@zackbart/connecta 0.38.0 → 0.40.0

package/dist/auth/downstream-oauth.js

@@ -1,74 +1,18 @@
-import { bytesToHex, sha256Hex } from "../bytes.js";
+import { META_ROUTES } from "../agent-routes.js";
 import { UnauthorizedError } from "@modelcontextprotocol/client";
-import { Effect, Exit } from "effect";
-import { byteReadResponse } from "../byte-read-response.js";
 import { deriveContext } from "../derived-context.js";
 import { ConnectorCallError, resendAdvice } from "../errors.js";
-import { oauthPartitionFor, retainOAuthPartition } from "../oauth-partition.js";
-import { keepErrorName } from "../redaction-identity.js";
-import { fromSignal, runEdge } from "../runtime/run.js";
-import { Settlement } from "../runtime/settlement.js";
 import { SentSecrets } from "../sent-secrets.js";
-import { OAUTH_FLOW_TTL_SECONDS, OAUTH_REFRESH_LEASE_SECONDS, oauthFlowKeys, oauthGrantKeys, retiredOAuthKeys, oauthRefreshActiveKeys, oauthRefreshKeys, oauthRefreshSpentKeys, } from "../storage/keys.js";
 import { authenticateRemoteClient, downstreamClientMetadata, remoteClientAuthMethod, } from "./downstream-client-metadata.js";
-import { revokeDownstreamGrant } from "./downstream-revocation.js";
-import { authAwait, authCall, authCatch, authDetached, authFlow, authInvoke, authMethod, authOwnMethod, authProgram, authStorage, authThen, authValue, registerAuth, registerAuthMethod, } from "./native.js";
-import { isOAuthCredentialRequest, isRefreshTokenRequest, refreshResponseOutcome, sdkSafeTokenResponse, tokenGrantType, } from "./oauth-token-response.js";
-import { discoveryIssuer } from "./oauth-grant.js";
-/** @internal Keep the SDK's cloned body reads inside the code exchange's request. */
-export function codeExchangeResponse(response, signal) {
-    if (!response.body)
-        return response;
-    const reader = response.body.getReader();
-    void reader.closed.catch(() => { });
-    let closed = false;
-    let abort;
-    const release = () => {
-        closed = true;
-        signal.removeEventListener("abort", abort);
-        reader.releaseLock();
-    };
-    const body = new ReadableStream({
-        start(controller) {
-            abort = () => {
-                if (closed)
-                    return;
-                void reader.cancel().catch(() => { });
-                release();
-                controller.error(signal.reason);
-            };
-            signal.addEventListener("abort", abort, { once: true });
-            if (signal.aborted)
-                abort();
-        },
-        async pull(controller) {
-            try {
-                const next = await reader.read();
-                if (closed)
-                    return;
-                if (next.done) {
-                    release();
-                    controller.close();
-                }
-                else
-                    controller.enqueue(next.value);
-            }
-            catch (error) {
-                if (!closed) {
-                    release();
-                    controller.error(error);
-                }
-            }
-        },
-        cancel() {
-            if (!closed) {
-                void reader.cancel().catch(() => { });
-                release();
-            }
-        },
-    });
-    return byteReadResponse(new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers }));
-}
+import { authMethods } from "./native.js";
+import { OAUTH_REFRESH_SKEW_MS } from "./oauth-grant.js";
+import { consentMethods } from "./downstream-oauth/consent.js";
+import { ACTIVE_EPOCH_PREFIX, GRANT, grantStoreMethods, isDisconnectedEpoch, } from "./downstream-oauth/grant-store.js";
+import { aborted, tokenResponse, } from "./downstream-oauth/refresh-coordinator.js";
+import { refreshRecordMethods } from "./downstream-oauth/refresh-records.js";
+import { sdkHookMethods } from "./downstream-oauth/sdk-hooks.js";
+export { earlyRenewalFetch, EarlyRenewals, OAuthRefreshCoordinator, refreshCoordinatorsByPartition, } from "./downstream-oauth/refresh-coordinator.js";
+export { codeExchangeResponse, OAuthCallbackClaimedError, oauthStateDigest } from "./downstream-oauth/consent.js";
 /** RFC 6749 section 3.3: one or more scope tokens, separated by single spaces. */
 const OAUTH_SCOPE = /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/;
 /** Refuse, at construction, a configured scope no authorization server could parse. */
@@ -87,650 +31,9 @@ export function assertOAuthScope(connectorId, scope) {
 export function authorizingContext(ctx) {
     return deriveContext(ctx, { allowAuthorization: true });
 }
-/**
- * A callback whose consent another callback already claimed: fixed text, and
- * nothing was sent. Its own class so the callback route can answer it as the
- * already-used link it is, not as an exchange the provider refused.
- */
-export class OAuthCallbackClaimedError extends ConnectorCallError {
-    constructor(connectorId) {
-        super("connector_call_failed", `Connector "${connectorId}" authorization callback was already used by another request; nothing was exchanged.`);
-        this.name = "OAuthCallbackClaimedError";
-    }
-}
-keepErrorName(OAuthCallbackClaimedError, "OAuthCallbackClaimedError");
 /** A local destination guard proved that no OAuth HTTP request left. */
 export class OAuthRequestNotSentError extends ConnectorCallError {
 }
-/** A 256-bit random opaque value, hex-encoded — used for the OAuth `state`. */
-function randomState() {
-    const bytes = new Uint8Array(32);
-    crypto.getRandomValues(bytes);
-    return bytesToHex(bytes);
-}
-/** Lowercase hex SHA-256 of a consent's `state`: the name of its flow record. */
-export async function oauthStateDigest(state) {
-    return sha256Hex(state);
-}
-function storedRefreshSpent(raw) {
-    const value = raw === null ? undefined : parsed(raw);
-    return plainObject(value) &&
-        value.connectaOAuthRefreshSpent === 1 &&
-        typeof value.epoch === "string" &&
-        typeof value.holder === "string" &&
-        typeof value.activeKey === "string" &&
-        (value.state === "outstanding" ||
-            value.state === "ambiguous" ||
-            (value.state === "resolved" && typeof value.resolvedAt === "number" && Number.isFinite(value.resolvedAt)))
-        ? value
-        : undefined;
-}
-const REFRESH_REQUEST_DEADLINE_MS = 20_000;
-const REFRESH_COMMIT_DEADLINE_MS = 20_000;
-const REFRESH_WAIT_DEADLINE_MS = 35_000;
-function refreshWait(signal, timeoutMs = REFRESH_WAIT_DEADLINE_MS) {
-    const deadline = new AbortController();
-    let timer = setTimeout(() => deadline.abort(), timeoutMs);
-    let closed = false;
-    let transferred = false;
-    let requestStarted = false;
-    const abort = () => deadline.abort(aborted(signal));
-    signal?.addEventListener("abort", abort, { once: true });
-    if (signal?.aborted)
-        abort();
-    return {
-        signal: deadline.signal,
-        get requestStarted() {
-            return requestStarted;
-        },
-        run: authMethod((operation) => {
-            return authFlow(function* () {
-                // A race's losing operation may still start. Check before constructing it,
-                // then again before handing a late result back to preparation.
