@agent-native/core 0.154.3 → 0.154.5

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/extensions/url-safety.d.ts

@@ -5,7 +5,9 @@ export declare function isBlockedExtensionUrl(url: string): boolean;
  * "public hostname resolves to a private address" gap before dispatch.
  */
 export declare function isBlockedExtensionUrlWithDns(url: string): Promise<boolean>;
-export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonly string[]): Promise<unknown | null>;
+export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonly string[], destinationUrl?: string, options?: {
+    required?: boolean;
+}): Promise<unknown>;
 /**
  * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
  *
@@ -14,7 +16,9 @@ export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonl
  *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
  *      on the initial URL and on every redirect hop.
  *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
- *      time (closes the DNS-rebinding TOCTOU) when undici is available.
+ *      time (closes the DNS-rebinding TOCTOU) when the runtime supports the
+ *      Node dispatcher. Edge runtimes retain preflight DNS checks, literal and
+ *      rebinding-domain rejection, and per-hop redirect validation.
  *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
  *      private network because each hop is re-validated before it is followed.
  *
@@ -33,6 +37,7 @@ export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonl
  */
 export declare function ssrfSafeFetch(url: string, init?: RequestInit, options?: {
     maxRedirects?: number;
+    followRedirects?: boolean;
     httpsOnly?: boolean;
     assertUrlAllowed?: (url: string) => void | Promise<void>;
     /**

package/dist/extensions/url-safety.js

@@ -225,25 +225,37 @@ function normalizeAllowedPrivateOriginOriginKeys(origins) {
     }
     return keys;
 }
-export async function createSsrfSafeDispatcher(allowedPrivateOrigins = []) {
-    // Keep the optional undici import opaque to Vite/Rolldown. A static
-    // `import("undici")` makes browser builds try to resolve and bundle undici
-    // even though this dispatcher is only useful in Node server runtimes.
+export async function createSsrfSafeDispatcher(allowedPrivateOrigins = [], destinationUrl, options = {}) {
+    // Keep the undici import opaque to Vite/Rolldown. A literal dynamic import
+    // makes browser builds try to resolve and bundle this server-only package.
     let undici;
     let dnsModule;
     try {
-        const runtimeImport = new Function("specifier", "return import(specifier)");
-        undici = await runtimeImport("undici");
+        const undiciSpecifier = "undici";
+        undici = await import(/* @vite-ignore */ undiciSpecifier);
         dnsModule = await import("node:dns");
     }
-    catch {
+    catch (error) {
+        if (options.required) {
+            throw new Error("SSRF protection is unavailable because the server dispatcher could not be loaded.", { cause: error });
+        }
         return null;
     }
     const { Agent } = undici;
     const { lookup } = dnsModule;
     const allowedPrivateOriginKeys = normalizeAllowedPrivateOriginKeys(allowedPrivateOrigins);
-    if (!Agent || !lookup)
+    let destinationPort = "";
+    if (destinationUrl) {
+        const parsed = new URL(destinationUrl);
+        destinationPort =
+            parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+    }
+    if (!Agent || !lookup) {
+        if (options.required) {
+            throw new Error("SSRF protection is unavailable because the server dispatcher is incomplete.");
+        }
         return null;
+    }
     return new Agent({
         connect: {
             // Override DNS lookup at connect time so the IP we hand to undici's
@@ -257,7 +269,7 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = []) {
                         ? addresses
                         : [{ address: addresses, family: 4 }];
                     for (const record of list) {
-                        const allowedOrigin = allowedPrivateOriginKeys.has(`${normalizeLookupHostname(hostname)}:${String(options?.port ?? "")}`);
+                        const allowedOrigin = allowedPrivateOriginKeys.has(`${normalizeLookupHostname(hostname)}:${destinationPort}`);
                         if (isPrivateHost(record.address) && !allowedOrigin) {
                             const e = new Error(`Connect blocked: ${hostname} resolved to private address ${record.address}`);
                             e.code = "EAI_BLOCKED";
@@ -285,7 +297,9 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = []) {
  *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
  *      on the initial URL and on every redirect hop.
  *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
- *      time (closes the DNS-rebinding TOCTOU) when undici is available.
+ *      time (closes the DNS-rebinding TOCTOU) when the runtime supports the
+ *      Node dispatcher. Edge runtimes retain preflight DNS checks, literal and
+ *      rebinding-domain rejection, and per-hop redirect validation.
  *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
  *      private network because each hop is re-validated before it is followed.
  *
@@ -304,8 +318,6 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = []) {
  */
 export async function ssrfSafeFetch(url, init = {}, options = {}) {
     const maxRedirects = options.maxRedirects ?? 3;
-    const dispatcher = (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??
-        undefined;
     const allowedPrivateOrigins = normalizeAllowedPrivateOriginOriginKeys(options.allowedPrivateOrigins ?? []);
     const isAllowedPrivateOrigin = (candidate) => {
         if (allowedPrivateOrigins.size === 0)
@@ -333,10 +345,13 @@ export async function ssrfSafeFetch(url, init = {}, options = {}) {
             ...init,
             redirect: "manual",
         };
+        const dispatcher = await createSsrfSafeDispatcher(options.allowedPrivateOrigins, currentUrl);
         if (dispatcher)
             fetchOpts.dispatcher = dispatcher;
         const response = await fetch(currentUrl, fetchOpts);
         if (response.status >= 300 && response.status < 400) {
+            if (options.followRedirects === false)
+                return response;
             const location = response.headers.get("location");
             if (!location)
                 return response;

