fix: record CIMD provenance as an issuer-keyed marker, not on the credential

Copilot review (#2287), three findings:

1. **invalid-client recovery lost the provenance.** SDK v2 `auth()` answers
   `invalid_client` / `unauthorized_client` with `invalidateCredentials("client")`
   and an immediate retry; our clear drops the registration *and* its kind, so
   the retry's URL-based client-ID save landed with nothing recorded and was
   stored as `dcr`. Provenance now lives in `cimdClientMetadataUrl`, an
   issuer-keyed marker on the issuer slot that records a property of the AS
   rather than a credential — `clearClientInformation` deliberately leaves it
   alone. `ensureCimdClientRegistration` writes it, and withdraws it when the AS
   stops advertising CIMD, on every connect.

2. **Discovery became a hard network dependency.** Moving the existing-client
   check after discovery meant a well-known outage could fail a reconnect the SDK
   would have served from its persisted discovery state. Reuse
   `provider.discoveryState()` first, and treat a discovery failure as "skip
   pre-registration" rather than an error — this helper is an optimization over
   what `auth()` does for itself.

3. **Dropped an unjustified double cast** in the test fetch helper; the async
   signature is directly assignable to `typeof fetch`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lmj6X2epWpPE7ScdSKQmtA
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/auth/cimd.test.ts

@@ -24,6 +24,9 @@ describe("ensureCimdClientRegistration", () => {
     storage = {
       getClientInformation: vi.fn(async () => undefined),
       saveClientInformation: vi.fn(async () => {}),
+      getDiscoveryState: vi.fn(async () => undefined),
+      getCimdClientMetadataUrl: vi.fn(async () => undefined),
+      saveCimdClientMetadataUrl: vi.fn(async () => {}),
       getScope: vi.fn().mockResolvedValue(undefined),
       getTokens: vi.fn(async () => undefined),
       saveTokens: vi.fn(async () => {}),
@@ -72,6 +75,12 @@ describe("ensureCimdClientRegistration", () => {
       },
       { registrationKind: "cimd", issuer: "http://127.0.0.1:9999" },
     );
+    // The provenance marker for this AS, which outlives the credential.
+    expect(storage.saveCimdClientMetadataUrl).toHaveBeenCalledWith(
+      SERVER_URL,
+      "http://127.0.0.1:9999",
+      METADATA_URL,
+    );
   });
 
   it("does not register when the AS metadata omits CIMD support", async () => {
@@ -102,6 +111,13 @@ describe("ensureCimdClientRegistration", () => {
     });
 
     expect(storage.saveClientInformation).not.toHaveBeenCalled();
+    // The marker is actively withdrawn, not merely left unwritten, so an AS that
+    // stops advertising CIMD stops being treated as one.
+    expect(storage.saveCimdClientMetadataUrl).toHaveBeenCalledWith(
+      SERVER_URL,
+      "http://127.0.0.1:9999",
+      undefined,
+    );
   });
 
   it("discovers protected-resource metadata at the challenge-advertised URL (#2071)", async () => {
@@ -161,6 +177,57 @@ describe("ensureCimdClientRegistration", () => {
     );
   });
 
