
+    trusted: Boolean(doc.trusted),
+    redirectUris: [...doc.redirectUris ?? []],
+    allowedScopes: [...doc.allowedScopes ?? []],
+    allowedResources: [...doc.allowedResources ?? []],
+    branding: { ...doc.branding ?? {} },
+    status: doc.status,
+    createdAt: doc.createdAt
+  };
+}
+function assertRedirectUri(value) {
+  if (typeof value !== "string" || !value) {
+    throw new TypeError(`oauth-host: every redirectUri must be a string (got ${JSON.stringify(value)})`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError(`oauth-host: redirectUri must be an absolute URI: '${value}'`);
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new TypeError(
+      `oauth-host: redirectUri must be https (http is allowed only on localhost/127.0.0.1): '${value}'`
+    );
+  }
+  if (url.hash) {
+    throw new TypeError(`oauth-host: redirectUri must not contain a fragment: '${value}'`);
+  }
+  return value;
+}
+function assertRedirectUris2(input) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError("oauth-host: a client needs at least one redirectUri");
+  }
+  return input.map(assertRedirectUri);
+}
+function assertScopes(ctx, input) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError("oauth-host: a client needs at least one entry in allowedScopes");
+  }
+  for (const id of input) {
+    if (typeof id !== "string" || !ctx.scopeIndex.has(id)) {
+      throw new TypeError(
+        `oauth-host: allowedScopes contains '${String(id)}', which is not in the configured scope catalog`
+      );
+    }
+  }
+  return [...input];
+}
+function assertResources(ctx, input) {
+  const declared = new Set(ctx.resources.map((r) => r.id));
+  if (input === void 0) return ctx.resources.map((r) => r.id);
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError("oauth-host: allowedResources, when given, must list at least one resource");
+  }
+  for (const id of input) {
+    if (typeof id !== "string" || !declared.has(id)) {
+      throw new TypeError(
+        `oauth-host: allowedResources contains '${String(id)}', which is not a configured resource`
+      );
+    }
+  }
+  return [...input];
+}
+function assertClientType(value) {
+  if (value === void 0) return "confidential";
+  if (value !== "confidential" && value !== "public") {
+    throw new TypeError(
+      `oauth-host: client type must be 'confidential' or 'public' (got ${JSON.stringify(value)})`
+    );
+  }
+  return value;
+}
+function assertName(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new TypeError("oauth-host: a client needs a non-empty `name` \u2014 it is what the consent screen shows");
+  }
+  return value.trim();
+}
+async function revokeGrantsMatching(ctx, filter, by) {
+  const res = await ctx.models.Grant.updateMany(
+    { ...filter, revokedAt: null },
+    { $set: { revokedAt: /* @__PURE__ */ new Date(), revokedBy: by } }
+  );
+  return { grantsRevoked: res.modifiedCount ?? 0 };
+}
+async function revokeTokensMatching(ctx, filter) {
+  const res = await ctx.models.Token.updateMany(
+    { ...filter, revokedAt: null },
+    { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+  );
+  return res.modifiedCount ?? 0;
+}
+function createClientsApi(ctx) {
+  async function create(spec) {
+    if (!spec || typeof spec !== "object") {
+      throw new TypeError("oauth-host: clients.create(spec) requires a spec object");
+    }
+    const name = assertName(spec.name);
+    const type = assertClientType(spec.type);
+    const redirectUris = assertRedirectUris2(spec.redirectUris);
+    const allowedScopes = assertScopes(ctx, spec.allowedScopes);
+    const allowedResources = assertResources(ctx, spec.allowedResources);
+    const clientId = spec.clientId ?? generateClientId();
     const clientSecret = type === "confidential" ? generateClientSecret() : void 0;
     const doc = await ctx.models.Client.create({
       clientId,
@@ -1455,7 +1880,7 @@ function createClientsApi(ctx) {