package/dist/index.browser.d.ts

@@ -2,7 +2,7 @@ export * from "./config.js";
 export { addContextToAgentChat, appendAgentChatContextToMessage, clearAgentChatContext, formatAgentChatContextItemsForPrompt, listAgentChatContext, refreshAgentChatContext, removeAgentChatContextItem, sendToAgentChat, sendToAgentChatAndConfirm, setAgentChatContextItem, setContextToAgentChat, isEmbedMcpChatBridgeActive, useAgentChatContext, useAgentChatGenerating, useDevMode, useSendToAgentChat, AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useMcpAppHostContext, CodeRequiredDialog, AgentNativeI18nProvider, LanguagePicker, getLocaleInitScript, localeDirection, normalizeLocaleCode, normalizeLocalePreference, normalizeLocalizationPreference, resolveLocaleFromCandidates, resolveLocaleFromPreference, useFormatters, useLocale, useT, DEFAULT_LOCALE, LOCALE_HYDRATION_GLOBAL, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, useDbSync, useFileWatcher, useSession, cn, ApiKeySettings, type AgentChatContextItem, type AgentChatContextMessage, type AgentChatContextMutationOptions, type AgentChatContextRemoveOptions, type AgentChatContextSetOptions, type AgentChatContextState, type AgentChatMessage, type AgentNativeMcpAppHostMessageType, type McpAppDisplayMode, type McpAppHostChatMessage, type McpAppHostCapabilities, type McpAppHostContext, type McpAppHostContextSnapshot, type McpAppModelContextContentPart, type McpAppModelContextUpdate, type CodeRequiredDialogProps, type AuthSession, type UseAgentChatContextResult, type AgentNativeI18nCatalog, type AgentNativeI18nProviderProps, type LocaleCode, type LocaleHydrationPayload, type LocaleMessages, type LocaleMetadata, type LocalePreference, type LocalizationPreference, } from "./client/index.js";
 export { agentChat } from "./shared/index.js";
 export { parseArgs, camelCaseArgs } from "./scripts/parse-args.js";
-export { defineAction, AgentActionStopError, isAgentActionStopError, type ActionHttpConfig, type AgentActionStopOptions, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, type ActionMcpAppConfig, type ActionMcpAppCsp, type ActionMcpAppCspBuilder, type ActionMcpAppHtmlBuilder, type ActionMcpAppPermissions, type ActionMcpAppResourceConfig, type ActionMcpAppResourceMeta, } from "./action.js";
+export { defineAction, ActionContractError, isActionContractError, type ActionContractErrorOptions, AgentActionStopError, isAgentActionStopError, type ActionHttpConfig, type AgentActionStopOptions, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, type ActionMcpAppConfig, type ActionMcpAppCsp, type ActionMcpAppCspBuilder, type ActionMcpAppHtmlBuilder, type ActionMcpAppPermissions, type ActionMcpAppResourceConfig, type ActionMcpAppResourceMeta, } from "./action.js";
 export { normalizeUserProfileName, USER_PROFILE_SETTING_KEY, type UserProfile, } from "./user-profile/index.js";
 export { ACTION_CHAT_UI_DATA_CHART_RENDERER, ACTION_CHAT_UI_DATA_INSIGHTS_RENDERER, ACTION_CHAT_UI_DATA_TABLE_RENDERER, ACTION_CHAT_UI_DATA_WIDGET_RENDERER, ACTION_CHAT_UI_INLINE_EXTENSION_RENDERER, ACTION_CHAT_UI_WORKSPACE_FILE_RENDERER, type ActionChatUIConfig, } from "./action-ui.js";
 export { DATA_CHART_WIDGET, DATA_INSIGHTS_WIDGET, DATA_TABLE_WIDGET, createDataChartWidgetResult, createDataInsightsWidgetResult, createDataTableWidgetResult, dataChartWidgetResultSchema, dataChartWidgetSchema, dataInsightsWidgetResultSchema, dataTableWidgetResultSchema, dataTableWidgetSchema, dataWidgetResultSchema, isDataChartWidget, isDataTableWidget, isDataWidgetResult, normalizeDataWidgetKind, normalizeDataWidgetResult, type DataChartSeriesDefinition, type DataChartWidget, type DataChartWidgetResult, type DataChartWidgetResultInput, type DataInsightsWidgetResult, type DataInsightsWidgetResultInput, type DataTableColumn, type DataTableWidget, type DataTableWidgetResult, type DataTableWidgetResultInput, type DataWidgetDisplay, type DataWidgetKind, type DataWidgetResult, type DataWidgetResultMetadata, } from "./data-widgets/index.js";

