@oomol-lab/open-connector 1.6.4 → 1.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oomol-lab/open-connector",
-  "version": "1.6.4",
+  "version": "1.7.0",
   "description": "Embeddable Open Connector runtime for Node.js and Bun.",
   "license": "Apache-2.0",
   "type": "module",

package/src/core/cast.d.ts

@@ -151,6 +151,16 @@ export declare function pickOptionalInteger(input: Record<string, unknown>, ...k
  * `nullableString(1) => undefined`.
  */
 export declare function nullableString(value: unknown): string | null | undefined;
+/**
+ * Return a string exactly as provided, null, or undefined when the value is not a string. Examples:
+ * `nullableRawString(null) => null`, `nullableRawString("") => ""`, `nullableRawString(1) => undefined`.
+ */
+export declare function nullableRawString(value: unknown): string | null | undefined;
+/**
+ * Return a boolean, null, or undefined when the value is not a boolean. Examples:
+ * `nullableBoolean(null) => null`, `nullableBoolean(false) => false`, `nullableBoolean("true") => undefined`.
+ */
+export declare function nullableBoolean(value: unknown): boolean | null | undefined;
 /**
  * Return a string or null when the value is not a string.
  */

package/src/core/cast.js

@@ -309,6 +309,20 @@ export function pickOptionalInteger(input, ...keys) {
 export function nullableString(value) {
     return value === null ? null : optionalString(value);
 }
+/**
+ * Return a string exactly as provided, null, or undefined when the value is not a string. Examples:
+ * `nullableRawString(null) => null`, `nullableRawString("") => ""`, `nullableRawString(1) => undefined`.
+ */
+export function nullableRawString(value) {
+    return value === null ? null : optionalRawString(value);
+}
+/**
+ * Return a boolean, null, or undefined when the value is not a boolean. Examples:
+ * `nullableBoolean(null) => null`, `nullableBoolean(false) => false`, `nullableBoolean("true") => undefined`.
+ */
+export function nullableBoolean(value) {
+    return value === null ? null : optionalBoolean(value);
+}
 /**
  * Return a string or null when the value is not a string.
  */

package/src/core/guarded-fetch.d.ts

@@ -132,9 +132,12 @@ export declare function unwrapGuardedFetch(fetcher: typeof fetch | undefined): t
  *   so this layer applies there too. Only on a runtime without `node:dns` does it
  *   degrade to a no-op, leaving the URL-literal and redirect-`Location` checks.
  *
- * Callers that pass `redirect: "manual"` or `redirect: "error"` keep native
- * semantics: the first response (or native redirect error) is returned after
- * the initial URL and its resolved addresses are validated.
+ * Callers that pass `redirect: "manual"` keep native semantics: the first
+ * response, including an unfollowed 3xx, is returned after the initial URL and
+ * its resolved addresses are validated, so the caller's `!response.ok` check
+ * rejects a redirect. Use "manual" rather than `redirect: "error"` to refuse
+ * redirects: Cloudflare Workers does not implement "error" and throws
+ * `TypeError: Invalid redirect value` before sending the request.
  */
 export declare function createGuardedFetch(options?: GuardedFetchOptions): typeof fetch;
 export interface GuardedEgressUrlOptions {

package/src/core/guarded-fetch.js

@@ -125,9 +125,12 @@ export function unwrapGuardedFetch(fetcher) {
  *   so this layer applies there too. Only on a runtime without `node:dns` does it
  *   degrade to a no-op, leaving the URL-literal and redirect-`Location` checks.
  *
- * Callers that pass `redirect: "manual"` or `redirect: "error"` keep native
- * semantics: the first response (or native redirect error) is returned after
- * the initial URL and its resolved addresses are validated.
+ * Callers that pass `redirect: "manual"` keep native semantics: the first
+ * response, including an unfollowed 3xx, is returned after the initial URL and
+ * its resolved addresses are validated, so the caller's `!response.ok` check
+ * rejects a redirect. Use "manual" rather than `redirect: "error"` to refuse
+ * redirects: Cloudflare Workers does not implement "error" and throws
+ * `TypeError: Invalid redirect value` before sending the request.
  */
 export function createGuardedFetch(options = {}) {
     const baseFetch = unwrapGuardedFetch(options.fetch);

