@zackbart/connecta 0.34.0 → 0.35.0

package/dist/auth/downstream-oauth.js

@@ -1,15 +1,72 @@
 import { UnauthorizedError } from "@modelcontextprotocol/client";
 import { Deferred, Effect } from "effect";
-import { revokeDownstreamGrant } from "./downstream-revocation.js";
-import { authenticateRemoteClient, downstreamClientMetadata, remoteClientAuthMethod, } from "./downstream-client-metadata.js";
+import { byteReadResponse } from "../byte-read-response.js";
+import { deriveContext } from "../derived-context.js";
+import { ConnectorCallError, resendAdvice } from "../errors.js";
+import { oauthPartitionFor, retainOAuthPartition } from "../oauth-partition.js";
+import { keepErrorName } from "../redaction-identity.js";
+import { fromSignal, runEdge } from "../runtime/run.js";
 import { SentSecrets } from "../sent-secrets.js";
-import { ConnectorCallError } from "../errors.js";
-import { attachOAuthPartition, oauthPartitionFor, retainOAuthPartition } from "../oauth-partition.js";
-import { inheritOAuthSealer } from "../oauth-sealing.js";
-import { detach, fromSignal, runEdge } from "../runtime/run.js";
-import { OAUTH_FLOW_TTL_SECONDS, OAUTH_REFRESH_LEASE_SECONDS, oauthFlowKeys, oauthGrantKeys, oauthRefreshKeys, oauthRefreshSpentKeys, oauthRefreshActiveKeys, } from "../storage/keys.js";
-import { isRefreshTokenRequest, isOAuthCredentialRequest, refreshResponseOutcome, sdkSafeTokenResponse, tokenGrantType, } from "./oauth-token-response.js";
-import { deleteV2Keys, discoveryIssuer, readV2Grant } from "./oauth-v2-migration.js";
+import { OAUTH_FLOW_TTL_SECONDS, OAUTH_REFRESH_LEASE_SECONDS, oauthFlowKeys, oauthGrantKeys, oauthRefreshActiveKeys, oauthRefreshKeys, oauthRefreshSpentKeys, } from "../storage/keys.js";
+import { authenticateRemoteClient, downstreamClientMetadata, remoteClientAuthMethod, } from "./downstream-client-metadata.js";
+import { revokeDownstreamGrant } from "./downstream-revocation.js";
+import { authAwait, authCall, authCatch, authDetached, authFlow, authInvoke, authMethod, authOwnMethod, authProgram, authStorage, authThen, authValue, registerAuth, registerAuthMethod, } from "./native.js";
+import { isOAuthCredentialRequest, isRefreshTokenRequest, refreshResponseOutcome, sdkSafeTokenResponse, tokenGrantType, } from "./oauth-token-response.js";
+import { deleteV2Keys, discoveryIssuer, readV2Grant, } from "./oauth-v2-migration.js";
+/** @internal Keep the SDK's cloned body reads inside the code exchange's request. */
+export function codeExchangeResponse(response, signal) {
+    if (!response.body)
+        return response;
+    const reader = response.body.getReader();
+    void reader.closed.catch(() => { });
+    let closed = false;
+    let abort;
+    const release = () => {
+        closed = true;
+        signal.removeEventListener("abort", abort);
+        reader.releaseLock();
+    };
+    const body = new ReadableStream({
+        start(controller) {
+            abort = () => {
+                if (closed)
+                    return;
+                void reader.cancel().catch(() => { });
+                release();
+                controller.error(signal.reason);
+            };
+            signal.addEventListener("abort", abort, { once: true });
+            if (signal.aborted)
+                abort();
+        },
+        async pull(controller) {
+            try {
+                const next = await reader.read();
+                if (closed)
+                    return;
+                if (next.done) {
+                    release();
+                    controller.close();
+                }
+                else
+                    controller.enqueue(next.value);
+            }
+            catch (error) {
+                if (!closed) {
+                    release();
+                    controller.error(error);
+                }
+            }
+        },
+        cancel() {
+            if (!closed) {
+                void reader.cancel().catch(() => { });
+                release();
+            }
+        },
+    });
+    return byteReadResponse(new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers }));
+}
 /** RFC 6749 section 3.3: one or more scope tokens, separated by single spaces. */
 const OAUTH_SCOPE = /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/;
 /** Refuse, at construction, a configured scope no authorization server could parse. */
@@ -20,16 +77,13 @@ export function assertOAuthScope(connectorId, scope) {
 }
 /**
  * The context an explicit authorization start runs under: allowed to begin
- * consent, with a request scope of its own, carrying the registry's sealer and
- * owner partition across the copy. Only `startAuth` builds one; status reads
- * and calls never do, which is what keeps them from starting authorization.
+ * consent, in the same request scope, and derived so the registry's sealer,
+ * owner partition, and every other call-state entry carry across the copy.
+ * Only `startAuth` builds one; status reads and calls never do, which is what
+ * keeps them from starting authorization.
  */
 export function authorizingContext(ctx) {
-    return attachOAuthPartition(inheritOAuthSealer(ctx, {
-        ...ctx,
-        requestScope: ctx.requestScope ?? ctx,
-        allowAuthorization: true,
-    }), oauthPartitionFor(ctx));
+    return deriveContext(ctx, { allowAuthorization: true });
 }
 /**
  * A callback whose consent another callback already claimed: fixed text, and
@@ -42,6 +96,7 @@ export class OAuthCallbackClaimedError extends ConnectorCallError {
         this.name = "OAuthCallbackClaimedError";
     }
 }
+keepErrorName(OAuthCallbackClaimedError, "OAuthCallbackClaimedError");
 /** A local destination guard proved that no OAuth HTTP request left. */
 export class OAuthRequestNotSentError extends ConnectorCallError {
 }
@@ -73,18 +128,51 @@ const REFRESH_REQUEST_DEADLINE_MS = 20_000;
 const REFRESH_WAIT_DEADLINE_MS = 35_000;
 function refreshWait(signal) {
     const deadline = new AbortController();
-    const timer = setTimeout(() => deadline.abort(), REFRESH_WAIT_DEADLINE_MS);
+    let timer = setTimeout(() => deadline.abort(), REFRESH_WAIT_DEADLINE_MS);
     let closed = false;
+    let transferred = false;
+    let requestStarted = false;
     const abort = () => deadline.abort(aborted(signal));
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted)
         abort();
     return {
         signal: deadline.signal,
-        run: (operation) => runEdge(Effect.raceAllFirst([
-            fromSignal(deadline.signal),
-            Effect.tryPromise({ try: operation, catch: (error) => error }),
-        ])),
+        get requestStarted() {
+            return requestStarted;
+        },
+        run: authMethod((operation) => {
+            return authFlow(function* () {
+                // A race's losing operation may still start. Check before constructing it,
+                // then again before handing a late result back to preparation.
+                if (deadline.signal.aborted)
+                    return (yield Effect.fail(aborted(deadline.signal)));
+                return (yield authThen(Effect.raceAllFirst([fromSignal(deadline.signal), authCall(operation, [])]), (value) => {
+                    if (deadline.signal.aborted)
+                        throw aborted(deadline.signal);
+                    return value;
+                }));
+            });
+        }),
+        transfer: () => {
+            if (deadline.signal.aborted)
+                throw aborted(deadline.signal);
+            if (transferred)
+                return;
+            // Synchronous with CAS submission: cancellation can prevent the write
+            // only before this point. Keep the independent preparation timer alive.
+            signal?.removeEventListener("abort", abort);
+            transferred = true;
+        },
+        beginRequest: () => {
+            if (deadline.signal.aborted)
+                throw aborted(deadline.signal);
+            requestStarted = true;
+            clearTimeout(timer);
+            timer = setTimeout(() => {
+                deadline.abort(new DOMException("OAuth refresh timed out", "TimeoutError"));
+            }, REFRESH_REQUEST_DEADLINE_MS);
+        },
         close: () => {
             if (closed)
                 return;
@@ -123,9 +211,16 @@ function tokenResponse(tokens) {
     return Response.json(answer);
 }
 function refreshTokensDigest(tokens) {
-    const { issuer: _issuer, ...answer } = tokens;
-    return oauthStateDigest(JSON.stringify(Object.fromEntries(Object.entries(answer).sort(([a], [b]) => a.localeCompare(b)))));
+    return runEdge(authProgram(refreshTokensDigestNative, [tokens]));
 }
+const refreshTokensDigestNative = /* @__PURE__ */ registerAuth(refreshTokensDigest, function (tokens) {
+    return authFlow(function* () {
+        const { issuer: _issuer, ...answer } = tokens;
+        return (yield authCall(oauthStateDigest, [
+            JSON.stringify(Object.fromEntries(Object.entries(answer).sort(([a], [b]) => a.localeCompare(b)))),
+        ]));
+    });
+});
 function requestedRefreshToken(init) {
     return init?.body instanceof URLSearchParams
         ? init.body.get("refresh_token")
@@ -154,254 +249,91 @@ export class OAuthRefreshCoordinator {
     constructor(retainPartition = () => () => { }) {
         this.retainPartition = retainPartition;
     }
-    coordinatedFetch(provider, baseFetch, requestSignal, defer, resourceFetch = baseFetch) {
-        return async (input, init) => {
-            // Freeze the form before any await: classification and the spent digest
-            // must describe the exact token sent, even if its caller mutates a form.
-            init = init
-                ? { ...init, ...(init.body instanceof URLSearchParams ? { body: new URLSearchParams(init.body) } : {}) }
-                : undefined;
-            if (isRefreshTokenRequest(init)) {
-                const signal = requestSignal && init?.signal
-                    ? AbortSignal.any([requestSignal, init.signal])
-                    : (requestSignal ?? init?.signal ?? undefined);
-                return this.refresh(provider, input, init, baseFetch, signal, defer);
-            }
-            const grantType = tokenGrantType(init);
-            const tokenRequest = isOAuthCredentialRequest(init);
-            const exchange = grantType === "authorization_code";
-            if (exchange) {
-                const answered = await provider.claimCodeExchange();
-                if (answered)
-                    return answered;
-            }
-            const dispatch = () => {
-                if (requestSignal?.aborted)
-                    throw aborted(requestSignal);
-                const signal = requestSignal
-                    ? init?.signal
+    coordinatedFetch(provider, baseFetch, requestSignal, defer, resourceFetch = baseFetch, prepareCredentialRequest) {
+        return authMethod((input, init) => {
+            return authFlow(function* () {
+                // Freeze the form before any await: classification and the spent digest
+                // must describe the exact token sent, even if its caller mutates a form.
+                init = init
+                    ? { ...init, ...(init.body instanceof URLSearchParams ? { body: new URLSearchParams(init.body) } : {}) }
+                    : undefined;
+                // Production adapters resolve the required host policy before a code or
+                // refresh claim can consume its single-use credential. Custom SDK leaves
+                // may supply their own policy; this hook performs no I/O and owns no data.
+                if (isOAuthCredentialRequest(init))
+                    prepareCredentialRequest?.();
+                if (isRefreshTokenRequest(init)) {
+                    const signal = requestSignal && init?.signal
                         ? AbortSignal.any([requestSignal, init.signal])
-                        : requestSignal
-                    : init?.signal;
-                // Credential-bearing OAuth requests use the raw send path. A redirect
-                // is a dispatched failure, never authority to send the form again.
-                return tokenRequest
-                    ? baseFetch(input, { ...init, redirect: "manual", ...(signal ? { signal } : {}) })
-                    : resourceFetch(input, { ...init, ...(signal ? { signal } : {}) });
-            };
-            // Awaited here so workerd associates a rejection with the fetch the SDK
-            // is already awaiting, not with an adopted inner promise.
-            const response = await (exchange ? provider.dispatchCodeExchange(dispatch, input) : dispatch());
-            if (!tokenRequest)
-                return response;
-            // A code exchange's failure is the SDK's to log as well.
-            const forSdk = await sdkSafeTokenResponse(response, exchange ? (tokens) => provider.recordCodeExchangeTokens(tokens) : undefined);
-            if (exchange && forSdk !== response)
-                provider.recordCodeExchangeRefusal(forSdk);
-            return forSdk;
-        };
-    }
-    async refresh(provider, input, init, baseFetch, signal, defer) {
-        const waiting = refreshWait(signal);
-        try {
-            // A verdict belongs to one refresh; never let an older one decide this.
-            provider.recordRefreshFailure(undefined);
-            const epoch = await waiting.run(() => provider.flowEpoch());
-            const requested = requestedRefreshToken(init);
-            for (let attempt = 0; attempt < 8; attempt++) {
-                if (signal?.aborted)
-                    throw aborted(signal);
-                const joined = this.flights.get(epoch);
-                if (joined) {
-                    const outcome = await waitForRefreshFlight(joined, signal, waiting.signal);
-                    if (outcome.status === "failed") {
-                        provider.recordRefreshFailure(outcome.verdict);
-                        throw outcome.error;
-                    }
-                    if (outcome.status === "refreshed")
-                        return provider.adoptRefresh(outcome.tokens);
-                    continue;
-                }
-                // Preparation reads share the same bound as later claim waits.
-                const current = await waiting.run(() => provider.storedTokens());
-                if (this.flights.has(epoch))
-                    continue;
-                if (current?.refresh_token &&
-                    (current.refresh_token !== requested || provider.refreshedSinceRead(current, epoch))) {
-                    return provider.adoptRefresh(current);
-                }
-                if (current?.refresh_token !== requested) {
-                    provider.recordRefreshFailure({ kind: "dead" });
-                    return Response.json({ error: "invalid_grant", error_description: "Refresh token is no longer active." }, { status: 400 });
-                }
-                const redemption = this.redeem(provider, epoch, requested, input, init, baseFetch, signal, waiting);
-                // The refresh owns its completion after dispatch, including storage.
-                // Attach it before yielding so a cancelled Worker keeps that work alive.
-                try {
-                    detach(Effect.promise(() => redemption), defer ? { waitUntil: defer } : undefined);
+                        : (requestSignal ?? init?.signal ?? undefined);
+                    return (yield authInvoke(this, "refresh", [provider, input, init, baseFetch, signal, defer]));
                 }
-                catch {
-                    // A missing or refusing runtime hook still leaves the promise running.
+                const grantType = tokenGrantType(init);
+                const tokenRequest = isOAuthCredentialRequest(init);
+                const exchange = grantType === "authorization_code";
+                if (exchange) {
+                    const answered = (yield authInvoke(provider, "claimCodeExchange", []));
+                    if (answered)
+                        return answered;
                 }
-                if (!signal)
-                    return await redemption;
-                return await runEdge(Effect.raceAllFirst([
-                    Effect.tryPromise({ try: () => redemption, catch: (error) => error }),
-                    fromSignal(signal),
+                const dispatch = authMethod(() => {
+                    return authFlow(function* () {
+                        if (requestSignal?.aborted)
+                            throw aborted(requestSignal);
+                        const signal = requestSignal
+                            ? init?.signal
+                                ? AbortSignal.any([requestSignal, init.signal])
+                                : requestSignal
+                            : init?.signal;
+                        // Credential-bearing OAuth requests use the raw send path. A redirect
+                        // is a dispatched failure, never authority to send the form again.
+                        return (yield tokenRequest
+                            ? authCall(baseFetch, [input, { ...init, redirect: "manual", ...(signal ? { signal } : {}) }])
+                            : authCall(resourceFetch, [input, { ...init, ...(signal ? { signal } : {}) }]));
+                    }.bind(this));
+                });
+                // Await the composed fetch here so workerd associates a rejection with
+                // the fetch the SDK is already awaiting.
+                const response = (yield exchange
+                    ? authInvoke(provider, "dispatchCodeExchange", [dispatch, input])
+                    : authCall(dispatch, []));
+                if (!tokenRequest)
+                    return response;
+                // A code exchange's failure is the SDK's to log as well.
+                const forSdk = (yield authCall(sdkSafeTokenResponse, [
+                    response,
+                    exchange
+                        ? authMethod((tokens) => {
+                            return authInvoke(provider, "recordCodeExchangeTokens", [tokens]);
+                        })
+                        : undefined,
                 ]));
-            }
-            throw provider.refreshContended();
-        }
-        catch (error) {
-            if (signal?.aborted)
-                throw aborted(signal);
-            if (waiting.signal.aborted)
-                throw provider.refreshContended();
-            throw error;
-        }
-        finally {
-            waiting.close();
-        }
+                if (exchange && forSdk !== response)
+                    provider.recordCodeExchangeRefusal(forSdk);
+                return forSdk;
+            }.bind(this));
+        });
     }
-    async redeem(provider, epoch, requested, input, init, baseFetch, signal, waiting) {
-        const flight = { outcome: Deferred.makeUnsafe() };
-        this.flights.set(epoch, flight);
-        // Pin the owner partition until the flight settles, whoever is waiting.
-        const release = this.retainPartition();
-        const settle = (outcome) => {
-            if (this.flights.get(epoch) === flight)
-                this.flights.delete(epoch);
-            release();
-            // Last, because joined fibers resume inside this call.
-            Deferred.doneUnsafe(flight.outcome, Effect.succeed(outcome));
-        };
-        const fail = (error, verdict) => {
-            if (verdict)
-                provider.recordRefreshFailure(verdict);
-            settle({ status: "failed", error, ...(verdict ? { verdict } : {}) });
-        };
-        // The authorization server this redemption answers to, fixed now.