       const doc = await ctx.models.Client.findOne({ clientId });
       if (!doc) throw notFound(clientId);
       if (patch.name !== void 0) doc.name = assertName(patch.name);
-      if (patch.redirectUris !== void 0) doc.redirectUris = assertRedirectUris(patch.redirectUris);
+      if (patch.redirectUris !== void 0) doc.redirectUris = assertRedirectUris2(patch.redirectUris);
       if (patch.allowedScopes !== void 0) doc.allowedScopes = assertScopes(ctx, patch.allowedScopes);
       if (patch.allowedResources !== void 0) {
         doc.allowedResources = assertResources(ctx, patch.allowedResources);
@@ -1529,19 +1954,202 @@ function authFailure(viaBasic) {
     headers: viaBasic ? { "WWW-Authenticate": 'Basic realm="oauth", charset="UTF-8"' } : {}
   });
 }
-async function authenticateClient(ctx, req) {
-  const creds = readCredentials(req);
-  if (!creds || !creds.clientId) throw authFailure(Boolean(creds?.viaBasic));
-  const client = await ctx.models.Client.findOne({ clientId: creds.clientId });
-  if (!client || client.status !== "active") throw authFailure(creds.viaBasic);
-  if (client.type === "public") {
-    if (creds.clientSecret !== null) throw authFailure(creds.viaBasic);
-    return client;
-  }
-  if (creds.clientSecret === null) throw authFailure(creds.viaBasic);
+var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var MAX_ASSERTION_BYTES = 8192;
+var COMPACT_JWS_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+var ASSERTION_ALGORITHMS = ["RS256", "ES256"];
+var MAX_ASSERTION_AGE_S = 3600;
+var MAX_JTI_LEN = 256;
+var REPLAY_CACHE_MAX = 1e4;
+var JWKS_CACHE_MAX = 100;
+var JWKS_FORCE_REFETCH_INTERVAL_MS = 6e4;
+var ASSERTION_CLOCK_TOLERANCE_S = 60;
+function tokenEndpointUrl(ctx) {
+  return `${ctx.issuer}${ctx.mountPath}/token`;
+}
+function isJwkSet(doc) {
+  return Boolean(doc) && typeof doc === "object" && Array.isArray(doc.keys);
+}
+function assertionFailure(reason) {
+  return new Error(reason);
+}
+function selectCandidateKeys(keys, header) {
+  return keys.filter((key) => {
+    if (header.kid !== void 0 && key.kid !== header.kid) return false;
+    const use = key.use;
+    if (use !== void 0 && use !== "sig") return false;
+    const alg = key.alg;
+    if (alg !== void 0 && alg !== header.alg) return false;
+    return true;
+  });
+}
+async function resolveJwksKeys(ctx, jwksUri, forceRefetch) {
+  const { jwksCache, jwksForceRefetchAt } = ctx.cimd;
   const now = Date.now();
-  let matched;
-  for (const record of client.secrets) {
+  const cached = jwksCache.get(jwksUri);
+  const fresh = cached !== void 0 && now - cached.fetchedAt < ctx.cimd.cacheTtlMs;
+  if (fresh && !forceRefetch) return cached.keys;
+  if (forceRefetch) {
+    const lastForced = jwksForceRefetchAt.get(jwksUri) ?? 0;
+    if (now - lastForced < JWKS_FORCE_REFETCH_INTERVAL_MS) {
+      return cached?.keys ?? [];
+    }
+    jwksForceRefetchAt.set(jwksUri, now);
+  }
+  const doc = await fetchJwks(ctx, jwksUri);
+  if (!isJwkSet(doc)) throw assertionFailure(`jwks_uri '${jwksUri}' did not serve a JWK Set`);
+  if (!jwksCache.has(jwksUri) && jwksCache.size >= JWKS_CACHE_MAX) {
+    const oldest = jwksCache.keys().next();
+    if (!oldest.done) jwksCache.delete(oldest.value);
+  }
+  jwksCache.set(jwksUri, { keys: doc.keys, fetchedAt: now });
+  return doc.keys;
+}
+async function loadClientJwks(ctx, client) {
+  if (client.jwks !== void 0 && client.jwks !== null) {
+    if (!isJwkSet(client.jwks)) {
+      throw assertionFailure(`client '${client.clientId}' has a malformed stored 'jwks'`);
+    }
+    return client.jwks.keys;
+  }
+  if (client.jwksUri) {
+    return resolveJwksKeys(ctx, client.jwksUri, false);
+  }
+  throw assertionFailure(`client '${client.clientId}' has neither 'jwks' nor 'jwksUri' stored`);
+}
+async function verifyClientAssertion(ctx, body) {
+  if (body.client_assertion_type !== CLIENT_ASSERTION_TYPE) {
+    throw assertionFailure(
