@zackbart/connecta 0.21.0 → 0.21.2

package/CHANGELOG.md

@@ -2,6 +2,80 @@
 
 All notable changes to this package are documented here.
 
+## 0.21.2 — 2026-08-31
+
+This patch closes two runtime isolation gaps: concurrent request scopes now
+share one downstream OAuth refresh inside a connector runtime, and QuickJS
+children no longer inherit the deployment process environment. Existing
+deployments need no configuration or storage migration. OAuth deployments get
+the refresh fix automatically; Node deployments using QuickJS get the tighter
+child boundary automatically. Deployments using neither path can ignore this
+release.
+
+### Changed
+
+- **Empty QuickJS child environments.** The Node process hosting the QuickJS
+  guest runtime starts with an explicit empty environment, so deployment
+  credentials and Node startup configuration such as `NODE_OPTIONS` never
+  cross the child-process boundary (#515).
+
+### Fixed
+
+- **One rotating-token redemption per runtime.** Concurrent request scopes for
+  one OAuth connector generation share the owner's refresh result or bounded
+  failure instead of independently redeeming the same refresh token. The gate
+  remains request-safe across follower and owner cancellation, storage
+  failures, force reauthorization, and issuer-generation changes (#514).
+- **Late and byte-identical refresh races.** Generation-scoped mutation and
+  success identities close token-save TOCTOU and complete-flight ABA windows,
+  including authorization servers that preserve the refresh token or return
+  byte-identical credentials. The guarantee is deliberately runtime-local;
+  `KVStorage` still has no cross-isolate compare-and-set primitive (#514).
+
+## 0.21.1 — 2026-08-30
+
+This patch aligns the handwritten Cloudflare and Notion contracts and the four
+hosted-provider manifests with their current catalogs. Existing deployments
+need no configuration or storage migration. Cloudflare programs that depend on
+provider fields outside the maintained `get_zone_setting` or
+`get_worker_settings` projections should pass `raw: true`. Stripe's server has
+retired three dedicated tool names, so programs that hardcoded them must search
+the current catalog and use the generic API tools or `stripe_analytics`.
+
+### Added
+
+- **Current Cloudflare jurisdictions.** All eight R2 bucket tools accept the
+  `us` jurisdiction alongside `default`, `eu`, and `fedramp`. KV namespace
+  creation accepts its separate `eu`, `fedramp`, and `us` set and preserves
+  jurisdiction on namespace reads (#498, #499).
+- **Current hosted-provider classifications.** Linear's workspace, template,
+  and issue-sharing tools join its plan-aware reviewed superset. RevenueCat's
+  refund-request preferences are read-only, and Mixpanel's metadata fill is a
+  destructive Lexicon update (#512).
+
+### Changed
+
+- **Useful Cloudflare result schemas.** All 48 named tools now declare their
+  maintained output keys. Zone settings and Worker settings project stable
+  camel-case fields by default and expose the provider response through
+  `raw: true`; rulesets, deployments, KV bulk operations, R2 CORS, and Pages
+  reuse named schemas instead of an empty object contract (#488).
+- **Stripe's current eleven tools.** Account listing, account-management links,
+  and analytics replace the retired account-info, refund, and report tools.
+  The integration planner and analytics are additive writes because their tool
+  boundaries can create provider-side guide or query-run state (#512).
+
+### Fixed
+
+- Worker settings retain VPC binding identity and observability fields,
+  rulesets retain origin-range metadata, and zone setting ids include
+  Cloudflare's current WebMCP settings (#500, #501, #502, #503).
+- Notion preserves every documented `verification.does_not_equal` value, and
+  Cloudflare's recorded KV bulk and zone-setting specifications match the
+  current published documents (#504, #509).
+- Mixpanel records the current schemas for all 64 classified tools, including
+  the three experiment contracts that changed since the prior review (#512).