-                if (deadline.signal.aborted)
-                    return (yield Effect.fail(aborted(deadline.signal)));
-                return (yield authThen(Effect.raceAllFirst([fromSignal(deadline.signal), authCall(operation, [])]), (value) => {
-                    if (deadline.signal.aborted)
-                        throw aborted(deadline.signal);
-                    return value;
-                }));
-            });
-        }),
-        transfer: () => {
-            if (deadline.signal.aborted)
-                throw aborted(deadline.signal);
-            if (transferred)
-                return;
-            // Synchronous with CAS submission: cancellation can prevent the write
-            // only before this point. Keep the independent preparation timer alive.
-            signal?.removeEventListener("abort", abort);
-            transferred = true;
-        },
-        beginRequest: () => {
-            if (deadline.signal.aborted)
-                throw aborted(deadline.signal);
-            requestStarted = true;
-            clearTimeout(timer);
-            timer = setTimeout(() => {
-                deadline.abort(new DOMException("OAuth refresh timed out", "TimeoutError"));
-            }, REFRESH_REQUEST_DEADLINE_MS);
-        },
-        close: () => {
-            if (closed)
-                return;
-            closed = true;
-            clearTimeout(timer);
-            signal?.removeEventListener("abort", abort);
-        },
-    };
-}
-function aborted(signal) {
-    return signal?.reason ?? new DOMException("This operation was aborted", "AbortError");
-}
-/**
- * The outcome of a flight another request owns, failures included. Rejects
- * only with this caller's own abort.
- *
- * The owner settles the flight from its own request. Settlement wakes this
- * waiter through a Promise this request created, so the wait — and the
- * caller's storage reads after it — resume here, never inside the owner's
- * call (src/runtime/settlement.ts).
- */
-function waitForRefreshFlight(flight, signal, deadline) {
-    const settled = flight.outcome.wait();
-    // The abort goes first, so a caller that has already left never joins.
-    return runEdge(Effect.raceAllFirst([
-        ...(signal ? [fromSignal(signal)] : []),
-        ...(deadline ? [fromSignal(deadline)] : []),
-        settled,
-    ]));
-}
-/** Tokens as a token response the SDK parses: only the client stamps an issuer. */
-function tokenResponse(tokens) {
-    const { issuer: _issuer, ...answer } = tokens;
-    return Response.json(answer);
-}
-function refreshTokensDigest(tokens) {
-    return runEdge(authProgram(refreshTokensDigestNative, [tokens]));
-}
-const refreshTokensDigestNative = /* @__PURE__ */ registerAuth(refreshTokensDigest, function (tokens) {
-    return authFlow(function* () {
-        const { issuer: _issuer, ...answer } = tokens;
-        return (yield authCall(oauthStateDigest, [
-            JSON.stringify(Object.fromEntries(Object.entries(answer).sort(([a], [b]) => a.localeCompare(b)))),
-        ]));
-    });
-});
-function requestedRefreshToken(init) {
-    return init?.body instanceof URLSearchParams
-        ? init.body.get("refresh_token")
-        : new URLSearchParams(String(init?.body ?? "")).get("refresh_token");
-}
-/**
- * The token endpoint as one connector runtime's OAuth flows reach it.
- *
- * A refresh generation is redeemed once per owner partition: the first request
- * owns the fetch, classifies the answer, and stores an accepted rotation, by
- * compare-and-set, before anyone is released, so a cancelled owner or an SDK
- * that redirects instead of saving cannot strand a spent refresh token.
- * Requests that arrive meanwhile join its outcome; a request whose token read
- * predates a stored refresh is handed that refresh instead of redeeming again.
- * A shared-storage lease prevents concurrent redemption across isolates;
- * the grant CAS also fences stale rotations.
- *
- * A code exchange claims its consent's flow record and re-checks the epoch in
- * the turn that dispatches it (`KvOAuthProvider.claimCodeExchange`,
- * `dispatchCodeExchange`). Every token answer the SDK parses is rebuilt from
- * the OAuth `error` code alone unless it is a token response.
- */
-export class OAuthRefreshCoordinator {
-    retainPartition;
-    flights = new Map();
-    constructor(retainPartition = () => () => { }) {
-        this.retainPartition = retainPartition;
-    }
-    coordinatedFetch(provider, baseFetch, requestSignal, defer, resourceFetch = baseFetch, prepareCredentialRequest) {
-        return authMethod((input, init) => {
-            return authFlow(function* () {
-                // Freeze the form before any await: classification and the spent digest
-                // must describe the exact token sent, even if its caller mutates a form.
-                init = init
-                    ? { ...init, ...(init.body instanceof URLSearchParams ? { body: new URLSearchParams(init.body) } : {}) }
-                    : undefined;
-                // Production adapters resolve the required host policy before a code or
-                // refresh claim can consume its single-use credential. Custom SDK leaves
-                // may supply their own policy; this hook performs no I/O and owns no data.
-                if (isOAuthCredentialRequest(init))
-                    prepareCredentialRequest?.();
-                if (isRefreshTokenRequest(init)) {
-                    const signal = requestSignal && init?.signal
-                        ? AbortSignal.any([requestSignal, init.signal])
-                        : (requestSignal ?? init?.signal ?? undefined);
-                    return (yield authInvoke(this, "refresh", [provider, input, init, baseFetch, signal, defer]));
-                }
-                const grantType = tokenGrantType(init);
-                const tokenRequest = isOAuthCredentialRequest(init);
-                const exchange = grantType === "authorization_code";
-                if (exchange) {
-                    const answered = (yield authInvoke(provider, "claimCodeExchange", []));
-                    if (answered)
-                        return answered;
-                }
-                const dispatch = authMethod(() => {
-                    return authFlow(function* () {
-                        if (requestSignal?.aborted)
-                            throw aborted(requestSignal);
-                        const signal = requestSignal
-                            ? init?.signal
-                                ? AbortSignal.any([requestSignal, init.signal])
-                                : requestSignal
-                            : init?.signal;
-                        // Credential-bearing OAuth requests use the raw send path. A redirect
-                        // is a dispatched failure, never authority to send the form again.
-                        return (yield tokenRequest
-                            ? authCall(baseFetch, [input, { ...init, redirect: "manual", ...(signal ? { signal } : {}) }])
-                            : authCall(resourceFetch, [input, { ...init, ...(signal ? { signal } : {}) }]));
-                    }.bind(this));
-                });
-                // Await the composed fetch here so workerd associates a rejection with
-                // the fetch the SDK is already awaiting.
-                const response = (yield exchange
-                    ? authInvoke(provider, "dispatchCodeExchange", [dispatch, input])
-                    : authCall(dispatch, []));
-                if (!tokenRequest)
-                    return response;
-                // A code exchange's failure is the SDK's to log as well.
