@zackbart/connecta 0.35.0 → 0.36.0

package/CHANGELOG.md

@@ -2,6 +2,61 @@
 
 All notable changes to this package are documented here.
 
+## 0.36.0 — 2026-10-27
+
+Connecta 0.36.0 adds a maintained QuickBooks Online Accounting provider for one fixed sandbox or production company per connector. It offers company identity, bounded record searches, individual records and hierarchical financial reports, with contact details and payment credentials withheld. Deployments can opt into customer creation, sparse customer naming updates and unsent US service-invoice creation by setting `readOnly: false` on the connector. Writes need a stable request ID and are never replayed automatically; the API hatch stays read-only, and invoice updates remain unavailable. See [QuickBooks Online](https://github.com/zackbart/connecta/blob/v0.36.0/documentation/providers.md#quickbooks-online).
+
+Static API OAuth gains two options used by QuickBooks and available to any `api()` connector: fixed callback parameters that must match before code exchange, and a trusted revocation endpoint with form or JSON framing. Connectors that don't configure them keep their behavior. Separately, the shared OAuth refresh coordinator now handles vendors that return unchanged refresh-token bytes after a successful refresh. This applies automatically to every OAuth connection, remote MCP included, with no setting.
+
+`@zackbart/connecta-eve` now targets Eve 0.84 (`>=0.84.0 <0.85.0`), which is a breaking change for helper users. Upgrade the Eve app to 0.84.0 together with the helper, and retarget its undici override from `eve@0.83.0>undici` to `eve@0.84.0>undici` (Eve 0.84.0 still pins undici 8.10.2). The helper's two agent files need no edits. Endpoint instructions are now fetched once per turn through Eve's memo, and a cancelled turn no longer delays other sessions' fetches. See the [package guide](https://github.com/zackbart/connecta/blob/v0.36.0/packages/connecta-eve/README.md).
+
+The operator UI build is smaller, with no change to pages or styles. The remaining entries are contributor-facing: retired characterization goldens and provider test mirrors in favor of outcome checks, archived historical evals, and a required outcome-eval CI job. Deployments without QuickBooks or Eve agents can upgrade without changes. No database conversion or token rotation is required.
+
+### Added
+
+- Static API OAuth can require fixed callback parameters, refusing missing, duplicate, or mismatched values after state verification and before issuer validation or code exchange.
+- Document maintained API sources and the generated read/write tool inventory for every provider, linked from the README and provider setup guide.
+- Add a QuickBooks Online Accounting API provider for one fixed sandbox or
+  production company: company identity, bounded record searches, individual
+  records and hierarchical financial reports, with shared OAuth and a restricted
+  read hatch. Contact details and payment credentials remain withheld; public
+  SyncToken record versions remain available.
+  
+  Support successive coordinated OAuth refreshes when a vendor returns unchanged
+  refresh-token bytes after a successful commit. Static API OAuth can configure
+  a trusted revocation endpoint and form or JSON request framing; QuickBooks
+  disconnect revokes the latest grant after local removal. Malformed query and
+  report payloads fail instead of appearing as empty accounting results.
+- Add explicitly enabled QuickBooks Online customer creation, sparse customer naming updates and real unsent service-invoice creation for US companies and USD customers. The connector remains read-only unless deployment code sets `readOnly: false`; the API hatch remains read-only. Writes require a stable request ID and are never automatically replayed. Invoice creation fixes email status and disables online payment options; invoice updates remain deferred pending safe preservation of existing delivery/payment settings.
+
+### Changed
+
+- Keep Google Discovery source evidence once per provider and derive normalized OpenAPI in memory. Remove duplicate raw test fixtures and retained conversions while preserving compiled indexes, reviewed safety and frozen measurement digests.
+- **Breaking:** Move `@zackbart/connecta-eve` to Eve 0.84 (`>=0.84.0 <0.85.0`). Upgrade the Eve app to 0.84.0 with the helper and retarget its undici override to `eve@0.84.0>undici`. Endpoint instructions use Eve's function-form `defineDynamic` and keep one result per turn in Eve's memo, app auth declares `principalType: "app"`, and `approval` accepts Eve's approval configurations as well as policies.
+- Validate QuickBooks accounting reads, OAuth persistence and privacy through shared Node and native Workers outcome journeys. New provider behavior uses executable outcomes instead of characterization goldens (#1072, #1079).
+- Exercise opt-in QuickBooks customer writes and unsent service invoices in required outcome checks and both deployment smokes, including concurrent version conflicts, ambiguous-response reconciliation, privacy and one physical send per intent.
+- Remove unused private REST and Google provider migration adapters and their exclusive regression coverage. Maintained provider tools, public exports, and hosted-selector migration errors keep their current behavior.
+- Replace redundant provider catalog, schema, adapter and kit/core comparison tests
+  with shared stateful provider outcome tasks and a real HTTP hostile-acknowledgement
+  journey. Retain provider-specific algorithms, privacy, physical-send and native
+  fault coverage; provider runtime behavior and public fixtures remain unchanged.
+  Read outcomes require requested facts to reach the agent, with data-loss
+  controls that keep vendor calls and the expected answer intact.
+- Slim the operator UI build by removing redundant Query and Tailwind layers, unused Button Slot support, and duplicate browser-only server emissions. Preserve the public page type, authored styles, local fonts, and identity-scoped read cancellation.
+
+### Fixed
+
+- Contributor evals: `eval:agent` now exits nonzero unless every declared trial ran once, completed normally and passed, so failed, errored, timed-out, interrupted, skipped, missing, duplicated and stopped trials fail the batch. `eval:smoke` provisions the Node template with `rotate-token local-machine`, reaches `/agent/local-machine`, runs `connecta doctor`, claims no write where no write-capable tool exists, and runs the Worker targets with the example's own compatibility date and flags. A new required `eval:outcomes` command and CI `behavior` job grade seven scripted outcome scenarios and their no-false-pass controls. No package behavior changes.
+
+### Removed
+
+- Archive redundant REST eval regrades, invalid initial diagnostic batches and obsolete 0.24/0.25 measurements in Git history, preserving failure notes, exact-file hashes and immutable recovery links. Retain raw live and review-round evidence and the selftest's 0.29 baselines (#1072).
+- Retire the migration-only provider characterization snapshots, capture engine,
+  source controls and self-tests. Keep behavioral failure, privacy, physical-send
+  and request-lifetime coverage, with compact HTTP/QuickJS privacy journeys for
+  credential echoes in newly returned vendor fields.
+- Retire completed schema-preload, index-compaction, Effect evaluation, and Worker-disconnect experiment artifacts from the source checkout. Architecture conclusions retain immutable links to historical evidence. Remove release-note inputs already preserved in the changelog; future release narratives use temporary files before assembly into `CHANGELOG.md`.
+
 ## 0.35.0 — 2026-10-26
 