-        const issuer = provider.refreshIssuer(epoch);
-        let lease;
-        try {
-            const claim = await provider.claimRefresh(epoch, requested, signal, waiting);
-            if (claim instanceof Response) {
-                const tokens = await waiting.run(() => provider.storedTokens());
-                if (tokens)
-                    settle({ status: "refreshed", tokens });
-                else
-                    settle({ status: "retired" });
-                return claim;
-            }
-            lease = claim;
-        }
-        catch (error) {
-            fail(error, provider.refreshVerdict());
-            throw error;
-        }
-        const releaseLease = async (verdict, resolution = "ambiguous") => {
-            await provider.releaseRefresh(lease, verdict, undefined, resolution);
-        };
-        let outcome;
-        const deadline = new AbortController();
-        let dispatched = false;
-        let timer;
-        try {
-            const read = provider
-                .dispatchRefresh(lease, () => {
-                if (signal?.aborted)
-                    throw aborted(signal);
-                if (init?.signal?.aborted)
-                    throw aborted(init.signal);
-                dispatched = true;
-                // Preparation remains bounded through the send transition. After
-                // dispatch, caller cancellation must not prevent an answer's commit.
-                waiting.close();
-                // Start the deadline at dispatch, including the response body read.
-                timer = setTimeout(() => {
-                    deadline.abort(new DOMException("OAuth refresh timed out", "TimeoutError"));
-                }, REFRESH_REQUEST_DEADLINE_MS);
-                return baseFetch(input, { ...init, redirect: "manual", signal: deadline.signal });
-            }, waiting)
-                .then((response) => {
-                if (deadline.signal.aborted) {
-                    void response.body?.cancel().catch(() => { });
-                    throw aborted(deadline.signal);
-                }
-                return refreshResponseOutcome(response, deadline.signal);
-            });
-            // The deadline can settle the race before a late fetch/body rejects.
-            void read.catch(() => { });
-            outcome = await runEdge(Effect.raceAllFirst([
-                Effect.tryPromise({ try: () => read, catch: (error) => error }),
-                fromSignal(deadline.signal),
-            ]));
-            if (deadline.signal.aborted)
-                throw aborted(deadline.signal);
-        }
-        catch (error) {
-            if (!dispatched) {
-                // A cancelled or timed-out unsent holder leaves a safely expiring
-                // claim. Cleanup must not retain its local flight or partition pin.
-                if (!waiting.signal.aborted && !signal?.aborted && !init?.signal?.aborted) {
-                    await waiting.run(() => releaseLease()).catch(() => { });
-                    if (provider.refreshVerdict()?.kind === "dead") {
-                        await waiting.run(() => provider.discardRefusedGrant(requested, epoch)).catch(() => { });
-                    }
-                }
-                const failure = !signal?.aborted && waiting.signal.aborted ? provider.refreshContended() : error;
-                fail(failure, provider.refreshVerdict());
-                throw failure;
-            }
-            // A sent request without a definitive answer may have rotated the token.
-            // Persist the refusal before dropping tokens, so interrupted cleanup or a
-            // later write of the same fingerprint cannot make it redeemable again.
-            const failure = new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
-            await releaseLease({ kind: "dead" });
-            await provider.discardRefusedGrant(requested, epoch);
-            fail(failure, { kind: "dead" });
-            throw failure;
-        }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-        }
-        // An answer exists from here on, and is committed whatever the owner does.
-        if (outcome.failure) {
-            // Drop a refused grant while the flight still stands: a caller arriving
-            // meanwhile joins it instead of redeeming the dead token again.
-            await provider.discardRefusedGrant(requested, epoch);
-            await releaseLease(outcome.verdict, "resolved");
-            fail(outcome.failure, outcome.verdict);
-            return outcome.forSdk;
-        }
-        // The server consumed the old refresh token; the SDK merges it back the
-        // same way when a rotation omits one.
-        const accepted = {
-            ...outcome.tokens,
-            ...(outcome.tokens.refresh_token === undefined && requested !== null ? { refresh_token: requested } : {}),
-        };
-        let committed;
-        try {
-            committed = await provider.storeRefresh(epoch, requested, accepted, issuer);
-        }
-        catch {
-            const failure = new UnauthorizedError("OAuth refresh could not be committed; authorization required.");
-            await releaseLease({ kind: "dead" }, "resolved");
-            await provider.discardRefusedGrant(requested, epoch);
-            fail(failure, { kind: "dead" });
-            throw failure;
-        }
-        if (!committed) {
-            // Restart, Disconnect, or another consent decides the newer grant.
-            await releaseLease({ kind: "dead" }, "resolved");
-            const failure = new UnauthorizedError("OAuth refresh grant is no longer active.");
-            fail(failure, { kind: "dead" });
-            throw failure;
-        }
-        await provider.releaseRefresh(lease, undefined, committed, "resolved");
-        settle({ status: "refreshed", tokens: committed });
-        return provider.adoptRefresh(committed);
+    refresh(provider, input, init, baseFetch, signal, defer) {
+        return runEdge(authOwnMethod(OAuthRefreshCoordinator.prototype, this, "refresh", [
+            provider,
+            input,
+            init,
+            baseFetch,
+            signal,
+            defer,
+        ]));
+    }
+    redeem(provider, epoch, requested, input, init, baseFetch, waiting) {
+        return runEdge(authOwnMethod(OAuthRefreshCoordinator.prototype, this, "redeem", [
+            provider,
+            epoch,
+            requested,
+            input,
+            init,
+            baseFetch,
+            waiting,
+        ]));
     }
     /** A reset fenced `epoch`: wake its joiners now rather than at the answer. */
     retire(epoch) {
@@ -411,6 +343,235 @@ export class OAuthRefreshCoordinator {
         this.flights.delete(epoch);
         Deferred.doneUnsafe(flight.outcome, Effect.succeed({ status: "retired" }));
     }
+    static {
+        registerAuthMethod(OAuthRefreshCoordinator.prototype, "refresh", function (provider, input, init, baseFetch, signal, defer) {
+            return authFlow(function* () {
+                if (signal?.aborted)
+                    throw aborted(signal);
+                const waiting = refreshWait(signal);
+                let redeeming = false;
+                try {
+                    // A verdict belongs to one refresh; never let an older one decide this.
+                    provider.recordRefreshFailure(undefined);
+                    const epoch = (yield authInvoke(waiting, "run", [
+                        authMethod(() => {
+                            return authInvoke(provider, "flowEpoch", []);
+                        }),
+                    ]));
+                    const requested = requestedRefreshToken(init);
+                    for (let attempt = 0; attempt < 8; attempt++) {
+                        if (signal?.aborted)
+                            throw aborted(signal);
+                        const joined = this.flights.get(epoch);
+                        if (joined) {
+                            const outcome = (yield authCall(waitForRefreshFlight, [
+                                joined,
+                                signal,
+                                waiting.signal,
+                            ]));
+                            if (signal?.aborted)
+                                throw aborted(signal);
+                            if (outcome.status === "failed") {
+                                provider.recordRefreshFailure(outcome.verdict);
+                                throw outcome.error;
+                            }
+                            if (outcome.status === "refreshed")
+                                return provider.adoptRefresh(outcome.tokens);
+                            continue;
+                        }
+                        // Preparation reads share the same bound as later claim waits.
+                        const current = (yield authInvoke(waiting, "run", [
+                            authMethod(() => {
+                                return authInvoke(provider, "storedTokens", [waiting.signal]);
+                            }),
+                        ]));
+                        if (this.flights.has(epoch))
+                            continue;
+                        if (current?.refresh_token &&
+                            (current.refresh_token !== requested || provider.refreshedSinceRead(current, epoch))) {
+                            return provider.adoptRefresh(current);
+                        }
+                        if (current?.refresh_token !== requested) {
+                            provider.recordRefreshFailure({ kind: "dead" });
+                            return Response.json({ error: "invalid_grant", error_description: "Refresh token is no longer active." }, { status: 400 });
+                        }
+                        redeeming = true;
+                        // Claim submission transfers renewal, including preparation, token
+                        // request and commit, to a bounded native coordinator. Only
+                        // this caller's wait races its signal; the coordinator receives
+                        // no request/call Context authority or caller-owned deadline.
+                        const redemption = authDetached(authInvoke(this, "redeem", [
+                            provider,
+                            epoch,
+                            requested,
+                            input,
+                            init,
+                            baseFetch,
+                            waiting,
+                        ]).pipe(Effect.ensuring(Effect.sync(() => waiting.close()))), defer);
+                        return (yield signal ? Effect.raceFirst(redemption, fromSignal(signal)) : redemption);
+                    }
+                    throw provider.refreshContended();
+                }
+                catch (error) {
+                    if (signal?.aborted)
+                        throw aborted(signal);
+                    if (waiting.signal.aborted && !waiting.requestStarted)
+                        throw provider.refreshContended();
+                    throw error;
+                }
+                finally {
+                    if (!redeeming)
+                        waiting.close();
+                }
+            }.bind(this));
+        }, OAuthRefreshCoordinator.prototype.refresh);
+        registerAuthMethod(OAuthRefreshCoordinator.prototype, "redeem", function (provider, epoch, requested, input, init, baseFetch, waiting) {
+            return authFlow(function* () {
+                const flight = { outcome: Deferred.makeUnsafe() };
+                this.flights.set(epoch, flight);
+                // Pin the owner partition until the flight settles, whoever is waiting.
+                const release = this.retainPartition();
+                const settle = (outcome) => {
+                    if (this.flights.get(epoch) === flight)
+                        this.flights.delete(epoch);
+                    release();
+                    // Last, because joined fibers resume inside this call.
+                    Deferred.doneUnsafe(flight.outcome, Effect.succeed(outcome));
+                };
+                const fail = (error, verdict) => {
+                    if (verdict)
+                        provider.recordRefreshFailure(verdict);
+                    settle({ status: "failed", error, ...(verdict ? { verdict } : {}) });
+                };
+                // The authorization server this redemption answers to, fixed now.
+                const issuer = provider.refreshIssuer(epoch);
+                let lease;
+                try {
+                    const claim = (yield authInvoke(provider, "claimRefresh", [epoch, requested, undefined, waiting]));
+                    if (claim instanceof Response) {
+                        const tokens = (yield authInvoke(waiting, "run", [
+                            authMethod(() => {
+                                return authInvoke(provider, "storedTokens", [waiting.signal]);
+                            }),
+                        ]));
+                        if (tokens)
+                            settle({ status: "refreshed", tokens });
+                        else
+                            settle({ status: "retired" });
+                        return claim;
+                    }
+                    lease = claim;
+                }
+                catch (error) {
+                    fail(error, provider.refreshVerdict());
+                    throw error;
+                }
+                const releaseLease = authMethod((verdict, resolution = "ambiguous") => {
+                    return authFlow(function* () {
+                        (yield authInvoke(provider, "releaseRefresh", [lease, verdict, undefined, resolution]));
+                    }.bind(this));
+                });
+                let outcome;
+                const deadline = waiting.signal;
+                let dispatched = false;
+                try {
+                    const read = authFlow(function* () {
+                        const response = (yield authInvoke(provider, "dispatchRefresh", [
+                            lease,
+                            authMethod(() => authFlow(function* () {
+                                waiting.beginRequest();
+                                dispatched = true;
+                                return (yield authCall(baseFetch, [
+                                    input,
+                                    { ...init, redirect: "manual", signal: deadline },
+                                ]));
+                            }.bind(this))),
+                            waiting,
+                        ]));
+                        if (deadline.aborted) {
+                            void response.body?.cancel().catch(() => { });
+                            throw aborted(deadline);
+                        }
+                        return (yield authCall(refreshResponseOutcome, [response, deadline]));
+                    }.bind(this));
+                    outcome = (yield Effect.raceFirst(read, fromSignal(deadline)));
+                    if (deadline.aborted)
+                        throw aborted(deadline);
+                }
+                catch (error) {
+                    if (!dispatched) {
+                        // Only the coordinator's own preparation deadline can interrupt a
+                        // submitted claim. Caller cancellation no longer reaches this work.
+                        if (!waiting.signal.aborted) {
+                            (yield authCatch(authInvoke(waiting, "run", [
+                                authMethod(() => {
+                                    return authCall(releaseLease, []);
+                                }),
+                            ]), () => { }));
+                            if (provider.refreshVerdict()?.kind === "dead") {
+                                (yield authCatch(authInvoke(waiting, "run", [
+                                    authMethod(() => {
+                                        return authInvoke(provider, "discardRefusedGrant", [requested, epoch]);
+                                    }),
+                                ]), () => { }));
+                            }
+                        }
+                        const failure = waiting.signal.aborted ? provider.refreshContended() : error;
+                        fail(failure, provider.refreshVerdict());
+                        throw failure;
+                    }
+                    // A sent request without a definitive answer may have rotated the token.
+                    // Persist the refusal before dropping tokens, so interrupted cleanup or a
+                    // later write of the same fingerprint cannot make it redeemable again.
+                    const failure = new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
+                    (yield authCall(releaseLease, [{ kind: "dead" }]));
+                    (yield authInvoke(provider, "discardRefusedGrant", [requested, epoch]));
+                    fail(failure, { kind: "dead" });
+                    throw failure;
+                }
+                finally {
+                    waiting.close();
+                }
+                // An answer exists from here on, and is committed whatever the owner does.
+                if (outcome.failure) {
+                    // Drop a refused grant while the flight still stands: a caller arriving
+                    // meanwhile joins it instead of redeeming the dead token again.
+                    (yield authInvoke(provider, "discardRefusedGrant", [requested, epoch]));
+                    (yield authCall(releaseLease, [outcome.verdict, "resolved"]));
+                    fail(outcome.failure, outcome.verdict);
+                    return outcome.forSdk;
+                }
+                // The server consumed the old refresh token; the SDK merges it back the
+                // same way when a rotation omits one.
+                const accepted = {
+                    ...outcome.tokens,
+                    ...(outcome.tokens.refresh_token === undefined && requested !== null ? { refresh_token: requested } : {}),
+                };
+                let committed;
+                try {
+                    committed = (yield authInvoke(provider, "storeRefresh", [epoch, requested, accepted, issuer]));
+                }
+                catch {
+                    const failure = new UnauthorizedError("OAuth refresh could not be committed; authorization required.");
+                    (yield authCall(releaseLease, [{ kind: "dead" }, "resolved"]));
+                    (yield authInvoke(provider, "discardRefusedGrant", [requested, epoch]));
+                    fail(failure, { kind: "dead" });
+                    throw failure;
+                }
+                if (!committed) {
+                    // Restart, Disconnect, or another consent decides the newer grant.
+                    (yield authCall(releaseLease, [{ kind: "dead" }, "resolved"]));
+                    const failure = new UnauthorizedError("OAuth refresh grant is no longer active.");
+                    fail(failure, { kind: "dead" });
+                    throw failure;
+                }
+                (yield authInvoke(provider, "releaseRefresh", [lease, undefined, committed, "resolved"]));
+                settle({ status: "refreshed", tokens: committed });
+                return provider.adoptRefresh(committed);
+            }.bind(this));
+        }, OAuthRefreshCoordinator.prototype.redeem);
+    }
 }
 /**
  * One refresh coordinator per owner partition, for one connector runtime.
@@ -452,18 +613,23 @@ const MAX_GRANT_WRITES = 32;
  * flow record's fifteen minutes.
  */
 const PENDING_AUTHORIZATION_MAX_AGE_MS = 10 * 60 * 1000;
-async function discoveryBinding(state) {
-    return state
-        ? {
-            issuer: discoveryIssuer(state),
-            tokenEndpoint: state.authorizationServerMetadata?.token_endpoint,
-            ...(state.authorizationServerMetadata?.authorization_response_iss_parameter_supported === true
-                ? { issRequired: true }
-                : {}),
-            discovery: await oauthStateDigest(JSON.stringify(state)),
-        }
-        : {};
+function discoveryBinding(state) {
+    return runEdge(authProgram(discoveryBindingNative, [state]));
 }
+const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, function (state) {
+    return authFlow(function* () {
+        return state
+            ? {
+                issuer: discoveryIssuer(state),
+                tokenEndpoint: state.authorizationServerMetadata?.token_endpoint,
+                ...(state.authorizationServerMetadata?.authorization_response_iss_parameter_supported === true
+                    ? { issRequired: true }
+                    : {}),
+                discovery: (yield authCall(oauthStateDigest, [JSON.stringify(state)])),
+            }
+            : {};
+    });
+});
 function plainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -589,7 +755,7 @@ export class KvOAuthProvider {
     constructor(connectorId, storage, redirectUri, refreshCoordinator, allowAuthorization = true, 
     /** Present when the deployment's vault can seal; the grant is then ciphertext. */
     sealer, 
-    /** Request ownership for a start; a timed-out SDK hook may still resume. */
+    /** SDK hook ownership; renewal ignores it after claim submission. */
     signal, 
     /** Stable connector configuration bound to dynamically registered clients. */
     clientBinding, 
@@ -624,129 +790,83 @@ export class KvOAuthProvider {
         const client = this.clientOptions?.client;
         return downstreamClientMetadata(this.redirectUri, this.scope, this.clientOptions?.name, client ? remoteClientAuthMethod(client) : "none");
     }
+    /** A preparation await owns no continuation after its call/request closes.
