@letta-ai/letta-code 0.33.6 → 0.33.7

package/letta.js

@@ -4358,7 +4358,7 @@ function isDuplicateKeychainItemError(error) {
   return message.includes("already exists in the keychain") || message.includes("code: -25299");
 }
 async function getSecretValue(name, label) {
-  if (!secretsAvailable && !secretGetOverrideForTests) {
+  if (!secrets && !secretGetOverrideForTests) {
     return null;
   }
   try {
@@ -4381,7 +4381,7 @@ async function getSecretValue(name, label) {
   }
 }
 async function setSecretValue(name, value) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     throw new Error("Secrets API unavailable");
   }
   try {
@@ -4409,7 +4409,7 @@ async function setSecretValue(name, value) {
   });
 }
 async function deleteSecretValue(name) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     return false;
   }
   try {
@@ -4423,7 +4423,7 @@ async function deleteSecretValue(name) {
   }
 }
 async function setApiKey(apiKey) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     throw new Error("Secrets API unavailable");
   }
   await setSecretValue(API_KEY_NAME, apiKey);
@@ -4432,7 +4432,7 @@ async function getApiKey() {
   return getSecretValue(API_KEY_NAME, "API key");
 }
 async function setRefreshToken(refreshToken2) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     throw new Error("Secrets API unavailable");
   }
   await setSecretValue(REFRESH_TOKEN_NAME, refreshToken2);
@@ -4463,7 +4463,7 @@ async function setSecureTokens(tokens) {
   }
 }
 async function deleteApiKey() {
-  if (secretsAvailable) {
+  if (secrets) {
     try {
       await secrets.delete({
         service: SERVICE_NAME,
@@ -4476,7 +4476,7 @@ async function deleteApiKey() {
   }
 }
 async function deleteRefreshToken() {
-  if (secretsAvailable) {
+  if (secrets) {
     try {
       await secrets.delete({
         service: SERVICE_NAME,
@@ -4498,7 +4498,7 @@ async function isKeychainAvailable() {
   if (process.platform === "linux" && !process.env.DBUS_SESSION_BUS_ADDRESS?.trim()) {
     return false;
   }
-  if (!secretsAvailable) {
+  if (!secrets) {
     return false;
   }
   try {
@@ -4511,15 +4511,10 @@ async function isKeychainAvailable() {
     return false;
   }
 }
-var secrets, secretsAvailable = false, SERVICE_NAME, API_KEY_NAME = "letta-api-key", REFRESH_TOKEN_NAME = "letta-refresh-token", warnedSecretReadFailures, secretGetOverrideForTests = null;
+var secrets, SERVICE_NAME, API_KEY_NAME = "letta-api-key", REFRESH_TOKEN_NAME = "letta-refresh-token", warnedSecretReadFailures, secretGetOverrideForTests = null;
 var init_secrets = __esm(() => {
   init_debug();
-  try {
-    secrets = globalThis.Bun.secrets;
-    secretsAvailable = true;
-  } catch {
-    secretsAvailable = false;
-  }
+  secrets = globalThis.Bun?.secrets;
   SERVICE_NAME = scopeServiceName("letta-code");
   warnedSecretReadFailures = new Set;
 });
@@ -4771,8 +4766,8 @@ class SettingsManager {
     const baseSettings = this.getSettings();
     const secureTokens = { ...this.secureTokensCache };
     if (!getRuntimeContext()) {
-      const secretsAvailable2 = await this.isKeychainAvailable();
-      if (secretsAvailable2) {
+      const secretsAvailable = await this.isKeychainAvailable();
+      if (secretsAvailable) {
         const storedTokens = await this.getSecureTokens();
         secureTokens.apiKey = storedTokens.apiKey ?? secureTokens.apiKey;
         secureTokens.refreshToken = storedTokens.refreshToken ?? secureTokens.refreshToken;
@@ -4861,8 +4856,8 @@ class SettingsManager {
     this.pendingWrites.add(writePromise);
   }
   async persistSettingsAndTokens(secureTokens) {
-    const secretsAvailable2 = await this.isKeychainAvailable();
-    if (secretsAvailable2 && Object.keys(secureTokens).length > 0) {
+    const secretsAvailable = await this.isKeychainAvailable();
+    if (secretsAvailable && Object.keys(secureTokens).length > 0) {
       try {
         await Promise.all([
           this.persistSettings(),
@@ -5653,7 +5648,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.33.6",
+    version: "0.33.7",
     lettaStartupLogProtocol: 1,
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
@@ -5680,6 +5675,8 @@ var init_package = __esm(() => {
       "dist/memory-constraints.js.map",
       "dist/mcp-client.js",
       "dist/mcp-client.js.map",
+      "dist/mcp-oauth.js",
+      "dist/mcp-oauth.js.map",
       "dist/agent-presets.js",
       "dist/agent-presets.js.map",
       "dist/schedules.js",
@@ -5724,6 +5721,11 @@ var init_package = __esm(() => {
         import: "./dist/mcp-client.js",
         default: "./dist/mcp-client.js"
       },
+      "./mcp-oauth": {
+        types: "./dist/types/mcp-oauth-public.d.ts",
+        import: "./dist/mcp-oauth.js",
+        default: "./dist/mcp-oauth.js"
+      },
       "./protocol": {
         types: "./dist/types/types/protocol.d.ts"
       },
@@ -5881,6 +5883,9 @@ var init_package = __esm(() => {
         "mcp-client": [
           "./dist/types/mcp-client.d.ts"
         ],
+        "mcp-oauth": [
+          "./dist/types/mcp-oauth-public.d.ts"
+        ],
         channels: [
           "./dist/types/channels-public.d.ts"
         ],
@@ -106236,10 +106241,19 @@ class HeadlessBackend {
     if (!run || run.agent_id !== agentId || isTerminalRun(run)) {
       return { [runId]: "failed" };
     }
+    return this.cancelRunById(runId);
+  }
+  async cancelRunById(runId) {
+    const run = this.runs.get(runId);
+    if (!run || isTerminalRun(run)) {
+      return { [runId]: "failed" };
+    }
     if (run.conversation_id) {
-      this.store.settleInterruptedToolCalls(run.conversation_id, { agentId });
+      this.store.settleInterruptedToolCalls(run.conversation_id, {
+        agentId: run.agent_id
+      });
     } else {
-      this.store.settleInterruptedToolCalls(agentId);
+      this.store.settleInterruptedToolCalls(run.agent_id);
     }
     const controller = this.runControllerByRunId.get(runId);
     this.recordRunChunk(runId, {
@@ -106250,6 +106264,17 @@ class HeadlessBackend {
     controller?.abort();
     return { [runId]: "cancelled" };
   }
+  async cancelConversationRun(...args) {
+    const [conversationId, requestedRunId] = args;
+    const runId = requestedRunId ?? this.activeRunByConversation.get(conversationId);
+    if (!runId)
+      return {};
+    const run = this.runs.get(runId);
+    if (!run || run.conversation_id !== conversationId || isTerminalRun(run)) {
+      return { [runId]: "failed" };