+
 ## 0.21.0 — 2026-08-28
 
 Cloudflare Access becomes the canonical interactive-auth path for Worker

package/dist/auth/downstream-oauth.d.ts

@@ -1,5 +1,55 @@
-import type { OAuthClientInformationContext, OAuthClientInformationMixed, OAuthClientMetadata, OAuthClientProvider, OAuthTokens } from "@modelcontextprotocol/client";
+import type { FetchLike, OAuthClientInformationContext, OAuthClientInformationMixed, OAuthClientMetadata, OAuthClientProvider, OAuthTokens } from "@modelcontextprotocol/client";
 import type { KVStorage } from "../types.js";
+type OAuthRefreshFlightOutcome = {
+    status: "refreshed";
+} | {
+    status: "retired";
+} | {
+    status: "failed";
+    error: unknown;
+};
+interface OAuthRefreshFlight {
+    done: Promise<OAuthRefreshFlightOutcome>;
+    release: (outcome: OAuthRefreshFlightOutcome) => void;
+    stopObservingOwnerAbort: () => void;
+    mutationId: object;
+}
+/**
+ * Share one rotating-token redemption within one connector runtime and OAuth
+ * generation. The first request still owns the real fetch and response. Its
+ * abort signal has one bounded listener until the exact flight settles, so a
+ * cancellation after the response cannot strand waiters during token storage.
+ * Followers wait for that provider to save tokens, then re-read storage. The
+ * map never retains a token response or transport.
+ *
+ * This is intentionally runtime-local. KVStorage has no atomic coordination
+ * operation, so a second isolate can still race the same refresh token.
+ */
+export declare class OAuthRefreshCoordinator {
+    private readonly flights;
+    /** Opaque identities only: no request promise, signal, callback, or response. */
+    private readonly pendingMutations;
+    /** One bounded latest-success slot, containing only generation + identity. */
+    private successfulRefresh;
+    /** Replaced on every map mutation, closing flight/pending ABA across awaits. */
+    private stateRevision;
+    private advanceStateRevision;
+    private observeAuthoritativeGeneration;
+    private settle;
+    private markMutationPending;
+    private finishMutation;
+    /** @internal Opaque basis for issuer-aware provider token reads. */
+    successfulRefreshIdentity(generation: string): object | undefined;
+    coordinatedFetch(provider: KvOAuthProvider, baseFetch: FetchLike, requestSignal?: AbortSignal): FetchLike;
+    /** Publish one exact owner's successful save without disturbing a newer try. */
+    succeedMutation(generation: string, flight: OAuthRefreshFlight): void;
+    /** Give joined callers a fetch/flow failure, without rejecting the gate. */
+    fail(generation: string, flight: OAuthRefreshFlight, error: unknown): void;
+    /** Finish an exact failed credential write, then publish its failure. */
+    failMutation(generation: string, flight: OAuthRefreshFlight, error: unknown): void;
+    /** Force reauthorization fences and wakes every waiter on the retired epoch. */
+    retire(generation: string): void;
+}
 /**
  * Physical key for an OAuth value in one authorization epoch. Legacy values
  * keep their historical names so upgrades can read an existing grant. Modern
@@ -20,19 +70,31 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     private readonly connectorId;
     private readonly storage;
     private readonly redirectUri;
+    private readonly refreshCoordinator?;
     /**
      * The reset generation this provider's flow started under. Every OAuth value
      * it writes carries this epoch, so a late write can land after a reset without
      * becoming readable under the new generation.
      */
     private capturedGeneration;
-    constructor(connectorId: string, storage: KVStorage, redirectUri: string);
+    private refreshFlight;
+    /** Tokens this request's issuer-aware auth flow decided to refresh. */
+    private refreshBasis;
+    constructor(connectorId: string, storage: KVStorage, redirectUri: string, refreshCoordinator?: OAuthRefreshCoordinator | undefined);
     /**
      * Stamp the force-reauth generation the current connect flow started under.
      * Called by the connector once per connect, before c.connect(). The callback
      * path captures the generation stored beside its verified state instead.