+     * null explicitly selects coordinator/reset ownership, never the caller. */
+    wait(work, signal = this.signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "wait", [work, signal]));
+    }
+    /** Legacy helpers must fence their inner reads/deletes too, not just our join. */
+    preparationStorage(signal) {
+        if (!signal)
+            return this.storage;
+        const storage = this.storage;
+        return {
+            ...storage,
+            get: authMethod((key) => {
+                return authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(storage, "get", [key]);
+                    }),
+                    signal,
+                ]);
+            }),
+            list: authMethod((prefix) => {
+                return authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(storage, "list", [prefix]);
+                    }),
+                    signal,
+                ]);
+            }),
+            delete: authMethod((key) => {
+                return authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(storage, "delete", [key]);
+                    }),
+                    signal,
+                ]);
+            }),
+        };
+    }
     // --- the grant record ---------------------------------------------------
     /** The grant's additional authenticated data: record and epoch. */
     grantLabel(epoch) {
         return `${GRANT}:${epoch}`;
     }
-    async encodeGrant(grant) {
-        this.assertCredentialFree({ issuer: grant.body.issuer, discovery: grant.body.discovery }, grant.body);
-        const stored = {
-            connectaOAuth: GRANT_VERSION,
-            epoch: grant.epoch,
-            ...(grant.cleanupPending ? { cleanupPending: true } : {}),
-            ...(grant.flow !== undefined ? { flow: grant.flow } : {}),
-        };
-        if (Object.keys(grant.body).length > 0) {
-            if (this.sealer) {
-                stored.sealed = await this.sealer.seal(this.grantLabel(grant.epoch), JSON.stringify(grant.body));
-            }
-            else {
-                stored.body = grant.body;
-            }
-        }
-        return JSON.stringify(stored);
+    encodeGrant(grant, signal = this.signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "encodeGrant", [grant, signal]));
     }
     /**
      * Open a stored grant. A body that does not open — tampered, under a
      * rotated key, moved from another connector, owner, or epoch, or sealed
      * with no sealer configured — reads as empty: authorization again.
      */
-    async openGrant(raw) {
-        if (raw === null)
-            return { epoch: INITIAL_EPOCH, body: {} };
-        const stored = storedGrant(raw);
-        if (!stored)
-            return { epoch: UNREADABLE_EPOCH, body: {} };
-        let body = stored.body;
-        if (stored.sealed !== undefined) {
-            body = undefined;
-            try {
-                if (this.sealer)
-                    body = parsed(await this.sealer.open(this.grantLabel(stored.epoch), stored.sealed));
-            }
-            catch {
-                this.sealer?.warn(`[connecta] connector "${this.connectorId}" has a sealed OAuth grant ` +
-                    "the configured vault cannot open; treating it as absent, so the " +
-                    "connector needs authorization again. A changed vault key or " +
-                    "tampered storage causes this.");
-            }
-        }
-        return {
-            epoch: stored.epoch,
-            ...(stored.cleanupPending ? { cleanupPending: true } : {}),
-            ...(stored.flow !== undefined ? { flow: stored.flow } : {}),
-            body: grantBody(body),
-        };
+    openGrant(raw, signal = this.signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "openGrant", [raw, signal]));
     }
     /**
      * The grant as stored now, migrating layout 2 on first sight. A plaintext
      * body, written before the vault could seal, is sealed where it lies by
      * compare-and-set; a failure leaves it readable for the next write to seal.
      */
-    async readGrant() {
-        let raw = await this.storage.get(GRANT);
-        if (raw === null)
-            raw = await this.migrate();
-        if (raw !== null && storedGrant(raw)?.cleanupPending)
-            raw = await this.cleanupV2(raw);
-        const grant = await this.openGrant(raw);
-        if (raw !== null && this.sealer && storedGrant(raw)?.body !== undefined && !this.signal?.aborted) {
-            const sealed = await this.encodeGrant(grant);
-            if (await this.storage.compareAndSet(GRANT, raw, sealed).catch(() => false))
-                raw = sealed;
-        }
-        return { raw, grant };
+    readGrant(signal = this.signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "readGrant", [signal]));
     }
-    /**
-     * Layout 2's grant, written once as this owner's record. Whichever request
-     * writes first wins; the layout 2 keys are deleted once a record exists.
-     */
-    async migrate() {
-        const found = await readV2Grant(this.storage, this.sealer);
-        // A request that has already left writes nothing, this included.
-        if (!found || this.signal?.aborted)
-            return null;
-        const prefix = found.disconnected ? DISCONNECTED_EPOCH_PREFIX : ACTIVE_EPOCH_PREFIX;
-        const encoded = await this.encodeGrant({
-            epoch: `${prefix}${crypto.randomUUID()}`,
-            body: found.body,
-            cleanupPending: true,
-        });
-        let written;
-        try {
-            written = await this.storage.compareAndSet(GRANT, null, encoded);
-        }
-        catch {
-            // A store's own error can quote the value it refused.
-            throw this.credentialWriteError();
-        }
-        const raw = written ? encoded : await this.storage.get(GRANT);
-        return raw;
+    /** Layout 2 migration and its cleanup retain the reading operation's owner. */
+    migrate(signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "migrate", [signal]));
     }
     /** Deletion is retried on every read, including reads after a reset. */
-    async cleanupV2(raw) {
-        try {
-            if (!(await deleteV2Keys(this.storage)))
-                return raw;
-            const grant = await this.openGrant(raw);
-            delete grant.cleanupPending;
-            const cleared = await this.encodeGrant(grant);
-            if (await this.storage.compareAndSet(GRANT, raw, cleared))
-                return cleared;
-            return this.storage.get(GRANT);
-        }
-        catch {
-            // The durable marker survives both deletion and marker-clear failures.
-            return raw;
-        }
+    cleanupV2(raw, signal = this.signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "cleanupV2", [raw, signal]));
     }
     /** The grant a bound flow reads: a replaced epoch fails it. */
-    async boundGrant() {
-        const { grant } = await this.readGrant();
-        if (this.bound && grant.epoch !== this.epoch)
-            throw this.flowSuperseded();
-        return grant;
+    boundGrant(signal = this.signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "boundGrant", [signal]));
+    }
+    /** SDK preparation is call/request-owned; coordinator reads explicitly opt out. */
+    activeGrant() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "activeGrant", []));
     }
     /**
      * The one way a grant changes: read, change, compare-and-set, again while
@@ -756,58 +876,12 @@ export class KvOAuthProvider {
      * writes after the request's abort too. `change` returning undefined
      * leaves the grant as it is.
      */
-    async updateGrant(change, options = {}) {
-        for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
-            if (!options.commit && this.signal?.aborted)
-                return false;
-            const { raw, grant } = await this.readGrant();
-            const epoch = options.epoch ?? (this.epoch ??= grant.epoch);
-            if (grant.epoch !== epoch) {
-                if (options.quiet || !this.bound)
-                    return false;
-                throw this.flowSuperseded();
-            }
-            // A disconnect's epoch holds nothing until an explicit start replaces it.
-            if (isDisconnectedEpoch(epoch))
-                return false;
-            const next = change(grant);
-            if (next === undefined)
-                return true;
-            const encoded = await this.encodeGrant(next);
-            if (!options.commit && this.signal?.aborted)
-                return false;
-            let written;
-            try {
-                written = await this.storage.compareAndSet(GRANT, raw, encoded);
-            }
-            catch {
-                // A store's own error can quote the value it refused.
-                throw this.credentialWriteError();
-            }
-            if (written) {
-                if (next.epoch !== grant.epoch)
-                    this.epoch = next.epoch;
-                return true;
-            }
-        }
-        throw this.credentialWriteError();
+    updateGrant(change, options = {}) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "updateGrant", [change, options]));
     }
     /** Store a client or tokens for `issuer`'s grant, replacing another server's. */
-    async writeCredential(field, value, issuer, refreshConsent) {
-        await this.updateGrant((grant) => {
-            const body = issuer !== undefined && grant.body.issuer !== issuer ? { issuer } : { ...grant.body };
-            if (field === "client")
-                body.client = value;
-            else {
-                body.tokens = value;
-                delete body.refreshConsent;
-                if (refreshConsent)
-                    body.refreshConsent = refreshConsent;
-            }
-            return this.withIssuer(grant, body);
-        });
-        // A flow may invalidate what it wrote itself.
-        this.seen[field] = fingerprint(field === "client" ? value.value : value);
+    writeCredential(field, value, issuer, refreshConsent) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "writeCredential", [field, value, issuer, refreshConsent]));
     }
     withIssuer(grant, body) {
         if (grant.body.issuer !== undefined && grant.body.issuer !== body.issuer) {
@@ -825,21 +899,11 @@ export class KvOAuthProvider {
     configuredAuthorizationBinding() {
         return undefined;
     }
-    async bindingForGrant(grant) {
-        const configured = this.configuredAuthorizationBinding();
-        return configured
-            ? { ...configured, issuer: grant.body.issuer }
-            : {
-                ...(await discoveryBinding(grant.body.discovery)),
-                issuer: grant.body.issuer,
-                clientId: grant.body.client?.value.client_id,
-            };
+    bindingForGrant(grant) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "bindingForGrant", [grant]));
     }
-    async checkFlowBinding(grant) {
-        const binding = this.callback?.flow.binding;
-        if (!binding || fingerprint(binding) !== fingerprint(await this.bindingForGrant(grant))) {
-            throw this.flowSuperseded();
-        }
+    checkFlowBinding(grant) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "checkFlowBinding", [grant]));
     }
     /** Validate RFC 9207 against the server this consent selected. */
     validateCallbackIssuer(issuer) {
@@ -854,73 +918,25 @@ export class KvOAuthProvider {
     flowLabel(key, epoch) {
         return `${key}:${epoch}`;
     }
-    async encodeFlow(key, flow) {
-        const { verifier, ...rest } = flow;
-        const stored = { connectaOAuthFlow: FLOW_VERSION, ...rest };
-        if (verifier !== undefined) {
-            if (this.sealer) {
-                stored.verifier = await this.sealer.seal(this.flowLabel(key, flow.epoch), verifier);
-                stored.sealed = true;
-            }
-            else {
-                stored.verifier = verifier;
-            }
-        }
-        return JSON.stringify(stored);
+    encodeFlow(key, flow) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "encodeFlow", [key, flow]));
     }
     /** A flow record, its verifier opened only when `withVerifier`. */
-    async openFlow(key, raw, withVerifier) {
-        const value = parsed(raw);
-        if (!plainObject(value) ||
-            value.connectaOAuthFlow !== FLOW_VERSION ||
-            typeof value.epoch !== "string" ||
-            typeof value.at !== "number" ||
-            (value.url !== undefined && typeof value.url !== "string") ||
-            (value.verifier !== undefined && typeof value.verifier !== "string")) {
-            return undefined;
-        }
-        const flow = {
-            epoch: value.epoch,
-            at: value.at,
-            ...(plainObject(value.binding) ? { binding: value.binding } : {}),
-            ...(typeof value.url === "string" ? { url: value.url } : {}),
-            ...(value.consumed === true ? { consumed: true } : {}),
-        };
-        if (!withVerifier || typeof value.verifier !== "string")
-            return flow;
-        if (value.sealed !== true)
-            return { ...flow, verifier: value.verifier };
-        try {
-            if (!this.sealer)
-                return undefined;
-            return { ...flow, verifier: await this.sealer.open(this.flowLabel(key, flow.epoch), value.verifier) };
-        }
-        catch {
-            this.sealer?.warn(`[connecta] connector "${this.connectorId}" has a sealed OAuth consent ` +
-                "the configured vault cannot open; its callback is refused.");
-            return undefined;
-        }
+    openFlow(key, raw, withVerifier) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "openFlow", [key, raw, withVerifier]));
     }
     /** The live epoch's latest consent, until a callback claims it. */
-    async latestConsent() {
-        const grant = await this.boundGrant();
-        if (grant.flow === undefined)
-            return undefined;
-        const key = oauthFlowKeys.flow(grant.flow);
-        const raw = await this.storage.get(key);
-        const flow = raw === null ? undefined : await this.openFlow(key, raw, false);
-        return flow && !flow.consumed && flow.epoch === grant.epoch && flow.url !== undefined
-            ? { ...flow, url: flow.url }
-            : undefined;
+    latestConsent() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "latestConsent", []));
     }
     // --- flows and epochs -----------------------------------------------------
     /** The live epoch; an owner with no grant yet has the initial one. */
-    async liveEpoch() {
-        return (await this.readGrant()).grant.epoch;
+    liveEpoch() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "liveEpoch", []));
     }
     /** True only after an operator disconnect, until an explicit start replaces it. */
-    async operatorDisconnected() {
-        return isDisconnectedEpoch(await this.liveEpoch());
+    operatorDisconnected() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "operatorDisconnected", []));
     }
     isOperatorDisconnectedEpoch(epoch) {
         return isDisconnectedEpoch(epoch);
@@ -930,15 +946,12 @@ export class KvOAuthProvider {
      * `api()` call or start — in the live epoch, and return it. Nothing about
      * the grant is decided here: a grant belongs to one server by construction.
      */
-    async beginFlow() {
-        const epoch = await this.liveEpoch();
-        this.epoch = epoch;
-        this.bound = true;
-        return epoch;
+    beginFlow() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "beginFlow", []));
     }
     /** The epoch this flow is bound to, or the live one. */
-    async flowEpoch() {
-        return this.epoch ?? (await this.liveEpoch());
+    flowEpoch() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "flowEpoch", []));
     }
     /**
      * Bind a code exchange: to the epoch its verified consent was written in, or
@@ -946,25 +959,12 @@ export class KvOAuthProvider {
      * replaced fails here, before the SDK can send anything. What the grant
      * holds now is all a refused code may invalidate.
      */
-    async bindFlow() {
-        const { grant } = await this.readGrant();
-        const epoch = this.callback?.flow.epoch ?? this.epoch ?? grant.epoch;
-        if (grant.epoch !== epoch)
-            throw this.flowSuperseded();
-        this.epoch = epoch;
-        this.bound = true;
-        this.codeExchange = true;
-        await this.checkFlowBinding(grant);
-        this.seen = {
-            client: fingerprint(grant.body.client?.value),
-            tokens: fingerprint(grant.body.tokens),
-        };
+    bindFlow() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "bindFlow", []));
     }
     /** Retain an already verified snapshot only for the exact same state. */
-    async verifyCallbackState(state) {
-        if (this.callback?.key === oauthFlowKeys.flow(await oauthStateDigest(state)))
-            return true;
-        return this.verifyState(state);
+    verifyCallbackState(state) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "verifyCallbackState", [state]));
     }
     /** Whether `verifyState` matched a consent on this provider. */
     verified() {
@@ -972,73 +972,45 @@ export class KvOAuthProvider {
     }
     /** The fixed, retryable failure of a flow a later reset superseded. */
     flowSuperseded() {
-        return new ConnectorCallError("unavailable", `Connector "${this.connectorId}" authorization changed while this request was in flight; try again.`);
+        return resendAdvice(new ConnectorCallError("unavailable", `Connector "${this.connectorId}" authorization changed while this request was in flight.`), "; try again");
     }
     /**
      * A credential write that storage refused, in fixed text and with no cause
      * attached. Retryable: the grant it held is untouched.
      */
     credentialWriteError() {
-        return new ConnectorCallError("unavailable", `Connector "${this.connectorId}" could not store its OAuth credentials; try again shortly.`);
+        return resendAdvice(new ConnectorCallError("unavailable", `Connector "${this.connectorId}" could not store its OAuth credentials.`), "; try again shortly");
     }
     /** @internal Other requests kept refreshing faster than this one could join. */
     refreshContended() {
         this.recordRefreshFailure({ kind: "contended" });
-        return new ConnectorCallError("unavailable", `Connector "${this.connectorId}" could not refresh its OAuth grant while other requests were; retry.`);
+        return resendAdvice(new ConnectorCallError("unavailable", `Connector "${this.connectorId}" could not refresh its OAuth grant while other requests were.`), "; retry");
     }
     /**
      * A passive call cannot start consent. A waiter deadline remains retryable;
      * any dispatched failure requires consent because its token is spent.
      */
     authorizationRefused() {
+        // The SDK catches a refresh cancellation and falls back to consent. Keep
+        // the ended caller's own reason instead of turning it into an auth verdict.