+  // #2242 (Copilot): the existing-client check moved after discovery, so this
+  // helper must not turn a well-known outage into a failed reconnect. It reuses
+  // the discovery state SDK `auth()` persists, and treats a discovery failure as
+  // "skip pre-registration" rather than an error.
+  it("reuses persisted discovery state instead of re-fetching", async () => {
+    storage.getDiscoveryState = vi.fn(async () => ({
+      authorizationServerUrl: "http://127.0.0.1:9999",
+      authorizationServerMetadata: {
+        issuer: "http://127.0.0.1:9999",
+        authorization_endpoint: "http://127.0.0.1:9999/oauth/authorize",
+        token_endpoint: "http://127.0.0.1:9999/oauth/token",
+        response_types_supported: ["code"],
+        client_id_metadata_document_supported: true,
+      },
+    }));
+    const fetchFn = vi.fn(async () => {
+      throw new Error("discovery must not run when state is cached");
+    });
+
+    await ensureCimdClientRegistration({
+      serverUrl: SERVER_URL,
+      provider: createProvider(storage),
+      fetchFn,
+    });
+
+    expect(fetchFn).not.toHaveBeenCalled();
+    expect(storage.saveClientInformation).toHaveBeenCalledWith(
+      SERVER_URL,
+      { client_id: METADATA_URL },
+      { registrationKind: "cimd", issuer: "http://127.0.0.1:9999" },
+    );
+  });
+
+  it("skips pre-registration when discovery fails, rather than throwing", async () => {
+    const fetchFn = vi.fn(async () => {
+      throw new Error("well-known endpoint is down");
+    });
+
+    await expect(
+      ensureCimdClientRegistration({
+        serverUrl: SERVER_URL,
+        provider: createProvider(storage),
+        fetchFn,
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(storage.saveClientInformation).not.toHaveBeenCalled();
+    // No marker is invented either — nothing was learned about the AS.
+    expect(storage.saveCimdClientMetadataUrl).not.toHaveBeenCalled();
+  });
+
   it("no-ops when client information is already stored for the discovered issuer", async () => {
     // Dynamic slot only — a preregistered hit would short-circuit
     // `clientInformation()` before it ever reaches the issuer-keyed read.

clients/web/src/test/core/auth/connection-state.test.ts

@@ -61,6 +61,8 @@ function createStorage(
     getCodeVerifier: vi.fn(),
     getDiscoveryState: vi.fn().mockResolvedValue(undefined),
     saveDiscoveryState: vi.fn(),
+    getCimdClientMetadataUrl: vi.fn(async () => undefined),
+    saveCimdClientMetadataUrl: vi.fn(async () => undefined),
     clearDiscoveryState: vi.fn(),
   };
 }

clients/web/src/test/core/auth/providers.test.ts

@@ -221,6 +221,8 @@ describe("OAuthNavigation", () => {
         getScope: vi.fn().mockResolvedValue(undefined),
         getClientInformation: vi.fn(async () => undefined),
         getClientRegistrationKind: vi.fn(async () => undefined),
+        getCimdClientMetadataUrl: vi.fn(async () => undefined),
+        saveCimdClientMetadataUrl: vi.fn(async () => undefined),
         saveClientInformation: vi.fn(async () => undefined),
         savePreregisteredClientInformation: vi.fn(async () => undefined),
         saveScope: vi.fn(async () => undefined),
@@ -641,20 +643,16 @@ describe("OAuthNavigation", () => {
         const ISSUER = "https://as.example.com";
         const METADATA_URL = "https://app.example.com/client-metadata.json";
 
-        /** Storage already holding the CIMD pre-registration for METADATA_URL. */
+        /** Storage holding this AS's CIMD marker for METADATA_URL. */
         function makeCimdStorage(): OAuthStorage {
           const storage = makeStorage();
-          vi.mocked(storage.getClientInformation).mockImplementation(
+          vi.mocked(storage.getCimdClientMetadataUrl).mockResolvedValue(
-            async (_url: string, preregistered?: boolean) =>
+            METADATA_URL,
-              preregistered ? undefined : { client_id: METADATA_URL },
-          );
-          vi.mocked(storage.getClientRegistrationKind).mockResolvedValue(
-            "cimd",
           );
           return storage;
         }
 
-        it("keeps cimd when CIMD is configured and the stored registration matches", async () => {
+        it("keeps cimd when CIMD is configured and this issuer carries the marker", async () => {
           const storage = makeCimdStorage();
           const provider = makeProvider(storage, vi.fn(), {
             clientMetadataUrl: METADATA_URL,
@@ -665,11 +663,8 @@ describe("OAuthNavigation", () => {
             { issuer: ISSUER },
           );
 
-          // Reads the dynamic slot for this issuer, which falls back to the
+          expect(storage.getCimdClientMetadataUrl).toHaveBeenCalledWith(
-          // unkeyed slot the pre-registration wrote.
-          expect(storage.getClientInformation).toHaveBeenCalledWith(
             SERVER,
-            false,
             ISSUER,
           );
           expect(storage.saveClientInformation).toHaveBeenCalledWith(
@@ -679,6 +674,31 @@ describe("OAuthNavigation", () => {
           );
         });
 
