3ngram 1.2.4

3ngram v1.2.4

Patch release: a Client ID Metadata Document is no longer rejected for
advertising a grant type this server does not implement. Together with v1.2.3
this completes CIMD support — the registration mechanism MCP 2026-07-28
designates as primary, replacing deprecated Dynamic Client Registration.

Changes

• CIMD documents advertising unsupported grants are now accepted.
  grant_types was validated as an enum of the two grants this server issues,
  capped at two entries. Any document listing a third grant failed structurally,
  so the client could not authorize at all — it received a bare
  400 invalid_client.

  This locked out real MCP clients. Claude's metadata document advertises
  urn:ietf:params:oauth:grant-type:jwt-bearer alongside authorization_code
  and refresh_token, failing both the enum and the cap.

  grant_types and response_types advertise what a client MAY use
  (RFC 7591 §2). An authorization server's obligations for CIMD are to validate
  that client_id matches the document URL, to validate redirect_uris, and to
  validate that the structure is valid JSON containing the required fields
  (client_id, client_name, redirect_uris) — grant_types is not among
  them. Both fields are now parsed permissively and narrowed to what this
  server issues.

  Structurally malformed advertisements are still rejected, and the
  absent-field default is unchanged.

• grant_types may narrow to empty; response_types may not. The
  asymmetry is deliberate. /oauth/authorize already rejects a client without
  authorization_code and reports the precise unsupported_grant_type, so
  usability stays a policy decision rather than a blanket invalid_document.
  Nothing downstream consults a client's advertised response_types, so code
  must survive narrowing — otherwise a document advertising only token would
  be issued an authorization code it never advertised support for.

• No per-element length cap on either field. A cap would reject before
  narrowing, so one long vendor extension URI would still condemn a document
  this server can otherwise serve. Input is bounded where it matters: the
  resolver caps a fetched document at 5 KiB, and the array length is bounded
  here.

Upgrading

No configuration or migration changes. Clients previously rejected for
advertising an unsupported grant can now authorize.

Library versions

@3ngram/schema 0.6.1, @3ngram/core 0.8.2. @3ngram/db 0.7.0,
@3ngram/config 0.2.3 — unchanged.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:50c9f1a744b0f66b003fa3c0c748663a3e34f4efdd354393733fa4fd2e5413e4