+      `client_assertion_type must be '${CLIENT_ASSERTION_TYPE}' (got ${JSON.stringify(body.client_assertion_type)})`
+    );
+  }
+  const assertion = body.client_assertion;
+  if (typeof assertion !== "string" || !assertion || Buffer.byteLength(assertion, "utf8") > MAX_ASSERTION_BYTES || !COMPACT_JWS_RE.test(assertion)) {
+    throw assertionFailure("client_assertion is not a well-formed compact JWS");
+  }
+  if (typeof body.client_secret === "string" && body.client_secret) {
+    throw assertionFailure("client_assertion was presented alongside a client_secret");
+  }
+  let unverified;
+  try {
+    unverified = decodeJwt(assertion);
+  } catch {
+    throw assertionFailure("client_assertion could not be decoded");
+  }
+  const iss = unverified.iss;
+  if (typeof iss !== "string" || !iss) {
+    throw assertionFailure("client_assertion is missing iss");
+  }
+  if (typeof body.client_id === "string" && body.client_id && body.client_id !== iss) {
+    throw assertionFailure("client_assertion iss does not match client_id");
+  }
+  const client = await ctx.models.Client.findOne({ clientId: iss });
+  if (!client || client.status !== "active" || !client.tokenEndpointAuthMethods?.includes("private_key_jwt")) {
+    throw assertionFailure(`client '${iss}' does not support private_key_jwt`);
+  }
+  let header;
+  try {
+    header = decodeProtectedHeader(assertion);
+  } catch {
+    throw assertionFailure("client_assertion header could not be decoded");
+  }
+  const alg = header.alg;
+  if (alg !== "RS256" && alg !== "ES256") {
+    throw assertionFailure(`client_assertion alg '${String(alg)}' is not permitted`);
+  }
+  const stored = await loadClientJwks(ctx, client);
+  let candidates = selectCandidateKeys(stored, { alg, kid: header.kid });
+  if (candidates.length === 0 && client.jwksUri) {
+    const refetched = await resolveJwksKeys(ctx, client.jwksUri, true);
+    candidates = selectCandidateKeys(refetched, { alg, kid: header.kid });
+  }
+  if (candidates.length === 0) {
+    throw assertionFailure(`no candidate key for kid '${String(header.kid)}'`);
+  }
+  const tokenEndpoint = tokenEndpointUrl(ctx);
+  let verified;
+  let lastJoseError;
+  for (const jwk of candidates) {
+    try {
+      const key = await importJWK(jwk, alg);
+      verified = await jwtVerify(assertion, key, {
+        // Passed explicitly rather than trusting the header a second time —
+        // this is the actual alg-confusion guard, not the earlier check,
+        // which only short-circuits the common case before a fetch.
+        algorithms: [...ASSERTION_ALGORITHMS],
+        audience: [tokenEndpoint, ctx.issuer],
+        clockTolerance: ASSERTION_CLOCK_TOLERANCE_S
+      });
+      break;
+    } catch (err) {
+      lastJoseError = err;
+    }
+  }
+  if (!verified) {
+    throw assertionFailure(
+      `client_assertion did not verify: ${lastJoseError instanceof Error ? lastJoseError.message : "unknown error"}`
+    );
+  }
+  const { payload } = verified;
+  if (payload.iss !== client.clientId || payload.sub !== client.clientId) {
+    throw assertionFailure("client_assertion iss/sub must both equal the client_id");
+  }
+  const exp = payload.exp;
+  const nowS = Math.floor(Date.now() / 1e3);
+  if (typeof exp !== "number" || exp - nowS > MAX_ASSERTION_AGE_S) {
+    throw assertionFailure("client_assertion exp is too far in the future");
+  }
+  const jti = payload.jti;
+  if (typeof jti !== "string" || !jti || jti.length > MAX_JTI_LEN) {
+    throw assertionFailure("client_assertion is missing jti");
+  }
+  const replay = ctx.cimd.assertionReplay;
+  const replayKey = `${client.clientId}:${jti}`;
+  const existing = replay.get(replayKey);
+  if (existing !== void 0 && existing > Date.now()) {
+    ctx.logger.warn?.({ clientId: client.clientId }, "oauth-host: private_key_jwt assertion replay detected");
+    throw assertionFailure("client_assertion jti has already been used");
+  }