      */
     captureGeneration(gen: string): void;
+    /** The generation captured for this flow, before a concurrent reset. */
+    flowGeneration(): Promise<string>;
+    /** @internal Record the refresh attempt this provider owns. */
+    captureRefreshFlight(generation: string, flight: OAuthRefreshFlight): void;
+    private succeedRefreshFlight;
+    private failRefreshFlight;
+    /** True when another request saved a refresh result after this flow's read. */
+    refreshBasisChanged(current: OAuthTokens, generation: string): boolean;
     /**
      * The epoch this provider writes under. Direct unit/custom use lazily captures
      * the current generation; connector-driven connect and callback paths stamp it
@@ -121,3 +183,4 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     resetAuthorization(operatorDisconnected?: boolean): Promise<void>;
     invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
 }
+export {};

package/dist/auth/downstream-oauth.js

@@ -26,6 +26,312 @@ const OAUTH_VALUE_KEYS = [
     "oauth:state",
 ];
 const MAX_CLEANUP_BACKLOG = 1_000;
+function isRefreshTokenRequest(init) {
+    if ((init?.method ?? "GET").toUpperCase() !== "POST")
+        return false;
+    const body = init?.body;
+    if (body instanceof URLSearchParams) {
+        return body.get("grant_type") === "refresh_token";
+    }
+    if (typeof body !== "string")
+        return false;
+    return new URLSearchParams(body).get("grant_type") === "refresh_token";
+}
+function sdkAcceptsOAuthTokens(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const candidate = value;
+    if (typeof candidate.access_token !== "string" ||
+        typeof candidate.token_type !== "string") {
+        return false;
+    }
+    for (const key of ["id_token", "scope", "refresh_token"]) {
+        if (candidate[key] !== undefined && typeof candidate[key] !== "string") {
+            return false;
+        }
+    }
+    if (candidate.expires_in !== undefined) {
+        try {
+            if (!Number.isFinite(Number(candidate.expires_in)))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+async function refreshResponseFailure(response) {
+    if (!response.ok) {
+        return new Error(`OAuth refresh failed with HTTP ${response.status}.`);
+    }
+    try {
+        return sdkAcceptsOAuthTokens(await response.clone().json())
+            ? undefined
+            : new Error("OAuth refresh response did not match the token schema.");
+    }
+    catch {
+        return new Error("OAuth refresh response did not contain JSON tokens.");
+    }
+}
+function refreshMutationPendingResponse() {
+    return Response.json({
+        error: "temporarily_unavailable",
+        error_description: "OAuth refresh is temporarily unavailable while previous credentials commit.",
+    }, { status: 503 });
+}
+function aborted(signal) {
+    return (signal.reason ?? new DOMException("This operation was aborted", "AbortError"));
+}
+async function waitForRefreshFlight(flight, signal) {
+    let outcome;
+    if (!signal) {
+        outcome = await flight.done;
+    }
+    else {
+        outcome = await new Promise((resolve, reject) => {
+            let settled = false;
+            const finish = (settle) => {
+                if (settled)
+                    return;
+                settled = true;
+                signal.removeEventListener("abort", onAbort);
+                settle();
+            };
+            const onAbort = () => finish(() => reject(aborted(signal)));
+            signal.addEventListener("abort", onAbort, { once: true });
+            void flight.done.then((result) => finish(() => resolve(result)));
+            // Abort may land between the caller's check and listener registration.
+            if (signal.aborted)
+                onAbort();
+        });
+    }
+    if (outcome.status === "failed")
+        throw outcome.error;
+    return outcome;
+}
+/**
+ * Share one rotating-token redemption within one connector runtime and OAuth
+ * generation. The first request still owns the real fetch and response. Its
+ * abort signal has one bounded listener until the exact flight settles, so a
+ * cancellation after the response cannot strand waiters during token storage.