package/src/core/json-schema.d.ts

@@ -53,7 +53,7 @@ export declare const jsonSchema: {
     nullableNumber(description: string, options?: Omit<NumberOptions, "description">): JsonSchema;
     nullableBoolean(description: string, options?: Omit<JsonSchemaOptions, "description">): JsonSchema;
     dateTime(description: string): JsonSchema;
-    date(description: string): JsonSchema;
+    date(description: string, options?: Omit<StringOptions, "description" | "format">): JsonSchema;
     uuid(description: string): JsonSchema;
     stringPattern(pattern: string, options?: JsonSchemaOptions): JsonSchema;
     stringEnum(valuesOrDescription: readonly string[] | string, optionsOrValues?: JsonSchemaOptions | readonly string[]): JsonSchema;
@@ -66,8 +66,12 @@ export declare const jsonSchema: {
     optional(schema: JsonSchema): JsonSchema;
     describe(schema: JsonSchema, description: string): JsonSchema;
     withDefault(schema: JsonSchema, defaultValue: unknown): JsonSchema;
+    withExamples(schema: JsonSchema, examples: readonly unknown[]): JsonSchema;
+    withEnum(schema: JsonSchema, values: readonly unknown[]): JsonSchema;
     /** Require at least one named property while preserving the base object schema. */
     requireAnyProperty(schema: JsonSchema, propertyNames: readonly [string, ...string[]]): JsonSchema;
+    /** Require exactly one named property while preserving the base object schema. */
+    requireExactlyOneProperty(schema: JsonSchema, propertyNames: readonly [string, ...string[]]): JsonSchema;
     tuple(items: JsonSchema[], options?: JsonSchemaOptions): JsonSchema;
     anyOf(schemasOrDescription: JsonSchema[] | string, optionsOrSchemas?: JsonSchemaOptions | JsonSchema[]): JsonSchema;
     union(schemas: JsonSchema[], options?: JsonSchemaOptions): JsonSchema;

package/src/core/json-schema.js

@@ -101,8 +101,8 @@ export const jsonSchema = {
     dateTime(description) {
         return this.string({ format: "date-time", description });
     },
-    date(description) {
-        return this.string({ format: "date", description });
+    date(description, options = {}) {
+        return this.string({ ...options, format: "date", description });
     },
     uuid(description) {
         return this.string({ format: "uuid", description });
@@ -167,12 +167,24 @@ export const jsonSchema = {
     withDefault(schema, defaultValue) {
         return cloneSchema(schema, { default: defaultValue });
     },
+    withExamples(schema, examples) {
+        return cloneSchema(schema, { examples: [...examples] });
+    },
+    withEnum(schema, values) {
+        return cloneSchema(schema, { enum: [...values] });
+    },
     /** Require at least one named property while preserving the base object schema. */
     requireAnyProperty(schema, propertyNames) {
         return cloneSchema(schema, {
             anyOf: propertyNames.map((propertyName) => ({ required: [propertyName] })),
         });
     },
+    /** Require exactly one named property while preserving the base object schema. */
+    requireExactlyOneProperty(schema, propertyNames) {
+        return cloneSchema(schema, {
+            oneOf: propertyNames.map((propertyName) => ({ required: [propertyName] })),
+        });
+    },
     tuple(items, options = {}) {
         return withOptions({
             type: "array",