+  if (!replay.has(replayKey) && replay.size >= REPLAY_CACHE_MAX) {
+    const oldest = replay.keys().next();
+    if (!oldest.done) replay.delete(oldest.value);
+  }
+  replay.set(replayKey, (exp + 60) * 1e3);
+  return client;
+}
+async function authenticateClient(ctx, req) {
+  const body = req.body ?? {};
+  const header = req.headers?.authorization;
+  const viaBasic = typeof header === "string" && /^Basic /i.test(header);
+  if (body.client_assertion !== void 0 || body.client_assertion_type !== void 0) {
+    if (viaBasic) {
+      ctx.logger.debug?.(
+        "oauth-host: client_assertion presented alongside a Basic Authorization header"
+      );
+      throw authFailure(viaBasic);
+    }
+    try {
+      return await verifyClientAssertion(ctx, body);
+    } catch (err) {
+      ctx.logger.debug?.(
+        { err: err instanceof Error ? err.message : err },
+        "oauth-host: private_key_jwt assertion rejected"
+      );
+      throw authFailure(viaBasic);
+    }
+  }
+  const creds = readCredentials(req);
+  if (!creds || !creds.clientId) throw authFailure(Boolean(creds?.viaBasic));
+  const client = await ctx.models.Client.findOne({ clientId: creds.clientId });
+  if (!client || client.status !== "active") throw authFailure(creds.viaBasic);
+  if (client.type === "public") {
+    if (creds.clientSecret !== null) throw authFailure(creds.viaBasic);
+    return client;
+  }
+  if (creds.clientSecret === null) throw authFailure(creds.viaBasic);
+  const now = Date.now();
+  let matched;
+  for (const record of client.secrets) {
     if (record.retiresAt && record.retiresAt.getTime() <= now) continue;
     if (safeEqual(sha256(creds.clientSecret), record.hash)) matched = record;
   }
@@ -1736,297 +2344,6 @@ function createContextsApi(ctx) {
   };
 }
 
-// src/server/services/cimd.ts
-var NEGATIVE_TTL_MS = 6e4;
-var MAX_REMEMBERED_FAILURES = 1e3;
-function refuse(description) {
-  return new UnredirectableError("invalid_client", description);
-}
-function isMetadataUrl(clientId) {
-  return /^https:\/\//i.test(clientId);
-}
-function hostAllowed(rules, url) {
-  const hostname = url.hostname.toLowerCase();
-  return rules.some((rule) => {
-    if (url.port !== rule.port) return false;
-    if (hostname === rule.host) return true;
-    return rule.subdomains && hostname.endsWith(`.${rule.host}`);
-  });
-}
-function assertFetchableUrl(ctx, clientId) {
-  let url;
-  try {
-    url = new URL(clientId);
-  } catch {
-    throw refuse(`client_id is not a valid URL: '${clientId}'`);
-  }
-  if (url.protocol !== "https:") {
-    throw refuse(`client_id metadata must be served over https (got '${url.protocol}')`);
-  }
-  if (url.username || url.password) {
-    throw refuse("client_id must not contain URL credentials");
-  }
-  if (url.hash) {
-    throw refuse("client_id must not contain a fragment");
-  }
-  if (!hostAllowed(ctx.cimd.allowedHosts, url)) {
-    throw refuse(`client_id host '${url.host}' is not in clientIdMetadata.allowedHosts`);
-  }
-  return url;
-}
-var JSON_CONTENT_TYPE = /^application\/(?:[\w.+-]+\+)?json\s*(?:;|$)/i;
-async function readCapped(res, maxBytes) {
-  const body = res.body;
-  if (!body) throw refuse("client_id metadata document was empty");
-  const reader = body.getReader();
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (!value) continue;
-    total += value.byteLength;
-    if (total > maxBytes) {
-      void reader.cancel();
-      throw refuse(`client_id metadata document exceeds ${maxBytes} bytes`);
-    }
-    chunks.push(Buffer.from(value));
-  }
-  return Buffer.concat(chunks).toString("utf8");
-}
-async function fetchMetadata(ctx, url, etag) {
-  let res;
-  try {
-    res = await fetch(url.toString(), {
-      method: "GET",
-      // The single most important line in this file. A 3xx is a failure below,
-      // not a hop: following redirects would let an allowlisted host forward us
-      // to any address it likes, allowlist intact.