package/dist/index.browser.js

@@ -9,7 +9,7 @@ export { agentChat } from "./shared/index.js";
 // Pure utilities (no Node.js deps — safe for browser and SSR)
 export { parseArgs, camelCaseArgs } from "./scripts/parse-args.js";
 // defineAction — used by template actions, no Node.js deps
-export { defineAction, AgentActionStopError, isAgentActionStopError, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, } from "./action.js";
+export { defineAction, ActionContractError, isActionContractError, AgentActionStopError, isAgentActionStopError, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, } from "./action.js";
 export { normalizeUserProfileName, USER_PROFILE_SETTING_KEY, } from "./user-profile/index.js";
 export { ACTION_CHAT_UI_DATA_CHART_RENDERER, ACTION_CHAT_UI_DATA_INSIGHTS_RENDERER, ACTION_CHAT_UI_DATA_TABLE_RENDERER, ACTION_CHAT_UI_DATA_WIDGET_RENDERER, ACTION_CHAT_UI_INLINE_EXTENSION_RENDERER, ACTION_CHAT_UI_WORKSPACE_FILE_RENDERER, } from "./action-ui.js";
 export { DATA_CHART_WIDGET, DATA_INSIGHTS_WIDGET, DATA_TABLE_WIDGET, createDataChartWidgetResult, createDataInsightsWidgetResult, createDataTableWidgetResult, dataChartWidgetResultSchema, dataChartWidgetSchema, dataInsightsWidgetResultSchema, dataTableWidgetResultSchema, dataTableWidgetSchema, dataWidgetResultSchema, isDataChartWidget, isDataTableWidget, isDataWidgetResult, normalizeDataWidgetKind, normalizeDataWidgetResult, } from "./data-widgets/index.js";

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export * from "./config.js";
 export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, DEFAULT_MODEL, TripWire, type Processor, type ProcessorState, type ProcessorAbort, } from "./agent/index.js";
-export { defineAction, AgentActionStopError, isAgentActionStopError, type ActionDefinition, type ActionHttpConfig, type AgentActionStopOptions, type PublicAgentActionConfig, type ActionDeepLink, type ActionLinkBuilder, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, type ActionMcpAppConfig, type ActionMcpAppCsp, type ActionMcpAppCspBuilder, type ActionMcpAppHtmlBuilder, type ActionMcpAppPermissions, type ActionMcpAppResourceConfig, type ActionMcpAppResourceMeta, } from "./action.js";
+export { defineAction, ActionContractError, isActionContractError, type ActionContractErrorOptions, AgentActionStopError, isAgentActionStopError, type ActionDefinition, type ActionHttpConfig, type AgentActionStopOptions, type PublicAgentActionConfig, type ActionDeepLink, type ActionLinkBuilder, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, type ActionMcpAppConfig, type ActionMcpAppCsp, type ActionMcpAppCspBuilder, type ActionMcpAppHtmlBuilder, type ActionMcpAppPermissions, type ActionMcpAppResourceConfig, type ActionMcpAppResourceMeta, } from "./action.js";
 export * from "./user-profile/index.js";
 export { embedApp, MCP_APP_REQUEST_ORIGIN_CSP_SOURCE, type EmbedAppOptions, } from "./mcp/embed-app.js";
 export { embedRoute, type EmbedRouteContext, type EmbedRouteOptions, type EmbedRoutePathBuilder, type EmbedRouteResult, } from "./mcp/embed-route.js";