+ * Followers wait for that provider to save tokens, then re-read storage. The
+ * map never retains a token response or transport.
+ *
+ * This is intentionally runtime-local. KVStorage has no atomic coordination
+ * operation, so a second isolate can still race the same refresh token.
+ */
+export class OAuthRefreshCoordinator {
+    flights = new Map();
+    /** Opaque identities only: no request promise, signal, callback, or response. */
+    pendingMutations = new Map();
+    /** One bounded latest-success slot, containing only generation + identity. */
+    successfulRefresh;
+    /** Replaced on every map mutation, closing flight/pending ABA across awaits. */
+    stateRevision = {};
+    advanceStateRevision() {
+        this.stateRevision = {};
+    }
+    observeAuthoritativeGeneration(generation) {
+        const staleGenerations = new Set([
+            ...this.flights.keys(),
+            ...this.pendingMutations.keys(),
+        ]);
+        for (const stale of staleGenerations) {
+            if (stale !== generation)
+                this.retire(stale);
+        }
+        if (this.successfulRefresh &&
+            this.successfulRefresh.generation !== generation) {
+            this.successfulRefresh = undefined;
+            this.advanceStateRevision();
+        }
+    }
+    settle(generation, flight, outcome) {
+        if (this.flights.get(generation) !== flight)
+            return;
+        this.flights.delete(generation);
+        this.advanceStateRevision();
+        flight.stopObservingOwnerAbort();
+        flight.release(outcome);
+    }
+    markMutationPending(generation, flight) {
+        if (this.flights.get(generation) !== flight)
+            return false;
+        this.pendingMutations.set(generation, flight.mutationId);
+        this.advanceStateRevision();
+        return true;
+    }
+    finishMutation(generation, flight) {
+        if (this.pendingMutations.get(generation) === flight.mutationId) {
+            this.pendingMutations.delete(generation);
+            this.advanceStateRevision();
+            return true;
+        }
+        return false;
+    }
+    /** @internal Opaque basis for issuer-aware provider token reads. */
+    successfulRefreshIdentity(generation) {
+        return this.successfulRefresh?.generation === generation
+            ? this.successfulRefresh.identity
+            : undefined;
+    }
+    coordinatedFetch(provider, baseFetch, requestSignal) {
+        return async (input, init) => {
+            // Await passthrough failures here so workerd associates the rejection
+            // with the fetch the SDK is already awaiting, rather than reporting the
+            // adopted inner promise as an unhandled rejection.
+            if (!isRefreshTokenRequest(init))
+                return await baseFetch(input, init);
+            const generation = await provider.flowGeneration();
+            const requestedRefreshToken = init?.body instanceof URLSearchParams
+                ? init.body.get("refresh_token")
+                : new URLSearchParams(String(init?.body ?? "")).get("refresh_token");
+            while (true) {
+                const revisionBeforeReads = this.stateRevision;
+                const activeGeneration = await provider.generation();
+                this.observeAuthoritativeGeneration(activeGeneration);
+                if (activeGeneration !== generation)
+                    this.retire(generation);
+                const activeFlight = this.flights.get(generation);
+                const pendingMutation = this.pendingMutations.get(generation);
+                if (activeGeneration === generation &&
+                    pendingMutation &&
+                    activeFlight?.mutationId !== pendingMutation) {
+                    return refreshMutationPendingResponse();
+                }
+                let currentTokens = activeGeneration === generation ? await provider.tokens() : undefined;
+                const latestGeneration = await provider.generation();
+                this.observeAuthoritativeGeneration(latestGeneration);
+                if (latestGeneration !== generation) {
+                    this.retire(generation);
+                    currentTokens = undefined;
+                }
+                if (this.stateRevision !== revisionBeforeReads)
+                    continue;
+                // Re-check both identities after every storage await. An owner can
+                // abort while this caller reads tokens, leaving only the mutation
+                // marker; a reset can likewise retire this caller's captured epoch.