-      redirect: "manual",
-      headers: {
-        accept: "application/json",
-        ...etag ? { "if-none-match": etag } : {}
-      },
-      signal: AbortSignal.timeout(ctx.cimd.fetchTimeoutMs)
-    });
-  } catch (err) {
-    const name = err?.name;
-    if (name === "TimeoutError" || name === "AbortError") {
-      throw refuse(`client_id metadata fetch timed out after ${ctx.cimd.fetchTimeoutMs}ms`);
-    }
-    throw refuse(`client_id metadata could not be fetched: ${err?.message ?? "network error"}`);
-  }
-  if (res.status === 304) return { document: null };
-  if (res.status >= 300 && res.status < 400) {
-    throw refuse(
-      `client_id metadata returned a ${res.status} redirect, which is not followed \u2014 serve the document at the client_id URL itself`
-    );
-  }
-  if (res.status !== 200) {
-    throw refuse(`client_id metadata returned HTTP ${res.status}`);
-  }
-  const contentType = res.headers.get("content-type") ?? "";
-  if (!JSON_CONTENT_TYPE.test(contentType)) {
-    throw refuse(`client_id metadata must be JSON (got content-type '${contentType || "none"}')`);
-  }
-  const text = await readCapped(res, ctx.cimd.maxBytes);
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    throw refuse("client_id metadata document is not valid JSON");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw refuse("client_id metadata document must be a JSON object");
-  }
-  return {
-    document: parsed,
-    ...res.headers.get("etag") ? { etag: res.headers.get("etag") } : {}
-  };
-}
-function requireString(doc, field) {
-  const value = doc[field];
-  if (typeof value !== "string" || !value.trim()) {
-    throw refuse(`client_id metadata field '${field}' must be a non-empty string`);
-  }
-  return value.trim();
-}
-function optionalHttpsUri(doc, field) {
-  const value = doc[field];
-  if (value === void 0 || value === null) return void 0;
-  if (typeof value !== "string" || !value.trim()) {
-    throw refuse(`client_id metadata field '${field}' must be a string`);
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw refuse(`client_id metadata field '${field}' must be an absolute URL: '${value}'`);
-  }
-  if (url.protocol !== "https:") {
-    throw refuse(`client_id metadata field '${field}' must be https (got '${url.protocol}')`);
-  }
-  return value;
-}
-function assertRedirectUris2(doc) {
-  const value = doc.redirect_uris;
-  if (!Array.isArray(value) || value.length === 0) {
-    throw refuse("client_id metadata field 'redirect_uris' must be a non-empty array");
-  }
-  return value.map((entry) => {
-    if (typeof entry !== "string" || !entry) {
-      throw refuse(`client_id metadata 'redirect_uris' entries must be strings (got ${JSON.stringify(entry)})`);
-    }
-    let url;
-    try {
-      url = new URL(entry);
-    } catch {
-      throw refuse(`client_id metadata 'redirect_uris' entry must be an absolute URI: '${entry}'`);
-    }
-    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
-      throw refuse(
-        `client_id metadata 'redirect_uris' entry must be https (http is allowed only on localhost/127.0.0.1): '${entry}'`
-      );
-    }
-    if (url.hash) {
-      throw refuse(`client_id metadata 'redirect_uris' entry must not contain a fragment: '${entry}'`);
-    }
-    return entry;
-  });
-}
-function validateMetadataDocument(ctx, url, doc) {
-  const declared = requireString(doc, "client_id");
-  let declaredUrl;
-  try {
-    declaredUrl = new URL(declared);
-  } catch {
-    throw refuse(`client_id metadata field 'client_id' is not a URL: '${declared}'`);
-  }
-  if (declaredUrl.href !== url.href) {
-    throw refuse(
-      `client_id metadata field 'client_id' is '${declared}', which is not the URL it was fetched from ('${url.href}')`
-    );
-  }
-  const method = doc.token_endpoint_auth_method;
-  if (method !== void 0 && method !== "none") {
-    throw refuse(
-      `client_id metadata field 'token_endpoint_auth_method' must be 'none' (got ${JSON.stringify(method)}) \u2014 a CIMD client holds no secret`
-    );
-  }
-  const name = requireString(doc, "client_name");
-  const redirectUris = assertRedirectUris2(doc);
-  const permitted = new Set(ctx.cimd.allowedScopes.filter((id) => ctx.scopeIndex.has(id)));
-  let allowedScopes;
-  if (doc.scope === void 0 || doc.scope === null) {
-    allowedScopes = [...permitted];
-  } else {