-                const forSdk = (yield authCall(sdkSafeTokenResponse, [
-                    response,
-                    exchange
-                        ? authMethod((tokens) => {
-                            return authInvoke(provider, "recordCodeExchangeTokens", [tokens]);
-                        })
-                        : undefined,
-                ]));
-                if (exchange && forSdk !== response)
-                    provider.recordCodeExchangeRefusal(forSdk);
-                return forSdk;
-            }.bind(this));
-        });
-    }
-    refresh(provider, input, init, baseFetch, signal, defer) {
-        return runEdge(authOwnMethod(OAuthRefreshCoordinator.prototype, this, "refresh", [
-            provider,
-            input,
-            init,
-            baseFetch,
-            signal,
-            defer,
-        ]));
-    }
-    redeem(provider, epoch, requested, input, init, baseFetch, waiting) {
-        return runEdge(authOwnMethod(OAuthRefreshCoordinator.prototype, this, "redeem", [
-            provider,
-            epoch,
-            requested,
-            input,
-            init,
-            baseFetch,
-            waiting,
-        ]));
-    }
-    /** A reset fenced `epoch`: wake its joiners now rather than at the answer. */
-    retire(epoch) {
-        const flight = this.flights.get(epoch);
-        if (!flight)
-            return;
-        this.flights.delete(epoch);
-        flight.outcome.settle(Exit.succeed({ status: "retired" }));
-    }
-    static {
-        registerAuthMethod(OAuthRefreshCoordinator.prototype, "refresh", function (provider, input, init, baseFetch, signal, defer) {
-            return authFlow(function* () {
-                if (signal?.aborted)
-                    throw aborted(signal);
-                const waiting = refreshWait(signal);
-                let redeeming = false;
-                try {
-                    // A verdict belongs to one refresh; never let an older one decide this.
-                    provider.recordRefreshFailure(undefined);
-                    const epoch = (yield authInvoke(waiting, "run", [
-                        authMethod(() => {
-                            return authInvoke(provider, "flowEpoch", []);
-                        }),
-                    ]));
-                    const requested = requestedRefreshToken(init);
-                    for (let attempt = 0; attempt < 8; attempt++) {
-                        if (signal?.aborted)
-                            throw aborted(signal);
-                        const joined = this.flights.get(epoch);
-                        if (joined) {
-                            const outcome = (yield authCall(waitForRefreshFlight, [
-                                joined,
-                                signal,
-                                waiting.signal,
-                            ]));
-                            if (signal?.aborted)
-                                throw aborted(signal);
-                            if (outcome.status === "failed") {
-                                provider.recordRefreshFailure(outcome.verdict);
-                                throw outcome.error;
-                            }
-                            if (outcome.status === "refreshed")
-                                return provider.adoptRefresh(outcome.tokens);
-                            continue;
-                        }
-                        // Preparation reads share the same bound as later claim waits.
-                        const current = (yield authInvoke(waiting, "run", [
-                            authMethod(() => {
-                                return authInvoke(provider, "storedTokens", [waiting.signal]);
-                            }),
-                        ]));
-                        if (this.flights.has(epoch))
-                            continue;
-                        if (current?.refresh_token &&
-                            (current.refresh_token !== requested || provider.refreshedSinceRead(current, epoch))) {
-                            return provider.adoptRefresh(current);
-                        }
-                        if (current?.refresh_token !== requested) {
-                            provider.recordRefreshFailure({ kind: "dead" });
-                            return Response.json({ error: "invalid_grant", error_description: "Refresh token is no longer active." }, { status: 400 });
-                        }
-                        redeeming = true;
-                        // Claim submission transfers renewal, including preparation, token
-                        // request and commit, to a bounded native coordinator. Only
-                        // this caller's wait races its signal; the coordinator receives
-                        // no request/call Context authority or caller-owned deadline.
-                        const redemption = authDetached(authInvoke(this, "redeem", [
-                            provider,
-                            epoch,
-                            requested,
-                            input,
-                            init,
-                            baseFetch,
-                            waiting,
-                        ]).pipe(Effect.ensuring(Effect.sync(() => waiting.close()))), defer);
-                        return (yield signal ? Effect.raceFirst(redemption, fromSignal(signal)) : redemption);
-                    }
-                    throw provider.refreshContended();
-                }
-                catch (error) {
-                    if (signal?.aborted)
-                        throw aborted(signal);
-                    if (waiting.signal.aborted && !waiting.requestStarted)
-                        throw provider.refreshContended();
-                    throw error;
-                }
-                finally {
-                    if (!redeeming)
-                        waiting.close();
-                }
-            }.bind(this));
-        }, OAuthRefreshCoordinator.prototype.refresh);
-        registerAuthMethod(OAuthRefreshCoordinator.prototype, "redeem", function (provider, epoch, requested, input, init, baseFetch, waiting) {
-            return authFlow(function* () {
-                const flight = { outcome: new Settlement() };
-                this.flights.set(epoch, flight);
-                // Pin the owner partition until this coordinator exits, whoever is waiting.
-                const release = this.retainPartition();
-                let settled = false;
-                const settle = (outcome) => {
-                    if (settled)
-                        return;
-                    settled = true;
-                    if (this.flights.get(epoch) === flight)
-                        this.flights.delete(epoch);
-                    release();
-                    // Last: joined waiters wake in their own requests, after this.
-                    flight.outcome.settle(Exit.succeed(outcome));
-                };
-                const fail = (error, verdict) => {
-                    if (verdict)
-                        provider.recordRefreshFailure(verdict);
-                    settle({ status: "failed", error, ...(verdict ? { verdict } : {}) });
-                };
-                let dispatched = false;
-                const unknownOutcome = () => new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
-                // One budget for the entire commit/cleanup phase, including retries
-                // and lease release. Interrupt native continuations, never detach a
-                // Promise whose late read could still start a credential write.
-                const complete = authMethod((operation) => {
-                    const completion = refreshWait(undefined, REFRESH_COMMIT_DEADLINE_MS);
-                    return authInvoke(completion, "run", [operation]).pipe(Effect.catch((error) => Effect.fail(completion.signal.aborted ? unknownOutcome() : error)), Effect.ensuring(Effect.sync(() => completion.close())));
-                });
-                try {
-                    // The authorization server this redemption answers to, fixed now.