+                const existing = this.flights.get(generation);
+                const latestPendingMutation = this.pendingMutations.get(generation);
+                if (latestGeneration === generation &&
+                    latestPendingMutation &&
+                    existing?.mutationId !== latestPendingMutation) {
+                    return refreshMutationPendingResponse();
+                }
+                // This flow may have read a token just before another flow saved its
+                // rotation. Replaying the retired token would recreate the race after
+                // the first network response. Give the SDK the already-saved rotating
+                // credential instead. A tokenless current value cannot do that: the
+                // SDK would merge the requested old refresh token back into it.
+                if (currentTokens?.refresh_token &&
+                    (currentTokens.refresh_token !== requestedRefreshToken ||
+                        provider.refreshBasisChanged(currentTokens, generation))) {
+                    return Response.json(currentTokens);
+                }
+                if (currentTokens?.refresh_token !== requestedRefreshToken) {
+                    return Response.json({
+                        error: "invalid_grant",
+                        error_description: "Refresh token is no longer active.",
+                    }, { status: 400 });
+                }
+                if (existing) {
+                    const outcome = await waitForRefreshFlight(existing, requestSignal);
+                    if (outcome.status === "refreshed") {
+                        const activeGeneration = await provider.generation();
+                        const refreshedTokens = activeGeneration === generation
+                            ? await provider.tokens()
+                            : undefined;
+                        if (refreshedTokens?.refresh_token) {
+                            return Response.json(refreshedTokens);
+                        }
+                    }
+                    continue;
+                }
+                let release;
+                const flight = {
+                    done: new Promise((resolve) => {
+                        release = resolve;
+                    }),
+                    release: (outcome) => release(outcome),
+                    stopObservingOwnerAbort: () => { },
+                    mutationId: {},
+                };
+                this.flights.set(generation, flight);
+                this.advanceStateRevision();
+                provider.captureRefreshFlight(generation, flight);
+                if (requestSignal) {
+                    let observing = true;
+                    const onOwnerAbort = () => {
+                        this.fail(generation, flight, aborted(requestSignal));
+                    };
+                    flight.stopObservingOwnerAbort = () => {
+                        if (!observing)
+                            return;
+                        observing = false;
+                        requestSignal.removeEventListener("abort", onOwnerAbort);
+                    };
+                    requestSignal.addEventListener("abort", onOwnerAbort, { once: true });
+                    // Abort may land between flight publication and listener registration.
+                    if (requestSignal.aborted)
+                        onOwnerAbort();
+                }
+                try {
+                    const response = await baseFetch(input, requestSignal ? { ...init, signal: requestSignal } : init);
+                    // These responses never reach a successful saveTokens callback. Give
+                    // current waiters a bounded failure now while leaving the owner's
+                    // response untouched for the SDK to parse and classify itself.
+                    const failure = await refreshResponseFailure(response);
+                    if (failure) {
+                        this.fail(generation, flight, failure);
+                    }
+                    else if (requestSignal?.aborted ||
+                        !this.markMutationPending(generation, flight)) {
+                        throw requestSignal?.aborted
+                            ? aborted(requestSignal)
+                            : new Error("OAuth refresh ended before tokens could be saved.");
+                    }
+                    return response;
+                }
+                catch (error) {
+                    this.fail(generation, flight, error);
+                    throw error;
+                }
+            }
+        };
+    }
+    /** Publish one exact owner's successful save without disturbing a newer try. */
+    succeedMutation(generation, flight) {
+        if (this.finishMutation(generation, flight)) {
+            this.successfulRefresh = { generation, identity: {} };
+            this.advanceStateRevision();
+        }
+        this.settle(generation, flight, { status: "refreshed" });
+    }
+    /** Give joined callers a fetch/flow failure, without rejecting the gate. */
+    fail(generation, flight, error) {
+        this.settle(generation, flight, { status: "failed", error });
+    }
+    /** Finish an exact failed credential write, then publish its failure. */
+    failMutation(generation, flight, error) {
+        this.finishMutation(generation, flight);
+        this.settle(generation, flight, { status: "failed", error });
+    }
+    /** Force reauthorization fences and wakes every waiter on the retired epoch. */
+    retire(generation) {
+        if (this.pendingMutations.delete(generation)) {
+            this.advanceStateRevision();
+        }
+        if (this.successfulRefresh?.generation === generation) {
+            this.successfulRefresh = undefined;
+            this.advanceStateRevision();
+        }
+        const flight = this.flights.get(generation);
+        if (!flight)
+            return;
+        this.settle(generation, flight, { status: "retired" });
+    }
+}
 function storedOAuthValue(value) {
     if (!value || typeof value !== "object")
         return false;
@@ -75,16 +381,21 @@ export class KvOAuthProvider {
     connectorId;
     storage;
     redirectUri;
+    refreshCoordinator;
     /**
      * The reset generation this provider's flow started under. Every OAuth value
      * it writes carries this epoch, so a late write can land after a reset without
      * becoming readable under the new generation.