package/dist/index.js

@@ -5,7 +5,7 @@ export * from "./config.js";
 export { createProductionAgentHandler, DEFAULT_MODEL, 
 // In-loop processors (observers/guardrails for runAgentLoop)
 TripWire, } from "./agent/index.js";
-export { defineAction, AgentActionStopError, isAgentActionStopError, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, } from "./action.js";
+export { defineAction, ActionContractError, isActionContractError, AgentActionStopError, isAgentActionStopError, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, } from "./action.js";
 export * from "./user-profile/index.js";
 export { embedApp, MCP_APP_REQUEST_ORIGIN_CSP_SOURCE, } from "./mcp/embed-app.js";
 export { embedRoute, } from "./mcp/embed-route.js";

package/dist/mcp-client/oauth-client.d.ts

@@ -7,8 +7,9 @@
  * and refresh boundary.
  */
 import { type AuthorizationServerMetadata, type OAuthClientInformationContext, type OAuthClientMetadata, type OAuthClientProvider, type OAuthDiscoveryState, OAuthProtectedResourceMetadata, type StoredOAuthClientInformation, type StoredOAuthTokens, OAuthTokens } from "@modelcontextprotocol/client";
+import { type OAuthCredential, type OAuthCredentialState, type OAuthRevocationResult } from "../oauth-tokens/lifecycle.js";
 export type McpOAuthDiscoveryState = OAuthDiscoveryState;
-export interface McpOAuthCredentialBundle {
+export interface McpOAuthCredentialBundle extends OAuthCredential {
     serverUrl: string;
     clientInformation: StoredOAuthClientInformation;
     discoveryState?: McpOAuthDiscoveryState;
@@ -89,12 +90,26 @@ export declare function readMcpOAuthCredentials(options: {
     key: string;
     scope: "user" | "org";
     scopeId: string;
+    serverUrl?: string;
 }): Promise<McpOAuthCredentialBundle | null>;
+export declare function getMcpOAuthConnectionState(options: {
+    key: string;
+    scope: "user" | "org";
+    scopeId: string;
+    serverUrl: string;
+}): Promise<OAuthCredentialState<McpOAuthCredentialBundle>>;
 export declare function deleteMcpOAuthCredentials(options: {
     key: string;
     scope: "user" | "org";
     scopeId: string;
+    serverUrl?: string;
 }): Promise<boolean>;
+export declare function revokeMcpOAuthCredentials(options: {
+    key: string;
+    scope: "user" | "org";
+    scopeId: string;
+    serverUrl: string;
+}): Promise<OAuthRevocationResult>;
 /**
  * Resolve an access token for the MCP manager. Refreshing happens only when a
  * token is near expiry, so ordinary manager reconfiguration does not perform