 Connecta 0.35.0 brings the provider kit and standard agent surfaces to all 15 maintained providers. Operation search and details expose reviewed API contracts without reading account data; indexed read and write tools complement the retained named tools. Gmail keeps its reviewed exception: draft writes use named tools and sending remains unavailable. Results use consistent list envelopes, narrowing `fields`, signed continuations and truncation paths. The [provider migration guide](https://github.com/zackbart/connecta/blob/v0.35.0/documentation/provider-migration-0.35.md) maps every renamed or removed tool and argument, including retired `raw`/`select` arguments, list keys, paging inputs and wrappers replaced by indexed operations. Update saved programs, pool grants, classification entries and deployment instructions before upgrading, and restart old continuations where the guide requires it.

package/README.md

@@ -24,11 +24,15 @@ Connecta supplies the service credentials, so the agent doesn't need them.
 
 ## What you can connect
 
-Maintained connections: <!-- providers:start -->Breeze ChMS, Church Community Builder, Cloudflare, GitHub, Gmail, Google Docs, Google Drive, Google Forms, Google Sheets, Google Slides, Overflow, Planning Center, Stripe, Tithe.ly, and Vercel<!-- providers:end -->.
+Maintained connections: <!-- providers:start -->Breeze ChMS, Church Community Builder, Cloudflare, GitHub, Gmail, Google Docs, Google Drive, Google Forms, Google Sheets, Google Slides, Overflow, Planning Center, QuickBooks Online, Stripe, Tithe.ly, and Vercel<!-- providers:end -->.
 