-                    const issuer = provider.refreshIssuer(epoch);
-                    let lease;
-                    try {
-                        const claim = (yield authInvoke(provider, "claimRefresh", [epoch, requested, undefined, waiting]));
-                        if (claim instanceof Response) {
-                            const tokens = (yield authInvoke(waiting, "run", [
-                                authMethod(() => {
-                                    return authInvoke(provider, "storedTokens", [waiting.signal]);
-                                }),
-                            ]));
-                            if (tokens)
-                                settle({ status: "refreshed", tokens });
-                            else
-                                settle({ status: "retired" });
-                            return claim;
-                        }
-                        lease = claim;
-                    }
-                    catch (error) {
-                        fail(error, provider.refreshVerdict());
-                        throw error;
-                    }
-                    const releaseLease = authMethod((verdict, resolution = "ambiguous") => {
-                        return authFlow(function* () {
-                            (yield authInvoke(provider, "releaseRefresh", [lease, verdict, undefined, resolution]));
-                        }.bind(this));
-                    });
-                    let outcome;
-                    const deadline = waiting.signal;
-                    try {
-                        const read = authFlow(function* () {
-                            const response = (yield authInvoke(provider, "dispatchRefresh", [
-                                lease,
-                                authMethod(() => authFlow(function* () {
-                                    waiting.beginRequest();
-                                    dispatched = true;
-                                    return (yield authCall(baseFetch, [
-                                        input,
-                                        { ...init, redirect: "manual", signal: deadline },
-                                    ]));
-                                }.bind(this))),
-                                waiting,
-                            ]));
-                            if (deadline.aborted) {
-                                void response.body?.cancel().catch(() => { });
-                                throw aborted(deadline);
-                            }
-                            return (yield authCall(refreshResponseOutcome, [response, deadline]));
-                        }.bind(this));
-                        outcome = (yield Effect.raceFirst(read, fromSignal(deadline)));
-                        if (deadline.aborted)
-                            throw aborted(deadline);
-                    }
-                    catch (error) {
-                        if (!dispatched) {
-                            // Only the coordinator's own preparation deadline can interrupt a
-                            // submitted claim. Caller cancellation no longer reaches this work.
-                            if (!waiting.signal.aborted) {
-                                (yield authCatch(authInvoke(waiting, "run", [
-                                    authMethod(() => {
-                                        return authCall(releaseLease, []);
-                                    }),
-                                ]), () => { }));
-                                if (provider.refreshVerdict()?.kind === "dead") {
-                                    (yield authCatch(authInvoke(waiting, "run", [
-                                        authMethod(() => {
-                                            return authInvoke(provider, "discardRefusedGrant", [requested, epoch]);
-                                        }),
-                                    ]), () => { }));
-                                }
-                            }
-                            const failure = waiting.signal.aborted ? provider.refreshContended() : error;
-                            fail(failure, provider.refreshVerdict());
-                            throw failure;
-                        }
-                        // A sent request without a definitive answer may have rotated the token.
-                        // Persist the refusal before dropping tokens, so interrupted cleanup or a
-                        // later write of the same fingerprint cannot make it redeemable again.
-                        const failure = new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
-                        (yield authCall(complete, [
-                            authMethod(() => authFlow(function* () {
-                                (yield authCall(releaseLease, [{ kind: "dead" }]));
-                                (yield authInvoke(provider, "discardRefusedGrant", [requested, epoch]));
-                            })),
-                        ]));
-                        fail(failure, { kind: "dead" });
-                        throw failure;
-                    }
-                    finally {
-                        waiting.close();
-                    }
-                    return (yield authCall(complete, [
-                        authMethod(() => authFlow(function* () {
-                            // An answer exists from here on, and is committed whatever the owner does.
-                            if (outcome.failure) {
-                                // Drop a refused grant while the flight still stands: a caller arriving
-                                // meanwhile joins it instead of redeeming the dead token again.
-                                (yield authInvoke(provider, "discardRefusedGrant", [requested, epoch]));
-                                (yield authCall(releaseLease, [outcome.verdict, "resolved"]));
-                                fail(outcome.failure, outcome.verdict);
-                                return outcome.forSdk;
-                            }
-                            // The server consumed the old refresh token; the SDK merges it back the
-                            // same way when a rotation omits one.
-                            const accepted = {
-                                ...outcome.tokens,
-                                ...(outcome.tokens.refresh_token === undefined && requested !== null
-                                    ? { refresh_token: requested }
-                                    : {}),
-                            };
-                            let committed;
-                            try {
-                                committed = (yield authInvoke(provider, "storeRefresh", [epoch, requested, accepted, issuer]));
-                            }
-                            catch {
-                                const failure = new UnauthorizedError("OAuth refresh could not be committed; authorization required.");
-                                (yield authCall(releaseLease, [{ kind: "dead" }, "resolved"]));
-                                (yield authInvoke(provider, "discardRefusedGrant", [requested, epoch]));
-                                fail(failure, { kind: "dead" });
-                                throw failure;
-                            }
-                            if (!committed) {
-                                // Restart, Disconnect, or another consent decides the newer grant.
-                                (yield authCall(releaseLease, [{ kind: "dead" }, "resolved"]));
-                                const failure = new UnauthorizedError("OAuth refresh grant is no longer active.");
-                                fail(failure, { kind: "dead" });
-                                throw failure;
-                            }
-                            (yield authInvoke(provider, "releaseRefresh", [lease, undefined, committed, "resolved"]));
-                            settle({ status: "refreshed", tokens: committed });
-                            return provider.adoptRefresh(committed);
-                        })),
-                    ]));
-                }
-                catch (error) {
-                    fail(error, dispatched ? { kind: "dead" } : provider.refreshVerdict());
-                    throw error;
-                }
-                finally {
-                    waiting.close();
-                    // No storage in this finalizer: even interruption or a failed
-                    // cleanup must drop the local flight and its owner retention.
-                    if (!settled)
-                        fail(unknownOutcome(), dispatched ? { kind: "dead" } : provider.refreshVerdict());
-                }
-            }.bind(this));
-        }, OAuthRefreshCoordinator.prototype.redeem);
-    }
-}
-/**
- * One refresh coordinator per owner partition, for one connector runtime.
- * Long-lived enough for distinct request scopes to join one token redemption;
- * it owns no client, transport, or request state. Production contexts carry a
- * stable registry partition; hand-written contexts coordinate by their shared
- * storage object instead.
- */
-export function refreshCoordinatorsByPartition() {
-    const coordinators = new WeakMap();
-    return (ctx) => {
-        const partition = oauthPartitionFor(ctx) ?? ctx.storage;
-        let coordinator = coordinators.get(partition);
-        if (!coordinator) {
-            coordinator = new OAuthRefreshCoordinator(() => retainOAuthPartition(partition));
-            coordinators.set(partition, coordinator);
-        }
-        return coordinator;
-    };
-}
-const GRANT = oauthGrantKeys.grant;
-/** The epoch of an owner with no grant record yet. */
-const INITIAL_EPOCH = "initial";
-/** The epoch of a record that does not parse: readers see no grant in it. */
-const UNREADABLE_EPOCH = "unreadable";
-const ACTIVE_EPOCH_PREFIX = "v3:";
-const DISCONNECTED_EPOCH_PREFIX = "disconnected:";
-const GRANT_VERSION = 3;
-const FLOW_VERSION = 1;
-/** Attempts at one grant write while other writers keep winning. */
-const MAX_GRANT_WRITES = 32;
-/**
- * How long a pending authorization URL may be handed out again instead of
- * starting a fresh flow. The authorization server's half of it expires: a
- * pushed request URI lives seconds to minutes (RFC 9126), and login
- * transactions are commonly held for minutes. Past this age a reissued URL
- * more likely lands on an expired session than on consent, and a fresh start
- * costs one authorization request, not a registration. It sits inside the
- * flow record's fifteen minutes.