package/dist/mcp-client/oauth-client.js

@@ -7,10 +7,12 @@
  * and refresh boundary.
  */
 import { auth, refreshAuthorization, validateAuthorizationResponseIssuer, } from "@modelcontextprotocol/client";
-import { deleteOAuthTokens, getOAuthTokens, saveOAuthTokens, } from "../oauth-tokens/store.js";
+import { ssrfSafeFetch } from "../extensions/url-safety.js";
+import { readOAuthCredentialState, resolveOAuthCredentialAccess, revokeOAuthCredential, saveOAuthCredential, } from "../oauth-tokens/lifecycle.js";
 import { validateRemoteUrl } from "./remote-url.js";
 const TOKEN_EXPIRY_SKEW_MS = 60_000;
 const MAX_OAUTH_REDIRECTS = 5;
+const MCP_OAUTH_PRIVATE_ORIGINS_ENV = "AGENT_NATIVE_MCP_OAUTH_PRIVATE_ORIGINS";
 function checkedRemoteUrl(value, label) {
     const result = validateRemoteUrl(String(value));
     if (!result.ok || !result.url) {
@@ -18,12 +20,35 @@ function checkedRemoteUrl(value, label) {
     }
     return result.url;
 }
+function canonicalServerUrl(value) {
+    return checkedRemoteUrl(value, "server").toString();
+}
+function serverUrlsMatch(stored, canonical) {
+    try {
+        return canonicalServerUrl(stored) === canonical;
+    }
+    catch {
+        // coercion-ok: an invalid stored URL is an explicit identity mismatch.
+        return false;
+    }
+}
+function configuredPrivateOrigins() {
+    return (process.env[MCP_OAUTH_PRIVATE_ORIGINS_ENV] ?? "")
+        .split(",")
+        .map((origin) => origin.trim())
+        .filter(Boolean);
+}
 function guardedOAuthFetch() {
+    const allowedPrivateOrigins = configuredPrivateOrigins();
     return async (url, init) => {
         let currentUrl = checkedRemoteUrl(url, "request");
         let currentInit = { ...init, redirect: "manual" };
         for (let redirectCount = 0;; redirectCount += 1) {
-            const response = await fetch(currentUrl, currentInit);
+            const response = await ssrfSafeFetch(currentUrl.href, currentInit, {
+                maxRedirects: 0,
+                followRedirects: false,
+                allowedPrivateOrigins,
+            });
             if (![301, 302, 303, 307, 308].includes(response.status)) {
                 return response;
             }
@@ -42,10 +67,15 @@ function guardedOAuthFetch() {
             }
             await response.body?.cancel().catch(() => undefined);
             const nextHeaders = new Headers(currentInit.headers);
-            if (nextUrl.origin !== currentUrl.origin) {
+            const changesOrigin = nextUrl.origin !== currentUrl.origin;
+            if (changesOrigin) {
                 nextHeaders.delete("authorization");
                 nextHeaders.delete("cookie");
                 nextHeaders.delete("proxy-authorization");
+                if ((response.status === 307 || response.status === 308) &&
+                    currentInit.body != null) {
+                    throw new Error("MCP OAuth redirect cannot forward a request body across origins.");
+                }
             }
             const nextInit = {
                 ...currentInit,
@@ -64,6 +94,19 @@ function guardedOAuthFetch() {
         }
     };
 }
+async function guardedRevocationFetch(url, init) {
+    const endpoint = checkedRemoteUrl(url, "revocation endpoint");
+    return ssrfSafeFetch(endpoint.href, init, {
+        maxRedirects: 0,
+        allowedPrivateOrigins: configuredPrivateOrigins(),
+        assertUrlAllowed: (candidate) => {
+            const checked = checkedRemoteUrl(candidate, "revocation redirect");
+            if (checked.origin !== endpoint.origin) {
+                throw new Error("MCP OAuth revocation redirect changed origin.");
+            }
+        },
+    });
+}
 function validateDiscoveryUrls(state) {
     checkedRemoteUrl(state.authorizationServerUrl, "authorization server");
     if (state.resourceMetadataUrl) {
@@ -85,13 +128,18 @@ function validateDiscoveryUrls(state) {
         }
     }
 }
-function credentialOwner(options) {
-    return `${options.scope}:${options.scopeId}`;
-}
 function issuerForDiscovery(discovery) {
     const issuer = discovery?.authorizationServerMetadata?.issuer;
     return typeof issuer === "string" && issuer ? issuer : undefined;
 }
+function credentialIdentity(options) {
+    return {
+        provider: "mcp",
+        accountId: options.key,
+        resource: options.serverUrl,
+        owner: { scope: options.scope, id: options.scopeId },
+    };
+}
 function withIssuer(value, context) {
     if (value.issuer && context?.issuer && value.issuer !== context.issuer) {
         throw new Error("MCP OAuth credential issuer does not match discovery");
@@ -270,24 +318,28 @@ export function tokenExpiresAt(tokens) {
     return Date.now() + expiresIn * 1_000;
 }
 export async function saveMcpOAuthCredentials(options) {