+    }
+    return this.cancelRunById(runId);
+  }
   async retrieveRun(runId) {
     const run = this.runs.get(runId);
     if (!run)
@@ -110931,6 +110956,9 @@ class APIBackend {
     const client = await this.getClient();
     return client.agents.messages.cancel(agentId, { run_ids: [runId] });
   }
+  async cancelConversationRun(_conversationId, _runId) {
+    throw new Error("API backend does not support exact cancellation for conversations with agent_id:null");
+  }
   async retrieveRun(runId, options) {
     const client = await this.getClient();
     return client.runs.retrieve(runId, options);
@@ -213117,7 +213145,7 @@ class CodexAppServerClient {
     await this.request("initialize", {
       clientInfo: {
         name: "letta-code",
-        version: "0.33.6"
+        version: "0.33.7"
       },
       capabilities: null
     });
@@ -418452,6 +418480,15 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
         throw new Error(`Backend did not cancel run ${runId}`);
       }
     },
+    cancelConversationRun: async (conversationId, runId) => {
+      const result3 = await getBackend().cancelConversationRun(conversationId, runId);
+      if (runId && result3[runId] !== "cancelled") {
+        throw new Error(`Backend did not cancel run ${runId}`);
+      }
+      if (!runId && !Object.values(result3).includes("cancelled")) {
+        throw new Error(`Backend did not cancel the active run for ${conversationId}`);
+      }
+    },
     ...deps
   };
   if (listener !== resolvedDeps.getActiveRuntime() || listener.intentionallyClosed) {
@@ -418471,7 +418508,7 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
     return false;
   }
   const cancellation = scopedRuntime.turnLifecycle.requestCancellation({
-    waitForExternalSettlement: hasActiveTurn && Boolean(scopedRuntime.agentId)
+    waitForExternalSettlement: hasActiveTurn
   });
   scopedRuntime.queueRuntime.pause();
   const interruptedRunId = cancellation.runId;
@@ -418535,19 +418572,17 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
   }
   const cancelConversationId = scopedRuntime.conversationId;
   const cancelAgentId = scopedRuntime.agentId;
-  if (cancelAgentId) {
-    const cancelRunId = interruptedRunId ?? params.command.run_id ?? null;
-    const backendCancellation = cancelRunId ? resolvedDeps.cancelRun(cancelAgentId, cancelRunId).catch(() => resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId)) : resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId);
-    backendCancellation.catch(() => {}).finally(() => {
-      if (!cancellation.lease) {
-        return;
-      }
-      const settlement = scopedRuntime.turnLifecycle.settleCancellation(cancellation.lease);
-      if (settlement.released) {
-        resolvedDeps.scheduleQueuePump(scopedRuntime, params.socket, params.opts, params.processQueuedTurn);
-      }
-    });
-  }
+  const cancelRunId = interruptedRunId ?? params.command.run_id ?? null;
+  const backendCancellation = cancelAgentId && cancelRunId ? resolvedDeps.cancelRun(cancelAgentId, cancelRunId).catch(() => resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId)) : cancelAgentId ? resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId) : resolvedDeps.cancelConversationRun(cancelConversationId, cancelRunId);
+  backendCancellation.catch(() => {}).finally(() => {
+    if (!cancellation.lease) {
+      return;
+    }
+    const settlement = scopedRuntime.turnLifecycle.settleCancellation(cancellation.lease);
+    if (settlement.released) {
+      resolvedDeps.scheduleQueuePump(scopedRuntime, params.socket, params.opts, params.processQueuedTurn);
+    }
+  });
   resolvedDeps.scheduleQueuePump(scopedRuntime, params.socket, params.opts, params.processQueuedTurn);
   return true;
 }
@@ -445147,23 +445182,24 @@ var init_streamableHttp = __esm(() => {
 async function connectMcpServer(config2, options = {}) {
   let client = new Client(options.clientInfo ?? DEFAULT_CLIENT_INFO);
   try {
+    options.signal?.throwIfAborted();
     const transport = createTransport2(config2, options);
     try {
-      await client.connect(transport);
+      await client.connect(transport, options.signal ? { signal: options.signal } : undefined);
     } catch (error5) {
       if (!(error5 instanceof UnauthorizedError) || !options.oauth?.waitForAuthorizationCode || !supportsOAuthCompletion(transport)) {
         throw error5;
       }
-      const authorizationCode = await options.oauth.waitForAuthorizationCode();
-      await transport.finishAuth(authorizationCode);
+      const authorizationCode = await withAbort(options.oauth.waitForAuthorizationCode(), options.signal, () => options.oauth?.close());
+      await withAbort(transport.finishAuth(authorizationCode), options.signal, () => transport.close());
       await client.close().catch(() => transport.close().catch(() => {
         return;
       }));
       client = new Client(options.clientInfo ?? DEFAULT_CLIENT_INFO);
-      await client.connect(createTransport2(config2, options));
+      await client.connect(createTransport2(config2, options), options.signal ? { signal: options.signal } : undefined);
     }
-    await options.oauth?.close();
-    const response = await client.listTools();
+    await (options.oauth?.closeCallback?.() ?? options.oauth?.close() ?? Promise.resolve());
+    const response = await client.listTools(undefined, options.signal ? { signal: options.signal } : undefined);
     const tools = response.tools.map((tool) => ({
       ...tool,
       inputSchema: normalizeInputSchema(tool.inputSchema),
@@ -445186,7 +445222,13 @@ async function connectMcpServer(config2, options = {}) {
         if (closed)
           return;
         closed = true;
-        await client.close();
+        const results = await Promise.allSettled([
+          client.close(),
+          options.oauth?.close()
+        ]);
+        const failure2 = results.find((result3) => result3.status === "rejected");
+        if (failure2)
+          throw failure2.reason;
       }
     };
   } catch (error5) {
@@ -445197,12 +445239,34 @@ async function connectMcpServer(config2, options = {}) {
     throw error5;
   }
 }
+async function withAbort(operation, signal, onAbort) {
+  if (!signal)
+    return operation;
+  signal.throwIfAborted();
+  let abort;
+  const cancellation = new Promise((_resolve, reject2) => {
+    abort = () => {
+      Promise.resolve(onAbort?.()).catch(() => {
+        return;
+      });