+        // SDK v2 `auth()` answers `invalid_client` / `unauthorized_client` with
+        // `invalidateCredentials("client")` and an immediate retry. That clears
+        // the stored registration *and* its kind, so provenance read off the
+        // credential would be gone by the time the retry's CIMD save lands
+        // (Copilot). The marker is not a credential and survives.
+        it("keeps cimd through invalid-client recovery, which clears the credential", async () => {
+          const storage = makeCimdStorage();
+          const provider = makeProvider(storage, vi.fn(), {
+            clientMetadataUrl: METADATA_URL,
+          });
+
+          await provider.invalidateCredentials("client");
+          await provider.saveClientInformation(
+            { client_id: METADATA_URL },
+            { issuer: ISSUER },
+          );
+
+          expect(storage.clearClientInformation).toHaveBeenCalledWith(SERVER);
+          expect(storage.saveClientInformation).toHaveBeenCalledWith(
+            SERVER,
+            { client_id: METADATA_URL },
+            { registrationKind: "cimd", issuer: ISSUER },
+          );
+        });
+
         it("records dcr for a server-minted client_id while CIMD is configured", async () => {
           const storage = makeCimdStorage();
           const provider = makeProvider(storage, vi.fn(), {
@@ -690,10 +710,8 @@ describe("OAuthNavigation", () => {
             { issuer: ISSUER },
           );
 
-          // The id is not the metadata URL, so nothing is read and nothing is
+          // The id is not the metadata URL, so the marker is never consulted.
-          // carried forward.
+          expect(storage.getCimdClientMetadataUrl).not.toHaveBeenCalled();
-          expect(storage.getClientInformation).not.toHaveBeenCalled();
-          expect(storage.getClientRegistrationKind).not.toHaveBeenCalled();
           expect(storage.saveClientInformation).toHaveBeenCalledWith(
             SERVER,
             { client_id: "dcr-minted-id" },
@@ -701,7 +719,7 @@ describe("OAuthNavigation", () => {
           );
         });
 
-        it("records dcr when CIMD is not configured, even if storage says cimd", async () => {
+        it("records dcr when CIMD is not configured, even if the marker is set", async () => {
           const storage = makeCimdStorage();
           const provider = makeProvider(storage);
 
@@ -717,29 +735,11 @@ describe("OAuthNavigation", () => {
           );
         });
 
-        it("records dcr when the metadata URL differs from the configured one", async () => {
+        it("records dcr when the marker names a different metadata URL", async () => {
-          const storage = makeCimdStorage();
-          const provider = makeProvider(storage, vi.fn(), {
-            clientMetadataUrl: "https://other.example.com/client-metadata.json",
-          });
-
-          await provider.saveClientInformation(
-            { client_id: METADATA_URL },
-            { issuer: ISSUER },
-          );
-
-          expect(storage.saveClientInformation).toHaveBeenCalledWith(
-            SERVER,
-            { client_id: METADATA_URL },
-            { registrationKind: "dcr", issuer: ISSUER },
-          );
-        });
-
-        it("records dcr when no CIMD registration was ever stored", async () => {
-          // The AS returns the configured metadata URL from a real registration
-          // (RFC 7591 §3.2 leaves the id opaque). With nothing recorded as CIMD
-          // under that id, the save is still DCR.
           const storage = makeStorage();
+          vi.mocked(storage.getCimdClientMetadataUrl).mockResolvedValue(
+            "https://other.example.com/client-metadata.json",
+          );
           const provider = makeProvider(storage, vi.fn(), {
             clientMetadataUrl: METADATA_URL,
           });
@@ -756,13 +756,11 @@ describe("OAuthNavigation", () => {
           );
         });
 