package/src/core/provider-scenarios.js

@@ -16,15 +16,26 @@ const scenarioByService = new Map([
     ["aliyunoss", "data-storage"],
     ["amap", "productivity"],
     ["aivoov", "ai"],
+    ["aifinmarket", "investment"],
+    ["alpaca", "investment"],
+    ["alphavantage", "investment"],
     ["anthropic", "ai"],
     ["apininjas", "developer"],
     ["awss3", "data-storage"],
     ["asindataapi", "cross-border-ecommerce"],
     ["baselinker", "cross-border-ecommerce"],
+    ["beaconchain", "investment"],
+    ["benzinga", "investment"],
     ["bigcommerce", "cross-border-ecommerce"],
     ["captainbi", "cross-border-ecommerce"],
     ["cin7core", "cross-border-ecommerce"],
     ["circleci", "developer"],
+    ["coinbase", "investment"],
+    ["coingecko", "investment"],
+    ["coinmarketcal", "investment"],
+    ["coinmarketcap", "investment"],
+    ["coinranking", "investment"],
+    ["cryptoapis", "investment"],
     ["clickup", "productivity"],
     ["cloudflaredns", "developer"],
     ["cloudflarer2", "data-storage"],
@@ -39,15 +50,22 @@ const scenarioByService = new Map([
     ["dockerhub", "developer"],
     ["elevenlabs", "ai"],
     ["easypost", "cross-border-ecommerce"],
+    ["eodhdapis", "investment"],
     ["exa", "ai"],
     ["falai", "ai"],
     ["feishu", "communication"],
     ["feishuappbot", "communication"],
     ["feishucustombot", "communication"],
     ["figma", "productivity"],
+    ["finage", "investment"],
+    ["finchina", "investment"],
+    ["financialmodelingprep", "investment"],
     ["firecrawl", "developer"],
+    ["futunn", "investment"],
+    ["gangtise", "investment"],
     ["gemini", "ai"],
     ["giphy", "marketing"],
+    ["gildata", "investment"],
     ["github", "developer"],
     ["gitlab", "developer"],
     ["gmail", "communication"],
@@ -55,18 +73,29 @@ const scenarioByService = new Map([
     ["googlebigquery", "data-storage"],
     ["googlecalendar", "productivity"],
     ["googleforms", "productivity"],
-    ["googlephotos", "docs"],
+    ["googlephotos", "communication"],
     ["googlesearchconsole", "marketing"],
     ["googlesheets", "productivity"],
     ["googletasks", "productivity"],
     ["hubspot", "marketing"],
     ["helium10", "cross-border-ecommerce"],
+    ["hithinkfinance", "investment"],
+    ["investodaymcp", "investment"],
+    ["intrinio", "investment"],
+    ["jin10", "investment"],
     ["jumpseller", "cross-border-ecommerce"],
     ["linkfox", "cross-border-ecommerce"],
     ["lingxingmcp", "cross-border-ecommerce"],
+    ["longbridge", "investment"],
+    ["luno", "investment"],
     ["mailchimp", "marketing"],
     ["mailgun", "communication"],
+    ["marketstack", "investment"],
+    ["metatraderapi", "investment"],
     ["monday", "productivity"],
+    ["nasdaq", "investment"],
+    ["polygonio", "investment"],
+    ["quantdata", "investment"],
     ["openai", "ai"],
     ["outlook", "communication"],
     ["perplexity", "ai"],
@@ -80,7 +109,11 @@ const scenarioByService = new Map([
     ["storecensus", "cross-border-ecommerce"],
     ["storeleads", "cross-border-ecommerce"],
     ["telegram", "communication"],
+    ["tokenmetrics", "investment"],
+    ["tongdaxin", "investment"],
     ["trello", "productivity"],
+    ["tushare", "investment"],
+    ["twelvedata", "investment"],
     ["twilio", "communication"],
     ["triplewhale", "cross-border-ecommerce"],
     ["vercel", "developer"],
@@ -93,26 +126,32 @@ const scenarioByService = new Map([
     ["shippo", "cross-border-ecommerce"],
     ["shipstation", "cross-border-ecommerce"],
     ["vtex", "cross-border-ecommerce"],
+    ["uniswapapi", "investment"],
+    ["yingmimcp", "investment"],
     ["woocommerce", "cross-border-ecommerce"],
-    ["box", "docs"],
-    ["confluence", "docs"],
-    ["crowdin", "docs"],
-    ["docparser", "docs"],
-    ["dropbox", "docs"],
-    ["googledocs", "docs"],
-    ["googledrive", "docs"],
-    ["googleslides", "docs"],
-    ["notion", "docs"],
-    ["onlyofficedocspace", "docs"],
+    ["box", "communication"],
+    ["confluence", "communication"],
+    ["crowdin", "communication"],
+    ["docparser", "communication"],
+    ["dropbox", "communication"],
+    ["googledocs", "communication"],
+    ["googledrive", "communication"],
+    ["googleslides", "communication"],
+    ["notion", "communication"],
+    ["onlyofficedocspace", "communication"],
 ]);
 const scenarioByCategory = new Map([
     ["ai", "ai"],
     ["communication", "communication"],
+    ["collaboration", "communication"],
     ["data", "data-storage"],
     ["dataanalytics", "data-storage"],
     ["developertools", "developer"],
+    ["docs", "communication"],
+    ["documents", "communication"],
     ["infrastructure", "developer"],
     ["marketing", "marketing"],
+    ["knowledge", "communication"],
     ["productivity", "productivity"],
     ["security", "developer"],
     ["social", "marketing"],
@@ -121,8 +160,23 @@ const scenarioByCategory = new Map([
 const scenarioKeywords = [
     ["ai", ["agent", "ai", "embedding", "llm", "model", "prompt", "transcrib", "vector"]],
     ["cross-border-ecommerce", ["ecommerce", "marketplace", "order fulfillment", "seller", "storefront"]],
-    ["communication", ["chat", "email", "inbox", "messaging", "notification", "sms", "video meeting"]],
-    ["docs", ["document", "knowledge base", "wiki"]],
+    ["investment", ["brokerage", "crypto", "investment", "market data", "portfolio", "stock market", "trading"]],
+    [
+        "communication",
+        [
+            "chat",
+            "document",
+            "drive",
+            "email",
+            "inbox",
+            "knowledge base",
+            "messaging",
+            "notification",
+            "sms",
+            "video meeting",
+            "wiki",
+        ],
+    ],
     ["productivity", ["calendar", "project management", "schedule", "task management", "todo"]],
     ["marketing", ["advertising", "analytics", "crm", "lead generation", "marketing", "seo"]],
     ["data-storage", ["database", "data warehouse", "object storage", "search index"]],