-    checkedRemoteUrl(options.credentials.serverUrl, "server");
-    if (options.credentials.discoveryState) {
-        validateDiscoveryUrls(options.credentials.discoveryState);
-    }
-    await saveOAuthTokens("mcp", options.key, options.credentials, `${options.scope}:${options.scopeId}`);
+    const serverUrl = checkedRemoteUrl(options.credentials.serverUrl, "server").toString();
+    const credentials = { ...options.credentials, serverUrl };
+    if (credentials.discoveryState) {
+        validateDiscoveryUrls(credentials.discoveryState);
+    }
+    await saveOAuthCredential(credentialIdentity({
+        ...options,
+        serverUrl,
+    }), credentials, { legacyAccountKey: true });
 }
 export async function readMcpOAuthCredentials(options) {
-    const stored = await getOAuthTokens("mcp", options.key, credentialOwner(options));
-    if (!stored)
+    if (!options.serverUrl)
         return null;
-    const parsed = stored;
-    if (typeof parsed.serverUrl !== "string" ||
-        !parsed.clientInformation ||
-        !parsed.tokens ||
-        typeof parsed.tokens.access_token !== "string") {
+    const serverUrl = canonicalServerUrl(options.serverUrl);
+    const state = await getMcpOAuthConnectionState({
+        ...options,
+        serverUrl,
+    });
+    if (state.kind === "missing" || state.kind === "malformed")
         return null;
-    }
-    if (!validateRemoteUrl(parsed.serverUrl).ok)
+    const parsed = state.credential;
+    if (!serverUrlsMatch(parsed.serverUrl, serverUrl))
         return null;
     if (parsed.discoveryState) {
         try {
@@ -297,10 +349,63 @@ export async function readMcpOAuthCredentials(options) {
             return null;
         }
     }
-    return parsed;
+    return { ...parsed, serverUrl };
+}
+export async function getMcpOAuthConnectionState(options) {
+    const serverUrl = canonicalServerUrl(options.serverUrl);
+    return readOAuthCredentialState(credentialIdentity({ ...options, serverUrl }), {
+        allowLegacy: true,
+        legacyAccountKey: true,
+        validateCredential: (credential) => serverUrlsMatch(credential.serverUrl, serverUrl),
+    });
 }
 export async function deleteMcpOAuthCredentials(options) {
-    return ((await deleteOAuthTokens("mcp", options.key, credentialOwner(options))) > 0);
+    if (!options.serverUrl)
+        return false;
+    const serverUrl = canonicalServerUrl(options.serverUrl);
+    const identity = credentialIdentity({
+        ...options,
+        serverUrl,
+    });
+    const result = await revokeOAuthCredential(identity, {
+        allowLegacy: true,
+        legacyAccountKey: true,
+        validateCredential: (credential) => serverUrlsMatch(credential.serverUrl, serverUrl),
+    });
+    return result.local === "deleted";
+}
+export async function revokeMcpOAuthCredentials(options) {
+    const serverUrl = canonicalServerUrl(options.serverUrl);
+    const identity = credentialIdentity({ ...options, serverUrl });
+    return revokeOAuthCredential(identity, {
+        allowLegacy: true,
+        legacyAccountKey: true,
+        validateCredential: (credential) => serverUrlsMatch(credential.serverUrl, serverUrl),
+        revoke: async ({ credential }) => {
+            const endpoint = credential.discoveryState?.authorizationServerMetadata?.revocation_endpoint;
+            if (!endpoint)
+                return "unsupported";
+            const token = credential.tokens.refresh_token ?? credential.tokens.access_token;
+            const body = new URLSearchParams({
+                token,
+                token_type_hint: credential.tokens.refresh_token
+                    ? "refresh_token"
+                    : "access_token",
+                client_id: credential.clientInformation.client_id,
+            });
+            const response = await guardedRevocationFetch(endpoint, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body,
+            });
+            if (!response.ok) {
+                await response.body?.cancel().catch(() => undefined);
+                throw new Error("MCP OAuth revocation failed.");
+            }
+            await response.body?.cancel().catch(() => undefined);
+            return "succeeded";
+        },
+    });
 }
 /**
  * Resolve an access token for the MCP manager. Refreshing happens only when a
@@ -308,66 +413,55 @@ export async function deleteMcpOAuthCredentials(options) {
  * a network request for every connector.
  */
 export async function getMcpOAuthAccessToken(options) {
-    if (!validateRemoteUrl(options.serverUrl).ok)
-        return null;
-    const credentials = await readMcpOAuthCredentials(options);
-    if (!credentials || credentials.serverUrl !== options.serverUrl)
+    const validation = validateRemoteUrl(options.serverUrl);
+    if (!validation.ok || !validation.url)
         return null;