-You can also connect another hosted MCP tool server, or describe an API
-Connecta should call. Hosted connections use the server's current tools;
-maintained integrations come with tools built by Connecta.
+Maintained API providers pair reviewed vendor contracts with tools built by
+Connecta. See the [API sources and tool inventory](./documentation/providers.md#api-sources-and-tool-inventory)
+for each provider's named workflows and reviewed API tools.
+
+You can also connect another hosted MCP tool server through `remoteMcp()`,
+which discovers the server's live tool catalog, or describe an API Connecta
+should call.
 
 ## What it protects
 

package/bin/version.mjs

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.35.0";
+export const CONNECTA_VERSION = "0.36.0";

package/dist/auth/downstream-oauth.js

@@ -229,7 +229,7 @@ function requestedRefreshToken(init) {
 /**
  * The token endpoint as one connector runtime's OAuth flows reach it.
  *
- * A refresh is redeemed once per owner partition and epoch: the first request
+ * A refresh generation is redeemed once per owner partition: the first request
  * owns the fetch, classifies the answer, and stores an accepted rotation, by
  * compare-and-set, before anyone is released, so a cancelled owner or an SDK
  * that redirects instead of saving cannot strand a spent refresh token.
@@ -1280,6 +1280,10 @@ export class KvOAuthProvider {
     disconnectAuthorization(send) {
         return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "disconnectAuthorization", [send]));
     }
+    /** Static adapters supply trusted configuration without persisting client secrets. */
+    revocationSnapshot(body) {
+        return { body, ...(this.clientOptions?.client ? { client: this.clientOptions.client } : {}) };
+    }
     performReset(operatorDisconnected, preserveClient, revoke) {
         return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "performReset", [
             operatorDisconnected,
@@ -2282,6 +2286,13 @@ export class KvOAuthProvider {
             return authFlow(function* () {
                 const waiting = sharedWait ?? refreshWait(signal);
                 const wait = waiting.run;
+                const read = (key) => authCall(wait, [authMethod(() => authStorage(this.storage, "get", [key]))]);
+                const discard = () => authCall(wait, [
+                    authMethod(() => authInvoke(this, "discardRefusedGrant", [requested, epoch, waiting.transfer, waiting.signal])),
+                ]);
+                const tokens = () => authCall(wait, [
+                    authMethod(() => authInvoke(this, "storedTokens", [waiting.signal])),
+                ]);
                 let delay = 10;
                 try {
                     const digest = (yield authCall(wait, [
@@ -2292,11 +2303,7 @@ export class KvOAuthProvider {
                     const key = oauthRefreshKeys.lease(epoch, digest);
                     const spentKey = oauthRefreshSpentKeys.spent(digest);
                     while (!waiting.signal.aborted) {
-                        const current = (yield authCall(wait, [
-                            authMethod(() => {
-                                return authInvoke(this, "storedTokens", [waiting.signal]);
-                            }),
-                        ]));
+                        const current = (yield tokens());
                         if (current?.refresh_token !== requested || (current && this.refreshedSinceRead(current, epoch))) {
                             if (!current)
                                 this.recordRefreshFailure({ kind: "dead" });
@@ -2304,46 +2311,29 @@ export class KvOAuthProvider {
                                 ? this.adoptRefresh(current)
                                 : Response.json({ error: "invalid_grant" }, { status: 400 });
                         }
-                        const raw = (yield authCall(wait, [
-                            authMethod(() => {
-                                return authStorage(this.storage, "get", [key]);
-                            }),
-                        ]));
+                        const raw = (yield read(key));
                         const stored = raw === null ? undefined : parsed(raw);
-                        if (plainObject(stored) &&
-                            stored.completed === true &&
-                            current &&
+                        const committed = plainObject(stored) &&
+                            (stored.completed === true ||
+                                (stored.state === "claimed" && typeof stored.predecessor === "string")) &&
+                            current !== undefined &&
                             stored.tokenDigest ===
                                 (yield authCall(wait, [
                                     authMethod(() => {
                                         return authCall(refreshTokensDigest, [current]);
                                     }),
-                                ]))) {
-                            return this.adoptRefresh(current);
-                        }
-                        if (plainObject(stored) && (plainObject(stored.verdict) || stored.completed === true)) {
+                                ]));
+                        const completed = committed && stored.completed === true;
+                        if (plainObject(stored) && (plainObject(stored.verdict) || (stored.completed === true && !committed))) {
                             this.recordRefreshFailure({ kind: "dead" });
-                            (yield authCall(wait, [
-                                authMethod(() => {
-                                    return authInvoke(this, "discardRefusedGrant", [
-                                        requested,
-                                        epoch,
-                                        waiting.transfer,