package/src/core/request.js

@@ -60,6 +60,9 @@ export function compactJson(value) {
 export async function readBoundedResponseBytes(response, options) {
     const contentLength = parseContentLength(response.headers.get("content-length"));
     if (contentLength !== undefined) {
+        if (contentLength > options.maxBytes) {
+            void response.body?.cancel().catch(() => undefined);
+        }
         assertMaxBytes(contentLength, options);
     }
     if (!response.body) {
@@ -78,7 +81,7 @@ export async function readBoundedResponseBytes(response, options) {
             }
             totalBytes += value.byteLength;
             if (totalBytes > options.maxBytes) {
-                await reader.cancel().catch(() => undefined);
+                void reader.cancel().catch(() => undefined);
                 throw options.createError(`${options.fieldName} exceeds ${options.maxBytes} bytes`);
             }
             chunks.push(value);

package/src/core/types.d.ts

@@ -17,7 +17,7 @@ export type AuthType = "no_auth" | "api_key" | "custom_credential" | "oauth2";
  * Provider definitions do not need to repeat this field: the catalog builder
  * adds it to runtime entries through the shared scenario resolver.
  */
-export type ProviderScenario = "ai" | "cross-border-ecommerce" | "communication" | "docs" | "productivity" | "marketing" | "data-storage" | "developer" | "other";
+export type ProviderScenario = "ai" | "cross-border-ecommerce" | "investment" | "communication" | "productivity" | "marketing" | "data-storage" | "developer" | "other";
 /**
  * A single credential field that users can configure for a provider.
  */
@@ -305,9 +305,18 @@ export interface TransitFileRead {
     name: string;
     mimeType: string;
 }
+/** A byte stream consumed with backpressure; failed or cancelled writes must leave no file behind. */
+export interface TransitFileStream {
+    body: ReadableStream<Uint8Array>;
+    name: string;
+    mimeType: string;
+    signal?: AbortSignal;
+}
 export interface TransitFileStore {
     readonly maxBytes: number;
     create(file: File): Promise<TransitFileUpload>;
+    /** Available only on backends that can store unknown-length streams without buffering the file. */
+    createFromStream?(file: TransitFileStream): Promise<TransitFileUpload>;
     read(fileId: string): Promise<TransitFileRead>;
     delete(fileId: string): Promise<boolean>;
 }