+      reject2(signal.reason ?? new DOMException("Operation aborted", "AbortError"));
+    };
+    signal.addEventListener("abort", abort, { once: true });
+  });
+  try {
+    return await Promise.race([operation, cancellation]);
+  } finally {
+    if (abort)
+      signal.removeEventListener("abort", abort);
+  }
+}
 function createTransport2(config2, options) {
   if (config2.transport === "http") {
     const headers = resolveHeaderEnvironment(config2.headers);
     return new StreamableHTTPClientTransport(new URL(config2.url), {
       requestInit: headersRequestInit(headers),
-      authProvider: options.oauth?.authProvider
+      authProvider: options.oauth?.authProvider,
+      fetch: abortAwareFetch(options.signal)
     });
   }
   if (config2.transport === "sse") {
@@ -445211,7 +445275,7 @@ function createTransport2(config2, options) {
     return new SSEClientTransport(new URL(config2.url), {
       requestInit,
       authProvider: options.oauth?.authProvider,
-      fetch: headers ? (url2, init) => fetch(url2, mergeHeaders4(init, headers)) : undefined
+      fetch: abortAwareFetch(options.signal, headers)
     });
   }
   return new StdioClientTransport({
@@ -445222,6 +445286,18 @@ function createTransport2(config2, options) {
     stderr: options.stderr ?? "inherit"
   });
 }
+function abortAwareFetch(operationSignal2, headers) {
+  if (!operationSignal2 && !headers)
+    return;
+  return (url2, init) => {
+    const requestInit = headers ? mergeHeaders4(init, headers) : { ...init };
+    const requestSignal3 = requestInit.signal ?? undefined;
+    return fetch(url2, {
+      ...requestInit,
+      signal: operationSignal2 && requestSignal3 ? AbortSignal.any([operationSignal2, requestSignal3]) : operationSignal2 ?? requestSignal3
+    });
+  };
+}
 function supportsOAuthCompletion(transport) {
   return "finishAuth" in transport && typeof transport.finishAuth === "function";
 }
@@ -445268,60 +445344,281 @@ var init_mcp_client = __esm(() => {
   init_streamableHttp();
   DEFAULT_CLIENT_INFO = {
     name: "letta-code",
-    version: "0.33.6"
+    version: "0.33.7"
   };
 });
 
+// src/mcp-oauth-callback.ts
+import { createServer as createServer3 } from "node:http";
+async function startOAuthCallbackServer2(preferredPort) {
+  try {
+    return await startOAuthCallbackServerOnPort(preferredPort ?? 0);
+  } catch (error5) {
+    if (!preferredPort)
+      throw error5;
+    return startOAuthCallbackServerOnPort(0);
+  }
+}
+function callbackPort(redirectUrl) {
+  if (!redirectUrl)
+    return;
+  try {
+    const parsed = new URL(redirectUrl);
+    return parsed.hostname === "127.0.0.1" && parsed.port ? Number(parsed.port) : undefined;
+  } catch {
+    return;
+  }
+}
+async function startOAuthCallbackServerOnPort(port) {
+  const expectedState = {};
+  let server2;
+  let completed = false;
+  let settle3;
+  let reject2;
+  const codePromise = new Promise((resolve39, rejectPromise) => {
+    settle3 = (code2) => {
+      completed = true;
+      resolve39(code2);
+    };
+    reject2 = (error5) => {
+      completed = true;
+      rejectPromise(error5);
+    };
+  });
+  codePromise.catch(() => {
+    return;
+  });
+  server2 = createServer3((request, response) => {
+    if (request.method !== "GET" || !request.url?.startsWith("/") || request.url.startsWith("//") || request.url.includes("\\")) {
+      response.writeHead(400, { "Content-Type": "text/plain" });
+      response.end("Invalid request target");
+      return;
+    }
+    const address2 = server2.address();
+    const expectedHost = address2 && typeof address2 !== "string" ? `127.0.0.1:${address2.port}` : undefined;
+    if (!expectedHost || request.headers.host !== expectedHost) {
+      response.writeHead(400, { "Content-Type": "text/plain" });
+      response.end("Invalid callback host");
+      return;
+    }
+    let url2;
+    try {
+      url2 = new URL(request.url, `http://${expectedHost}`);
+    } catch {
+      response.writeHead(400, { "Content-Type": "text/plain" });
+      response.end("Invalid request target");
+      return;
+    }
+    if (url2.origin !== `http://${expectedHost}` || url2.pathname !== "/callback") {
+      response.writeHead(404).end("Not found");
+      return;
+    }
+    const error5 = url2.searchParams.get("error");
+    const code2 = url2.searchParams.get("code");
+    const state = url2.searchParams.get("state");
+    if (!state || state !== expectedState.value) {
+      response.writeHead(400, { "Content-Type": "text/html" });
+      response.end(callbackPage("Authorization failed", "Invalid OAuth callback"));
+      return;
+    }
+    if (error5) {
+      response.writeHead(400, { "Content-Type": "text/html" });
+      reject2?.(new Error(`MCP OAuth authorization failed: ${error5}`));
+      response.end(callbackPage("Authorization failed", error5), () => {
+        closeServer(true);
+      });
+      return;
+    }
+    if (!code2) {
+      response.writeHead(400, { "Content-Type": "text/html" });
+      response.end(callbackPage("Authorization failed", "Missing authorization code"));
+      return;
+    }
+    response.writeHead(200, { "Content-Type": "text/html" });
+    settle3?.(code2);
+    response.end(callbackPage("Authorization complete", "You can close this tab and return to Letta Code."), () => {
+      closeServer(true);
+    });
+  });
+  server2.on("clientError", (_error, socket) => {
+    if (!socket.writable)
+      return;
+    socket.end(`HTTP/1.1 400 Bad Request\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+  });
+  let serverClosing = false;
+  const closeServer = (force = false) => {
+    if (serverClosing)
+      return;
+    serverClosing = true;
+    server2.close();
+    if (force)
+      server2.closeAllConnections();
+  };
+  await new Promise((resolve39, rejectListen) => {
+    server2.once("error", rejectListen);
+    server2.listen(port, "127.0.0.1", resolve39);
+  });
+  server2.unref();
+  const address = server2.address();
+  if (!address || typeof address === "string") {
+    server2.close();
+    throw new Error("Could not start MCP OAuth callback server");
+  }
+  const timeout = setTimeout(() => {
+    reject2?.(new Error("Timed out waiting for MCP OAuth authorization"));
+    closeServer(true);
+  }, CALLBACK_TIMEOUT_MS);
+  timeout.unref();
+  return {
+    redirectUrl: `http://127.0.0.1:${address.port}/callback`,
+    expectedState,
+    waitForCode: () => codePromise.finally(() => clearTimeout(timeout)),