- */
-const PENDING_AUTHORIZATION_MAX_AGE_MS = 10 * 60 * 1000;
-function discoveryBinding(state) {
-    return runEdge(authProgram(discoveryBindingNative, [state]));
-}
-const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, function (state) {
-    return authFlow(function* () {
-        return state
-            ? {
-                issuer: discoveryIssuer(state),
-                tokenEndpoint: state.authorizationServerMetadata?.token_endpoint,
-                ...(state.authorizationServerMetadata?.authorization_response_iss_parameter_supported === true
-                    ? { issRequired: true }
-                    : {}),
-                discovery: (yield authCall(oauthStateDigest, [JSON.stringify(state)])),
-            }
-            : {};
-    });
-});
-function plainObject(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function parsed(raw) {
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-}
-function storedGrant(raw) {
-    const value = parsed(raw);
-    return plainObject(value) &&
-        value.connectaOAuth === GRANT_VERSION &&
-        typeof value.epoch === "string" &&
-        (value.flow === undefined || typeof value.flow === "string") &&
-        (value.sealed === undefined || typeof value.sealed === "string")
-        ? value
-        : undefined;
-}
-/** The epoch a raw grant record names, without opening its body. */
-function epochOf(raw) {
-    if (raw === null)
-        return INITIAL_EPOCH;
-    return storedGrant(raw)?.epoch ?? UNREADABLE_EPOCH;
-}
-/** Nothing here trusts stored bytes: keep only what has the expected shape. */
-function grantBody(value) {
-    if (!plainObject(value))
-        return {};
-    const { issuer, client, tokens, discovery, refreshConsent } = value;
-    return {
-        ...(typeof issuer === "string" ? { issuer } : {}),
-        ...(plainObject(client) && plainObject(client.value) && typeof client.value.client_id === "string"
-            ? {
-                client: {
-                    value: client.value,
-                    ...(typeof client.binding === "string" ? { binding: client.binding } : {}),
-                    ...(client.carried === true ? { carried: true } : {}),
-                    ...(client.registrationPath === "cimd" ||
-                        client.registrationPath === "dcr" ||
-                        client.registrationPath === "static"
-                        ? { registrationPath: client.registrationPath }
-                        : {}),
-                },
-            }
-            : {}),
-        ...(plainObject(tokens) && typeof tokens.access_token === "string"
-            ? { tokens: tokens }
-            : {}),
-        ...(discoveryIssuer(discovery) !== undefined ? { discovery: discovery } : {}),
-        ...(plainObject(refreshConsent) &&
-            typeof refreshConsent.digest === "string" &&
-            typeof refreshConsent.resolution === "string"
-            ? { refreshConsent: { digest: refreshConsent.digest, resolution: refreshConsent.resolution } }
-            : {}),
-    };
-}
-/** What an invalidation compares: the value exactly as this flow saw it. */
-function fingerprint(value) {
-    return value === undefined ? undefined : JSON.stringify(value);
-}
-function isDisconnectedEpoch(epoch) {
-    return epoch.startsWith(DISCONNECTED_EPOCH_PREFIX);
-}
 /**
  * OAuthClientProvider over one owner's grant record and its consents' flow
  * records, in one connector's namespace.
@@ -743,6 +46,11 @@ function isDisconnectedEpoch(epoch) {
  * to one epoch. Its reads fail once another epoch is live, and its writes are
  * compare-and-sets against the record it read, so a restart or disconnect,
  * which replaces the epoch, fences every flow that began before it.
+ *
+ * Each native method is defined once, in `./downstream-oauth/` by seam, and
+ * `authMethods` installs it with its Promise edge; the class declares only the
+ * edge's type. State those bodies read is not `private` for that reason; it
+ * remains internal to src/auth.
  */
 export class KvOAuthProvider {
     connectorId;
@@ -787,6 +95,17 @@ export class KvOAuthProvider {
     refreshBasis;
     /** The access token of a refresh the coordinator already stored. */
     storedRefresh;
+    /**
+     * @internal When this flow's last token request other than a refresh was
+     * sent. The tokens the SDK saves from its answer expire counted from here,
+     * never from the later save, which a slow answer would push past expiry.
+     */
+    tokenRequestSent;
+    /**
+     * The tokens of the grant this provider last opened or wrote, as facts
+     * only: no credential beyond the access token it already handed out.
+     */
+    observed;
     constructor(connectorId, storage, redirectUri, refreshCoordinator, allowAuthorization = true, 
     /** Present when the deployment's vault can seal; the grant is then ciphertext. */
     sealer, 
@@ -818,9 +137,31 @@ export class KvOAuthProvider {
         if (client)
             this.addClientAuthentication = (headers, params) => authenticateRemoteClient(client, headers, params);
     }
-    /** Stored facts only: no sealing writes, refresh or discovery. */
-    storedAuthorization(issuer) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "storedAuthorization", [issuer]));
+    /**
+     * @internal The access token a call should renew before sending it: the
+     * one this provider last read, refreshable and within
+     * OAUTH_REFRESH_SKEW_MS of its stored expiry, in the epoch it is bound to.
+     * Memory only: no storage read, refresh or discovery. A grant without an
+     * expiry is never due; a 401 renews it.
+     */
+    renewalDue(now = Date.now()) {
+        const seen = this.observed;
+        if (!seen?.refreshable || seen.expiresAt === undefined)
+            return undefined;
+        if (this.bound && seen.epoch !== this.epoch)
+            return undefined;
+        return seen.expiresAt - OAUTH_REFRESH_SKEW_MS <= now ? seen.accessToken : undefined;
+    }
+    observe(grant) {
+        const { tokens, expiresAt } = grant.body;
+        this.observed = tokens
+            ? {
+                epoch: grant.epoch,
+                accessToken: tokens.access_token,
+                refreshable: typeof tokens.refresh_token === "string" && tokens.refresh_token !== "",
+                ...(expiresAt !== undefined ? { expiresAt } : {}),
+            }
+            : undefined;
     }
     get redirectUrl() {
         return this.redirectUri;
@@ -829,58 +170,11 @@ export class KvOAuthProvider {
         const client = this.clientOptions?.client;
         return downstreamClientMetadata(this.redirectUri, this.scope, this.clientOptions?.name, client ? remoteClientAuthMethod(client) : "none");
     }
-    /** A preparation await owns no continuation after its call/request closes.
-     * null explicitly selects coordinator/reset ownership, never the caller. */
-    wait(work, signal = this.signal) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "wait", [work, signal]));
-    }
     // --- the grant record ---------------------------------------------------
     /** The grant's additional authenticated data: record and epoch. */
     grantLabel(epoch) {
         return `${GRANT}:${epoch}`;
     }
-    encodeGrant(grant, signal = this.signal) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "encodeGrant", [grant, signal]));
-    }
-    /**
-     * Open a stored grant. A body that does not open — tampered, under a
-     * rotated key, moved from another connector, owner, or epoch, or sealed
-     * with no sealer configured — reads as empty: authorization again.
-     */
-    openGrant(raw, signal = this.signal) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "openGrant", [raw, signal]));
-    }
-    /**
-     * The current grant record. A plaintext
-     * body, written before the vault could seal, is sealed where it lies by
-     * compare-and-set; a failure leaves it readable for the next write to seal.