+        if (this.signal?.aborted)
+            throw aborted(this.signal);
         const failure = this.refreshFailure;
         if (failure?.kind === "contended")
             return this.refreshContended();
         return new UnauthorizedError("Authorization required. Use authorize_connector or Connect to start consent.");
     }
     // --- the SDK's hooks --------------------------------------------------------
-    async clientInformation(ctx) {
-        const { body } = await this.boundGrant();
-        const client = this.clientOptions?.client;
-        if (!body.client && !this.allowAuthorization)
-            throw this.authorizationRefused();
-        if (client) {
-            if ((ctx && ctx.issuer !== client.issuer) || body.issuer !== client.issuer)
-                throw this.flowSuperseded();
-            if (body.client &&
-                (body.client.value.client_id !== client.clientId || body.client.binding !== this.clientBinding))
-                throw this.flowSuperseded();
-            return {
-                client_id: client.clientId,
-                issuer: client.issuer,
-                token_endpoint_auth_method: this.clientMetadata.token_endpoint_auth_method,
-                ...(client.clientSecret !== undefined ? { client_secret: client.clientSecret } : {}),
-            };
-        }
-        if (!body.client || (ctx && body.issuer !== ctx.issuer))
-            return undefined;
-        this.seen.client = fingerprint(body.client.value);
-        return ctx ? { ...body.client.value, issuer: ctx.issuer } : body.client.value;
-    }
-    async saveClientInformation(info, ctx) {
-        const { body } = await this.boundGrant();
-        const registrationPath = this.clientOptions?.client
-            ? "static"
-            : body.client?.value.client_id === info.client_id && body.client.registrationPath
-                ? body.client.registrationPath
-                : this.clientMetadataUrl &&
-                    body.discovery?.authorizationServerMetadata?.client_id_metadata_document_supported === true
-                    ? "cimd"
-                    : "dcr";
-        await this.writeCredential("client", {
-            value: this.clientOptions?.client ? { client_id: this.clientOptions.client.clientId } : info,
-            registrationPath,
-            ...(this.clientBinding !== undefined ? { binding: this.clientBinding } : {}),
-        }, ctx?.issuer);
-    }
-    async registrationPath() {
-        const { body } = await this.boundGrant();
-        return body.client?.registrationPath;
+    clientInformation(ctx) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "clientInformation", [
+            ctx,
+        ]));
+    }
+    saveClientInformation(info, ctx) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveClientInformation", [info, ctx]));
+    }
+    registrationPath() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "registrationPath", []));
     }
     /** Intake and saved URLs share a guard. Include the current grant's secrets
      * so a fresh request can reject an older cache before sending credentials. */
@@ -1068,9 +1040,9 @@ export class KvOAuthProvider {
                 secrets.secret(value);
         }
         if (body.client?.value.client_secret)
-            secrets.add(body.client.value.client_id);
+            secrets.identifier(body.client.value.client_id);
         if (this.clientOptions?.client?.clientSecret)
-            secrets.add(this.clientOptions.client.clientId);
+            secrets.identifier(this.clientOptions.client.clientId);
         const urls = [];
         const collect = (item) => {
             if (typeof item === "string") {
@@ -1086,27 +1058,16 @@ export class KvOAuthProvider {
                     collect(field);
         };
         collect(value);
-        if ([secrets, this.clientOptions?.secrets].some((source) => source && (source.redact(value) !== value || urls.some((url) => source.containsUrl(url))))) {
+        if ([secrets, this.clientOptions?.secrets].some((source) => source && (source.changes(value) || urls.some((url) => source.containsUrl(url))))) {
             throw new ConnectorCallError("connector_call_failed", "OAuth metadata or consent URL contains a credential; refusing authorization.", { retryable: false });
         }
     }
     /** Only metadata bound to the discovered issuer can supply operator origins. */
-    async validatedIssuerOrigin() {
-        const { body } = await this.boundGrant();
-        const state = body.discovery;
-        if (!state ||
-            state.authorizationServerMetadata?.issuer !== state.authorizationServerUrl ||
-            body.issuer !== state.authorizationServerUrl)
-            return undefined;
-        this.assertCredentialFree(state, body);
-        return new URL(state.authorizationServerUrl).origin;
+    validatedIssuerOrigin() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "validatedIssuerOrigin", []));
     }
-    async discoveryState() {
-        const { body } = await this.boundGrant();
-        const state = body.discovery;
-        this.assertCredentialFree(state, body);
-        this.consentDiscovery = state;
-        return state;
+    discoveryState() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "discoveryState", []));
     }
     /**
      * Discovery names the grant's server: the same one keeps the client and
@@ -1114,74 +1075,33 @@ export class KvOAuthProvider {
      * without a cached record — a restart's carried client, say — and what a
      * different server leaves behind would never be sent to it anyway.
      */
-    async saveDiscoveryState(state) {
-        this.assertCredentialFree(state, (await this.boundGrant()).body);
-        const issuer = discoveryIssuer(state);
-        if (this.clientOptions?.client && issuer !== this.clientOptions.client.issuer)
-            throw this.flowSuperseded();
-        if (!this.allowAuthorization && !(await this.boundGrant()).body.client)
-            throw this.authorizationRefused();
-        this.consentDiscovery = state;
-        await this.updateGrant((grant) => {
-            const body = grant.body.issuer !== issuer ? (issuer !== undefined ? { issuer } : {}) : { ...grant.body };
-            this.assertCredentialFree(state, grant.body);
-            body.discovery = state;
-            return this.withIssuer(grant, body);
-        });
+    saveDiscoveryState(state) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveDiscoveryState", [state]));
     }
     /**
      * The grant's tokens, for the server that issued them only. An
      * issuer-aware read records what it handed the SDK, so the coordinator can
      * tell a refresh another request completed since.
      */
-    async tokens(ctx) {
-        const grant = await this.boundGrant();
-        const { tokens } = grant.body;
-        if (!tokens || (ctx && grant.body.issuer !== ctx.issuer))
-            return undefined;
-        this.seen.tokens = fingerprint(tokens);
-        if (!ctx)
-            return tokens;
-        this.refreshBasis = { accessToken: tokens.access_token, epoch: grant.epoch, issuer: ctx.issuer };
-        return { ...tokens, issuer: ctx.issuer };
-    }
-    async saveTokens(tokens, ctx) {
-        if (this.refreshFailure?.kind === "dead")
-            throw this.authorizationRefused();
-        // The coordinator stored this refresh already, or handed on another's.
-        if (this.storedRefresh !== undefined && tokens.access_token === this.storedRefresh)
-            return;
-        const refreshConsent = this.exchangeConsent &&
-            tokens.refresh_token !== undefined &&
-            this.exchangeConsent.digest === (await oauthStateDigest(tokens.refresh_token))
-            ? this.exchangeConsent
-            : undefined;
-        await this.writeCredential("tokens", tokens, ctx?.issuer, refreshConsent);
-        this.refreshFailure = undefined;
+    tokens(ctx) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "tokens", [ctx]));
+    }
+    saveTokens(tokens, ctx) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveTokens", [tokens, ctx]));
     }
     /**
      * OAuth `state`: 256 random bits the consent URL carries and the callback
      * must present, so nobody holding a consent URL can complete it with their
      * own account (login CSRF). Stored, by digest, with the consent.
      */
-    async state() {
-        if (!this.allowAuthorization)
-            throw this.authorizationRefused();
-        const state = randomState();
-        this.consent = { state };
-        return state;
-    }
-    async saveCodeVerifier(verifier) {
-        if (!this.allowAuthorization)
-            throw this.authorizationRefused();
-        this.consent = { ...this.consent, verifier };
-    }
-    async codeVerifier() {
-        const verifier = this.callback?.flow.verifier ?? this.consent.verifier;
-        if (verifier === undefined) {
-            throw new Error(`No PKCE code verifier for "${this.connectorId}"`);
-        }
-        return verifier;
+    state() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "state", []));
+    }
+    saveCodeVerifier(verifier) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveCodeVerifier", [verifier]));
+    }
+    codeVerifier() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "codeVerifier", []));
     }
     /**
      * Store the consent: its flow record first, by state digest with the
@@ -1189,76 +1109,16 @@ export class KvOAuthProvider {
      * reset that replaced the epoch fails the start, and the record is removed,
      * so no start hands out a consent its callback could not complete.
      */
-    async redirectToAuthorization(authorizationUrl) {
-        if (!this.allowAuthorization)
-            throw this.authorizationRefused();
-        this.assertCredentialFree(authorizationUrl.toString(), (await this.boundGrant()).body, true);
-        const state = this.consent.state ?? authorizationUrl.searchParams.get("state");
-        if (!state)
-            throw new Error(`OAuth consent for "${this.connectorId}" carries no state`);
-        const client = this.clientOptions?.client;
-        if (client && !(await this.boundGrant()).body.client) {
-            await this.saveClientInformation({ client_id: client.clientId }, { issuer: client.issuer });
-        }
-        const configured = this.configuredAuthorizationBinding();
-        if (configured?.issuer !== undefined) {
-            const issuer = configured.issuer;
-            // Static adapters do not save discovery or client configuration. Publish
-            // their server identity before consent so a changed endpoint fences the
-            // old grant before any code exchange can leave.
-            await this.updateGrant((grant) => grant.body.issuer === issuer ? undefined : this.withIssuer(grant, { issuer }));
-        }
-        const epoch = await this.flowEpoch();
-        this.epoch = epoch;
-        const digest = await oauthStateDigest(state);
-        const key = oauthFlowKeys.flow(digest);
-        const url = authorizationUrl.toString();
-        const { verifier } = this.consent;
-        const grant = await this.boundGrant();
-        this.assertCredentialFree(url, grant.body, true);
-        const binding = this.configuredAuthorizationBinding() ?? {
-            ...(await discoveryBinding(this.consentDiscovery ?? grant.body.discovery)),
-            issuer: discoveryIssuer(this.consentDiscovery) ?? grant.body.issuer,
-            clientId: authorizationUrl.searchParams.get("client_id") ?? grant.body.client?.value.client_id,
-        };
-        const record = await this.encodeFlow(key, {
-            epoch,
-            at: Date.now(),
-            binding,
-            url,
-            ...(verifier !== undefined ? { verifier } : {}),
-        });
-        if (this.signal?.aborted)
-            return;
-        if (!(await this.storage.compareAndSet(key, null, record, { ttlSeconds: OAUTH_FLOW_TTL_SECONDS }))) {
-            throw new Error(`OAuth consent for "${this.connectorId}" reused a state`);
-        }
-        let published = false;
-        try {
-            published = await this.updateGrant((grant) => ({ ...grant, flow: digest }), { epoch });
-        }
-        finally {
-            if (!published)
-                await this.storage.compareAndSet(key, record, null).catch(() => { });
-        }
-        if (published)
-            this.published = { epoch, url };
+    redirectToAuthorization(authorizationUrl) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "redirectToAuthorization", [authorizationUrl]));
     }
     /** The consent this provider stored, while its epoch is still live. */
-    async consentUrl() {
-        const published = this.published;
-        if (!published)
-            return undefined;
-        if (epochOf(await this.storage.get(GRANT)) !== published.epoch)
-            throw this.flowSuperseded();
-        this.assertCredentialFree(published.url, (await this.boundGrant()).body, true);
-        return published.url;
+    consentUrl(signal = this.signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "consentUrl", [signal]));
     }
     /** The live epoch's pending consent URL, if one is unclaimed. */
-    async pendingAuthorizationUrl() {
-        const url = (await this.latestConsent())?.url;
-        this.assertCredentialFree(url, (await this.boundGrant()).body, true);
-        return url;
+    pendingAuthorizationUrl() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "pendingAuthorizationUrl", []));
     }
     /**
      * The pending consent URL, only while it is still worth handing out again:
@@ -1268,39 +1128,16 @@ export class KvOAuthProvider {
      * `invalid_client` drops the client, and its URL would send the operator to
      * a consent the server has already refused.
      */
-    async reusablePendingAuthorizationUrl() {
-        const consent = await this.latestConsent();
-        if (!consent || Math.abs(Date.now() - consent.at) >= PENDING_AUTHORIZATION_MAX_AGE_MS) {
-            return undefined;
-        }
-        this.assertCredentialFree(consent.url, (await this.boundGrant()).body, true);
-        let clientId;
-        try {
-            clientId = new URL(consent.url).searchParams.get("client_id");
-        }
-        catch {
-            return undefined;
-        }
-        const client = await this.clientInformation();
-        return clientId !== null && client?.client_id === clientId ? consent.url : undefined;
+    reusablePendingAuthorizationUrl() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "reusablePendingAuthorizationUrl", []));
     }
     /**
      * Find the consent a callback's `state` names. One read whatever the
      * answer; the callback route's refusals pay the same. A claimed consent
      * no longer matches.
      */
-    async verifyState(candidate) {
-        this.callback = undefined;
-        if (candidate === null)
-            return false;
-        const key = oauthFlowKeys.flow(await oauthStateDigest(candidate));
-        const raw = await this.storage.get(key);
-        const flow = raw === null ? undefined : await this.openFlow(key, raw, true);
-        if (raw === null || !flow || flow.consumed)
-            return false;
-        this.callback = { key, raw, flow, claimed: false };
-        this.epoch = flow.epoch;
-        return true;
+    verifyState(candidate) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "verifyState", [candidate]));
     }
     /**
      * @internal The first half of the fence a code exchange crosses after every
@@ -1312,43 +1149,15 @@ export class KvOAuthProvider {
      * exchange succeeds; the SDK's one retry after a refused code is answered
      * with that refusal, never sent again.
      */
-    async claimCodeExchange() {
-        if (this.exchangeRefusal)
-            return this.exchangeRefusal.clone();
-        await this.claimConsent();
-        return undefined;
+    claimCodeExchange() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "claimCodeExchange", []));
     }
     /** Terminate the verified consent on an error, sharing the code exchange CAS. */
-    async consumeAuthError() {
-        const { grant } = await this.readGrant();
-        if (!this.callback || grant.epoch !== this.callback.flow.epoch)
-            throw this.flowSuperseded();
-        await this.checkFlowBinding(grant);
-        await this.claimConsent();
-        this.callback = undefined;
-    }
-    async claimConsent() {
-        const callback = this.callback;
-        if (!callback)
-            throw this.flowSuperseded();
-        if (callback.claimed)
-            throw new OAuthCallbackClaimedError(this.connectorId);
-        callback.claimed = true;
-        const { epoch, at } = callback.flow;
-        const claimed = JSON.stringify({
-            connectaOAuthFlow: FLOW_VERSION,
-            epoch,
-            at,
-            consumed: true,
-        });
-        const remaining = Math.ceil((at + OAUTH_FLOW_TTL_SECONDS * 1000 - Date.now()) / 1000);
-        const ttlSeconds = Math.min(OAUTH_FLOW_TTL_SECONDS, Math.max(1, remaining));
-        if (await this.storage.compareAndSet(callback.key, callback.raw, claimed, { ttlSeconds })) {
-            return;
-        }
-        if (epochOf(await this.storage.get(GRANT)) !== epoch)
-            throw this.flowSuperseded();
-        throw new OAuthCallbackClaimedError(this.connectorId);
+    consumeAuthError() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "consumeAuthError", []));
+    }
+    claimConsent() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "claimConsent", []));
     }
     /**
      * @internal The second half: read the live epoch and, in the reaction to
@@ -1358,86 +1167,24 @@ export class KvOAuthProvider {
      * ordered before the send without a lock across requests, and its tokens
      * are refused by the grant's compare-and-set: one more consent.
      */
-    async dispatchCodeExchange(send, endpoint) {
-        const epoch = this.epoch;
-        if (!this.codeExchange || epoch === undefined)
-            throw this.flowSuperseded();
-        const raw = await this.storage.get(GRANT);
-        const grant = await this.openGrant(raw);
-        if (grant.epoch !== epoch)
-            throw this.flowSuperseded();
-        await this.checkFlowBinding(grant);
-        if (endpoint !== undefined && this.callback?.flow.binding?.tokenEndpoint !== String(endpoint)) {
-            throw this.flowSuperseded();
-        }
-        // Opening ciphertext may yield. Re-read the exact record after opening,
-        // then check and send in the same reaction, without another await.
-        return this.storage.get(GRANT).then((current) => {
-            if (current !== raw)
-                throw this.flowSuperseded();
-            const sent = send();
-            sent.catch(() => { });
-            return sent;
-        });
+    dispatchCodeExchange(send, endpoint) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "dispatchCodeExchange", [send, endpoint]));
     }
     /** @internal Keep a refused code's answer for the SDK's retry to read. */
     recordCodeExchangeRefusal(forSdk) {
         this.exchangeRefusal = forSdk.clone();
     }
     /** @internal Observe resolution while accepting the code response, never on a later SDK save. */
-    async recordCodeExchangeTokens(tokens) {
-        this.exchangeConsent = undefined;
-        if (tokens.refresh_token === undefined)
-            return;
-        try {
-            const digest = await oauthStateDigest(tokens.refresh_token);
-            const resolution = await this.storage.get(oauthRefreshSpentKeys.spent(digest));
-            const spent = storedRefreshSpent(resolution);
-            // Observing the exact resolved storage write before consent completion
-            // proves their order without comparing isolate clocks. A consent that
-            // saw outstanding/ambiguous cannot become eligible on a delayed save.
-            if (spent?.state === "resolved")
-                this.exchangeConsent = { digest, resolution: resolution };
-        }
-        catch {
-            throw this.credentialWriteError();
-        }
+    recordCodeExchangeTokens(tokens) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "recordCodeExchangeTokens", [tokens]));
     }
     /**
      * Remove what the SDK asks, but only as this flow saw it: a refused code or
      * refresh says nothing about a client or tokens another flow wrote since.
      * The verifier lives in its consent, which the claim already spent.
      */
-    async invalidateCredentials(scope) {
-        const fields = {
-            all: ["client", "tokens", "discovery"],
-            client: ["client"],
-            tokens: ["tokens"],
-            discovery: ["discovery"],
-            verifier: [],
-        }[scope];
-        if (fields.length > 0) {
-            await this.updateGrant((grant) => {
-                const body = { ...grant.body };
-                let changed = false;
-                for (const field of fields) {
-                    const current = field === "client" ? body.client?.value : body[field];
-                    if (current === undefined)
-                        continue;
-                    if (field !== "discovery" && fingerprint(current) !== this.seen[field])
-                        continue;
-                    delete body[field];
-                    changed = true;
-                }
-                return changed ? { ...grant, body } : undefined;
-            }, { quiet: true });
-        }
-        // The SDK invalidates after a refused refresh and then starts over, which
-        // on `invalid_client` means registering a new client. A passive request
-        // must not begin authorization, so it ends here, as auth_required.
-        if (!this.allowAuthorization && this.refreshFailure?.kind === "dead") {
-            throw this.authorizationRefused();
-        }
+    invalidateCredentials(scope) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "invalidateCredentials", [scope]));
     }
     // --- refresh, for the coordinator ---------------------------------------------
     /**
@@ -1449,229 +1196,32 @@ export class KvOAuthProvider {
         this.refreshFailure = failure;
     }
     /** @internal A shared-storage claim precedes every refresh dispatch. */
-    async claimRefresh(epoch, requested, signal, sharedWait) {
-        const waiting = sharedWait ?? refreshWait(signal);
-        const wait = waiting.run;
-        let delay = 10;
-        try {
-            const digest = await wait(() => oauthStateDigest(requested ?? ""));
-            const key = oauthRefreshKeys.lease(epoch, digest);
-            const spentKey = oauthRefreshSpentKeys.spent(digest);
-            while (!waiting.signal.aborted) {
-                if (signal?.aborted)
-                    throw aborted(signal);
-                const current = await wait(() => this.storedTokens());
-                if (current?.refresh_token !== requested || (current && this.refreshedSinceRead(current, epoch))) {
-                    if (!current)
-                        this.recordRefreshFailure({ kind: "dead" });
-                    return current ? this.adoptRefresh(current) : Response.json({ error: "invalid_grant" }, { status: 400 });
-                }
-                const raw = await wait(() => this.storage.get(key));
-                const stored = raw === null ? undefined : parsed(raw);
-                if (plainObject(stored) &&
-                    stored.completed === true &&
-                    current &&
-                    stored.tokenDigest === (await wait(() => refreshTokensDigest(current)))) {
-                    return this.adoptRefresh(current);
-                }
-                if (plainObject(stored) && (plainObject(stored.verdict) || stored.completed === true)) {
-                    this.recordRefreshFailure({ kind: "dead" });
-                    await wait(() => this.discardRefusedGrant(requested, epoch));
-                    throw new UnauthorizedError("OAuth refresh grant is no longer active.");
-                }
-                if (plainObject(stored) && stored.state !== "claimed") {
-                    // Never compare another isolate's clock for a sent request. The
-                    // durable record survives expiry of this storage-owned liveness key.