+    close: () => {
+      clearTimeout(timeout);
+      if (!completed)
+        reject2?.(new Error("MCP OAuth flow was cancelled"));
+      closeServer(true);
+    }
+  };
+}
+function callbackPage(title, message) {
+  return `<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>${escapeHtml2(title)}</h1><p>${escapeHtml2(message)}</p></body></html>`;
+}
+function escapeHtml2(value) {
+  return value.replace(/[&<>"']/g, (character) => {
+    const entities = {
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    };
+    return entities[character] ?? character;
+  });
+}
+var CALLBACK_TIMEOUT_MS;
+var init_mcp_oauth_callback = __esm(() => {
+  CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+});
+
 // src/mcp-oauth.ts
 import { createHash as createHash11, randomBytes as randomBytes2 } from "node:crypto";
-import { createServer as createServer3 } from "node:http";
 async function clearMcpOAuthCredentials(agentId, serverName, serverUrl) {
-  return deleteSecretValue(oauthSecretName(agentId, serverName, serverUrl));
+  const credentialKey = mcpOAuthCredentialKey(agentId, serverName, serverUrl);
+  const coordinationKey = storageCoordinationKey(bunSecretStorage, credentialKey, "bun-secrets");
+  const { result: result3 } = await clearStoredCredentials(bunSecretStorage, credentialKey, coordinationKey);
+  return result3 === true;
 }
 async function createMcpOAuthSession(agentId, serverName, serverUrl, options) {
-  const secretName = oauthSecretName(agentId, serverName, serverUrl);
-  const persisted = await loadState(secretName);
-  if (!options.interactive && !persisted)
-    return;
-  const callback = options.interactive ? await startOAuthCallbackServer2(callbackPort(persisted?.redirectUrl)) : undefined;
-  const redirectUrl = callback?.redirectUrl ?? persisted?.redirectUrl;
-  if (!redirectUrl)
-    return;
-  const provider = new PersistentMcpOAuthProvider({
-    secretName,
-    redirectUrl,
-    persisted,
+  const credentialKey = mcpOAuthCredentialKey(agentId, serverName, serverUrl);
+  return createMcpOAuthSessionWithStorage({
+    credentialKey,
+    storageNamespace: "bun-secrets",
+    storage: bunSecretStorage,
     interactive: options.interactive,
     onStatus: options.onStatus,
-    openBrowser: options.openBrowser ?? openSystemBrowser,
-    expectedState: callback?.expectedState
+    openBrowser: options.openBrowser ?? openSystemBrowser
   });
-  return {
-    authProvider: provider,
-    ...callback ? { waitForAuthorizationCode: () => callback.waitForCode() } : {},
-    close: async () => callback?.close()
-  };
+}
+async function createMcpOAuthSessionWithStorage(options) {
+  const coordinationKey = storageCoordinationKey(options.storage, options.credentialKey, options.storageNamespace);
+  retainCredentialCoordinator(coordinationKey);
+  let provider;
+  let callback;
+  try {
+    const loaded = await loadState(options.storage, options.credentialKey, coordinationKey);
+    const persisted = loaded.state;
+    if (!options.interactive && !persisted) {
+      await releaseCredentialCoordinator(coordinationKey);
+      return;
+    }
+    callback = options.interactive ? await startOAuthCallbackServer2(callbackPort(persisted?.redirectUrl)) : undefined;
+    const redirectUrl = callback?.redirectUrl ?? persisted?.redirectUrl;
+    if (!redirectUrl) {
+      await releaseCredentialCoordinator(coordinationKey);
+      return;
+    }
+    provider = new PersistentMcpOAuthProvider({
+      credentialKey: options.credentialKey,
+      coordinationKey,
+      storage: options.storage,
+      redirectUrl,
+      persisted,
+      interactive: options.interactive,
+      onStatus: options.onStatus,
+      openBrowser: options.openBrowser ?? openSystemBrowser,
+      expectedState: callback?.expectedState,
+      generation: loaded.generation
+    });
+    const activeProvider = provider;
+    const activeCallback = callback;
+    return {
+      authProvider: activeProvider,
+      ...activeCallback ? { waitForAuthorizationCode: () => activeCallback.waitForCode() } : {},
+      exportCredentials: () => activeProvider.exportCredentials(),
+      closeCallback: async () => activeCallback?.close(),
+      close: async () => {
+        activeCallback?.close();
+        await activeProvider.dispose();
+      }
+    };
+  } catch (error5) {
+    callback?.close();
+    if (provider)
+      await provider.dispose();
+    else
+      await releaseCredentialCoordinator(coordinationKey);
+    throw error5;
+  }
 }
 
 class PersistentMcpOAuthProvider {
   stateData;
-  secretName;
+  pendingClientInformation;
+  pendingDiscoveryState;
+  codeVerifierValue;
+  generation;
+  observedClientVersion;
+  observedTokenVersion;
+  observedDiscoveryVersion;
+  tokenOperationGeneration;
+  tokenOperationVersion;
+  coordinatorValue;
+  credentialKey;
+  coordinationKey;
+  storage;
   interactive;
   onStatus;
   openBrowser;
   expectedState;
+  closed = false;
   constructor(options) {
-    this.secretName = options.secretName;
+    this.credentialKey = options.credentialKey;
+    this.coordinationKey = options.coordinationKey;
+    this.storage = options.storage;
     this.interactive = options.interactive;
     this.onStatus = options.onStatus;
     this.openBrowser = options.openBrowser;
     this.expectedState = options.expectedState;
+    this.generation = options.generation;
+    const coordinator = getCredentialCoordinator(options.coordinationKey);
+    this.coordinatorValue = coordinator;
+    this.observedClientVersion = coordinator.clientVersion;
+    this.observedTokenVersion = coordinator.tokenVersion;
+    this.observedDiscoveryVersion = coordinator.discoveryVersion;
+    this.tokenOperationGeneration = coordinator.generation;
+    this.tokenOperationVersion = coordinator.tokenVersion;
     this.stateData = {
       ...options.persisted,
       redirectUrl: options.redirectUrl
     };
   }
   get redirectUrl() {
+    this.assertOpen();
     return this.stateData.redirectUrl;
   }
   get clientMetadata() {
@@ -445334,27 +445631,127 @@ class PersistentMcpOAuthProvider {
     };
   }
   state() {
+    this.assertOpen();
     const state = randomBytes2(24).toString("base64url");
     if (this.expectedState)
       this.expectedState.value = state;
     return state;
   }
   clientInformation() {
-    const client = this.stateData.clientInformation;
-    return client && "redirect_uris" in client && client.redirect_uris.includes(this.redirectUrl) ? client : undefined;