-    if (typeof doc.scope !== "string") {
-      throw refuse("client_id metadata field 'scope' must be a space-delimited string");
-    }
-    const requested = new Set(doc.scope.split(/\s+/).filter(Boolean));
-    allowedScopes = [...permitted].filter((id) => requested.has(id));
-  }
-  if (allowedScopes.length === 0) {
-    throw refuse(
-      "client_id metadata field 'scope' has no overlap with what this server offers \u2014 there is nothing this client could be granted"
-    );
-  }
-  const branding = {};
-  const logoUrl = optionalHttpsUri(doc, "logo_uri");
-  const homepageUrl = optionalHttpsUri(doc, "client_uri");
-  const tosUrl = optionalHttpsUri(doc, "tos_uri");
-  const privacyUrl = optionalHttpsUri(doc, "policy_uri");
-  if (logoUrl) branding.logoUrl = logoUrl;
-  if (homepageUrl) branding.homepageUrl = homepageUrl;
-  if (tosUrl) branding.tosUrl = tosUrl;
-  if (privacyUrl) branding.privacyUrl = privacyUrl;
-  return { name, redirectUris, allowedScopes, branding };
-}
-function rememberFailure(ctx, key, message) {
-  const { failures } = ctx.cimd;
-  if (failures.size >= MAX_REMEMBERED_FAILURES) {
-    const oldest = failures.keys().next();
-    if (!oldest.done) failures.delete(oldest.value);
-  }
-  failures.set(key, { until: Date.now() + NEGATIVE_TTL_MS, message });
-}
-function rememberedFailure(ctx, key) {
-  const found = ctx.cimd.failures.get(key);
-  if (!found) return null;
-  if (found.until <= Date.now()) {
-    ctx.cimd.failures.delete(key);
-    return null;
-  }
-  return found.message;
-}
-function isFresh(ctx, client) {
-  const fetchedAt = client.metadataFetchedAt?.getTime();
-  if (fetchedAt === void 0) return false;
-  return Date.now() - fetchedAt < ctx.cimd.cacheTtlMs;
-}
-async function persist(ctx, clientId, url, registration, etag) {
-  const doc = await ctx.models.Client.findOneAndUpdate(
-    { clientId },
-    {
-      $set: {
-        name: registration.name,
-        redirectUris: registration.redirectUris,
-        allowedScopes: registration.allowedScopes,
-        // Every declared resource. A CIMD client cannot express an audience
-        // preference, and RFC 8707 validation at `/authorize` narrows it anyway.
-        allowedResources: ctx.resources.map((r) => r.id),
-        branding: registration.branding,
-        metadataUrl: url.href,
-        metadataFetchedAt: /* @__PURE__ */ new Date(),
-        ...etag ? { metadataEtag: etag } : {}
-      },
-      $setOnInsert: {
-        type: "public",
-        registration: "cimd",
-        trusted: false,
-        secrets: [],
-        status: "active"
-      }
-    },
-    { upsert: true, returnDocument: "after", setDefaultsOnInsert: false }
-  ).exec();
-  return doc;
-}
-async function resolveCimdClient(ctx, clientId) {
-  const url = assertFetchableUrl(ctx, clientId);
-  const existing = await ctx.models.Client.findOne({ clientId }).exec();
-  if (existing) {
-    if (existing.status !== "active") {
-      throw refuse(`client '${clientId}' is disabled`);
-    }
-    if (existing.registration !== "cimd") return existing;
-    if (isFresh(ctx, existing)) return existing;
-  }
-  const remembered = rememberedFailure(ctx, url.href);
-  if (remembered) throw refuse(remembered);
-  try {
-    const { document, etag } = await fetchMetadata(ctx, url, existing?.metadataEtag);
-    if (!document) {
-      if (existing) {
-        existing.metadataFetchedAt = /* @__PURE__ */ new Date();
-        await existing.save();
-        return existing;
-      }
-      throw refuse("client_id metadata returned 304 with nothing cached to answer from");
-    }
-    const registration = validateMetadataDocument(ctx, url, document);
-    const client = await persist(ctx, clientId, url, registration, etag);
-    ctx.logger.debug?.({ clientId }, "oauth-host: client_id metadata document resolved");
-    return client;
-  } catch (err) {
-    const message = err instanceof UnredirectableError ? err.description ?? "client_id metadata could not be resolved" : "client_id metadata could not be resolved";
-    rememberFailure(ctx, url.href, message);
-    ctx.logger.warn?.({ clientId, err }, "oauth-host: client_id metadata resolution failed");
-    throw err instanceof UnredirectableError ? err : refuse(message);
-  }
-}
-
 // src/server/services/scopes.ts
 function parseScope(raw) {
   if (typeof raw !== "string") return [];