-                    const active = typeof stored.activeKey === "string"
-                        ? await wait(() => this.storage.get(stored.activeKey))
-                        : null;
-                    if (active === null) {
-                        const refused = JSON.stringify({ ...stored, verdict: { kind: "dead" } });
-                        if (await wait(() => this.storage.compareAndSet(key, raw, refused))) {
-                            await wait(() => this.resolveRefreshSpent({ key, spentKey, spentExpected: null, raw: raw }, "ambiguous"));
-                            this.recordRefreshFailure({ kind: "dead" });
-                            await wait(() => this.discardRefusedGrant(requested, epoch));
-                            throw new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
-                        }
-                        continue;
-                    }
-                }
-                else {
-                    const spentExpected = await wait(() => this.storage.get(spentKey));
-                    if (spentExpected !== null) {
-                        const spent = storedRefreshSpent(spentExpected);
-                        const consent = (await wait(() => this.boundGrant())).body.refreshConsent;
-                        if (spent?.state !== "resolved" ||
-                            spent.epoch === epoch ||
-                            consent?.digest !== digest ||
-                            consent.resolution !== spentExpected) {
-                            // Reset can sweep the old lease while its request remains live.
-                            // Only storage-owned expiry can make an outstanding send ambiguous.
-                            if (spent?.state === "outstanding" && (await wait(() => this.storage.get(spent.activeKey))) === null) {
-                                await wait(() => this.storage.compareAndSet(spentKey, spentExpected, JSON.stringify({ ...spent, state: "ambiguous" })));
-                            }
-                            this.recordRefreshFailure({ kind: "dead" });
-                            await wait(() => this.discardRefusedGrant(requested, epoch));
-                            throw new UnauthorizedError("OAuth refresh token was already spent; authorization required.");
-                        }
-                    }
-                    if (raw === null ||
-                        (plainObject(stored) && typeof stored.expiresAt === "number" && stored.expiresAt <= this.refreshNow())) {
-                        // Clock skew can replace an unsent claim; its dispatch CAS then loses.
-                        const claimed = JSON.stringify({
-                            connectaOAuthRefresh: 1,
-                            holder: crypto.randomUUID(),
-                            state: "claimed",
-                            expiresAt: this.refreshNow() + OAUTH_REFRESH_LEASE_SECONDS * 1000,
-                        });
-                        let won;
-                        try {
-                            won = await wait(() => this.storage.compareAndSet(key, raw, claimed));
-                        }
-                        catch {
-                            throw this.credentialWriteError();
-                        }
-                        if (won) {
-                            try {
-                                const latest = await wait(() => this.storedTokens());
-                                if (latest?.refresh_token !== requested || (latest && this.refreshedSinceRead(latest, epoch))) {
-                                    await wait(() => this.releaseRefresh({ key, spentKey, spentExpected, raw: claimed }));
-                                    return latest
-                                        ? this.adoptRefresh(latest)
-                                        : Response.json({ error: "invalid_grant" }, { status: 400 });
-                                }
-                                if (signal?.aborted)
-                                    throw aborted(signal);
-                                return { key, spentKey, spentExpected, raw: claimed };
-                            }
-                            catch (error) {
-                                // An unsent claim can expire safely. A caller that has left must
-                                // settle its local flight without awaiting cleanup storage.
-                                if (!waiting.signal.aborted && !signal?.aborted) {
-                                    await wait(() => this.releaseRefresh({ key, spentKey, spentExpected, raw: claimed }));
-                                }
-                                throw error;
-                            }
-                        }
-                    }
-                }
-                await runEdge(Effect.raceAllFirst([
-                    Effect.sleep(delay),
-                    fromSignal(waiting.signal),
-                    ...(signal ? [fromSignal(signal)] : []),
-                ]));
-                delay = Math.min(250, delay * 2);
-            }
-        }
-        catch (error) {
-            if (signal?.aborted)
-                throw aborted(signal);
-            if (!waiting.signal.aborted)
-                throw error;
-        }
-        finally {
-            if (!sharedWait)
-                waiting.close();
-        }
-        throw this.refreshContended();
+    claimRefresh(epoch, requested, signal, sharedWait) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "claimRefresh", [
+            epoch,
+            requested,
+            signal,
+            sharedWait,
+        ]));
     }
     /** @internal Only the successful claimed-to-dispatched CAS may send. */
-    async dispatchRefresh(lease, send, waiting) {
-        const stored = parsed(lease.raw);
-        const epoch = await waiting.run(() => this.flowEpoch());
-        const activeKey = oauthRefreshActiveKeys.holder(epoch, stored.holder);
-        await waiting.run(() => this.storage.set(activeKey, JSON.stringify({ connectaOAuthRefresh: 1 }), {
-            ttlSeconds: OAUTH_REFRESH_LEASE_SECONDS,
-        }));
-        const dispatched = JSON.stringify({ ...stored, state: "dispatched", activeKey });
-        const transition = this.storage.compareAndSet(lease.key, lease.raw, dispatched).then((won) => {
-            if (!won)
-                throw this.refreshContended();
-            lease.raw = dispatched;
-            if (waiting.signal.aborted)
-                throw aborted(waiting.signal);
-        });
-        void transition.catch(() => { });
-        await waiting.run(() => transition);
-        // One CAS owns the fingerprint across every epoch. Only a later consent
-        // that observed a resolved write may replace it. No TTL or deletion path.
-        lease.spentRaw = JSON.stringify({
-            connectaOAuthRefreshSpent: 1,
-            epoch,
-            holder: stored.holder,
-            activeKey,
-            state: "outstanding",
-        });
-        const preparation = this.storage
-            .compareAndSet(lease.spentKey, lease.spentExpected, lease.spentRaw)
-            .catch(() => {
-            this.recordRefreshFailure({ kind: "dead" });
-            throw new UnauthorizedError("OAuth refresh dispatch could not be recorded; authorization required.");
-        })
-            .then((unspent) => {
-            if (!unspent) {
-                this.recordRefreshFailure({ kind: "dead" });
-                throw new UnauthorizedError("OAuth refresh token was already spent; authorization required.");
-            }
-            // A storage operation can finish after its waiter left. Never send from
-            // abandoned preparation, even if both CAS operations succeeded.
-            if (waiting.signal.aborted)
-                throw aborted(waiting.signal);
-            const sent = send();
-            sent.catch(() => { });
-            return { sent };
-        });
-        void preparation.catch(() => { });
-        const { sent } = await waiting.run(() => preparation);
-        return sent;
+    dispatchRefresh(lease, send, waiting) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "dispatchRefresh", [lease, send, waiting]));
     }
     /** @internal Release by CAS after a commit or a classified failure. */
-    async releaseRefresh(lease, verdict, tokens, resolution = "ambiguous") {
-        const stored = parsed(lease.raw);
-        // Only an unsent claim may be removed. Dispatched outcomes never reopen it.
-        const next = stored.state === "claimed"
-            ? null
-            : JSON.stringify({
-                ...stored,
-                ...(tokens
-                    ? { completed: true, tokenDigest: await refreshTokensDigest(tokens) }
-                    : { verdict: { kind: "dead" } }),
-            });
-        // Verdicts contain fixed typed facts; no downstream causes or text.
-        if (verdict)
-            this.recordRefreshFailure(verdict);
-        await this.resolveRefreshSpent(lease, resolution);
-        const released = await this.storage.compareAndSet(lease.key, lease.raw, next).catch(() => false);
-        if (released && stored.activeKey)
-            await this.storage.delete(stored.activeKey).catch(() => { });
-    }
-    async resolveRefreshSpent(lease, state) {
-        try {
-            const raw = lease.spentRaw ?? (await this.storage.get(lease.spentKey));
-            const spent = storedRefreshSpent(raw);
-            const holder = parsed(lease.raw).holder;
-            if (spent?.state !== "outstanding" || spent.holder !== holder)
-                return;
-            // The timestamp belongs to this resolution write, never to dispatch.
-            // Consent copies the exact stored receipt, so wall clocks grant no sends.
-            await this.storage.compareAndSet(lease.spentKey, raw, JSON.stringify({
-                ...spent,
-                state,
-                ...(state === "resolved" ? { resolvedAt: Date.now() } : {}),
-            }));
-        }
-        catch {
-            // A lost resolution answer leaves outstanding or the durable outcome;
-            // either blocks replay until a later consent observes a resolved write.
-        }
+    releaseRefresh(lease, verdict, tokens, resolution = "ambiguous") {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "releaseRefresh", [lease, verdict, tokens, resolution]));
+    }
+    resolveRefreshSpent(lease, state) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "resolveRefreshSpent", [lease, state]));
     }
     /** @internal The same typed verdict for local and cross-isolate joiners. */
     refreshVerdict() {
         return this.refreshFailure;
     }
     /** @internal The grant's tokens as stored, in the flow's epoch. */
-    async storedTokens() {
-        return (await this.boundGrant()).body.tokens;
+    storedTokens(signal = null) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "storedTokens", [signal]));
     }
     /** @internal True when a refresh landed after this flow's issuer-aware read. */
     refreshedSinceRead(current, epoch) {
@@ -1694,25 +1244,8 @@ export class KvOAuthProvider {
      * grant, or another epoch is there now. A token response names no issuer:
      * the one the refreshed grant was bound to is stamped here.
      */
-    async storeRefresh(epoch, requested, tokens, issuer) {
-        for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
-            try {
-                const { raw, grant } = await this.readGrant();
-                if (grant.epoch !== epoch || (issuer !== undefined && grant.body.issuer !== issuer))
-                    return undefined;
-                if (grant.body.tokens?.refresh_token !== requested)
-                    return grant.body.tokens;
-                const committed = issuer !== undefined ? { ...tokens, issuer } : tokens;
-                const encoded = await this.encodeGrant({ ...grant, body: { ...grant.body, tokens: committed } });
-                if (await this.storage.compareAndSet(GRANT, raw, encoded))
-                    return committed;
-            }
-            catch {
-                // A failed or lost CAS answer may still have committed. Re-read the
-                // epoch and retry these in-memory tokens without another HTTP request.
-            }
-        }
-        throw this.credentialWriteError();
+    storeRefresh(epoch, requested, tokens, issuer) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "storeRefresh", [epoch, requested, tokens, issuer]));
     }
     /**
      * @internal Drop the tokens the authorization server just refused, only
@@ -1720,18 +1253,13 @@ export class KvOAuthProvider {
      * that completed meanwhile survives. Best effort: if storage fails, the
      * next refresh is refused again and ends the same way.
      */
-    async discardRefusedGrant(refreshToken, epoch) {
-        try {
-            await this.updateGrant((grant) => {
-                if (grant.body.tokens?.refresh_token !== refreshToken)
-                    return undefined;
-                const { tokens: _refused, ...body } = grant.body;
-                return { ...grant, body };
-            }, { epoch, quiet: true, commit: true });
-        }
-        catch {
-            // See above: a refusal that could not be recorded recurs, it does not hide.
-        }
+    discardRefusedGrant(refreshToken, epoch, beforeWrite, signal) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "discardRefusedGrant", [
+            refreshToken,
+            epoch,
+            beforeWrite,
+            signal,
+        ]));
     }
     // --- restart and disconnect ---------------------------------------------------
     /**
@@ -1743,44 +1271,21 @@ export class KvOAuthProvider {
      * callbacks fail the epoch check anyway and the records expire.
      */
     resetAuthorization(operatorDisconnected = false, preserveClient = false) {
-        const reset = this.performReset(operatorDisconnected, preserveClient);
-        this.onReset?.(reset);
-        return reset;
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "resetAuthorization", [
+            operatorDisconnected,
+            preserveClient,
+        ]));
     }
     /** Remove the local grant before a bounded, best-effort RFC 7009 request. */
     disconnectAuthorization(send) {
-        const reset = this.performReset(true, false, send);
-        this.onReset?.(reset);
-        return reset;
-    }
-    async performReset(operatorDisconnected, preserveClient, revoke) {
-        const epoch = `${operatorDisconnected ? DISCONNECTED_EPOCH_PREFIX : ACTIVE_EPOCH_PREFIX}${crypto.randomUUID()}`;
-        for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
-            const { raw, grant } = await this.readGrant();
-            const carried = preserveClient && !operatorDisconnected ? this.carriableClient(grant) : undefined;
-            const encoded = await this.encodeGrant({ epoch, body: carried ?? {}, cleanupPending: true });
-            let written;
-            try {
-                written = await this.storage.compareAndSet(GRANT, raw, encoded);
-            }
-            catch {
-                throw this.credentialWriteError();
-            }
-            if (written) {
-                this.refreshCoordinator?.retire(grant.epoch);
-                try {
-                    await this.cleanupV2(encoded);
-                    await this.sweepConsents();
-                    await this.sweepRefreshLeases();
-                }
-                finally {
-                    if (revoke)
-                        await revokeDownstreamGrant(grant.body, revoke, this.clientOptions?.client);
-                }
-                return;
-            }
-        }
-        throw this.credentialWriteError();
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "disconnectAuthorization", [send]));
+    }
+    performReset(operatorDisconnected, preserveClient, revoke) {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "performReset", [
+            operatorDisconnected,
+            preserveClient,
+            revoke,
+        ]));
     }
     /**
      * Remove every consent of an epoch no longer live. The records are read
@@ -1788,47 +1293,11 @@ export class KvOAuthProvider {
      * the live one then can never complete; each goes by compare-and-set
      * against what was read. Best effort.
      */
-    async sweepConsents() {
-        try {
-            const consents = [];
-            for (const key of await this.storage.list(oauthFlowKeys.prefix)) {
-                const raw = await this.storage.get(key);
-                if (raw !== null)
-                    consents.push([key, raw]);
-            }
-            const live = epochOf(await this.storage.get(GRANT));
-            for (const [key, raw] of consents) {
-                const flow = parsed(raw);
-                if (plainObject(flow) && flow.epoch === live)
-                    continue;
-                await this.storage.compareAndSet(key, raw, null);
-            }
-        }
-        catch {
-            // Hygiene only: the epoch, not this, fences a stale consent.
-        }
+    sweepConsents() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "sweepConsents", []));
     }
-    async sweepRefreshLeases() {
-        try {
-            const records = [];
-            // A reset may sweep an old lease while its HTTP request is still live.
-            // Keep holder liveness until completion or its storage-owned TTL: spent
-            // records in later epochs still use it to distinguish live from crashed.
-            for (const key of await this.storage.list(oauthRefreshKeys.prefix)) {
-                const raw = await this.storage.get(key);
-                if (raw !== null)
-                    records.push([key, raw]);
-            }
-            const live = epochOf(await this.storage.get(GRANT));
-            for (const [key, raw] of records) {
-                if (!key.startsWith(`${oauthRefreshKeys.prefix}${live}:`)) {
-                    await this.storage.compareAndSet(key, raw, null);
-                }
-            }
-        }
-        catch {
-            // Stale dispatch records cannot grant credentials: epochs never recur.