-     */
-    readGrant(signal = this.signal) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "readGrant", [signal]));
-    }
-    /** The grant a bound flow reads: a replaced epoch fails it. */
-    boundGrant(signal = this.signal) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "boundGrant", [signal]));
-    }
-    /** SDK preparation is call/request-owned; coordinator reads explicitly opt out. */
-    activeGrant() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "activeGrant", []));
-    }
-    /**
-     * The one way a grant changes: read, change, compare-and-set, again while
-     * other writers win. The write belongs to `epoch` (default: the flow's,
-     * captured now if unset) and lands nowhere once another is live: `quiet`
-     * drops it silently, otherwise a bound flow fails as superseded. `commit`
-     * writes after the request's abort too. `change` returning undefined
-     * leaves the grant as it is.
-     */
-    updateGrant(change, options = {}) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "updateGrant", [change, options]));
-    }
-    /** Store a client or tokens for `issuer`'s grant, replacing another server's. */
-    writeCredential(field, value, issuer, refreshConsent) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "writeCredential", [field, value, issuer, refreshConsent]));
-    }
     withIssuer(grant, body) {
         if (grant.body.issuer !== undefined && grant.body.issuer !== body.issuer) {
             if (this.codeExchange)
@@ -896,12 +190,6 @@ export class KvOAuthProvider {
     configuredAuthorizationBinding() {
         return undefined;
     }
-    bindingForGrant(grant) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "bindingForGrant", [grant]));
-    }
-    checkFlowBinding(grant) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "checkFlowBinding", [grant]));
-    }
     /** Validate RFC 9207 against the server this consent selected. */
     validateCallbackIssuer(issuer) {
         if (!this.callback ||
@@ -915,55 +203,9 @@ export class KvOAuthProvider {
     flowLabel(key, epoch) {
         return `${key}:${epoch}`;
     }
-    encodeFlow(key, flow) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "encodeFlow", [key, flow]));
-    }
-    /** A flow record, its verifier opened only when `withVerifier`. */
-    openFlow(key, raw, withVerifier) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "openFlow", [key, raw, withVerifier]));
-    }
-    /** The live epoch's latest consent, until a callback claims it. */
-    latestConsent() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "latestConsent", []));
-    }
-    // --- flows and epochs -----------------------------------------------------
-    /** The live epoch; an owner with no grant yet has the initial one. */
-    liveEpoch() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "liveEpoch", []));
-    }
-    /** True only after an operator disconnect, until an explicit start replaces it. */
-    operatorDisconnected() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "operatorDisconnected", []));
-    }
     isOperatorDisconnectedEpoch(epoch) {
         return isDisconnectedEpoch(epoch);
     }
-    /**
-     * Begin a flow — a connect, whose 401 may refresh or start consent, or an
-     * `api()` call or start — in the live epoch, and return it. Nothing about
-     * the grant is decided here: a grant belongs to one server by construction.
-     * An expected epoch continues an existing attempt; a replacement fails it.
-     */
-    beginFlow(expectedEpoch) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "beginFlow", [expectedEpoch]));
-    }
-    /** The epoch this flow is bound to, or the live one. */
-    flowEpoch() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "flowEpoch", []));
-    }
-    /**
-     * Bind a code exchange: to the epoch its verified consent was written in, or
-     * the live one for an exchange no callback verified. An epoch already
-     * replaced fails here, before the SDK can send anything. What the grant
-     * holds now is all a refused code may invalidate.
-     */
-    bindFlow() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "bindFlow", []));
-    }
-    /** Retain an already verified snapshot only for the exact same state. */
-    verifyCallbackState(state) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "verifyCallbackState", [state]));
-    }
     /** Whether `verifyState` matched a consent on this provider. */
     verified() {
         return this.callback !== undefined;
@@ -996,19 +238,9 @@ export class KvOAuthProvider {
         const failure = this.refreshFailure;
         if (failure?.kind === "contended")
             return this.refreshContended();
-        return new UnauthorizedError("Authorization required. Use authorize_connector or Connect to start consent.");
-    }
-    // --- the SDK's hooks --------------------------------------------------------
-    clientInformation(ctx) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "clientInformation", [
-            ctx,
-        ]));
-    }
-    saveClientInformation(info, ctx) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveClientInformation", [info, ctx]));
-    }
-    registrationPath() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "registrationPath", []));
+        // Only the class reaches callers: remoteMcp replaces this error with its own
+        // typed auth error, so this text keeps the meta name.
+        return new UnauthorizedError(`Authorization required. Use ${META_ROUTES.authorize} or Connect to start consent.`);
     }
     /** Intake and saved URLs share a guard. Include the current grant's secrets
      * so a fresh request can reject an older cache before sending credentials. */
@@ -1060,130 +292,18 @@ export class KvOAuthProvider {
             throw new ConnectorCallError("connector_call_failed", "OAuth metadata or consent URL contains a credential; refusing authorization.", { retryable: false });
         }
     }
-    /** Only metadata bound to the discovered issuer can supply operator origins. */
-    validatedIssuerOrigin() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "validatedIssuerOrigin", []));
-    }
-    discoveryState() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "discoveryState", []));
-    }
-    /**
-     * Discovery names the grant's server: the same one keeps the client and
-     * tokens beside it, another replaces them. The SDK discovers afresh only
-     * without a cached record — a restart's carried client, say — and what a
-     * different server leaves behind would never be sent to it anyway.
-     */
-    saveDiscoveryState(state) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveDiscoveryState", [state]));
-    }
-    /**
-     * The grant's tokens, for the server that issued them only. An
-     * issuer-aware read records what it handed the SDK, so the coordinator can
-     * tell a refresh another request completed since.
-     */
-    tokens(ctx) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "tokens", [ctx]));
-    }
-    saveTokens(tokens, ctx) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveTokens", [tokens, ctx]));
-    }
-    /**
-     * OAuth `state`: 256 random bits the consent URL carries and the callback
-     * must present, so nobody holding a consent URL can complete it with their
-     * own account (login CSRF). Stored, by digest, with the consent.
-     */
-    state() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "state", []));
-    }
-    saveCodeVerifier(verifier) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "saveCodeVerifier", [verifier]));
-    }
-    codeVerifier() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "codeVerifier", []));
+    /** @internal The access token of the last refresh this flow adopted. */
+    adoptedRefresh() {
+        return this.storedRefresh;
     }
-    /**
-     * Store the consent: its flow record first, by state digest with the
-     * link's lifetime, then the grant's pointer to it, in the flow's epoch. A
-     * reset that replaced the epoch fails the start, and the record is removed,
-     * so no start hands out a consent its callback could not complete.
-     */
-    redirectToAuthorization(authorizationUrl) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "redirectToAuthorization", [authorizationUrl]));
-    }
-    /** The consent this provider stored, while its epoch is still live. */
-    consentUrl(signal = this.signal) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "consentUrl", [signal]));
-    }
-    /** The live epoch's pending consent URL, if one is unclaimed. */
-    pendingAuthorizationUrl() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "pendingAuthorizationUrl", []));
-    }
-    /**
-     * The pending consent URL, only while it is still worth handing out again:
-     * unclaimed, written within PENDING_AUTHORIZATION_MAX_AGE_MS of now in
-     * either direction (clock skew between isolates), and naming the grant's
-     * client. A callback whose exchange the server refused with
-     * `invalid_client` drops the client, and its URL would send the operator to
-     * a consent the server has already refused.