+    this.assertOpen();
+    if (this.generation !== this.coordinator.generation)
+      return;
+    if (this.pendingClientInformation && this.pendingClientInformation.baseVersion !== this.coordinator.clientVersion) {
+      this.pendingClientInformation = undefined;
+    }
+    const client = this.pendingClientInformation?.value ?? this.coordinator.state?.clientInformation;
+    this.observedClientVersion = this.coordinator.clientVersion;
+    return client && "redirect_uris" in client && Array.isArray(client.redirect_uris) && client.redirect_uris.includes(this.redirectUrl) ? client : undefined;
   }
   saveClientInformation(clientInformation) {
+    this.assertOpen();
+    assertCurrentGeneration(this.coordinationKey, this.generation);
     this.stateData.clientInformation = clientInformation;
+    this.pendingClientInformation = {
+      value: clientInformation,
+      baseVersion: this.coordinator.clientVersion
+    };
+    if (!this.coordinator.state?.tokens) {
+      this.tokenOperationGeneration = this.coordinator.generation;
+      this.tokenOperationVersion = this.coordinator.tokenVersion;
+    }
   }
   tokens() {
-    return this.stateData.tokens;
+    this.assertOpen();
+    if (this.generation !== this.coordinator.generation)
+      return;
+    this.observedTokenVersion = this.coordinator.tokenVersion;
+    this.tokenOperationGeneration = this.coordinator.generation;
+    this.tokenOperationVersion = this.coordinator.tokenVersion;
+    return this.coordinator.state?.tokens;
+  }
+  async exportCredentials() {
+    this.assertOpen();
+    const expectedGeneration = this.generation;
+    return enqueueStorageMutation(this.coordinationKey, async () => {
+      this.assertOpen();
+      assertCurrentGeneration(this.coordinationKey, expectedGeneration);
+      const latest = await readStoredState(this.storage, this.credentialKey);
+      if (!latest) {
+        throw new Error("MCP OAuth authorization is not complete");
+      }
+      this.assertOpen();
+      this.coordinator.state = latest;
+      this.stateData = latest;
+      return exportCredentialSnapshot(latest);
+    });
   }
   async saveTokens(tokens) {
-    this.stateData.tokens = tokens;
-    delete this.stateData.codeVerifier;
-    await this.persist();
+    this.assertOpen();
+    const expectedGeneration = this.tokenOperationGeneration;
+    const expectedTokenVersion = this.tokenOperationVersion;
+    const tokenExpiresAt = tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;
+    const pendingClientInformation = this.pendingClientInformation;
+    const pendingDiscoveryState = this.pendingDiscoveryState;
+    const result3 = await enqueueStorageMutation(this.coordinationKey, async () => {
+      this.assertOpen();
+      assertCurrentGeneration(this.coordinationKey, expectedGeneration);
+      if (this.coordinator.tokenVersion !== expectedTokenVersion) {
+        throw new Error("MCP OAuth token response is stale because credentials changed");
+      }
+      if (pendingClientInformation && this.coordinator.clientVersion !== pendingClientInformation.baseVersion || pendingDiscoveryState && this.coordinator.discoveryVersion !== pendingDiscoveryState.baseVersion) {
+        throw new Error("MCP OAuth token response is stale because protocol state changed");
+      }
+      const state = await readStoredState(this.storage, this.credentialKey) ?? { redirectUrl: this.redirectUrl };
+      let clientMerged = false;
+      let discoveryMerged = false;
+      if (pendingClientInformation && this.coordinator.clientVersion === pendingClientInformation.baseVersion) {
+        state.redirectUrl = this.redirectUrl;
+        state.clientInformation = pendingClientInformation.value;
+        clientMerged = true;
+      }
+      if (pendingDiscoveryState && this.coordinator.discoveryVersion === pendingDiscoveryState.baseVersion) {
+        state.discoveryState = pendingDiscoveryState.value;
+        discoveryMerged = true;
+      }
+      state.tokens = {
+        ...tokens,
+        refresh_token: tokens.refresh_token ?? state.tokens?.refresh_token
+      };
+      state.tokenExpiresAt = tokenExpiresAt;
+      await this.storage.set(this.credentialKey, JSON.stringify(state));
+      this.coordinator.state = state;
+      this.coordinator.tokenVersion += 1;
+      if (clientMerged)
+        this.coordinator.clientVersion += 1;
+      if (discoveryMerged)
+        this.coordinator.discoveryVersion += 1;
+      return { state, clientMerged, discoveryMerged };
+    });
+    this.codeVerifierValue = undefined;
+    if (this.closed) {
+      this.scrubLocalState();
+      return;
+    }
+    this.stateData = result3.state;
+    this.observedTokenVersion = this.coordinator.tokenVersion;
+    this.tokenOperationGeneration = this.coordinator.generation;
+    this.tokenOperationVersion = this.coordinator.tokenVersion;
+    this.observedClientVersion = this.coordinator.clientVersion;
+    this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+    if (this.pendingClientInformation === pendingClientInformation) {
+      this.pendingClientInformation = undefined;
+    } else if (this.pendingClientInformation) {
+      this.pendingClientInformation.baseVersion = this.coordinator.clientVersion;
+    }
+    if (this.pendingDiscoveryState === pendingDiscoveryState) {
+      this.pendingDiscoveryState = undefined;
+    } else if (this.pendingDiscoveryState) {
+      this.pendingDiscoveryState.baseVersion = this.coordinator.discoveryVersion;
+    }
   }
   async redirectToAuthorization(authorizationUrl) {
+    this.assertOpen();
     if (!this.interactive) {
       throw new Error("MCP authentication requires user authorization. Open /mcp and press R to sign in.");
     }
@@ -445364,147 +445761,268 @@ ${authorizationUrl.toString()}`);
     await this.openBrowser(authorizationUrl.toString());
   }
   saveCodeVerifier(codeVerifier) {
-    this.stateData.codeVerifier = codeVerifier;
+    this.assertOpen();
+    this.codeVerifierValue = codeVerifier;
   }
   codeVerifier() {
-    if (!this.stateData.codeVerifier) {
+    this.assertOpen();
+    if (!this.codeVerifierValue) {
       throw new Error("No MCP OAuth PKCE verifier is available");
     }
-    return this.stateData.codeVerifier;
+    return this.codeVerifierValue;
   }
   saveDiscoveryState(state) {
+    this.assertOpen();
+    assertCurrentGeneration(this.coordinationKey, this.generation);