      */
     capturedGeneration = null;
-    constructor(connectorId, storage, redirectUri) {
+    refreshFlight;
+    /** Tokens this request's issuer-aware auth flow decided to refresh. */
+    refreshBasis;
+    constructor(connectorId, storage, redirectUri, refreshCoordinator) {
         this.connectorId = connectorId;
         this.storage = storage;
         this.redirectUri = redirectUri;
+        this.refreshCoordinator = refreshCoordinator;
     }
     /**
      * Stamp the force-reauth generation the current connect flow started under.
@@ -94,6 +405,43 @@ export class KvOAuthProvider {
     captureGeneration(gen) {
         this.capturedGeneration = gen;
     }
+    /** The generation captured for this flow, before a concurrent reset. */
+    async flowGeneration() {
+        return this.capturedGeneration ?? this.generation();
+    }
+    /** @internal Record the refresh attempt this provider owns. */
+    captureRefreshFlight(generation, flight) {
+        this.refreshFlight = { generation, flight };
+    }
+    succeedRefreshFlight() {
+        const owned = this.refreshFlight;
+        this.refreshFlight = undefined;
+        if (owned) {
+            this.refreshCoordinator?.succeedMutation(owned.generation, owned.flight);
+        }
+    }
+    failRefreshFlight(error, mutationFinished = false) {
+        const owned = this.refreshFlight;
+        this.refreshFlight = undefined;
+        if (owned) {
+            if (mutationFinished) {
+                this.refreshCoordinator?.failMutation(owned.generation, owned.flight, error);
+            }
+            else {
+                this.refreshCoordinator?.fail(owned.generation, owned.flight, error);
+            }
+        }
+    }
+    /** True when another request saved a refresh result after this flow's read. */
+    refreshBasisChanged(current, generation) {
+        const basis = this.refreshBasis;
+        return Boolean(basis &&
+            basis.generation === generation &&
+            (basis.accessToken !== current.access_token ||
+                basis.refreshToken !== current.refresh_token ||
+                basis.successIdentity !==
+                    this.refreshCoordinator?.successfulRefreshIdentity(generation)));
+    }
     /**
      * The epoch this provider writes under. Direct unit/custom use lazily captures
      * the current generation; connector-driven connect and callback paths stamp it
@@ -274,10 +622,32 @@ export class KvOAuthProvider {
         await this.writeValue("oauth:client", info, (value) => JSON.stringify(value), ctx?.issuer);
     }
     async tokens(ctx) {
-        return this.readIssuerBoundValue("oauth:tokens", (raw) => JSON.parse(raw), (value) => JSON.stringify(value), ctx);
+        const refreshGeneration = ctx ? await this.flowGeneration() : undefined;
+        const successIdentity = refreshGeneration !== undefined
+            ? this.refreshCoordinator?.successfulRefreshIdentity(refreshGeneration)
+            : undefined;
+        const tokens = await this.readIssuerBoundValue("oauth:tokens", (raw) => JSON.parse(raw), (value) => JSON.stringify(value), ctx);
+        if (ctx && tokens && refreshGeneration !== undefined) {
+            this.refreshBasis = {
+                accessToken: tokens.access_token,
+                generation: refreshGeneration,
+                ...(tokens.refresh_token !== undefined
+                    ? { refreshToken: tokens.refresh_token }
+                    : {}),
+                ...(successIdentity !== undefined ? { successIdentity } : {}),
+            };
+        }
+        return tokens;
     }
     async saveTokens(tokens, ctx) {