-        }
+    sweepRefreshLeases() {
+        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "sweepRefreshLeases", []));
     }
     /**
      * The registration a forced restart may carry into its new epoch, or
@@ -1876,4 +1345,1426 @@ export class KvOAuthProvider {
             },
         };
     }
+    static {
+        registerAuthMethod(KvOAuthProvider.prototype, "wait", function (work, signal) {
+            signal = signal === undefined ? this.signal : signal;
+            return authFlow(function* () {
+                if (signal?.aborted)
+                    throw aborted(signal);
+                const value = signal
+                    ? (yield authAwait(authCall(work, []), { signal }.signal))
+                    : (yield authCall(work, []));
+                if (signal?.aborted)
+                    throw aborted(signal);
+                return value;
+            });
+        }, KvOAuthProvider.prototype.wait);
+        registerAuthMethod(KvOAuthProvider.prototype, "encodeGrant", function (grant, signal) {
+            signal = signal === undefined ? this.signal : signal;
+            return authFlow(function* () {
+                this.assertCredentialFree({ issuer: grant.body.issuer, discovery: grant.body.discovery }, grant.body);
+                const stored = {
+                    connectaOAuth: GRANT_VERSION,
+                    epoch: grant.epoch,
+                    ...(grant.cleanupPending ? { cleanupPending: true } : {}),
+                    ...(grant.flow !== undefined ? { flow: grant.flow } : {}),
+                };
+                if (Object.keys(grant.body).length > 0) {
+                    if (this.sealer) {
+                        stored.sealed = (yield authInvoke(this, "wait", [
+                            authMethod(() => {
+                                return authInvoke(this.sealer, "seal", [
+                                    this.grantLabel(grant.epoch),
+                                    JSON.stringify(grant.body),
+                                ]);
+                            }),
+                            signal,
+                        ]));
+                    }
+                    else {
+                        stored.body = grant.body;
+                    }
+                }
+                return JSON.stringify(stored);
+            }.bind(this));
+        }, KvOAuthProvider.prototype.encodeGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "openGrant", function (raw, signal) {
+            signal = signal === undefined ? this.signal : signal;
+            return authFlow(function* () {
+                if (raw === null)
+                    return { epoch: INITIAL_EPOCH, body: {} };
+                const stored = storedGrant(raw);
+                if (!stored)
+                    return { epoch: UNREADABLE_EPOCH, body: {} };
+                let body = stored.body;
+                if (stored.sealed !== undefined) {
+                    body = undefined;
+                    try {
+                        if (this.sealer)
+                            body = parsed((yield authInvoke(this, "wait", [
+                                authMethod(() => {
+                                    return authInvoke(this.sealer, "open", [
+                                        this.grantLabel(stored.epoch),
+                                        stored.sealed,
+                                    ]);
+                                }),
+                                signal,
+                            ])));
+                    }
+                    catch {
+                        if (signal?.aborted)
+                            throw aborted(signal);
+                        this.sealer?.warn(`[connecta] connector "${this.connectorId}" has a sealed OAuth grant ` +
+                            "the configured vault cannot open; treating it as absent, so the " +
+                            "connector needs authorization again. A changed vault key or " +
+                            "tampered storage causes this.");
+                    }
+                }
+                return {
+                    epoch: stored.epoch,
+                    ...(stored.cleanupPending ? { cleanupPending: true } : {}),
+                    ...(stored.flow !== undefined ? { flow: stored.flow } : {}),
+                    body: grantBody(body),
+                };
+            }.bind(this));
+        }, KvOAuthProvider.prototype.openGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "readGrant", function (signal) {
+            signal = signal === undefined ? this.signal : signal;
+            return authFlow(function* () {
+                let raw = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "get", [GRANT]);
+                    }),
+                    signal,
+                ]));
+                if (raw === null)
+                    raw = (yield authInvoke(this, "migrate", [signal]));
+                if (raw !== null && storedGrant(raw)?.cleanupPending)
+                    raw = (yield authInvoke(this, "cleanupV2", [raw, signal]));
+                const grant = (yield authInvoke(this, "openGrant", [raw, signal]));
+                if (raw !== null && this.sealer && storedGrant(raw)?.body !== undefined) {
+                    const sealed = (yield authInvoke(this, "encodeGrant", [grant, signal]));
+                    if ((yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authCatch(authStorage(this.storage, "compareAndSet", [GRANT, raw, sealed]), () => false);
+                        }),
+                        signal,
+                    ])))
+                        raw = sealed;
+                }
+                return { raw, grant };
+            }.bind(this));
+        }, KvOAuthProvider.prototype.readGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "migrate", function (signal) {
+            return authFlow(function* () {
+                const sealer = this.sealer;
+                const found = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authCall(readV2Grant, [
+                            this.preparationStorage(signal),
+                            sealer && {
+                                ...sealer,
+                                open: authMethod((label, value) => {
+                                    return authInvoke(this, "wait", [
+                                        authMethod(() => {
+                                            return authInvoke(sealer, "open", [label, value]);
+                                        }),
+                                        signal,
+                                    ]);
+                                }),
+                            },
+                        ]);
+                    }),
+                    signal,
+                ]));
+                if (!found)
+                    return null;
+                const prefix = found.disconnected ? DISCONNECTED_EPOCH_PREFIX : ACTIVE_EPOCH_PREFIX;
+                const encoded = (yield authInvoke(this, "encodeGrant", [
+                    {
+                        epoch: `${prefix}${crypto.randomUUID()}`,
+                        body: found.body,
+                        cleanupPending: true,
+                    },
+                    signal,
+                ]));
+                let written;
+                try {
+                    written = (yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authStorage(this.storage, "compareAndSet", [GRANT, null, encoded]);
+                        }),
+                        signal,
+                    ]));
+                }
+                catch {
+                    if (signal?.aborted)
+                        throw aborted(signal);
+                    throw this.credentialWriteError();
+                }
+                return (yield written
+                    ? authValue(() => encoded)
+                    : authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authStorage(this.storage, "get", [GRANT]);
+                        }),
+                        signal,
+                    ]));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.migrate);
+        registerAuthMethod(KvOAuthProvider.prototype, "cleanupV2", function (raw, signal) {
+            signal = signal === undefined ? this.signal : signal;
+            return authFlow(function* () {
+                try {
+                    if (!(yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authCall(deleteV2Keys, [this.preparationStorage(signal)]);
+                        }),
+                        signal,
+                    ])))
+                        return raw;
+                    const grant = (yield authInvoke(this, "openGrant", [raw, signal]));
+                    delete grant.cleanupPending;
+                    const cleared = (yield authInvoke(this, "encodeGrant", [grant, signal]));
+                    if ((yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authStorage(this.storage, "compareAndSet", [GRANT, raw, cleared]);
+                        }),
+                        signal,
+                    ])))
+                        return cleared;
+                    return (yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authStorage(this.storage, "get", [GRANT]);
+                        }),
+                        signal,
+                    ]));
+                }
+                catch {
+                    if (signal?.aborted)
+                        throw aborted(signal);
+                    // The durable marker survives both deletion and marker-clear failures.
+                    return raw;
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.cleanupV2);
+        registerAuthMethod(KvOAuthProvider.prototype, "boundGrant", function (signal) {
+            signal = signal === undefined ? this.signal : signal;
+            return authFlow(function* () {
+                const { grant } = (yield authInvoke(this, "readGrant", [signal]));
+                if (this.bound && grant.epoch !== this.epoch)
+                    throw this.flowSuperseded();
+                return grant;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.boundGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "activeGrant", function () {
+            return authInvoke(this, "boundGrant", []);
+        }, KvOAuthProvider.prototype.activeGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "updateGrant", function (change, options = {}) {
+            return authFlow(function* () {
+                const signal = options.signal ?? (options.commit ? null : this.signal);
+                for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
+                    if (!options.commit && this.signal?.aborted)
+                        return false;
+                    const { raw, grant } = (yield authInvoke(this, "readGrant", [signal]));
+                    const epoch = options.epoch ?? (this.epoch ??= grant.epoch);
+                    if (grant.epoch !== epoch) {
+                        if (options.quiet || !this.bound)
+                            return false;
+                        throw this.flowSuperseded();
+                    }
+                    // A disconnect's epoch holds nothing until an explicit start replaces it.
+                    if (isDisconnectedEpoch(epoch))
+                        return false;
+                    const next = change(grant);
+                    if (next === undefined)
+                        return true;
+                    const encoded = (yield authInvoke(this, "encodeGrant", [next, signal]));
+                    if (!options.commit && this.signal?.aborted)
+                        return false;
+                    let written;
+                    try {
+                        written = (yield authInvoke(this, "wait", [
+                            authMethod(() => {
+                                return authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded], options.beforeWrite && (() => options.beforeWrite?.()));
+                            }),
+                            signal,
+                        ]));
+                    }
+                    catch {
+                        if (signal?.aborted)
+                            throw aborted(signal);
+                        // A store's own error can quote the value it refused.
+                        throw this.credentialWriteError();
+                    }
+                    if (written) {
+                        if (next.epoch !== grant.epoch)
+                            this.epoch = next.epoch;
+                        return true;
+                    }
+                }
+                throw this.credentialWriteError();
+            }.bind(this));
+        }, KvOAuthProvider.prototype.updateGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "writeCredential", function (field, value, issuer, refreshConsent) {
+            return authFlow(function* () {
+                (yield authInvoke(this, "updateGrant", [
+                    (grant) => {
+                        const body = issuer !== undefined && grant.body.issuer !== issuer ? { issuer } : { ...grant.body };
+                        if (field === "client")
+                            body.client = value;
+                        else {
+                            body.tokens = value;
+                            delete body.refreshConsent;
+                            if (refreshConsent)
+                                body.refreshConsent = refreshConsent;
+                        }
+                        return this.withIssuer(grant, body);
+                    },
+                ]));
+                // A flow may invalidate what it wrote itself.
+                this.seen[field] = fingerprint(field === "client" ? value.value : value);
+            }.bind(this));
+        }, KvOAuthProvider.prototype.writeCredential);
+        registerAuthMethod(KvOAuthProvider.prototype, "bindingForGrant", function (grant) {
+            return authFlow(function* () {
+                const configured = this.configuredAuthorizationBinding();
+                return configured
+                    ? { ...configured, issuer: grant.body.issuer }
+                    : {
+                        ...(yield authInvoke(this, "wait", [
+                            authMethod(() => {
+                                return authCall(discoveryBinding, [grant.body.discovery]);
+                            }),
+                        ])),
+                        issuer: grant.body.issuer,
+                        clientId: grant.body.client?.value.client_id,
+                    };
+            }.bind(this));
+        }, KvOAuthProvider.prototype.bindingForGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "checkFlowBinding", function (grant) {
+            return authFlow(function* () {
+                const binding = this.callback?.flow.binding;
+                if (!binding ||
+                    fingerprint(binding) !== fingerprint((yield authInvoke(this, "bindingForGrant", [grant])))) {
+                    throw this.flowSuperseded();
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.checkFlowBinding);
+        registerAuthMethod(KvOAuthProvider.prototype, "encodeFlow", function (key, flow) {
+            return authFlow(function* () {
+                const { verifier, ...rest } = flow;
+                const stored = { connectaOAuthFlow: FLOW_VERSION, ...rest };
+                if (verifier !== undefined) {
+                    if (this.sealer) {
+                        stored.verifier = (yield authInvoke(this, "wait", [
+                            authMethod(() => {
+                                return authInvoke(this.sealer, "seal", [
+                                    this.flowLabel(key, flow.epoch),
+                                    verifier,
+                                ]);
+                            }),
+                        ]));
+                        stored.sealed = true;
+                    }
+                    else {
+                        stored.verifier = verifier;
+                    }
+                }
+                return JSON.stringify(stored);
+            }.bind(this));
+        }, KvOAuthProvider.prototype.encodeFlow);
+        registerAuthMethod(KvOAuthProvider.prototype, "openFlow", function (key, raw, withVerifier) {
+            return authFlow(function* () {
+                const value = parsed(raw);
+                if (!plainObject(value) ||
+                    value.connectaOAuthFlow !== FLOW_VERSION ||
+                    typeof value.epoch !== "string" ||
+                    typeof value.at !== "number" ||
+                    (value.url !== undefined && typeof value.url !== "string") ||
+                    (value.verifier !== undefined && typeof value.verifier !== "string")) {
+                    return undefined;
+                }
+                const flow = {
+                    epoch: value.epoch,
+                    at: value.at,
+                    ...(plainObject(value.binding) ? { binding: value.binding } : {}),
+                    ...(typeof value.url === "string" ? { url: value.url } : {}),
+                    ...(value.consumed === true ? { consumed: true } : {}),
+                };
+                if (!withVerifier || typeof value.verifier !== "string")
+                    return flow;
+                if (value.sealed !== true)
+                    return { ...flow, verifier: value.verifier };
+                try {
+                    if (!this.sealer)
+                        return undefined;
+                    return {
+                        ...flow,
+                        verifier: (yield authInvoke(this, "wait", [
+                            authMethod(() => {
+                                return authInvoke(this.sealer, "open", [
+                                    this.flowLabel(key, flow.epoch),
+                                    value.verifier,
+                                ]);
+                            }),
+                        ])),
+                    };
+                }
+                catch {
+                    if (this.signal?.aborted)
+                        throw aborted(this.signal);
+                    this.sealer?.warn(`[connecta] connector "${this.connectorId}" has a sealed OAuth consent ` +
+                        "the configured vault cannot open; its callback is refused.");
+                    return undefined;
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.openFlow);
+        registerAuthMethod(KvOAuthProvider.prototype, "latestConsent", function () {
+            return authFlow(function* () {
+                const grant = (yield authInvoke(this, "boundGrant", []));
+                if (grant.flow === undefined)
+                    return undefined;
+                const key = oauthFlowKeys.flow(grant.flow);
+                const raw = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "get", [key]);
+                    }),
+                ]));
+                const flow = raw === null ? undefined : (yield authInvoke(this, "openFlow", [key, raw, false]));
+                return flow && !flow.consumed && flow.epoch === grant.epoch && flow.url !== undefined
+                    ? { ...flow, url: flow.url }
+                    : undefined;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.latestConsent);
+        registerAuthMethod(KvOAuthProvider.prototype, "liveEpoch", function () {
+            return authFlow(function* () {
+                return (yield authInvoke(this, "readGrant", [])).grant.epoch;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.liveEpoch);
+        registerAuthMethod(KvOAuthProvider.prototype, "operatorDisconnected", function () {
+            return authFlow(function* () {
+                return isDisconnectedEpoch((yield authInvoke(this, "liveEpoch", [])));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.operatorDisconnected);
+        registerAuthMethod(KvOAuthProvider.prototype, "beginFlow", function () {
+            return authFlow(function* () {
+                const epoch = (yield authInvoke(this, "liveEpoch", []));
+                this.epoch = epoch;
+                this.bound = true;
+                return epoch;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.beginFlow);
+        registerAuthMethod(KvOAuthProvider.prototype, "flowEpoch", function () {
+            return authFlow(function* () {
+                return this.epoch ?? (yield authInvoke(this, "liveEpoch", []));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.flowEpoch);
+        registerAuthMethod(KvOAuthProvider.prototype, "bindFlow", function () {
+            return authFlow(function* () {
+                const { grant } = (yield authInvoke(this, "readGrant", []));
+                const epoch = this.callback?.flow.epoch ?? this.epoch ?? grant.epoch;
+                if (grant.epoch !== epoch)
+                    throw this.flowSuperseded();
+                this.epoch = epoch;
+                this.bound = true;
+                this.codeExchange = true;
+                (yield authInvoke(this, "checkFlowBinding", [grant]));
+                this.seen = {
+                    client: fingerprint(grant.body.client?.value),
+                    tokens: fingerprint(grant.body.tokens),
+                };
+            }.bind(this));
+        }, KvOAuthProvider.prototype.bindFlow);
+        registerAuthMethod(KvOAuthProvider.prototype, "verifyCallbackState", function (state) {
+            return authFlow(function* () {
+                if (this.callback?.key ===
+                    oauthFlowKeys.flow((yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authCall(oauthStateDigest, [state]);
+                        }),
+                    ]))))
+                    return true;
+                return (yield authInvoke(this, "verifyState", [state]));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.verifyCallbackState);
+        registerAuthMethod(KvOAuthProvider.prototype, "clientInformation", function (ctx) {
+            return authFlow(function* () {
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                const { body } = (yield authInvoke(this, "activeGrant", []));
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                const client = this.clientOptions?.client;
+                if (!body.client && !this.allowAuthorization)
+                    throw this.authorizationRefused();
+                if (client) {
+                    if ((ctx && ctx.issuer !== client.issuer) || body.issuer !== client.issuer)
+                        throw this.flowSuperseded();
+                    if (body.client &&
+                        (body.client.value.client_id !== client.clientId || body.client.binding !== this.clientBinding))
+                        throw this.flowSuperseded();
+                    return {
+                        client_id: client.clientId,
+                        issuer: client.issuer,
+                        token_endpoint_auth_method: this.clientMetadata.token_endpoint_auth_method,
+                        ...(client.clientSecret !== undefined ? { client_secret: client.clientSecret } : {}),
+                    };
+                }
+                if (!body.client || (ctx && body.issuer !== ctx.issuer))
+                    return undefined;
+                this.seen.client = fingerprint(body.client.value);
+                return ctx ? { ...body.client.value, issuer: ctx.issuer } : body.client.value;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.clientInformation);
+        registerAuthMethod(KvOAuthProvider.prototype, "saveClientInformation", function (info, ctx) {
+            return authFlow(function* () {
+                try {
+                    const { body } = (yield authInvoke(this, "boundGrant", []));
+                    const registrationPath = this.clientOptions?.client
+                        ? "static"
+                        : body.client?.value.client_id === info.client_id && body.client.registrationPath
+                            ? body.client.registrationPath
+                            : this.clientMetadataUrl &&
+                                body.discovery?.authorizationServerMetadata?.client_id_metadata_document_supported === true
+                                ? "cimd"
+                                : "dcr";
+                    (yield authInvoke(this, "writeCredential", [
+                        "client",
+                        {
+                            value: this.clientOptions?.client ? { client_id: this.clientOptions.client.clientId } : info,
+                            registrationPath,
+                            ...(this.clientBinding !== undefined ? { binding: this.clientBinding } : {}),
+                        },
+                        ctx?.issuer,
+                    ]));
+                }
+                catch (error) {
+                    if (!this.signal?.aborted)
+                        throw error;
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.saveClientInformation);
+        registerAuthMethod(KvOAuthProvider.prototype, "registrationPath", function () {
+            return authFlow(function* () {
+                const { body } = (yield authInvoke(this, "boundGrant", []));
+                return body.client?.registrationPath;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.registrationPath);
+        registerAuthMethod(KvOAuthProvider.prototype, "validatedIssuerOrigin", function () {
+            return authFlow(function* () {
+                const { body } = (yield authInvoke(this, "boundGrant", []));
+                const state = body.discovery;
+                if (!state ||
+                    state.authorizationServerMetadata?.issuer !== state.authorizationServerUrl ||
+                    body.issuer !== state.authorizationServerUrl)
+                    return undefined;
+                this.assertCredentialFree(state, body);
+                return new URL(state.authorizationServerUrl).origin;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.validatedIssuerOrigin);
+        registerAuthMethod(KvOAuthProvider.prototype, "discoveryState", function () {
+            return authFlow(function* () {
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                const { body } = (yield authInvoke(this, "activeGrant", []));
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                const state = body.discovery;
+                this.assertCredentialFree(state, body);
+                this.consentDiscovery = state;
+                return state;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.discoveryState);
+        registerAuthMethod(KvOAuthProvider.prototype, "saveDiscoveryState", function (state) {
+            return authFlow(function* () {
+                this.assertCredentialFree(state, (yield authInvoke(this, "boundGrant", [])).body);
+                const issuer = discoveryIssuer(state);
+                if (this.clientOptions?.client && issuer !== this.clientOptions.client.issuer)
+                    throw this.flowSuperseded();
+                if (!this.allowAuthorization && !(yield authInvoke(this, "boundGrant", [])).body.client)
+                    throw this.authorizationRefused();
+                this.consentDiscovery = state;
+                (yield authInvoke(this, "updateGrant", [
+                    (grant) => {
+                        const body = grant.body.issuer !== issuer ? (issuer !== undefined ? { issuer } : {}) : { ...grant.body };
+                        this.assertCredentialFree(state, grant.body);
+                        body.discovery = state;
+                        return this.withIssuer(grant, body);
+                    },
+                ]));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.saveDiscoveryState);
+        registerAuthMethod(KvOAuthProvider.prototype, "tokens", function (ctx) {
+            return authFlow(function* () {
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                const grant = (yield authInvoke(this, "activeGrant", []));
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                const { tokens } = grant.body;
+                if (!tokens || (ctx && grant.body.issuer !== ctx.issuer))
+                    return undefined;
+                this.seen.tokens = fingerprint(tokens);
+                if (!ctx)
+                    return tokens;
+                this.refreshBasis = { accessToken: tokens.access_token, epoch: grant.epoch, issuer: ctx.issuer };
+                return { ...tokens, issuer: ctx.issuer };
+            }.bind(this));
+        }, KvOAuthProvider.prototype.tokens);
+        registerAuthMethod(KvOAuthProvider.prototype, "saveTokens", function (tokens, ctx) {
+            return authFlow(function* () {
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                if (this.refreshFailure?.kind === "dead")
+                    throw this.authorizationRefused();
+                // The coordinator stored this refresh already, or handed on another's.