     this.stateData.discoveryState = state;
+    this.pendingDiscoveryState = {
+      value: state,
+      baseVersion: this.coordinator.discoveryVersion
+    };
+    if (!this.coordinator.state?.tokens) {
+      this.tokenOperationGeneration = this.coordinator.generation;
+      this.tokenOperationVersion = this.coordinator.tokenVersion;
+    }
   }
   discoveryState() {
-    return this.stateData.discoveryState;
-  }
-  async invalidateCredentials(scope) {
-    if (scope === "all") {
-      this.stateData = { redirectUrl: this.redirectUrl };
-      await deleteSecretValue(this.secretName);
+    this.assertOpen();
+    if (this.generation !== this.coordinator.generation)
       return;
+    if (this.pendingDiscoveryState && this.pendingDiscoveryState.baseVersion !== this.coordinator.discoveryVersion) {
+      this.pendingDiscoveryState = undefined;
     }
-    if (scope === "client")
-      delete this.stateData.clientInformation;
-    if (scope === "tokens")
-      delete this.stateData.tokens;
-    if (scope === "verifier")
-      delete this.stateData.codeVerifier;
-    if (scope === "discovery")
-      delete this.stateData.discoveryState;
-    await this.persist();
-  }
-  async persist() {
-    await setSecretValue(this.secretName, JSON.stringify(this.stateData));
-  }
-}
-async function startOAuthCallbackServer2(preferredPort) {
-  try {
-    return await startOAuthCallbackServerOnPort(preferredPort ?? 0);
-  } catch (error5) {
-    if (!preferredPort)
-      throw error5;
-    return startOAuthCallbackServerOnPort(0);
+    this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+    return this.pendingDiscoveryState?.value ?? this.coordinator.state?.discoveryState;
   }
-}
-async function startOAuthCallbackServerOnPort(port) {
-  const expectedState = {};
-  let server2;
-  let completed = false;
-  let settle3;
-  let reject2;
-  const codePromise = new Promise((resolve39, rejectPromise) => {
-    settle3 = (code2) => {
-      completed = true;
-      resolve39(code2);
-    };
-    reject2 = (error5) => {
-      completed = true;
-      rejectPromise(error5);
-    };
-  });
-  codePromise.catch(() => {
-    return;
-  });
-  server2 = createServer3((request, response) => {
-    const url2 = new URL(request.url ?? "/", "http://127.0.0.1");
-    if (url2.pathname !== "/callback") {
-      response.writeHead(404).end("Not found");
+  async invalidateCredentials(scope) {
+    this.assertOpen();
+    if (scope === "verifier") {
+      this.codeVerifierValue = undefined;
       return;
     }
-    const error5 = url2.searchParams.get("error");
-    const code2 = url2.searchParams.get("code");
-    const state = url2.searchParams.get("state");
-    if (error5) {
-      response.writeHead(400, { "Content-Type": "text/html" });
-      response.end(callbackPage("Authorization failed", error5));
-      reject2?.(new Error(`MCP OAuth authorization failed: ${error5}`));
-      server2.close();
+    if (scope === "all") {
+      const redirectUrl = this.redirectUrl;
+      const { generation: generation3, cleared } = await clearStoredCredentials(this.storage, this.credentialKey, this.coordinationKey, {
+        generation: this.generation,
+        clientVersion: this.observedClientVersion,
+        tokenVersion: this.observedTokenVersion,
+        discoveryVersion: this.observedDiscoveryVersion
+      });
+      if (this.closed)
+        return;
+      if (!cleared) {
+        this.stateData = this.coordinator.state ?? { redirectUrl };
+        this.pendingClientInformation = undefined;
+        this.pendingDiscoveryState = undefined;
+        this.codeVerifierValue = undefined;
+        this.observedClientVersion = this.coordinator.clientVersion;
+        this.observedTokenVersion = this.coordinator.tokenVersion;
+        this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+        return;
+      }
+      this.generation = generation3;
+      this.stateData = { redirectUrl };
+      this.pendingClientInformation = undefined;
+      this.pendingDiscoveryState = undefined;
+      this.codeVerifierValue = undefined;
+      this.observedClientVersion = this.coordinator.clientVersion;
+      this.observedTokenVersion = this.coordinator.tokenVersion;
+      this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+      return;
+    }
+    const expectedGeneration = this.generation;
+    const pendingClientInformation = this.pendingClientInformation;
+    const pendingDiscoveryState = this.pendingDiscoveryState;
+    const expectedVersion = scope === "client" ? this.observedClientVersion : scope === "tokens" ? this.observedTokenVersion : this.observedDiscoveryVersion;
+    const result3 = await enqueueStorageMutation(this.coordinationKey, async () => {
+      this.assertOpen();
+      assertCurrentGeneration(this.coordinationKey, expectedGeneration);
+      const currentVersion = scope === "client" ? this.coordinator.clientVersion : scope === "tokens" ? this.coordinator.tokenVersion : this.coordinator.discoveryVersion;
+      if (currentVersion !== expectedVersion) {
+        return this.coordinator.state;
+      }
+      const state = await readStoredState(this.storage, this.credentialKey);
+      if (state) {
+        if (scope === "client")
+          delete state.clientInformation;
+        if (scope === "tokens") {
+          delete state.tokens;
+          delete state.tokenExpiresAt;
+        }
+        if (scope === "discovery")
+          delete state.discoveryState;
+        await this.storage.set(this.credentialKey, JSON.stringify(state));
+      }
+      this.coordinator.state = state;
+      if (scope === "client")
+        this.coordinator.clientVersion += 1;
+      if (scope === "tokens")
+        this.coordinator.tokenVersion += 1;
+      if (scope === "discovery")
+        this.coordinator.discoveryVersion += 1;
+      return state;
+    });
+    if (this.closed)
       return;
+    this.stateData = result3 ?? { redirectUrl: this.redirectUrl };
+    if (scope === "client") {
+      this.observedClientVersion = this.coordinator.clientVersion;
+      if (this.pendingClientInformation === pendingClientInformation) {
+        this.pendingClientInformation = undefined;
+      } else if (this.pendingClientInformation) {
+        this.pendingClientInformation.baseVersion = this.coordinator.clientVersion;
+      }
     }
-    if (!code2 || !state || state !== expectedState.value) {
-      response.writeHead(400, { "Content-Type": "text/html" });