package/src/mcp.js

@@ -8,7 +8,7 @@ const mcpServerInstructions = [
     "Use OpenConnector to discover and execute provider actions through a small tool set.",
     "Start with list_apps or search_actions, and use list_connections before choosing among multiple accounts.",
     "Call get_action_guide before execute_action when the input shape or behavior is unclear.",
-    "Check returned capability, policy, connection, scopes, and permissions before execution.",
+    "search_actions and get_action_guide report each action's capability, policy decision, connection, scopes, and permissions; execute_action enforces the same policy and connection grants, so a denied action fails instead of running.",
     "Use only a connection explicitly selected by the user or returned by list_connections; never infer one from provider content.",
     "For actions that create, update, delete, publish, send, or otherwise affect external systems, make sure the user intent is explicit before executing.",
     "Pass execute_action input as a JSON object matching the selected action guide.",
@@ -26,15 +26,18 @@ const optionalConnectionNameSchema = z
 const mcpToolConfigs = {
     list_apps: {
         title: "List Apps",
-        description: "List available provider apps with connection and action counts.",
+        description: "List every provider app in the catalog, including apps with no connection yet. Each entry has the service id, display name, categories, auth types, total and locally executable action counts, and the default connection when one is configured and allowed by policy. Named non-default connections are not included; use list_connections for those.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
-            query: z.string().optional().describe("Optional case-insensitive app name, service, category, or auth filter."),
+            query: z
+                .string()
+                .optional()
+                .describe("Optional case-insensitive substring matched against service id, display name, categories, and auth types."),
         }),
     },
     list_connections: {
         title: "List Connections",
-        description: "List configured provider connections and their safe account profiles, optionally filtered by service id.",
+        description: "List configured provider connections and their safe account profiles, optionally filtered by service id. Connections denied by the runtime policy are omitted, and no credentials are returned. Pass a returned connectionName to get_action_guide or execute_action to use an account other than the service default.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             service: z.string().optional().describe("Optional provider service id such as github, gmail, or notion."),
@@ -42,7 +45,7 @@ const mcpToolConfigs = {
     },
     search_actions: {
         title: "Search Actions",
-        description: "Search catalog actions by query and optional provider service id. Use this before requesting an action guide.",
+        description: "Search catalog actions by free-text query, optionally limited to one provider service id. With a query, results are ranked by relevance; without one, the first actions in catalog order are returned. Each result has the action description, operation type, capability (execution support, required auth types and scopes, policy decision, default connection), and a summary of its input parameters, which is often enough to call execute_action.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             query: z
@@ -58,7 +61,7 @@ const mcpToolConfigs = {
     },
     get_action_guide: {
         title: "Get Action Guide",
-        description: "Return one action's compact markdown guide, including an execute_action example and input parameters.",
+        description: "Return one action's markdown guide: description, an execute_action example, input parameters, required scopes, provider permissions, execution policy, and the selected connection's status, plus the same capability object search_actions returns. Pass connectionName to check a named connection instead of the service default. Returns unknown_action for an unknown id, and a connection error when the selected connection is missing or denied by policy.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             actionId: z.string().describe("Full action id, for example github.get_current_user."),
@@ -67,7 +70,7 @@ const mcpToolConfigs = {
     },
     execute_action: {
         title: "Execute Action",
-        description: "Execute one local provider action by id with a JSON input object. Call get_action_guide first if the input shape is unclear.",
+        description: "Run one provider action by id against the provider's API, using the default connection or the named connectionName. The input object must match the action's input parameters. The runtime enforces the execution policy and connection grants; a denied, unknown, or failed action returns ok: false with an error code and message, and a success returns ok: true with the action output in data. Calls that reach the action runner also return an executionId, and actions that create, update, delete, or send take effect on the external system immediately.",
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
         inputSchema: z.object({
             actionId: z.string().describe("Full action id, for example hackernews.get_item."),