-                                        waiting.signal,
-                                    ]);
-                                }),
-                            ]));
+                            (yield discard());
                             throw new UnauthorizedError("OAuth refresh grant is no longer active.");
                         }
-                        if (plainObject(stored) && stored.state !== "claimed") {
+                        if (plainObject(stored) && stored.state !== "claimed" && !completed) {
                             // Never compare another isolate's clock for a sent request. The
                             // durable record survives expiry of this storage-owned liveness key.
                             const active = typeof stored.activeKey === "string"
-                                ? (yield authCall(wait, [
-                                    authMethod(() => {
-                                        return authStorage(this.storage, "get", [stored.activeKey]);
-                                    }),
-                                ]))
+                                ? (yield read(stored.activeKey))
                                 : null;
                             if (active === null) {
                                 const refused = JSON.stringify({ ...stored, verdict: { kind: "dead" } });
@@ -2361,27 +2351,14 @@ export class KvOAuthProvider {
                                         }),
                                     ]));
                                     this.recordRefreshFailure({ kind: "dead" });
-                                    (yield authCall(wait, [
-                                        authMethod(() => {
-                                            return authInvoke(this, "discardRefusedGrant", [
-                                                requested,
-                                                epoch,
-                                                waiting.transfer,
-                                                waiting.signal,
-                                            ]);
-                                        }),
-                                    ]));
+                                    (yield discard());
                                     throw new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
                                 }
                                 continue;
                             }
                         }
                         else {
-                            const spentExpected = (yield authCall(wait, [
-                                authMethod(() => {
-                                    return authStorage(this.storage, "get", [spentKey]);
-                                }),
-                            ]));
+                            const spentExpected = (yield read(spentKey));
                             if (spentExpected !== null) {
                                 const spent = storedRefreshSpent(spentExpected);
                                 const consent = (yield authCall(wait, [
@@ -2390,17 +2367,23 @@ export class KvOAuthProvider {
                                     }),
                                 ])).body.refreshConsent;
                                 if (spent?.state !== "resolved" ||
-                                    spent.epoch === epoch ||
-                                    consent?.digest !== digest ||
-                                    consent.resolution !== spentExpected) {
+                                    !(
+                                    // A completed lease proves these exact tokens committed.
+                                    // Reusable refresh tokens may start another generation,
+                                    // but only after its own dispatch is durably resolved.
+                                    (committed &&
+                                        spent.epoch === epoch &&
+                                        spent.holder === (completed ? stored.holder : stored.predecessor)) ||
+                                        (spent.epoch !== epoch && consent?.digest === digest && consent.resolution === spentExpected))) {
+                                    // Lease and fingerprint are separate records. A competing
+                                    // generation can advance both between these reads; retry
+                                    // its new lease instead of discarding a live grant.
+                                    const latestLease = (yield read(key));
+                                    if (latestLease !== raw)
+                                        continue;
                                     // Reset can sweep the old lease while its request remains live.
                                     // Only storage-owned expiry can make an outstanding send ambiguous.
-                                    if (spent?.state === "outstanding" &&
-                                        (yield authCall(wait, [
-                                            authMethod(() => {
-                                                return authStorage(this.storage, "get", [spent.activeKey]);
-                                            }),
-                                        ])) === null) {
+                                    if (spent?.state === "outstanding" && (yield read(spent.activeKey)) === null) {
                                         (yield authCall(wait, [
                                             authMethod(() => {
                                                 return authStorage(this.storage, "compareAndSet", [spentKey, spentExpected, JSON.stringify({ ...spent, state: "ambiguous" })], () => waiting.transfer());
@@ -2408,29 +2391,32 @@ export class KvOAuthProvider {
                                         ]));
                                     }