+                if (this.storedRefresh !== undefined && tokens.access_token === this.storedRefresh)
+                    return;
+                const refreshConsent = this.exchangeConsent &&
+                    tokens.refresh_token !== undefined &&
+                    this.exchangeConsent.digest ===
+                        (yield authInvoke(this, "wait", [
+                            authMethod(() => {
+                                return authCall(oauthStateDigest, [tokens.refresh_token]);
+                            }),
+                        ]))
+                    ? this.exchangeConsent
+                    : undefined;
+                (yield authInvoke(this, "writeCredential", ["tokens", tokens, ctx?.issuer, refreshConsent]));
+                this.refreshFailure = undefined;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.saveTokens);
+        registerAuthMethod(KvOAuthProvider.prototype, "state", function () {
+            return authValue(() => {
+                if (!this.allowAuthorization)
+                    throw this.authorizationRefused();
+                const state = randomState();
+                this.consent = { state };
+                return state;
+            });
+        }, KvOAuthProvider.prototype.state);
+        registerAuthMethod(KvOAuthProvider.prototype, "saveCodeVerifier", function (verifier) {
+            return authValue(() => {
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                if (!this.allowAuthorization)
+                    throw this.authorizationRefused();
+                this.consent = { ...this.consent, verifier };
+            });
+        }, KvOAuthProvider.prototype.saveCodeVerifier);
+        registerAuthMethod(KvOAuthProvider.prototype, "codeVerifier", function () {
+            return authValue(() => {
+                const verifier = this.callback?.flow.verifier ?? this.consent.verifier;
+                if (verifier === undefined) {
+                    throw new Error(`No PKCE code verifier for "${this.connectorId}"`);
+                }
+                return verifier;
+            });
+        }, KvOAuthProvider.prototype.codeVerifier);
+        registerAuthMethod(KvOAuthProvider.prototype, "redirectToAuthorization", function (authorizationUrl) {
+            return authFlow(function* () {
+                if (this.signal?.aborted)
+                    return;
+                if (!this.allowAuthorization)
+                    throw this.authorizationRefused();
+                this.assertCredentialFree(authorizationUrl.toString(), (yield authInvoke(this, "boundGrant", [])).body, true);
+                const state = this.consent.state ?? authorizationUrl.searchParams.get("state");
+                if (!state)
+                    throw new Error(`OAuth consent for "${this.connectorId}" carries no state`);
+                const client = this.clientOptions?.client;
+                if (client && !(yield authInvoke(this, "boundGrant", [])).body.client) {
+                    (yield authInvoke(this, "saveClientInformation", [
+                        { client_id: client.clientId },
+                        { issuer: client.issuer },
+                    ]));
+                }
+                const configured = this.configuredAuthorizationBinding();
+                if (configured?.issuer !== undefined) {
+                    const issuer = configured.issuer;
+                    // Static adapters do not save discovery or client configuration. Publish
+                    // their server identity before consent so a changed endpoint fences the
+                    // old grant before any code exchange can leave.
+                    (yield authInvoke(this, "updateGrant", [
+                        (grant) => (grant.body.issuer === issuer ? undefined : this.withIssuer(grant, { issuer })),
+                    ]));
+                }
+                const epoch = (yield authInvoke(this, "flowEpoch", []));
+                this.epoch = epoch;
+                const digest = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authCall(oauthStateDigest, [state]);
+                    }),
+                ]));
+                const key = oauthFlowKeys.flow(digest);
+                const url = authorizationUrl.toString();
+                const { verifier } = this.consent;
+                const grant = (yield authInvoke(this, "boundGrant", []));
+                this.assertCredentialFree(url, grant.body, true);
+                const binding = this.configuredAuthorizationBinding() ?? {
+                    ...(yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authCall(discoveryBinding, [this.consentDiscovery ?? grant.body.discovery]);
+                        }),
+                    ])),
+                    issuer: discoveryIssuer(this.consentDiscovery) ?? grant.body.issuer,
+                    clientId: authorizationUrl.searchParams.get("client_id") ?? grant.body.client?.value.client_id,
+                };
+                const record = (yield authInvoke(this, "encodeFlow", [
+                    key,
+                    {
+                        epoch,
+                        at: Date.now(),
+                        binding,
+                        url,
+                        ...(verifier !== undefined ? { verifier } : {}),
+                    },
+                ]));
+                if (this.signal?.aborted)
+                    return;
+                if (!(yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "compareAndSet", [
+                            key,
+                            null,
+                            record,
+                            { ttlSeconds: OAUTH_FLOW_TTL_SECONDS },
+                        ]);
+                    }),
+                ]))) {
+                    throw new Error(`OAuth consent for "${this.connectorId}" reused a state`);
+                }
+                let published = false;
+                try {
+                    published = (yield authInvoke(this, "updateGrant", [
+                        (grant) => ({ ...grant, flow: digest }),
+                        { epoch },
+                    ]));
+                }
+                finally {
+                    if (!published)
+                        (yield authCatch(authInvoke(this, "wait", [
+                            authMethod(() => {
+                                return authStorage(this.storage, "compareAndSet", [key, record, null]);
+                            }),
+                        ]), () => { }));
+                }
+                if (published)
+                    this.published = { epoch, url };
+            }.bind(this));
+        }, KvOAuthProvider.prototype.redirectToAuthorization);
+        registerAuthMethod(KvOAuthProvider.prototype, "consentUrl", function (signal) {
+            signal = signal === undefined ? this.signal : signal;
+            return authFlow(function* () {
+                const published = this.published;
+                if (!published)
+                    return undefined;
+                if (epochOf((yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "get", [GRANT]);
+                    }),
+                    signal,
+                ]))) !== published.epoch)
+                    throw this.flowSuperseded();
+                this.assertCredentialFree(published.url, (yield authInvoke(this, "boundGrant", [signal])).body, true);
+                return published.url;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.consentUrl);
+        registerAuthMethod(KvOAuthProvider.prototype, "pendingAuthorizationUrl", function () {
+            return authFlow(function* () {
+                const url = (yield authInvoke(this, "latestConsent", []))?.url;
+                this.assertCredentialFree(url, (yield authInvoke(this, "boundGrant", [])).body, true);
+                return url;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.pendingAuthorizationUrl);
+        registerAuthMethod(KvOAuthProvider.prototype, "reusablePendingAuthorizationUrl", function () {
+            return authFlow(function* () {
+                const consent = (yield authInvoke(this, "latestConsent", []));
+                if (!consent || Math.abs(Date.now() - consent.at) >= PENDING_AUTHORIZATION_MAX_AGE_MS) {
+                    return undefined;
+                }
+                this.assertCredentialFree(consent.url, (yield authInvoke(this, "boundGrant", [])).body, true);
+                let clientId;
+                try {
+                    clientId = new URL(consent.url).searchParams.get("client_id");
+                }
+                catch {
+                    return undefined;
+                }
+                const client = (yield authInvoke(this, "clientInformation", []));
+                return clientId !== null && client?.client_id === clientId ? consent.url : undefined;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.reusablePendingAuthorizationUrl);
+        registerAuthMethod(KvOAuthProvider.prototype, "verifyState", function (candidate) {
+            return authFlow(function* () {
+                this.callback = undefined;
+                if (candidate === null)
+                    return false;
+                const key = oauthFlowKeys.flow((yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authCall(oauthStateDigest, [candidate]);
+                    }),
+                ])));
+                const raw = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "get", [key]);
+                    }),
+                ]));
+                const flow = raw === null ? undefined : (yield authInvoke(this, "openFlow", [key, raw, true]));
+                if (raw === null || !flow || flow.consumed)
+                    return false;
+                this.callback = { key, raw, flow, claimed: false };
+                this.epoch = flow.epoch;
+                return true;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.verifyState);
+        registerAuthMethod(KvOAuthProvider.prototype, "claimCodeExchange", function () {
+            return authFlow(function* () {
+                if (this.exchangeRefusal)
+                    return this.exchangeRefusal.clone();
+                (yield authInvoke(this, "claimConsent", []));
+                return undefined;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.claimCodeExchange);
+        registerAuthMethod(KvOAuthProvider.prototype, "consumeAuthError", function () {
+            return authFlow(function* () {
+                const { grant } = (yield authInvoke(this, "readGrant", []));
+                if (!this.callback || grant.epoch !== this.callback.flow.epoch)
+                    throw this.flowSuperseded();
+                (yield authInvoke(this, "checkFlowBinding", [grant]));
+                (yield authInvoke(this, "claimConsent", []));
+                this.callback = undefined;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.consumeAuthError);
+        registerAuthMethod(KvOAuthProvider.prototype, "claimConsent", function () {
+            return authFlow(function* () {
+                const callback = this.callback;
+                if (!callback)
+                    throw this.flowSuperseded();
+                if (callback.claimed)
+                    throw new OAuthCallbackClaimedError(this.connectorId);
+                callback.claimed = true;
+                const { epoch, at } = callback.flow;
+                const claimed = JSON.stringify({
+                    connectaOAuthFlow: FLOW_VERSION,
+                    epoch,
+                    at,
+                    consumed: true,
+                });
+                const remaining = Math.ceil((at + OAUTH_FLOW_TTL_SECONDS * 1000 - Date.now()) / 1000);
+                const ttlSeconds = Math.min(OAUTH_FLOW_TTL_SECONDS, Math.max(1, remaining));
+                if ((yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "compareAndSet", [
+                            callback.key,
+                            callback.raw,
+                            claimed,
+                            { ttlSeconds },
+                        ]);
+                    }),
+                ]))) {
+                    return;
+                }
+                if (epochOf((yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "get", [GRANT]);
+                    }),
+                ]))) !== epoch)
+                    throw this.flowSuperseded();
+                throw new OAuthCallbackClaimedError(this.connectorId);
+            }.bind(this));
+        }, KvOAuthProvider.prototype.claimConsent);
+        registerAuthMethod(KvOAuthProvider.prototype, "dispatchCodeExchange", function (send, endpoint) {
+            return authFlow(function* () {
+                const epoch = this.epoch;
+                if (!this.codeExchange || epoch === undefined)
+                    throw this.flowSuperseded();
+                const raw = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "get", [GRANT]);
+                    }),
+                ]));
+                const grant = (yield authInvoke(this, "openGrant", [raw]));
+                if (grant.epoch !== epoch)
+                    throw this.flowSuperseded();
+                (yield authInvoke(this, "checkFlowBinding", [grant]));
+                if (endpoint !== undefined && this.callback?.flow.binding?.tokenEndpoint !== String(endpoint)) {
+                    throw this.flowSuperseded();
+                }
+                // Opening ciphertext may yield. Re-read the exact record after opening,
+                // then check and send in the same reaction, without another await.
+                return (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authThen(authStorage(this.storage, "get", [GRANT]), authMethod((current) => {
+                            return authFlow(function* () {
+                                if (this.signal?.aborted)
+                                    throw aborted(this.signal);
+                                if (current !== raw)
+                                    throw this.flowSuperseded();
+                                const sent = send();
+                                sent.catch(() => { });
+                                return (yield authValue(() => sent));
+                            }.bind(this));
+                        }));
+                    }),
+                ]));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.dispatchCodeExchange);
+        registerAuthMethod(KvOAuthProvider.prototype, "recordCodeExchangeTokens", function (tokens) {
+            return authFlow(function* () {
+                this.exchangeConsent = undefined;
+                if (tokens.refresh_token === undefined)
+                    return;
+                try {
+                    const digest = (yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authCall(oauthStateDigest, [tokens.refresh_token]);
+                        }),
+                    ]));
+                    const resolution = (yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authStorage(this.storage, "get", [oauthRefreshSpentKeys.spent(digest)]);
+                        }),
+                    ]));
+                    const spent = storedRefreshSpent(resolution);
+                    // Observing the exact resolved storage write before consent completion
+                    // proves their order without comparing isolate clocks. A consent that
+                    // saw outstanding/ambiguous cannot become eligible on a delayed save.
+                    if (spent?.state === "resolved")
+                        this.exchangeConsent = { digest, resolution: resolution };
+                }
+                catch {
+                    if (this.signal?.aborted)
+                        throw aborted(this.signal);
+                    throw this.credentialWriteError();
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.recordCodeExchangeTokens);
+        registerAuthMethod(KvOAuthProvider.prototype, "invalidateCredentials", function (scope) {
+            return authFlow(function* () {
+                if (this.signal?.aborted)
+                    throw aborted(this.signal);
+                const fields = {
+                    all: ["client", "tokens", "discovery"],
+                    client: ["client"],
+                    tokens: ["tokens"],
+                    discovery: ["discovery"],
+                    verifier: [],
+                }[scope];
+                if (fields.length > 0) {
+                    (yield authInvoke(this, "updateGrant", [
+                        (grant) => {
+                            const body = { ...grant.body };
+                            let changed = false;
+                            for (const field of fields) {
+                                const current = field === "client" ? body.client?.value : body[field];
+                                if (current === undefined)
+                                    continue;
+                                if (field !== "discovery" && fingerprint(current) !== this.seen[field])
+                                    continue;
+                                delete body[field];
+                                changed = true;
+                            }
+                            return changed ? { ...grant, body } : undefined;
+                        },
+                        { quiet: true },
+                    ]));
+                }
+                // The SDK invalidates after a refused refresh and then starts over, which
+                // on `invalid_client` means registering a new client. A passive request
+                // must not begin authorization, so it ends here, as auth_required.
+                if (!this.allowAuthorization && this.refreshFailure?.kind === "dead") {
+                    throw this.authorizationRefused();
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.invalidateCredentials);
+        registerAuthMethod(KvOAuthProvider.prototype, "claimRefresh", function (epoch, requested, signal, sharedWait) {
+            return authFlow(function* () {
+                const waiting = sharedWait ?? refreshWait(signal);
+                const wait = waiting.run;
+                let delay = 10;
+                try {
+                    const digest = (yield authCall(wait, [
+                        authMethod(() => {
+                            return authCall(oauthStateDigest, [requested ?? ""]);
+                        }),
+                    ]));
+                    const key = oauthRefreshKeys.lease(epoch, digest);
+                    const spentKey = oauthRefreshSpentKeys.spent(digest);
+                    while (!waiting.signal.aborted) {
+                        const current = (yield authCall(wait, [
+                            authMethod(() => {
+                                return authInvoke(this, "storedTokens", [waiting.signal]);
+                            }),
+                        ]));
+                        if (current?.refresh_token !== requested || (current && this.refreshedSinceRead(current, epoch))) {
+                            if (!current)
+                                this.recordRefreshFailure({ kind: "dead" });
+                            return current
+                                ? this.adoptRefresh(current)
+                                : Response.json({ error: "invalid_grant" }, { status: 400 });
+                        }
+                        const raw = (yield authCall(wait, [
+                            authMethod(() => {
+                                return authStorage(this.storage, "get", [key]);
+                            }),
+                        ]));
+                        const stored = raw === null ? undefined : parsed(raw);
+                        if (plainObject(stored) &&
+                            stored.completed === true &&
+                            current &&
+                            stored.tokenDigest ===
+                                (yield authCall(wait, [
+                                    authMethod(() => {
+                                        return authCall(refreshTokensDigest, [current]);
+                                    }),
+                                ]))) {
+                            return this.adoptRefresh(current);
+                        }
+                        if (plainObject(stored) && (plainObject(stored.verdict) || stored.completed === true)) {
+                            this.recordRefreshFailure({ kind: "dead" });
+                            (yield authCall(wait, [
+                                authMethod(() => {
+                                    return authInvoke(this, "discardRefusedGrant", [
+                                        requested,
+                                        epoch,
+                                        waiting.transfer,
+                                        waiting.signal,
+                                    ]);
+                                }),
+                            ]));
+                            throw new UnauthorizedError("OAuth refresh grant is no longer active.");
+                        }
+                        if (plainObject(stored) && stored.state !== "claimed") {
+                            // Never compare another isolate's clock for a sent request. The
+                            // durable record survives expiry of this storage-owned liveness key.