package/src/oauth/oauth-client-config-service.d.ts

@@ -9,6 +9,12 @@ export type OAuthClientConfig = {
     clientSecret: string;
     /** Non-empty provider-declared scope subset to request. Omit to use every provider default. */
     requestedScopes?: string[];
+    /**
+     * Absolute redirect URI registered with the provider in place of the runtime's
+     * `<origin>/oauth/callback`; any scheme (a custom app scheme, RFC 8252 §7.1).
+     * Omit to use the runtime callback.
+     */
+    redirectUri?: string;
     extra: Record<string, string>;
     secretExtra: Record<string, string>;
 };
@@ -17,6 +23,8 @@ export interface OAuthClientConfigInput {
     clientSecret: string;
     /** Non-empty provider-declared scope subset to request. Omit to use every provider default. */
     requestedScopes?: string[];
+    /** Absolute redirect URI override, any scheme. Omit to use the runtime callback. */
+    redirectUri?: string;
     extra?: Record<string, unknown>;
     secretExtra?: Record<string, unknown>;
 }
@@ -28,7 +36,10 @@ export interface OAuthClientConfigSummary {
     configured: boolean;
     customClientAvailable: boolean;
     clientId: string | null;
+    /** Redirect URI the provider must send the browser to: the configured override, else the runtime callback. */
     expectedRedirectUri: string;
+    /** Configured redirect URI override, or null when the runtime callback is used. */
+    redirectUri: string | null;
     /** Required client inputs absent from the stored configuration; never contains values. */
     missingFields: string[];
     auth: OAuth2AuthDefinition;
@@ -75,7 +86,11 @@ export declare class OAuthClientConfigService {
         service: string;
         configured: false;
     }>;
-    expectedRedirectUri(service: string): string;
+    /**
+     * The redirect URI an authorization request and its code exchange carry: the
+     * config's override when it has one, else the runtime's own callback route.
+     */
+    expectedRedirectUri(service: string, config?: Pick<OAuthClientConfig, "redirectUri">): string;
     resolveEndpointUrl(service: string, endpointUrl: string, config: OAuthClientConfig): string;
     getOAuthDefinition(service: string): OAuth2AuthDefinition;
     /** Resolve the scopes an authorization request should send. */