                                     this.recordRefreshFailure({ kind: "dead" });
-                                    (yield authCall(wait, [
-                                        authMethod(() => {
-                                            return authInvoke(this, "discardRefusedGrant", [
-                                                requested,
-                                                epoch,
-                                                waiting.transfer,
-                                                waiting.signal,
-                                            ]);
-                                        }),
-                                    ]));
+                                    (yield discard());
                                     throw new UnauthorizedError("OAuth refresh token was already spent; authorization required.");
                                 }
                             }
                             if (raw === null ||
+                                completed ||
                                 (plainObject(stored) &&
                                     typeof stored.expiresAt === "number" &&
                                     stored.expiresAt <= this.refreshNow())) {
                                 // Clock skew can replace an unsent claim; its dispatch CAS then loses.
+                                const predecessor = completed
+                                    ? stored.holder
+                                    : plainObject(stored)
+                                        ? stored.predecessor
+                                        : undefined;
                                 const claimed = JSON.stringify({
                                     connectaOAuthRefresh: 1,
                                     holder: crypto.randomUUID(),
                                     state: "claimed",
                                     expiresAt: this.refreshNow() + OAUTH_REFRESH_LEASE_SECONDS * 1000,
+                                    ...(committed && typeof predecessor === "string" && typeof stored.tokenDigest === "string"
+                                        ? {
+                                            predecessor,
+                                            tokenDigest: stored.tokenDigest,
+                                        }
+                                        : {}),
                                 });
                                 let won;
                                 try {
@@ -2445,11 +2431,7 @@ export class KvOAuthProvider {
                                 }
                                 if (won) {
                                     try {
-                                        const latest = (yield authCall(wait, [
-                                            authMethod(() => {
-                                                return authInvoke(this, "storedTokens", [waiting.signal]);
-                                            }),
-                                        ]));
+                                        const latest = (yield tokens());
                                         if (latest?.refresh_token !== requested || (latest && this.refreshedSinceRead(latest, epoch))) {
                                             (yield authCall(wait, [
                                                 authMethod(() => {
@@ -2527,8 +2509,8 @@ export class KvOAuthProvider {
                 lease.raw = dispatched;
                 if (waiting.signal.aborted)
                     throw aborted(waiting.signal);
-                // One CAS owns the fingerprint across every epoch. Only a later consent
-                // that observed a resolved write may replace it. No TTL or deletion path.
+                // One CAS owns the fingerprint across epochs and generations. Only a
+                // proven successful commit or later consent may replace a resolved send.
                 lease.spentRaw = JSON.stringify({
                     connectaOAuthRefreshSpent: 1,
                     epoch,
@@ -2565,9 +2547,17 @@ export class KvOAuthProvider {
         registerAuthMethod(KvOAuthProvider.prototype, "releaseRefresh", function (lease, verdict, tokens, resolution = "ambiguous") {
             return authFlow(function* () {
                 const stored = parsed(lease.raw);
-                // Only an unsent claim may be removed. Dispatched outcomes never reopen it.
+                // Unsent successors restore the prior completed proof; other unsent
+                // claims may be removed. Dispatched outcomes never reopen a send.
                 const next = stored.state === "claimed"
-                    ? null
+                    ? stored.predecessor && stored.tokenDigest
+                        ? JSON.stringify({
+                            ...stored,
+                            holder: stored.predecessor,
+                            state: "dispatched",
+                            completed: true,
+                        })
+                        : null
                     : JSON.stringify({
                         ...stored,
                         ...(tokens
@@ -2711,8 +2701,10 @@ export class KvOAuthProvider {
                             (yield authInvoke(this, "sweepRefreshLeases", []));
                         }
                         finally {
-                            if (revoke)
-                                (yield authCall(revokeDownstreamGrant, [grant.body, revoke, this.clientOptions?.client]));
+                            if (revoke) {
+                                const snapshot = this.revocationSnapshot(grant.body);
+                                (yield authCall(revokeDownstreamGrant, [snapshot.body, revoke, snapshot.client]));
+                            }
                         }
                         return;
                     }