-     */
-    reusablePendingAuthorizationUrl() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "reusablePendingAuthorizationUrl", []));
-    }
-    /**
-     * Find the consent a callback's `state` names. One read whatever the
-     * answer; the callback route's refusals pay the same. A claimed consent
-     * no longer matches.
-     */
-    verifyState(candidate) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "verifyState", [candidate]));
-    }
-    /**
-     * @internal The first half of the fence a code exchange crosses after every
-     * read it depends on, just before the code leaves: claim the consent by
-     * compare-and-set from the exact record `verifyState` found to a claimed
-     * one. Of several callbacks carrying one state, exactly one wins; the
-     * others send nothing. A claim that fails because a restart swept the
-     * consent reports the supersession. The claim is spent whether or not the
-     * exchange succeeds; the SDK's one retry after a refused code is answered
-     * with that refusal, never sent again.
-     */
-    claimCodeExchange() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "claimCodeExchange", []));
-    }
-    /** Terminate the verified consent on an error, sharing the code exchange CAS. */
-    consumeAuthError() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "consumeAuthError", []));
-    }
-    claimConsent() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "claimConsent", []));
-    }
-    /**
-     * @internal The second half: read the live epoch and, in the reaction to
-     * that read, dispatch. No await stands between the check and `send`. A
-     * reset published at or before the read fails the exchange with nothing
-     * sent; one published after it, while the request is leaving, cannot be
-     * ordered before the send without a lock across requests, and its tokens
-     * are refused by the grant's compare-and-set: one more consent.
-     */
-    dispatchCodeExchange(send, endpoint) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "dispatchCodeExchange", [send, endpoint]));
+    /** @internal The stored expiry of `accessToken`, when this provider last read or wrote it. */
+    observedExpiry(accessToken) {
+        return this.observed?.accessToken === accessToken ? this.observed.expiresAt : undefined;
     }
     /** @internal Keep a refused code's answer for the SDK's retry to read. */
     recordCodeExchangeRefusal(forSdk) {
         this.exchangeRefusal = forSdk.clone();
     }
-    /** @internal Observe resolution while accepting the code response, never on a later SDK save. */
-    recordCodeExchangeTokens(tokens) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "recordCodeExchangeTokens", [tokens]));
-    }
-    /**
-     * Remove what the SDK asks, but only as this flow saw it: a refused code or
-     * refresh says nothing about a client or tokens another flow wrote since.
-     * The verifier lives in its consent, which the claim already spent.
-     */
-    invalidateCredentials(scope) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "invalidateCredentials", [scope]));
-    }
     // --- refresh, for the coordinator ---------------------------------------------
     /**
      * @internal How the refresh this provider owned or joined failed; undefined
@@ -1193,34 +313,10 @@ export class KvOAuthProvider {
     recordRefreshFailure(failure) {
         this.refreshFailure = failure;
     }
-    /** @internal A shared-storage claim precedes every refresh dispatch. */
-    claimRefresh(epoch, requested, signal, sharedWait) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "claimRefresh", [
-            epoch,
-            requested,
-            signal,
-            sharedWait,
-        ]));
-    }
-    /** @internal Only the successful claimed-to-dispatched CAS may send. */
-    dispatchRefresh(lease, send, waiting) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "dispatchRefresh", [lease, send, waiting]));
-    }
-    /** @internal Release by CAS after a commit or a classified failure. */
-    releaseRefresh(lease, verdict, tokens, resolution = "ambiguous") {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "releaseRefresh", [lease, verdict, tokens, resolution]));
-    }
-    resolveRefreshSpent(lease, state) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "resolveRefreshSpent", [lease, state]));
-    }
     /** @internal The same typed verdict for local and cross-isolate joiners. */
     refreshVerdict() {
         return this.refreshFailure;
     }
-    /** @internal The grant's tokens as stored, in the flow's epoch. */
-    storedTokens(signal = null) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "storedTokens", [signal]));
-    }
     /** @internal True when a refresh landed after this flow's issuer-aware read. */
     refreshedSinceRead(current, epoch) {
         const basis = this.refreshBasis;
@@ -1236,71 +332,10 @@ export class KvOAuthProvider {
         this.storedRefresh = tokens.access_token;
         return tokenResponse(tokens);
     }
-    /**
-     * @internal Store an accepted rotation in `epoch`, even after the request
-     * that redeemed it has left, unless a newer rotation, another server's
-     * grant, or another epoch is there now. A token response names no issuer:
-     * the one the refreshed grant was bound to is stamped here.
-     */
-    storeRefresh(epoch, requested, tokens, issuer) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "storeRefresh", [epoch, requested, tokens, issuer]));
-    }
-    /**
-     * @internal Drop the tokens the authorization server just refused, only
-     * while the grant still holds that refresh token in `epoch`: a consent
-     * that completed meanwhile survives. Best effort: if storage fails, the
-     * next refresh is refused again and ends the same way.
-     */
-    discardRefusedGrant(refreshToken, epoch, beforeWrite, signal) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "discardRefusedGrant", [
-            refreshToken,
-            epoch,
-            beforeWrite,
-            signal,
-        ]));
-    }
-    // --- restart and disconnect ---------------------------------------------------
-    /**
-     * Replace the epoch, by one compare-and-set: the grant goes with it, and
-     * every flow bound to the old epoch fails at its next read or write. A
-     * forced restart may carry the registration forward (`carriableClient`);
-     * a disconnect leaves only its epoch, which no passive request leaves.
-     * Then the old epochs' consents are removed; that is hygiene, since their
-     * callbacks fail the epoch check anyway and the records expire.
-     */
-    resetAuthorization(operatorDisconnected = false, preserveClient = false) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "resetAuthorization", [
-            operatorDisconnected,
-            preserveClient,
-        ]));
-    }
-    /** Remove the local grant before a bounded, best-effort RFC 7009 request. */
-    disconnectAuthorization(send) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "disconnectAuthorization", [send]));
-    }
     /** Static adapters supply trusted configuration without persisting client secrets. */
     revocationSnapshot(body) {
         return { body, ...(this.clientOptions?.client ? { client: this.clientOptions.client } : {}) };
     }
-    performReset(operatorDisconnected, preserveClient, revoke) {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "performReset", [
-            operatorDisconnected,
-            preserveClient,
-            revoke,
-        ]));
-    }
-    /**
-     * Remove every consent of an epoch no longer live. The records are read
-     * before the epoch, and epochs never recur, so a consent whose epoch is not
-     * the live one then can never complete; each goes by compare-and-set
-     * against what was read. Best effort.