-        it("records dcr when the stored kind under that id is not cimd", async () => {
+        it("records dcr when this issuer carries no marker", async () => {
+          // The AS returns the configured metadata URL from a real registration
+          // (RFC 7591 §3.2 leaves the id opaque). With no marker for this AS,
+          // the save is still DCR.
           const storage = makeStorage();
-          vi.mocked(storage.getClientInformation).mockImplementation(
-            async (_url: string, preregistered?: boolean) =>
-              preregistered ? undefined : { client_id: METADATA_URL },
-          );
-          vi.mocked(storage.getClientRegistrationKind).mockResolvedValue("dcr");
           const provider = makeProvider(storage, vi.fn(), {
             clientMetadataUrl: METADATA_URL,
           });
@@ -802,8 +800,8 @@ describe("OAuthNavigation", () => {
            * has to name the AS, so that the RFC 8414 §3.3 issuer echo the SDK
            * enforces resolves against the AS URL rather than the resource's.
            */
-          function discoveryFetch(issuer: string, cimd: boolean) {
+          function discoveryFetch(issuer: string, cimd: boolean): typeof fetch {
-            return (async (input: RequestInfo | URL) => {
+            return async (input: RequestInfo | URL) => {
               const url = String(input);
               if (url.includes("/.well-known/oauth-protected-resource")) {
                 return new Response(
@@ -827,7 +825,7 @@ describe("OAuthNavigation", () => {
                 );
               }
               throw new Error(`unexpected fetch: ${url}`);
-            }) as unknown as typeof fetch;
+            };
           }
 
           /** Issuer A pre-registers via CIMD, then the SDK binds it. */
@@ -900,6 +898,43 @@ describe("OAuthNavigation", () => {
             ).toBe("cimd");
           });
 
+          // The provenance marker's whole reason for existing: SDK v2 `auth()`
+          // answers `invalid_client` with `invalidateCredentials("client")` and
+          // an immediate retry, and that clear removes the credential *and* its
+          // registration kind. Asserted against real storage, since the point is
+          // what `clearClientInformation` does and does not touch (Copilot).
+          it("keeps the CIMD marker through invalid-client credential invalidation", async () => {
+            const storage = makeRealStorage();
+            const provider = await bindIssuerA(storage);
+            expect(await storage.getCimdClientMetadataUrl(SERVER, ISSUER)).toBe(
+              METADATA_URL,
+            );
+
+            await provider.invalidateCredentials("client");
+
+            // The credential and its kind are gone...
+            expect(
+              await storage.getClientInformation(SERVER, false, ISSUER),
+            ).toBeUndefined();
+            expect(
+              await storage.getClientRegistrationKind(SERVER, ISSUER),
+            ).toBeUndefined();
+            // ...but the marker is not a credential, so it survives.
+            expect(await storage.getCimdClientMetadataUrl(SERVER, ISSUER)).toBe(
+              METADATA_URL,
+            );
+
+            // The SDK's retry re-runs its URL-based client-ID branch.
+            await provider.saveClientInformation(
+              { client_id: METADATA_URL },
+              { issuer: ISSUER },
+            );
+
+            expect(
+              await storage.getClientRegistrationKind(SERVER, ISSUER),
+            ).toBe("cimd");
+          });
+
           it("records dcr for a second issuer that mints its own client_id", async () => {
             const storage = makeRealStorage();
             const provider = await bindIssuerA(storage);

clients/web/src/test/core/mcp/oauthManager.test.ts

@@ -70,6 +70,8 @@ function createMockParams(
     takeRevocationSnapshot: vi.fn().mockResolvedValue({ byIssuer: {} }),
     getDiscoveryState: vi.fn().mockResolvedValue(undefined),
     saveDiscoveryState: vi.fn().mockResolvedValue(undefined),
+    getCimdClientMetadataUrl: vi.fn(async () => undefined),
+    saveCimdClientMetadataUrl: vi.fn(async () => undefined),
     clearDiscoveryState: vi.fn().mockResolvedValue(undefined),
   };
 

core/auth/cimd.ts

@@ -27,50 +27,69 @@ export async function ensureCimdClientRegistration(params: {
   const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
   if (!clientMetadataUrl) return;
 