package/dist/auth/static-oauth.js

@@ -54,6 +54,15 @@ const RESERVED_AUTHORIZATION_PARAMS = new Set([
     "code_challenge_method",
     "resource",
 ]);
+/** Protocol response fields have their own validation, never static assertions. */
+const RESERVED_CALLBACK_PARAMS = new Set([
+    "code",
+    "state",
+    "iss",
+    "error",
+    "error_description",
+    "error_uri",
+]);
 /** Token-request headers the grant owns: client authentication and framing. */
 const RESERVED_TOKEN_HEADERS = new Set([
     "authorization",
@@ -92,65 +101,91 @@ function settingsFor(id, config) {
     if (!config || typeof config !== "object") {
         throw new Error(`[connecta] connector "${id}" oauth must be an object.`);
     }
+    const invalid = (detail) => {
+        throw new Error(`[connecta] connector "${id}" oauth.${detail}`);
+    };
     const authorizationEndpoint = configuredUrl(id, "authorizationEndpoint", config.authorizationEndpoint);
     const tokenEndpoint = configuredUrl(id, "tokenEndpoint", config.tokenEndpoint);
+    const revocationEndpoint = config.revocationEndpoint === undefined
+        ? undefined
+        : configuredUrl(id, "revocationEndpoint", config.revocationEndpoint);
+    if (revocationEndpoint?.search)
+        invalid(`revocationEndpoint must not carry a query.`);
+    const revocationRequestFormat = config.revocationRequestFormat ?? "form";
+    if ((revocationRequestFormat !== "form" && revocationRequestFormat !== "json") ||
+        (config.revocationRequestFormat !== undefined && !revocationEndpoint))
+        invalid(`revocationRequestFormat requires an endpoint and form or json.`);
     if (tokenEndpoint.search) {
-        throw new Error(`[connecta] connector "${id}" oauth.tokenEndpoint must not carry a query.`);
+        invalid(`tokenEndpoint must not carry a query.`);
     }
     if (typeof config.clientId !== "string" || config.clientId.trim() === "") {
-        throw new Error(`[connecta] connector "${id}" oauth.clientId must be a non-empty string.`);
+        invalid(`clientId must be a non-empty string.`);
     }
     if (config.clientSecret !== undefined && (typeof config.clientSecret !== "string" || config.clientSecret === "")) {
         // Usually an unset environment variable read as "". Never echo it.
-        throw new Error(`[connecta] connector "${id}" oauth.clientSecret must be a non-empty string when set.`);
+        invalid(`clientSecret must be a non-empty string when set.`);
     }
     const clientAuthentication = config.tokenEndpointAuthMethod ?? (config.clientSecret !== undefined ? "client_secret_basic" : "none");
     if (!CLIENT_AUTHENTICATION.has(clientAuthentication)) {
-        throw new Error(`[connecta] connector "${id}" oauth.tokenEndpointAuthMethod must be ` +
-            '"client_secret_basic", "client_secret_post", or "none".');
+        invalid(`tokenEndpointAuthMethod must be ` + '"client_secret_basic", "client_secret_post", or "none".');
     }
     if (clientAuthentication === "none" && config.clientSecret !== undefined) {
         throw new Error(`[connecta] connector "${id}" oauth declares a clientSecret with ` +
             'tokenEndpointAuthMethod "none"; a public client sends no secret.');
     }
     if (clientAuthentication !== "none" && config.clientSecret === undefined) {
-        throw new Error(`[connecta] connector "${id}" oauth.tokenEndpointAuthMethod ` + `"${clientAuthentication}" needs a clientSecret.`);
+        invalid(`tokenEndpointAuthMethod ` + `"${clientAuthentication}" needs a clientSecret.`);
     }
     assertOAuthScope(id, config.scope);
     const authorizationParams = [];
     for (const [name, value] of Object.entries(config.authorizationParams ?? {})) {
         if (RESERVED_AUTHORIZATION_PARAMS.has(name)) {
-            throw new Error(`[connecta] connector "${id}" oauth.authorizationParams may not set ` +
-                `"${name}"; the authorization request owns it.`);
+            invalid(`authorizationParams may not set ` + `"${name}"; the authorization request owns it.`);
         }
         if (typeof value !== "string") {
-            throw new Error(`[connecta] connector "${id}" oauth.authorizationParams.${name} must be a string.`);
+            invalid(`authorizationParams.${name} must be a string.`);
         }
         authorizationParams.push([name, value]);
     }
+    const expectedCallbackParameters = [];
+    if (config.expectedCallbackParameters !== undefined &&
+        (!config.expectedCallbackParameters ||
+            typeof config.expectedCallbackParameters !== "object" ||