+                            const active = typeof stored.activeKey === "string"
+                                ? (yield authCall(wait, [
+                                    authMethod(() => {
+                                        return authStorage(this.storage, "get", [stored.activeKey]);
+                                    }),
+                                ]))
+                                : null;
+                            if (active === null) {
+                                const refused = JSON.stringify({ ...stored, verdict: { kind: "dead" } });
+                                if ((yield authCall(wait, [
+                                    authMethod(() => {
+                                        return authStorage(this.storage, "compareAndSet", [key, raw, refused], () => waiting.transfer());
+                                    }),
+                                ]))) {
+                                    (yield authCall(wait, [
+                                        authMethod(() => {
+                                            return authInvoke(this, "resolveRefreshSpent", [
+                                                { key, spentKey, spentExpected: null, raw: raw },
+                                                "ambiguous",
+                                            ]);
+                                        }),
+                                    ]));
+                                    this.recordRefreshFailure({ kind: "dead" });
+                                    (yield authCall(wait, [
+                                        authMethod(() => {
+                                            return authInvoke(this, "discardRefusedGrant", [
+                                                requested,
+                                                epoch,
+                                                waiting.transfer,
+                                                waiting.signal,
+                                            ]);
+                                        }),
+                                    ]));
+                                    throw new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
+                                }
+                                continue;
+                            }
+                        }
+                        else {
+                            const spentExpected = (yield authCall(wait, [
+                                authMethod(() => {
+                                    return authStorage(this.storage, "get", [spentKey]);
+                                }),
+                            ]));
+                            if (spentExpected !== null) {
+                                const spent = storedRefreshSpent(spentExpected);
+                                const consent = (yield authCall(wait, [
+                                    authMethod(() => {
+                                        return authInvoke(this, "boundGrant", [waiting.signal]);
+                                    }),
+                                ])).body.refreshConsent;
+                                if (spent?.state !== "resolved" ||
+                                    spent.epoch === epoch ||
+                                    consent?.digest !== digest ||
+                                    consent.resolution !== spentExpected) {
+                                    // Reset can sweep the old lease while its request remains live.
+                                    // Only storage-owned expiry can make an outstanding send ambiguous.
+                                    if (spent?.state === "outstanding" &&
+                                        (yield authCall(wait, [
+                                            authMethod(() => {
+                                                return authStorage(this.storage, "get", [spent.activeKey]);
+                                            }),
+                                        ])) === null) {
+                                        (yield authCall(wait, [
+                                            authMethod(() => {
+                                                return authStorage(this.storage, "compareAndSet", [spentKey, spentExpected, JSON.stringify({ ...spent, state: "ambiguous" })], () => waiting.transfer());
+                                            }),
+                                        ]));
+                                    }
+                                    this.recordRefreshFailure({ kind: "dead" });
+                                    (yield authCall(wait, [
+                                        authMethod(() => {
+                                            return authInvoke(this, "discardRefusedGrant", [
+                                                requested,
+                                                epoch,
+                                                waiting.transfer,
+                                                waiting.signal,
+                                            ]);
+                                        }),
+                                    ]));
+                                    throw new UnauthorizedError("OAuth refresh token was already spent; authorization required.");
+                                }
+                            }
+                            if (raw === null ||
+                                (plainObject(stored) &&
+                                    typeof stored.expiresAt === "number" &&
+                                    stored.expiresAt <= this.refreshNow())) {
+                                // Clock skew can replace an unsent claim; its dispatch CAS then loses.
+                                const claimed = JSON.stringify({
+                                    connectaOAuthRefresh: 1,
+                                    holder: crypto.randomUUID(),
+                                    state: "claimed",
+                                    expiresAt: this.refreshNow() + OAUTH_REFRESH_LEASE_SECONDS * 1000,
+                                });
+                                let won;
+                                try {
+                                    won = (yield authCall(wait, [
+                                        authMethod(() => {
+                                            return authStorage(this.storage, "compareAndSet", [key, raw, claimed], () => waiting.transfer());
+                                        }),
+                                    ]));
+                                }
+                                catch {
+                                    throw this.credentialWriteError();
+                                }
+                                if (won) {
+                                    try {
+                                        const latest = (yield authCall(wait, [
+                                            authMethod(() => {
+                                                return authInvoke(this, "storedTokens", [waiting.signal]);
+                                            }),
+                                        ]));
+                                        if (latest?.refresh_token !== requested || (latest && this.refreshedSinceRead(latest, epoch))) {
+                                            (yield authCall(wait, [
+                                                authMethod(() => {
+                                                    return authInvoke(this, "releaseRefresh", [
+                                                        { key, spentKey, spentExpected, raw: claimed },
+                                                    ]);
+                                                }),
+                                            ]));
+                                            return latest
+                                                ? this.adoptRefresh(latest)
+                                                : Response.json({ error: "invalid_grant" }, { status: 400 });
+                                        }
+                                        return { key, spentKey, spentExpected, raw: claimed };
+                                    }
+                                    catch (error) {
+                                        if (!waiting.signal.aborted) {
+                                            (yield authCall(wait, [
+                                                authMethod(() => {
+                                                    return authInvoke(this, "releaseRefresh", [
+                                                        { key, spentKey, spentExpected, raw: claimed },
+                                                    ]);
+                                                }),
+                                            ]));
+                                        }
+                                        throw error;
+                                    }
+                                }
+                            }
+                        }
+                        (yield Effect.raceAllFirst([Effect.sleep(delay), fromSignal(waiting.signal)]));
+                        delay = Math.min(250, delay * 2);
+                    }
+                }
+                catch (error) {
+                    if (!waiting.signal.aborted)
+                        throw error;
+                }
+                finally {
+                    if (!sharedWait)
+                        waiting.close();
+                }
+                throw this.refreshContended();
+            }.bind(this));
+        }, KvOAuthProvider.prototype.claimRefresh);
+        registerAuthMethod(KvOAuthProvider.prototype, "dispatchRefresh", function (lease, send, waiting) {
+            return authFlow(function* () {
+                const stored = parsed(lease.raw);
+                const epoch = (yield authInvoke(waiting, "run", [
+                    authMethod(() => {
+                        return authInvoke(this, "flowEpoch", []);
+                    }),
+                ]));
+                const activeKey = oauthRefreshActiveKeys.holder(epoch, stored.holder);
+                (yield authInvoke(waiting, "run", [
+                    authMethod(() => {
+                        return authStorage(this.storage, "set", [
+                            activeKey,
+                            JSON.stringify({ connectaOAuthRefresh: 1 }),
+                            {
+                                ttlSeconds: OAUTH_REFRESH_LEASE_SECONDS,
+                            },
+                        ]);
+                    }),
+                ]));
+                const dispatched = JSON.stringify({
+                    ...stored,
+                    state: "dispatched",
+                    activeKey,
+                });
+                const won = (yield authInvoke(waiting, "run", [
+                    authMethod(() => authStorage(this.storage, "compareAndSet", [lease.key, lease.raw, dispatched])),
+                ]));
+                if (!won)
+                    throw this.refreshContended();
+                lease.raw = dispatched;
+                if (waiting.signal.aborted)
+                    throw aborted(waiting.signal);
+                // One CAS owns the fingerprint across every epoch. Only a later consent
+                // that observed a resolved write may replace it. No TTL or deletion path.
+                lease.spentRaw = JSON.stringify({
+                    connectaOAuthRefreshSpent: 1,
+                    epoch,
+                    holder: stored.holder,
+                    activeKey,
+                    state: "outstanding",
+                });
+                let unspent;
+                try {
+                    unspent = (yield authInvoke(waiting, "run", [
+                        authMethod(() => authStorage(this.storage, "compareAndSet", [
+                            lease.spentKey,
+                            lease.spentExpected,
+                            lease.spentRaw,
+                        ])),
+                    ]));
+                }
+                catch {
+                    this.recordRefreshFailure({ kind: "dead" });
+                    throw new UnauthorizedError("OAuth refresh dispatch could not be recorded; authorization required.");
+                }
+                if (!unspent) {
+                    this.recordRefreshFailure({ kind: "dead" });
+                    throw new UnauthorizedError("OAuth refresh token was already spent; authorization required.");
+                }
+                // Final owner check and physical submission share one reaction.
+                // Submission already transferred ownership to the coordinator. Only
+                // its own deadline can stop this send; the departed caller cannot.
+                if (waiting.signal.aborted)
+                    throw aborted(waiting.signal);
+                return (yield authCall(send, []));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.dispatchRefresh);
+        registerAuthMethod(KvOAuthProvider.prototype, "releaseRefresh", function (lease, verdict, tokens, resolution = "ambiguous") {
+            return authFlow(function* () {
+                const stored = parsed(lease.raw);
+                // Only an unsent claim may be removed. Dispatched outcomes never reopen it.
+                const next = stored.state === "claimed"
+                    ? null
+                    : JSON.stringify({
+                        ...stored,
+                        ...(tokens
+                            ? {
+                                completed: true,
+                                tokenDigest: (yield authCall(refreshTokensDigest, [tokens])),
+                            }
+                            : { verdict: { kind: "dead" } }),
+                    });
+                // Verdicts contain fixed typed facts; no downstream causes or text.
+                if (verdict)
+                    this.recordRefreshFailure(verdict);
+                (yield authInvoke(this, "resolveRefreshSpent", [lease, resolution]));
+                const released = (yield authCatch(authStorage(this.storage, "compareAndSet", [lease.key, lease.raw, next]), () => false));
+                if (released && stored.activeKey)
+                    (yield authCatch(authStorage(this.storage, "delete", [stored.activeKey]), () => { }));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.releaseRefresh);
+        registerAuthMethod(KvOAuthProvider.prototype, "resolveRefreshSpent", function (lease, state) {
+            return authFlow(function* () {
+                try {
+                    const raw = lease.spentRaw ?? (yield authStorage(this.storage, "get", [lease.spentKey]));
+                    const spent = storedRefreshSpent(raw);
+                    const holder = parsed(lease.raw).holder;
+                    if (spent?.state !== "outstanding" || spent.holder !== holder)
+                        return;
+                    // The timestamp belongs to this resolution write, never to dispatch.
+                    // Consent copies the exact stored receipt, so wall clocks grant no sends.
+                    (yield authStorage(this.storage, "compareAndSet", [
+                        lease.spentKey,
+                        raw,
+                        JSON.stringify({
+                            ...spent,
+                            state,
+                            ...(state === "resolved" ? { resolvedAt: Date.now() } : {}),
+                        }),
+                    ]));
+                }
+                catch {
+                    // A lost resolution answer leaves outstanding or the durable outcome;
+                    // either blocks replay until a later consent observes a resolved write.
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.resolveRefreshSpent);
+        registerAuthMethod(KvOAuthProvider.prototype, "storedTokens", function (signal = null) {
+            return authFlow(function* () {
+                return (yield authInvoke(this, "boundGrant", [signal])).body.tokens;
+            }.bind(this));
+        }, KvOAuthProvider.prototype.storedTokens);
+        registerAuthMethod(KvOAuthProvider.prototype, "storeRefresh", function (epoch, requested, tokens, issuer) {
+            return authFlow(function* () {
+                for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
+                    try {
+                        const { raw, grant } = (yield authInvoke(this, "readGrant", [null]));
+                        if (grant.epoch !== epoch || (issuer !== undefined && grant.body.issuer !== issuer))
+                            return undefined;
+                        if (grant.body.tokens?.refresh_token !== requested)
+                            return grant.body.tokens;
+                        const committed = issuer !== undefined ? { ...tokens, issuer } : tokens;
+                        const encoded = (yield authInvoke(this, "encodeGrant", [
+                            { ...grant, body: { ...grant.body, tokens: committed } },
+                            null,
+                        ]));
+                        if ((yield authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded])))
+                            return committed;
+                    }
+                    catch {
+                        // A failed or lost CAS answer may still have committed. Re-read the
+                        // epoch and retry these in-memory tokens without another HTTP request.
+                    }
+                }
+                throw this.credentialWriteError();
+            }.bind(this));
+        }, KvOAuthProvider.prototype.storeRefresh);
+        registerAuthMethod(KvOAuthProvider.prototype, "discardRefusedGrant", function (refreshToken, epoch, beforeWrite, signal) {
+            return authFlow(function* () {
+                try {
+                    (yield authInvoke(this, "updateGrant", [
+                        (grant) => {
+                            if (grant.body.tokens?.refresh_token !== refreshToken)
+                                return undefined;
+                            const { tokens: _refused, ...body } = grant.body;
+                            return { ...grant, body };
+                        },
+                        {
+                            epoch,
+                            quiet: true,
+                            commit: true,
+                            ...(beforeWrite ? { beforeWrite } : {}),
+                            ...(signal ? { signal } : {}),
+                        },
+                    ]));
+                }
+                catch {
+                    // See above: a refusal that could not be recorded recurs, it does not hide.
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.discardRefusedGrant);
+        registerAuthMethod(KvOAuthProvider.prototype, "resetAuthorization", function (operatorDisconnected = false, preserveClient = false) {
+            return authFlow(function* () {
+                const operation = authInvoke(this, "performReset", [operatorDisconnected, preserveClient]);
+                if (!this.onReset)
+                    return (yield operation);
+                const reset = runEdge(operation);
+                this.onReset?.(reset);
+                return (yield authValue(() => reset));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.resetAuthorization);
+        registerAuthMethod(KvOAuthProvider.prototype, "disconnectAuthorization", function (send) {
+            return authFlow(function* () {
+                const operation = authInvoke(this, "performReset", [true, false, send]);
+                if (!this.onReset)
+                    return (yield operation);
+                const reset = runEdge(operation);
+                this.onReset?.(reset);
+                return (yield authValue(() => reset));
+            }.bind(this));
+        }, KvOAuthProvider.prototype.disconnectAuthorization);
+        registerAuthMethod(KvOAuthProvider.prototype, "performReset", function (operatorDisconnected, preserveClient, revoke) {
+            return authFlow(function* () {
+                const epoch = `${operatorDisconnected ? DISCONNECTED_EPOCH_PREFIX : ACTIVE_EPOCH_PREFIX}${crypto.randomUUID()}`;
+                for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
+                    const { raw, grant } = (yield authInvoke(this, "readGrant", [null]));
+                    const carried = preserveClient && !operatorDisconnected ? this.carriableClient(grant) : undefined;
+                    const encoded = (yield authInvoke(this, "encodeGrant", [
+                        { epoch, body: carried ?? {}, cleanupPending: true },
+                        null,
+                    ]));
+                    let written;
+                    try {
+                        written = (yield authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded]));
+                    }
+                    catch {
+                        throw this.credentialWriteError();
+                    }
+                    if (written) {
+                        this.refreshCoordinator?.retire(grant.epoch);
+                        try {
+                            (yield authInvoke(this, "cleanupV2", [encoded, null]));
+                            (yield authInvoke(this, "sweepConsents", []));
+                            (yield authInvoke(this, "sweepRefreshLeases", []));
+                        }
+                        finally {
+                            if (revoke)
+                                (yield authCall(revokeDownstreamGrant, [grant.body, revoke, this.clientOptions?.client]));
+                        }
+                        return;
+                    }
+                }
+                throw this.credentialWriteError();
+            }.bind(this));
+        }, KvOAuthProvider.prototype.performReset);
+        registerAuthMethod(KvOAuthProvider.prototype, "sweepConsents", function () {
+            return authFlow(function* () {
+                try {
+                    const consents = [];
+                    for (const key of (yield authStorage(this.storage, "list", [oauthFlowKeys.prefix]))) {
+                        const raw = (yield authStorage(this.storage, "get", [key]));
+                        if (raw !== null)
+                            consents.push([key, raw]);
+                    }
+                    const live = epochOf((yield authStorage(this.storage, "get", [GRANT])));
+                    for (const [key, raw] of consents) {
+                        const flow = parsed(raw);
+                        if (plainObject(flow) && flow.epoch === live)
+                            continue;
+                        (yield authStorage(this.storage, "compareAndSet", [key, raw, null]));
+                    }
+                }
+                catch {
+                    // Hygiene only: the epoch, not this, fences a stale consent.
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.sweepConsents);
+        registerAuthMethod(KvOAuthProvider.prototype, "sweepRefreshLeases", function () {
+            return authFlow(function* () {
+                try {
+                    const records = [];
+                    // A reset may sweep an old lease while its HTTP request is still live.
+                    // Keep holder liveness until completion or its storage-owned TTL: spent
+                    // records in later epochs still use it to distinguish live from crashed.
+                    for (const key of (yield authStorage(this.storage, "list", [oauthRefreshKeys.prefix]))) {
+                        const raw = (yield authStorage(this.storage, "get", [key]));
+                        if (raw !== null)
+                            records.push([key, raw]);
+                    }
+                    const live = epochOf((yield authStorage(this.storage, "get", [GRANT])));
+                    for (const [key, raw] of records) {
+                        if (!key.startsWith(`${oauthRefreshKeys.prefix}${live}:`)) {
+                            (yield authStorage(this.storage, "compareAndSet", [key, raw, null]));
+                        }
+                    }
+                }
+                catch {
+                    // Stale dispatch records cannot grant credentials: epochs never recur.
+                }
+            }.bind(this));
+        }, KvOAuthProvider.prototype.sweepRefreshLeases);
+    }
 }