-  let resourceMetadata;
+  // Prefer the discovery state SDK `auth()` itself persists and reuses. Without
-  try {
+  // this, moving the existing-client check after discovery would turn a
-    resourceMetadata = await discoverOAuthProtectedResourceMetadata(
+  // temporary well-known outage into a failed reconnect, even where the SDK
-      params.serverUrl,
+  // could have proceeded from cache (Copilot).
-      { resourceMetadataUrl: params.resourceMetadataUrl },
+  let metadata = (await params.provider.discoveryState())
-      // The same fetch the AS-metadata leg below uses. On web that is
+    ?.authorizationServerMetadata;
-      // `createRemoteFetch`, which proxies through the backend to sidestep
+
-      // CORS — on the global `fetch` this leg would fail in the browser, be
+  if (!metadata) {
-      // swallowed by the catch, and leave CIMD probing the wrong
+    let resourceMetadata;
-      // authorization server (Copilot).
+    try {
-      params.fetchFn,
+      resourceMetadata = await discoverOAuthProtectedResourceMetadata(
-    );
+        params.serverUrl,
-  } catch {
+        { resourceMetadataUrl: params.resourceMetadataUrl },
-    resourceMetadata = undefined;
+        // The same fetch the AS-metadata leg below uses. On web that is
+        // `createRemoteFetch`, which proxies through the backend to sidestep
+        // CORS — on the global `fetch` this leg would fail in the browser, be
+        // swallowed by the catch, and leave CIMD probing the wrong
+        // authorization server (Copilot).
+        params.fetchFn,
+      );
+    } catch {
+      resourceMetadata = undefined;
+    }
+
+    try {
+      // Walks the path-scoped authorization-server URL before the bare origin, so
+      // a server hosted under a path is probed where it actually publishes its
+      // metadata rather than only at the domain root (#2110).
+      metadata = await discoverAuthorizationServerMetadataForServer(
+        params.serverUrl,
+        resourceMetadata,
+        params.fetchFn,
+      );
+    } catch {
+      // Pre-registration is an optimization over what SDK `auth()` does for
+      // itself, so a discovery failure here must never fail the connection: bail
+      // out and let `auth()` run its own discovery and error handling.
+      return;
+    }
+  }
+
+  const issuer = metadata?.issuer;
+
+  // Record — or withdraw — this AS's CIMD marker before anything else, so it
+  // stays current rather than only ever being written once. It is keyed by
+  // issuer and is not a credential, so `invalidateCredentials("client")` leaves
+  // it alone; see `IssuerBoundOAuthState.cimdClientMetadataUrl`.
+  if (issuer) {
+    await params.provider.saveCimdClientMetadataUrl(
+      issuer,
+      metadata?.client_id_metadata_document_supported
+        ? clientMetadataUrl
+        : undefined,
+    );
   }
 
-  // Walks the path-scoped authorization-server URL before the bare origin, so a
-  // server hosted under a path is probed where it actually publishes its
-  // metadata rather than only at the domain root (#2110).
-  const metadata = await discoverAuthorizationServerMetadataForServer(
-    params.serverUrl,
-    resourceMetadata,
-    params.fetchFn,
-  );
   if (!metadata?.client_id_metadata_document_supported) return;
 
-  // SEP-2352 keys a registration to the authorization server that issued it, so
+  // ⚠️ Keyed by the issuer just resolved, not read ctx-less. A ctx-less read
-  // the record this writes is bound to the issuer we just discovered rather than
+  // resolves through the *active* issuer, so it early-returns for every
-  // to the server as a whole. That binding is what makes the provenance
+  // subsequent issuer and leaves them with no CIMD record at all. It still
-  // trustworthy later: `BaseOAuthClientProvider.saveClientInformation` preserves
-  // `cimd` only for an issuer this function recorded it for, having first
-  // confirmed *that* AS advertises `client_id_metadata_document_supported`
-  // (#2242, Copilot). A second AS behind the same resource therefore gets its own
-  // determination — pre-registered here when it too supports CIMD, and left to
-  // dynamic registration when it does not.
-  //
-  // ⚠️ This is why the "do we already have a client?" check below sits *after*
-  // discovery rather than short-circuiting it, at the cost of a discovery round
-  // trip on each connect attempt rather than only the first. Read ctx-less — as
-  // it was — it resolves through the *active* issuer and so early-returns for
-  // every subsequent issuer, leaving them with no CIMD record at all. It still
   // answers the static case first, since `clientInformation` checks the
   // preregistered slot before any issuer slot.
-  const issuer = metadata.issuer;
   const existing = await params.provider.clientInformation(
     issuer ? { issuer } : undefined,
   );

core/auth/oauth-storage.ts

@@ -186,6 +186,34 @@ export class OAuthStorageBase implements OAuthStorage {
     );
   }
 