-    const accessToken = credentials.tokens.access_token;
-    const now = Date.now();
-    if (typeof credentials.tokenExpiresAt !== "number" ||
-        credentials.tokenExpiresAt - now > TOKEN_EXPIRY_SKEW_MS) {
-        return accessToken;
-    }
-    const tokenIsExpired = credentials.tokenExpiresAt <= now;
-    const refreshToken = credentials.tokens.refresh_token;
-    const discovery = credentials.discoveryState;
-    if (!refreshToken || !discovery?.authorizationServerUrl) {
-        return tokenIsExpired ? null : accessToken;
-    }
-    try {
-        const expectedIssuer = issuerForDiscovery(discovery);
-        if (!expectedIssuer ||
-            credentials.clientInformation.issuer !== expectedIssuer ||
-            credentials.tokens.issuer !== expectedIssuer) {
-            return null;
-        }
-        const resource = discovery.resourceMetadata?.resource
-            ? checkedRemoteUrl(discovery.resourceMetadata.resource, "resource")
-            : undefined;
-        const authorizationServerUrl = checkedRemoteUrl(discovery.authorizationServerUrl, "authorization server");
-        const refreshed = await refreshAuthorization(authorizationServerUrl, {
-            metadata: discovery.authorizationServerMetadata,
-            clientInformation: credentials.clientInformation,
-            refreshToken,
-            resource,
-            fetchFn: guardedOAuthFetch(),
-        });
-        const nextTokens = {
-            ...credentials.tokens,
-            ...refreshed,
-            issuer: expectedIssuer,
-            ...(refreshed.refresh_token
-                ? { refresh_token: refreshed.refresh_token }
-                : credentials.tokens.refresh_token
-                    ? { refresh_token: credentials.tokens.refresh_token }
-                    : {}),
-        };
-        const next = {
-            ...credentials,
-            tokens: nextTokens,
-            tokenExpiresAt: tokenExpiresAt(nextTokens),
-        };
-        await saveMcpOAuthCredentials({
-            ...options,
-            credentials: next,
-        });
-        return nextTokens.access_token;
-    }
-    catch {
-        // A still-valid token can survive a transient refresh failure. Once it has
-        // expired, omit it so callers surface reauthorization instead of retrying
-        // a credential that can never authenticate.
-        return tokenIsExpired ? null : accessToken;
-    }
+    const serverUrl = validation.url.toString();
+    const result = await resolveOAuthCredentialAccess(credentialIdentity({ ...options, serverUrl }), {
+        allowLegacy: true,
+        legacyAccountKey: true,
+        validateCredential: (credential) => serverUrlsMatch(credential.serverUrl, serverUrl),
+        expirySkewMs: TOKEN_EXPIRY_SKEW_MS,
+        refresh: async ({ credential: credentials }) => {
+            const refreshToken = credentials.tokens.refresh_token;
+            const discovery = credentials.discoveryState;
+            if (!refreshToken || !discovery?.authorizationServerUrl) {
+                throw new Error("MCP OAuth refresh is unavailable.");
+            }
+            const expectedIssuer = issuerForDiscovery(discovery);
+            if (!expectedIssuer ||
+                credentials.clientInformation.issuer !== expectedIssuer ||
+                credentials.tokens.issuer !== expectedIssuer) {
+                throw new Error("MCP OAuth refresh issuer binding is invalid.");
+            }
+            const resource = discovery.resourceMetadata?.resource
+                ? checkedRemoteUrl(discovery.resourceMetadata.resource, "resource")
+                : undefined;
+            const authorizationServerUrl = checkedRemoteUrl(discovery.authorizationServerUrl, "authorization server");
+            const refreshed = await refreshAuthorization(authorizationServerUrl, {
+                metadata: discovery.authorizationServerMetadata,
+                clientInformation: credentials.clientInformation,
+                refreshToken,
+                resource,
+                fetchFn: guardedOAuthFetch(),
+            });
+            const nextTokens = {
+                ...credentials.tokens,
+                ...refreshed,
+                issuer: expectedIssuer,
+                ...(refreshed.refresh_token
+                    ? { refresh_token: refreshed.refresh_token }
+                    : credentials.tokens.refresh_token
+                        ? { refresh_token: credentials.tokens.refresh_token }
+                        : {}),
+            };
+            const next = {
+                ...credentials,
+                tokens: nextTokens,
+                tokenExpiresAt: tokenExpiresAt(nextTokens),
+            };
+            return next;
+        },
+    });
+    return result.accessToken;
 }