+            Array.isArray(config.expectedCallbackParameters))) {
+        invalid(`expectedCallbackParameters must be a string record.`);
+    }
+    for (const [name, value] of Object.entries(config.expectedCallbackParameters ?? {})) {
+        if (!/^[A-Za-z0-9_.-]+$/.test(name) ||
+            RESERVED_CALLBACK_PARAMS.has(name) ||
+            typeof value !== "string" ||
+            value === "") {
+            invalid(`expectedCallbackParameters must use nonempty parameter names ` +
+                "(ASCII letters, digits, dots, underscores or hyphens), nonempty string values, and no OAuth response fields.");
+        }
+        expectedCallbackParameters.push([name, value]);
+    }
     const tokenRequestHeaders = [];
     for (const [name, value] of Object.entries(config.tokenRequestHeaders ?? {})) {
         if (!HEADER_NAME.test(name)) {
-            throw new Error(`[connecta] connector "${id}" oauth.tokenRequestHeaders has an invalid header name.`);
+            invalid(`tokenRequestHeaders has an invalid header name.`);
         }
         if (RESERVED_TOKEN_HEADERS.has(name.toLowerCase())) {
-            throw new Error(`[connecta] connector "${id}" oauth.tokenRequestHeaders may not set ` + `"${name}"; the token request owns it.`);
+            invalid(`tokenRequestHeaders may not set ` + `"${name}"; the token request owns it.`);
         }
         if (typeof value !== "string" || value.includes("\r") || value.includes("\n") || value.includes("\0")) {
-            throw new Error(`[connecta] connector "${id}" oauth.tokenRequestHeaders.${name} must be a single-line string.`);
+            invalid(`tokenRequestHeaders.${name} must be a single-line string.`);
         }
         tokenRequestHeaders.push([name, value]);
     }
     const origins = Array.isArray(config.apiOrigins) ? config.apiOrigins : [];
     if (origins.length === 0) {
-        throw new Error(`[connecta] connector "${id}" oauth.apiOrigins must name at least one ` +
-            "origin; ctx.oauth.fetch sends the access token nowhere else.");
+        invalid(`apiOrigins must name at least one ` + "origin; ctx.oauth.fetch sends the access token nowhere else.");
     }
     const apiOrigins = new Set();
     for (const origin of origins) {
         const url = configuredUrl(id, "apiOrigins", origin);
         if (url.origin !== origin) {
-            throw new Error(`[connecta] connector "${id}" oauth.apiOrigins entries must be exact ` +
+            invalid(`apiOrigins entries must be exact ` +
                 'origins, like "https://api.example.com", with no path or trailing slash.');
         }
         apiOrigins.add(url.origin);
@@ -158,12 +193,15 @@ function settingsFor(id, config) {
     return {
         authorizationEndpoint,
         tokenEndpoint,
+        ...(revocationEndpoint ? { revocationEndpoint } : {}),
+        revocationRequestFormat,
         clientId: config.clientId,
         ...(config.clientSecret !== undefined ? { clientSecret: config.clientSecret } : {}),
         clientAuthentication,
         ...(config.scope !== undefined ? { scope: config.scope } : {}),
         pkce: config.pkce ?? true,
         authorizationParams,
+        expectedCallbackParameters,
         tokenRequestHeaders,
         apiOrigins,
         serverUrl: new URL(origins[0]),
@@ -202,6 +240,29 @@ class StaticOAuthProvider extends KvOAuthProvider {
             tokenEndpoint: this.settings.tokenEndpoint.href,
         };
     }
+    configuredClientInformation() {
+        const { settings } = this;
+        return {
+            client_id: settings.clientId,
+            ...(settings.clientSecret !== undefined ? { client_secret: settings.clientSecret } : {}),
+            redirect_uris: [this.redirectUrl],
+            token_endpoint_auth_method: settings.clientAuthentication,
+            issuer: settings.identity,
+        };
+    }
+    revocationSnapshot(body) {
+        const { settings } = this;
+        return {
+            body: {
+                ...body,
+                client: { value: this.configuredClientInformation() },
+                discovery: {
+                    authorizationServerUrl: settings.identity,
+                    authorizationServerMetadata: { revocation_endpoint: settings.revocationEndpoint.href },
+                },
+            },
+        };
+    }
     saveClientInformation() {
         return runEdge(authOwnMethod(StaticOAuthProvider.prototype, this, "saveClientInformation", []));
     }
@@ -245,16 +306,7 @@ class StaticOAuthProvider extends KvOAuthProvider {
     }