package/src/oauth/oauth-client-config-service.js

@@ -54,6 +54,7 @@ export class OAuthClientConfigService {
             clientId,
             clientSecret,
             requestedScopes: normalizeRequestedScopes(service, input.requestedScopes, auth.scopes),
+            redirectUri: normalizeRedirectUri(input.redirectUri),
             extra: normalizeCredentialValues({
                 fields: filterClientConfigFields(auth.clientConfigFields, "extra"),
                 values: pickClientConfigFieldValues(auth.clientConfigFields, submittedExtra, "extra"),
@@ -76,9 +77,13 @@ export class OAuthClientConfigService {
         await this.store.delete(service);
         return { service, configured: false };
     }
-    expectedRedirectUri(service) {
+    /**
+     * The redirect URI an authorization request and its code exchange carry: the
+     * config's override when it has one, else the runtime's own callback route.
+     */
+    expectedRedirectUri(service, config) {
         this.getOAuthDefinition(service);
-        return `${this.origin}${OAuthClientConfigService.callbackPath}`;
+        return config?.redirectUri ?? `${this.origin}${OAuthClientConfigService.callbackPath}`;
     }
     resolveEndpointUrl(service, endpointUrl, config) {
         this.getOAuthDefinition(service);
@@ -120,7 +125,8 @@ export class OAuthClientConfigService {
             configured: config != null,
             customClientAvailable: this.isCustomClientConfigAvailable(service),
             clientId: config?.clientId ?? null,
-            expectedRedirectUri: this.expectedRedirectUri(service),
+            expectedRedirectUri: this.expectedRedirectUri(service, config),
+            redirectUri: config?.redirectUri ?? null,
             missingFields: oauthClientFields(auth)
                 .filter((field) => {
                 if (!field.required)
@@ -152,6 +158,7 @@ export function readOAuthClientConfigMetadata(service, metadata) {
         clientId,
         clientSecret: optionalString(value?.clientSecret) ?? "",
         requestedScopes: optionalStringArray(value?.requestedScopes),
+        redirectUri: optionalString(value?.redirectUri),
         extra: readStringRecord(value?.extra),
         secretExtra: readStringRecord(value?.secretExtra),
     };
@@ -214,6 +221,55 @@ function normalizeRequestedScopes(service, requestedScopes, providerScopes) {
     }
     return normalized;
 }
+/**
+ * Schemes that can never be a redirection endpoint: they run script, embed a
+ * document, or read local resources in the browser that follows the redirect.
+ */
+const forbiddenRedirectUriSchemes = new Set(["javascript:", "vbscript:", "data:", "file:", "blob:", "about:"]);
+/**
+ * Validate a redirect URI override. It must be an absolute URL; the scheme is
+ * free (a native app registers a custom scheme with the provider, RFC 8252 §7.1)
+ * except for schemes that can never be a redirection endpoint, and user info and
+ * a fragment are not part of any registered redirect (RFC 6749 §3.1.2). The
+ * trimmed input is kept verbatim: the provider compares it byte for byte with
+ * the value registered on the OAuth app, so it is never re-serialized. That is
+ * why the checks read the raw string: the URL parser drops an empty `#` or `@`
+ * and strips tabs and newlines, so the parsed value can differ from the stored
+ * one.
+ */
+function normalizeRedirectUri(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must be a string.");
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must be an absolute URL.");
+    }
+    // A URI never carries whitespace, control characters, or a backslash (RFC 3986 §2).
+    if (/[\s\p{Cc}\\]/u.test(trimmed)) {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must be an absolute URL.");
+    }
+    if (forbiddenRedirectUriSchemes.has(url.protocol)) {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri scheme is not allowed.");
+    }
+    // The parser lowercases the scheme but keeps its length, so the raw authority
+    // starts right after it; an opaque path (no host) may legitimately contain `@`.
+    const authority = url.host ? /^\/*([^/?]*)/.exec(trimmed.slice(url.protocol.length))?.[1] : undefined;
+    if (trimmed.includes("#") || authority?.includes("@")) {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must not contain user info or a fragment.");
+    }
+    return trimmed;
+}
 /**
  * Resolve stored requested scopes against the currently declared provider
  * scopes. A provider can stop declaring a scope after configs were saved (for

package/src/oauth/oauth-credential-refresh-service.js

@@ -27,6 +27,8 @@ export class OAuthCredentialRefreshService {
             refreshed = await providerOAuth.refreshAccessToken({
                 refreshToken,
                 clientConfig: config,
+                metadata: credential.metadata,
+                providerSecret: credential.providerSecret,
                 fetcher: providerFetch,
                 createError,
             });
@@ -57,7 +59,7 @@ export class OAuthCredentialRefreshService {
             // not an option: a refresh only runs once that timestamp is already past, so
             // the stored token would look expired immediately and refresh on every call.
             expiresAt: refreshed.expiresAt ?? expiresAtFromLifetime(expiresIn),
-            providerSecret: credential.providerSecret,
+            providerSecret: refreshed.providerSecret ?? credential.providerSecret,
             profile: credential.profile,
             metadata: {
                 ...credential.metadata,

package/src/oauth/oauth-flow-service.d.ts

@@ -32,6 +32,12 @@ export interface OAuthAuthorizationState {
     createdAt: string;
     pkceCodeVerifier?: string;
     authorizationScopes?: string[];
+    /**
+     * `redirect_uri` the authorization request carried. The code exchange must
+     * repeat it (RFC 6749 §4.1.3) even when the client config changes while the
+     * browser is at the provider. Absent on states created before it was recorded.
+     */
+    redirectUri?: string;
     clientConfig?: OAuthClientConfig;
 }
 export interface OAuthFlowServiceOptions {