-      response.end(callbackPage("Authorization failed", "Invalid OAuth callback"));
-      reject2?.(new Error("Invalid MCP OAuth callback state"));
-      server2.close();
+    if (scope === "tokens") {
+      this.observedTokenVersion = this.coordinator.tokenVersion;
+    }
+    if (scope === "discovery") {
+      this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+      if (this.pendingDiscoveryState === pendingDiscoveryState) {
+        this.pendingDiscoveryState = undefined;
+      } else if (this.pendingDiscoveryState) {
+        this.pendingDiscoveryState.baseVersion = this.coordinator.discoveryVersion;
+      }
+    }
+  }
+  async dispose() {
+    if (this.closed)
       return;
+    this.closed = true;
+    this.scrubLocalState();
+    try {
+      await releaseCredentialCoordinator(this.coordinationKey);
+    } finally {
+      this.coordinatorValue = undefined;
+      this.scrubLocalState();
     }
-    response.writeHead(200, { "Content-Type": "text/html" });
-    response.end(callbackPage("Authorization complete", "You can close this tab and return to Letta Code."));
-    settle3?.(code2);
-    server2.close();
-  });
-  await new Promise((resolve39, rejectListen) => {
-    server2.once("error", rejectListen);
-    server2.listen(port, "127.0.0.1", resolve39);
-  });
-  server2.unref();
-  const address = server2.address();
-  if (!address || typeof address === "string") {
-    server2.close();
-    throw new Error("Could not start MCP OAuth callback server");
   }
-  const timeout = setTimeout(() => {
-    reject2?.(new Error("Timed out waiting for MCP OAuth authorization"));
-    server2.close();
-  }, CALLBACK_TIMEOUT_MS);
-  timeout.unref();
+  get coordinator() {
+    if (!this.coordinatorValue)
+      throw new Error("MCP OAuth session is closed");
+    return this.coordinatorValue;
+  }
+  scrubLocalState() {
+    this.codeVerifierValue = undefined;
+    this.pendingClientInformation = undefined;
+    this.pendingDiscoveryState = undefined;
+    this.stateData = { redirectUrl: this.stateData.redirectUrl };
+  }
+  assertOpen() {
+    if (this.closed)
+      throw new Error("MCP OAuth session is closed");
+  }
+}
+function exportCredentialSnapshot(state) {
+  const clientInformation = state.clientInformation;
+  const tokens = state.tokens;
+  const validClient = clientInformation && "redirect_uris" in clientInformation && clientInformation.redirect_uris.includes(state.redirectUrl) ? clientInformation : undefined;
+  if (!validClient?.client_id || !tokens?.access_token) {
+    throw new Error("MCP OAuth authorization is not complete");
+  }
   return {
-    redirectUrl: `http://127.0.0.1:${address.port}/callback`,
-    expectedState,
-    waitForCode: () => codePromise.finally(() => clearTimeout(timeout)),
-    close: () => {
-      clearTimeout(timeout);
-      if (!completed)
-        reject2?.(new Error("MCP OAuth flow was cancelled"));
-      server2.close();
-    }
+    access_token: tokens.access_token,
+    ...tokens.refresh_token ? { refresh_token: tokens.refresh_token } : {},
+    client_id: validClient.client_id,
+    ...validClient.client_secret ? { client_secret: validClient.client_secret } : {},
+    redirect_uri: state.redirectUrl,
+    ...tokens.token_type ? { token_type: tokens.token_type } : {},
+    ...state.tokenExpiresAt !== undefined ? {
+      expires_in: Math.max(0, Math.ceil((state.tokenExpiresAt - Date.now()) / 1000))
+    } : {},
+    ...tokens.scope ? { scope: tokens.scope } : {}
   };
 }
-function callbackPort(redirectUrl) {
-  if (!redirectUrl)
+function enqueueStorageMutation(coordinationKey, mutation) {
+  const coordinator = getCredentialCoordinator(coordinationKey);
+  const pending = coordinator.queue.then(mutation, mutation);
+  coordinator.queue = pending.then(() => {
     return;
-  try {
-    const parsed = new URL(redirectUrl);
-    return parsed.hostname === "127.0.0.1" && parsed.port ? Number(parsed.port) : undefined;
-  } catch {
+  }, () => {
     return;
+  });
+  return pending;
+}
+function getCredentialCoordinator(coordinationKey) {
+  const existing = credentialCoordinators.get(coordinationKey);
+  if (existing)
+    return existing;
+  const coordinator = {
+    queue: Promise.resolve(),
+    generation: 0,
+    activeProviders: 0,
+    clientVersion: 0,
+    tokenVersion: 0,
+    discoveryVersion: 0
+  };
+  credentialCoordinators.set(coordinationKey, coordinator);
+  return coordinator;
+}
+function storageCoordinationKey(storage, credentialKey, storageNamespace) {
+  const namespace = storageNamespace;
+  if (namespace !== undefined && (!namespace.trim() || namespace.includes("\x00"))) {
+    throw new Error("MCP OAuth storage namespace must be non-empty and contain no NUL bytes");
+  }
+  let identity2;
+  if (!namespace) {
+    let objectId = storageObjectIds.get(storage);
+    if (!objectId) {
+      objectId = nextStorageObjectId;
+      nextStorageObjectId += 1;
+      storageObjectIds.set(storage, objectId);
+    }
+    identity2 = `object:${objectId}`;
+  } else {
+    identity2 = `namespace:${namespace}`;
   }
+  return `${identity2}\x00${credentialKey}`;
 }
-function callbackPage(title, message) {
-  return `<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>${escapeHtml2(title)}</h1><p>${escapeHtml2(message)}</p></body></html>`;
+function retainCredentialCoordinator(coordinationKey) {
+  getCredentialCoordinator(coordinationKey).activeProviders += 1;
 }
-function escapeHtml2(value) {
-  return value.replace(/[&<>"']/g, (character) => {
-    const entities = {
-      "&": "&amp;",
-      "<": "&lt;",
-      ">": "&gt;",
-      '"': "&quot;",
-      "'": "&#39;"
-    };
-    return entities[character] ?? character;
+async function releaseCredentialCoordinator(coordinationKey) {
+  const coordinator = getCredentialCoordinator(coordinationKey);
+  await enqueueStorageMutation(coordinationKey, async () => {
+    coordinator.activeProviders = Math.max(0, coordinator.activeProviders - 1);
+    if (coordinator.activeProviders === 0)
+      coordinator.state = undefined;
   });
+  await coordinator.queue;
+  if (coordinator.activeProviders === 0 && credentialCoordinators.get(coordinationKey) === coordinator) {
+    credentialCoordinators.delete(coordinationKey);
+  }
+}
+function assertCurrentGeneration(coordinationKey, expectedGeneration) {
+  if (getCredentialCoordinator(coordinationKey).generation !== expectedGeneration) {