+  async getCimdClientMetadataUrl(
+    serverUrl: string,
+    issuer?: string,
+  ): Promise<string | undefined> {
+    await this.ensureLoaded();
+    const state = this.memory.getState().getServerState(serverUrl);
+    return this.issuerSlot(state, issuer)?.cimdClientMetadataUrl;
+  }
+
+  async saveCimdClientMetadataUrl(
+    serverUrl: string,
+    issuer: string,
+    clientMetadataUrl: string | undefined,
+  ): Promise<void> {
+    await this.ensureLoaded();
+    // Not a save of credentials, so it must not promote this issuer to
+    // `activeIssuer` — the marker is written during discovery, before anything
+    // has been authorized against this AS.
+    this.updateIssuerSlot(
+      serverUrl,
+      issuer,
+      { cimdClientMetadataUrl: clientMetadataUrl },
+      {},
+      false,
+    );
+    await this.persist();
+  }
+
   async saveClientInformation(
     serverUrl: string,
     clientInformation: OAuthClientInformation,

core/auth/providers.ts

@@ -321,38 +321,35 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
    * Connection Info the moment the SDK bound it to an issuer (#2242).
    *
    * The claim is deliberately narrow — three conditions must all hold, and the
-   * decisive one is a registration *we ourselves recorded* as CIMD, not an
+   * decisive one is a fact *we recorded about this authorization server*, not an
-   * inference about what the authorization server returned:
+   * inference about what it returned:
    *
    * 1. CIMD is configured for this connection right now, and
    * 2. the incoming `client_id` is exactly that metadata-document URL, and
-   * 3. the registration stored **for this issuer** under that same `client_id`
+   * 3. `ensureCimdClientRegistration` recorded that same URL as the CIMD marker
-   *    is recorded as `cimd` — written by `ensureCimdClientRegistration`, which
+   *    **for this issuer**, having read `client_id_metadata_document_supported`
-   *    reaches that line only after confirming *that* AS advertises
+   *    from *that* AS's own metadata.
-   *    `client_id_metadata_document_supported`.
    *
    * RFC 7591 §3.2 makes a dynamically issued `client_id` opaque, so a client may
    * not assume its format — which is why (2) is not load-bearing on its own. For
    * a `registerClient` result to be mislabeled here, the AS would have to mint an
-   * identifier byte-identical to the HTTPS URL we configured *and* be an AS we
+   * identifier byte-identical to the HTTPS URL we configured *and* be an AS that
-   * had already recorded a CIMD registration for — that is, one that advertises
+   * currently advertises CIMD and dynamically registered anyway. Anything else —
-   * CIMD and then dynamically registers anyway. Anything else — a fresh DCR, a
+   * a fresh DCR, a different id, CIMD switched off, an AS that does not advertise
-   * different id, CIMD switched off, no prior CIMD registration for this issuer —
+   * CIMD — falls through to `"dcr"`.
-   * falls through to `"dcr"`.
    *
-   * ⚠️ (3) is scoped to the issuer on purpose, and the lookup deliberately does
+   * ⚠️ (3) reads the **marker**, not the stored registration kind, and the two
-   * **not** fall back to the server's active issuer. SEP-2352 keys registrations
+   * differ in exactly one place that matters: `invalidateCredentials("client")`
-   * per AS, so a second AS behind the same resource is a separate determination:
+   * clears the credential and its kind, and SDK v2 `auth()` calls it on an
-   * it may well not support CIMD and register dynamically, and RFC 7591 permits
+   * `invalid_client` / `unauthorized_client` response before retrying. The
-   * it to mint the very URL the first AS uses as a CIMD `client_id` (Copilot).
+   * retry's URL-based client-ID save would then find no kind and be recorded as
-   * `ensureCimdClientRegistration` binds the record to the issuer it discovered,
+   * DCR. The marker describes the AS rather than the credential, so it survives
-   * which is what lets this stay issuer-scoped without losing a genuine
+   * that clear (#2242, Copilot).
-   * second-issuer CIMD registration.
    *
-   * The read is still issuer-*keyed* rather than issuer-*only*: `getClientInformation`
+   * ⚠️ (3) is issuer-scoped with no fallback to the server's active issuer. A
-   * falls back to the unkeyed slot when no `byIssuer` entry exists, which is how a
+   * second AS behind one resource is a separate determination: it may not support
-   * pre-registration written before an issuer was known is still found on the save
+   * CIMD and may register dynamically, and RFC 7591 permits it to mint the very
-   * that first binds one.
+   * URL the first AS uses as its CIMD `client_id`.
    */
   private async resolveSdkRegistrationKind(
     clientInformation: OAuthClientInformation,
@@ -365,19 +362,28 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
     ) {
       return "dcr";
     }
-    const stored = await this.storage.getClientInformation(
+    const marker = await this.storage.getCimdClientMetadataUrl(
-      this.serverUrl,
-      false,
-      issuer,
-    );
-    if (stored?.client_id !== clientMetadataUrl) return "dcr";
-    const storedKind = await this.storage.getClientRegistrationKind(
       this.serverUrl,
       issuer,
     );
-    // `"static"` lives in the preregistered slot, never this one, so `"cimd"`
+    return marker === clientMetadataUrl ? "cimd" : "dcr";
-    // is the only kind worth carrying forward.
+  }
-    return storedKind === "cimd" ? "cimd" : "dcr";
+
+  /** @see OAuthStorage.getCimdClientMetadataUrl */
+  async cimdClientMetadataUrl(issuer?: string): Promise<string | undefined> {
+    return await this.storage.getCimdClientMetadataUrl(this.serverUrl, issuer);
+  }
+
+  /** @see OAuthStorage.saveCimdClientMetadataUrl */
+  async saveCimdClientMetadataUrl(
+    issuer: string,
+    clientMetadataUrl: string | undefined,
+  ): Promise<void> {
+    await this.storage.saveCimdClientMetadataUrl(
+      this.serverUrl,
+      issuer,
+      clientMetadataUrl,
+    );
   }
 