     static {
         registerAuthMethod(StaticOAuthProvider.prototype, "clientInformation", function () {
-            return authValue(() => {
-                const { settings } = this;
-                return {
-                    client_id: settings.clientId,
-                    ...(settings.clientSecret !== undefined ? { client_secret: settings.clientSecret } : {}),
-                    redirect_uris: [this.redirectUrl],
-                    token_endpoint_auth_method: settings.clientAuthentication,
-                    issuer: settings.identity,
-                };
-            });
+            return authValue(() => this.configuredClientInformation());
         }, StaticOAuthProvider.prototype.clientInformation);
         registerAuthMethod(StaticOAuthProvider.prototype, "saveClientInformation", function () {
             // Nothing to save: the SDK only saves a client it registered or stamped.
@@ -359,6 +411,10 @@ const readChallengeNative = /* @__PURE__ */ registerAuth(readChallenge, function
 /** The grant behind one `api()` connector's `oauth`, as the hooks it exposes. */
 export function staticOAuth(id, config) {
     const settings = settingsFor(id, config);
+    const callbackParametersMatch = (params) => settings.expectedCallbackParameters.every(([name, expected]) => {
+        const values = params?.getAll(name);
+        return values?.length === 1 && values[0] === expected;
+    });
     const issuerContext = { issuer: settings.identity };
     const coordinatorFor = refreshCoordinatorsByPartition();
     // Keyed by request scope, so nothing here outlives the request that set it.
@@ -830,7 +886,25 @@ export function staticOAuth(id, config) {
     const disconnectAuth = authMethod((ctx) => {
         return authFlow(function* () {
             rejectedScopes.delete(scopeOf(ctx));
-            (yield authInvoke(providerFor(ctx), "resetAuthorization", [true]));
+            if (!settings.revocationEndpoint) {
+                (yield authInvoke(providerFor(ctx), "resetAuthorization", [true]));
+                return;
+            }
+            (yield authInvoke(providerFor(ctx), "disconnectAuthorization", [
+                authMethod((input, init = {}) => {
+                    // Register the standard form's credentials before any JSON framing.
+                    trackRemoteClientRequest(sentSecretsFor(ctx), input, init);
+                    if (settings.revocationRequestFormat === "json" && init.body instanceof URLSearchParams) {
+                        const params = new URLSearchParams(init.body);
+                        params.delete("token_type_hint");
+                        const headers = new Headers(init.headers);
+                        headers.set("Content-Type", "application/json");
+                        headers.set("Accept", "application/json");
+                        init = { ...init, headers, body: JSON.stringify(Object.fromEntries(params)) };
+                    }
+                    return authCall(tokenEndpointFetch, [sentSecretsFor(ctx), input, init]);
+                }),
+            ]));
         });
     });
     const verifyState = authMethod((state, ctx) => {
@@ -854,6 +928,9 @@ export function staticOAuth(id, config) {
                 if (!consent || !(yield authInvoke(provider, "verifyCallbackState", [consent]))) {
                     throw new ConnectorCallError("connector_call_failed", `Connector "${id}" authorization callback matches no pending consent; nothing was exchanged.`);
                 }
+                if (!callbackParametersMatch(callbackParams)) {
+                    throw new ConnectorCallError("connector_call_failed", `Connector "${id}" authorization callback did not match its configured parameters; nothing was exchanged.`);
+                }
                 provider.validateCallbackIssuer(callbackParams?.get("iss") ?? null);
                 provider.exchanging(authorizationCode);
                 (yield authInvoke(provider, "bindFlow", []));
@@ -877,6 +954,7 @@ export function staticOAuth(id, config) {
         startAuth: retainAuthPartition(startAuth, 0),
         disconnectAuth: retainAuthPartition(disconnectAuth, 0),
         verifyState: retainAuthPartition(verifyState, 1),
+        verifyCallbackParameters: retainAuthPartition(authMethod((params, _ctx) => authValue(() => callbackParametersMatch(params))), 1),
         verifyCallbackIssuer: retainAuthPartition(authMethod((issuer, ctx) => {
             return authValue(() => {
                 const provider = callbackProviders.get(scopeOf(ctx));