-        await this.writeValue("oauth:tokens", tokens, (value) => JSON.stringify(value), ctx?.issuer);
+        try {
+            await this.writeValue("oauth:tokens", tokens, (value) => JSON.stringify(value), ctx?.issuer);
+            this.succeedRefreshFlight();
+        }
+        catch (error) {
+            this.failRefreshFlight(error, true);
+            throw error;
+        }
     }
     /**
      * OAuth `state`. The SDK calls this (when present) and appends the value to
@@ -317,7 +687,14 @@ export class KvOAuthProvider {
         return stored.value;
     }
     async redirectToAuthorization(authorizationUrl) {
-        await this.writeValue("oauth:pending", authorizationUrl.toString(), (raw) => raw);
+        try {
+            await this.writeValue("oauth:pending", authorizationUrl.toString(), (raw) => raw);
+            this.failRefreshFlight(new Error("OAuth refresh required reauthorization before tokens were saved."));
+        }
+        catch (error) {
+            this.failRefreshFlight(error);
+            throw error;
+        }
     }
     /** The stored authorization URL, if a flow is pending. */
     async pendingAuthorizationUrl() {
@@ -385,6 +762,7 @@ export class KvOAuthProvider {
         // reset's epoch after their cleanup finishes out of order.
         try {
             await this.storage.set("oauth:generation", active);
+            this.refreshCoordinator?.retire(previous);
         }
         catch (error) {
             try {
@@ -414,23 +792,33 @@ export class KvOAuthProvider {
             throw firstError;
     }
     async invalidateCredentials(scope) {
-        const generation = await this.writeGeneration();
-        if (scope === "all") {
-            await this.deleteAll([
-                oauthValueStorageKey("oauth:client", generation),
-                oauthValueStorageKey("oauth:tokens", generation),
-                oauthValueStorageKey("oauth:verifier", generation),
-            ]);
-            return;
-        }
-        if (scope === "client") {
-            await this.storage.delete(oauthValueStorageKey("oauth:client", generation));
-        }
-        if (scope === "tokens") {
-            await this.storage.delete(oauthValueStorageKey("oauth:tokens", generation));
+        const endsRefresh = scope === "all" || scope === "tokens";
+        try {
+            const generation = await this.writeGeneration();
+            if (scope === "all") {
+                await this.deleteAll([
+                    oauthValueStorageKey("oauth:client", generation),
+                    oauthValueStorageKey("oauth:tokens", generation),
+                    oauthValueStorageKey("oauth:verifier", generation),
+                ]);
+            }
+            else if (scope === "client") {
+                await this.storage.delete(oauthValueStorageKey("oauth:client", generation));
+            }
+            else if (scope === "tokens") {
+                await this.storage.delete(oauthValueStorageKey("oauth:tokens", generation));
+            }
+            else if (scope === "verifier") {
+                await this.storage.delete(oauthValueStorageKey("oauth:verifier", generation));
+            }
+            if (endsRefresh) {
+                this.failRefreshFlight(new Error("OAuth refresh invalidated credentials before tokens were saved."));
+            }
         }
-        if (scope === "verifier") {
-            await this.storage.delete(oauthValueStorageKey("oauth:verifier", generation));
+        catch (error) {
+            if (endsRefresh)
+                this.failRefreshFlight(error);
+            throw error;
         }
     }
 }