   async saveScope(scope: string | undefined): Promise<void> {

core/auth/storage.ts

@@ -81,6 +81,23 @@ export interface OAuthStorage {
     issuer?: string,
   ): Promise<OAuthClientRegistrationKind | undefined>;
 
+  /**
+   * The CIMD client-metadata URL this authorization server was confirmed to
+   * accept as a `client_id`. Survives {@link clearClientInformation}, because it
+   * records a property of the AS rather than a credential (#2242).
+   */
+  getCimdClientMetadataUrl(
+    serverUrl: string,
+    issuer?: string,
+  ): Promise<string | undefined>;
+
+  /** Write (or, with `undefined`, clear) the marker above for one issuer. */
+  saveCimdClientMetadataUrl(
+    serverUrl: string,
+    issuer: string,
+    clientMetadataUrl: string | undefined,
+  ): Promise<void>;
+
   /**
    * Save client information (dynamically registered)
    */

core/auth/store.ts

@@ -30,6 +30,21 @@ export interface IssuerBoundOAuthState {
   /** Set when {@link clientInformation} is saved — DCR vs CIMD. */
   clientRegistrationKind?: OAuthClientRegistrationKind;
   tokens?: OAuthTokens;
+  /**
+   * The CIMD client-metadata URL this AS was confirmed to accept as a `client_id`
+   * — written by `ensureCimdClientRegistration` after reading
+   * `client_id_metadata_document_supported` from *this* issuer's metadata, and
+   * refreshed (or cleared) on every connect because that check now runs each time.
+   *
+   * Deliberately **not** a credential, and so deliberately **not** cleared by
+   * {@link OAuthStorage.clearClientInformation}. It records a property of the
+   * authorization server and our own configuration, which an `invalid_client`
+   * response says nothing about: SDK v2 `auth()` answers that error by calling
+   * `invalidateCredentials("client")` and retrying, and the retry's URL-based
+   * client-ID save would otherwise land with no provenance and be recorded as
+   * DCR (#2242, Copilot).
+   */
+  cimdClientMetadataUrl?: string;
 }
 
 /**