+    throw new Error("MCP OAuth session is stale because credentials were cleared");
+  }
+}
+async function clearStoredCredentials(storage, credentialKey, coordinationKey, expected) {
+  const coordinator = getCredentialCoordinator(coordinationKey);
+  const outcome = await enqueueStorageMutation(coordinationKey, async () => {
+    if (expected) {
+      assertCurrentGeneration(coordinationKey, expected.generation);
+      if (coordinator.clientVersion !== expected.clientVersion || coordinator.tokenVersion !== expected.tokenVersion || coordinator.discoveryVersion !== expected.discoveryVersion) {
+        return {
+          result: false,
+          generation: coordinator.generation,
+          cleared: false
+        };
+      }
+    }
+    const result3 = await storage.delete(credentialKey);
+    coordinator.generation += 1;
+    coordinator.clientVersion += 1;
+    coordinator.tokenVersion += 1;
+    coordinator.discoveryVersion += 1;
+    coordinator.state = undefined;
+    return { result: result3, generation: coordinator.generation, cleared: true };
+  });
+  await coordinator.queue;
+  if (coordinator.activeProviders === 0 && credentialCoordinators.get(coordinationKey) === coordinator) {
+    credentialCoordinators.delete(coordinationKey);
+  }
+  return outcome;
 }
 async function openSystemBrowser(url2) {
   try {
@@ -445513,25 +446031,73 @@ async function openSystemBrowser(url2) {
     subprocess.on("error", () => {});
   } catch {}
 }
-function oauthSecretName(agentId, serverName, serverUrl) {
+function mcpOAuthCredentialKey(agentId, serverName, serverUrl) {
   const digest = createHash11("sha256").update(`${agentId}\x00${serverName}\x00${serverUrl}`).digest("hex").slice(0, 32);
   return `mcp-oauth-${digest}`;
 }
-async function loadState(secretName) {
-  const value = await getSecretValue(secretName, "MCP OAuth credentials");
+async function loadState(storage, credentialKey, coordinationKey) {
+  return enqueueStorageMutation(coordinationKey, async () => {
+    const coordinator = getCredentialCoordinator(coordinationKey);
+    const state = await readStoredState(storage, credentialKey);
+    coordinator.state = state;
+    return { state, generation: coordinator.generation };
+  });
+}
+async function readStoredState(storage, credentialKey) {
+  const value = await storage.get(credentialKey);
   if (!value)
     return;
   try {
-    return JSON.parse(value);
+    const parsed = JSON.parse(value);
+    if (!isPersistedMcpOAuthState(parsed)) {
+      await storage.delete(credentialKey);
+      return;
+    }
+    return parsed;
   } catch {
-    await deleteSecretValue(secretName);
+    await storage.delete(credentialKey);
     return;
   }
 }
-var CALLBACK_TIMEOUT_MS;
+function isPersistedMcpOAuthState(value) {
+  if (!isRecord17(value) || !SafeUrlSchema.safeParse(value.redirectUrl).success || "codeVerifier" in value) {
+    return false;
+  }
+  if (value.clientInformation !== undefined) {
+    if (!isRecord17(value.clientInformation))
+      return false;
+    const schema5 = "redirect_uris" in value.clientInformation ? OAuthClientInformationFullSchema : OAuthClientInformationSchema;
+    if (!schema5.safeParse(value.clientInformation).success)
+      return false;
+  }
+  if (value.tokens !== undefined && !OAuthTokensSchema.safeParse(value.tokens).success) {
+    return false;
+  }
+  if (value.tokenExpiresAt !== undefined && (typeof value.tokenExpiresAt !== "number" || !Number.isFinite(value.tokenExpiresAt))) {
+    return false;
+  }
+  if (value.discoveryState !== undefined) {
+    if (!isRecord17(value.discoveryState) || !SafeUrlSchema.safeParse(value.discoveryState.authorizationServerUrl).success || value.discoveryState.resourceMetadataUrl !== undefined && !SafeUrlSchema.safeParse(value.discoveryState.resourceMetadataUrl).success || value.discoveryState.authorizationServerMetadata !== undefined && !OAuthMetadataSchema.safeParse(value.discoveryState.authorizationServerMetadata).success && !OpenIdProviderDiscoveryMetadataSchema.safeParse(value.discoveryState.authorizationServerMetadata).success || value.discoveryState.resourceMetadata !== undefined && !OAuthProtectedResourceMetadataSchema.safeParse(value.discoveryState.resourceMetadata).success) {
+      return false;
+    }
+  }
+  return true;
+}
+function isRecord17(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var credentialCoordinators, storageObjectIds, nextStorageObjectId = 1, bunSecretStorage;
 var init_mcp_oauth = __esm(() => {
+  init_auth2();
+  init_mcp_oauth_callback();
   init_secrets();
-  CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+  credentialCoordinators = new Map;
+  storageObjectIds = new WeakMap;
+  bunSecretStorage = {
+    get: (credentialKey) => getSecretValue(credentialKey, "MCP OAuth credentials"),
+    set: setSecretValue,
+    delete: deleteSecretValue
+  };
 });
 
 // src/mcp-runtime.ts
@@ -447936,7 +448502,7 @@ import {
 } from "node:fs";
 import { tmpdir as tmpdir12 } from "node:os";
 import path45 from "node:path";
-function isRecord17(value) {
+function isRecord18(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isPathInsideOrEqual2(childPath, parentPath) {
@@ -447952,7 +448518,7 @@ function readPackageJson(packageJsonPath) {
   } catch (error5) {
     throw new Error(`Could not read package.json: ${error5 instanceof Error ? error5.message : String(error5)}`);
   }
-  if (!isRecord17(parsed)) {
+  if (!isRecord18(parsed)) {
     throw new Error("package.json must be an object");
   }
   return parsed;
@@ -447962,7 +448528,7 @@ function formatRepository(repository) {
     const trimmed2 = repository.trim();
     return trimmed2 || undefined;
   }
-  if (!isRecord17(repository))
+  if (!isRecord18(repository))
     return;
   const url2 = repository.url;
   if (typeof url2 !== "string")
@@ -448492,7 +449058,7 @@ function hasRuntimeDependencies(packageJson) {
   if (!packageJson)
     return false;
   const dependencies4 = packageJson.dependencies;
-  return isRecord17(dependencies4) && Object.keys(dependencies4).length > 0;
+  return isRecord18(dependencies4) && Object.keys(dependencies4).length > 0;
 }
 function readPackageJsonIfExists(packageDirectory) {
   const packageJsonPath = path45.join(packageDirectory, "package.json");
@@ -512630,4 +513196,4 @@ function registerBunOAuthFlows() {
 registerBunOAuthFlows();
 await init_src5().then(() => exports_src2);
 
-//# debugId=8FBCBEB92238D00764756E2164756E21
+//# debugId=3195287CCD45D3B564756E2164756E21