-     */
-    sweepConsents() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "sweepConsents", []));
-    }
-    sweepRefreshLeases() {
-        return runEdge(authOwnMethod(KvOAuthProvider.prototype, this, "sweepRefreshLeases", []));
-    }
     /**
      * The registration a forced restart may carry into its new epoch, or
      * nothing. It must be bound to a server (`issuer`) and registered under this
@@ -1348,1362 +383,11 @@ export class KvOAuthProvider {
         };
     }
     static {
-        registerAuthMethod(KvOAuthProvider.prototype, "wait", function (work, signal) {
-            signal = signal === undefined ? this.signal : signal;
-            return authFlow(function* () {
-                if (signal?.aborted)
-                    throw aborted(signal);
-                const value = signal
-                    ? (yield authAwait(authCall(work, []), { signal }.signal))
-                    : (yield authCall(work, []));
-                if (signal?.aborted)
-                    throw aborted(signal);
-                return value;
-            });
-        }, KvOAuthProvider.prototype.wait);
-        registerAuthMethod(KvOAuthProvider.prototype, "encodeGrant", function (grant, signal) {
-            signal = signal === undefined ? this.signal : signal;
-            return authFlow(function* () {
-                this.assertCredentialFree({ issuer: grant.body.issuer, discovery: grant.body.discovery }, grant.body);
-                const stored = {
-                    connectaOAuth: GRANT_VERSION,
-                    epoch: grant.epoch,
-                    ...(grant.flow !== undefined ? { flow: grant.flow } : {}),
-                };
-                if (Object.keys(grant.body).length > 0) {
-                    if (this.sealer) {
-                        stored.sealed = (yield authInvoke(this, "wait", [
-                            authMethod(() => {
-                                return authInvoke(this.sealer, "seal", [
-                                    this.grantLabel(grant.epoch),
-                                    JSON.stringify(grant.body),
-                                ]);
-                            }),
-                            signal,
-                        ]));
-                    }
-                    else {
-                        stored.body = grant.body;
-                    }
-                }
-                return JSON.stringify(stored);
-            }.bind(this));
-        }, KvOAuthProvider.prototype.encodeGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "openGrant", function (raw, signal) {
-            signal = signal === undefined ? this.signal : signal;
-            return authFlow(function* () {
-                if (raw === null)
-                    return { epoch: INITIAL_EPOCH, body: {} };
-                const stored = storedGrant(raw);
-                if (!stored)
-                    return { epoch: UNREADABLE_EPOCH, body: {} };
-                let body = stored.body;
-                if (stored.sealed !== undefined) {
-                    body = undefined;
-                    try {
-                        if (this.sealer)
-                            body = parsed((yield authInvoke(this, "wait", [
-                                authMethod(() => {
-                                    return authInvoke(this.sealer, "open", [
-                                        this.grantLabel(stored.epoch),
-                                        stored.sealed,
-                                    ]);
-                                }),
-                                signal,
-                            ])));
-                    }
-                    catch {
-                        if (signal?.aborted)
-                            throw aborted(signal);
-                        this.sealer?.warn(`[connecta] connector "${this.connectorId}" has a sealed OAuth grant ` +
-                            "the configured vault cannot open; treating it as absent, so the " +
-                            "connector needs authorization again. A changed vault key or " +
-                            "tampered storage causes this.");
-                    }
-                }
-                return {
-                    epoch: stored.epoch,
-                    ...(stored.flow !== undefined ? { flow: stored.flow } : {}),
-                    body: grantBody(body),
-                };
-            }.bind(this));
-        }, KvOAuthProvider.prototype.openGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "storedAuthorization", function (issuer) {
-            return authFlow(function* () {
-                const raw = (yield authStorage(this.storage, "get", [GRANT]));
-                const grant = (yield authInvoke(this, "openGrant", [raw]));
-                if (isDisconnectedEpoch(grant.epoch))
-                    return false;
-                const body = grant.body;
-                const configured = issuer ?? this.clientOptions?.client?.issuer;
-                const discovered = body.discovery;
-                if (!configured &&
-                    (!discovered || discovered.authorizationServerMetadata?.issuer !== discovered.authorizationServerUrl))
-                    return false;
-                const expected = configured ?? discoveryIssuer(discovered);
-                return Boolean(expected && body.issuer === expected && body.tokens?.access_token);
-            }.bind(this)).pipe(Effect.catch(() => Effect.succeed(false)));
-        }, KvOAuthProvider.prototype.storedAuthorization);
-        registerAuthMethod(KvOAuthProvider.prototype, "readGrant", function (signal) {
-            signal = signal === undefined ? this.signal : signal;
-            return authFlow(function* () {
-                let raw = (yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "get", [GRANT]);
-                    }),
-                    signal,
-                ]));
-                if (raw === null) {
-                    // Inspect names only: retired credentials are never opened or copied.
-                    const keys = (yield authInvoke(this, "wait", [
-                        authMethod(() => authStorage(this.storage, "list", [retiredOAuthKeys.scan])),
-                        signal,
-                    ]));
-                    if (keys.some((key) => retiredOAuthKeys.prefixes.some((prefix) => key.startsWith(prefix))))
-                        (this.sealer ?? console).warn(`[connecta] connector "${this.connectorId}" has an unsupported pre-layout-3 OAuth grant; ` +
-                            "treating it as absent. Connect again to authorize, or restore a backup and run the " +
-                            "OAuth migration on Connecta 0.37.1 before upgrading.");
-                }
-                const grant = (yield authInvoke(this, "openGrant", [raw, signal]));
-                if (raw !== null && this.sealer && storedGrant(raw)?.body !== undefined) {
-                    const sealed = (yield authInvoke(this, "encodeGrant", [grant, signal]));
-                    if ((yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authCatch(authStorage(this.storage, "compareAndSet", [GRANT, raw, sealed]), () => false);
-                        }),
-                        signal,
-                    ])))
-                        raw = sealed;
-                }
-                return { raw, grant };
-            }.bind(this));
-        }, KvOAuthProvider.prototype.readGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "boundGrant", function (signal) {
-            signal = signal === undefined ? this.signal : signal;
-            return authFlow(function* () {
-                const { grant } = (yield authInvoke(this, "readGrant", [signal]));
-                if (this.bound && grant.epoch !== this.epoch)
-                    throw this.flowSuperseded();
-                return grant;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.boundGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "activeGrant", function () {
-            return authInvoke(this, "boundGrant", []);
-        }, KvOAuthProvider.prototype.activeGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "updateGrant", function (change, options = {}) {
-            return authFlow(function* () {
-                const signal = options.signal ?? (options.commit ? null : this.signal);
-                for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
-                    if (!options.commit && this.signal?.aborted)
-                        return false;
-                    const { raw, grant } = (yield authInvoke(this, "readGrant", [signal]));
-                    const epoch = options.epoch ?? (this.epoch ??= grant.epoch);
-                    if (grant.epoch !== epoch) {
-                        if (options.quiet || !this.bound)
-                            return false;
-                        throw this.flowSuperseded();
-                    }
-                    // A disconnect's epoch holds nothing until an explicit start replaces it.
-                    if (isDisconnectedEpoch(epoch))
-                        return false;
-                    const next = change(grant);
-                    if (next === undefined)
-                        return true;
-                    const encoded = (yield authInvoke(this, "encodeGrant", [next, signal]));
-                    if (!options.commit && this.signal?.aborted)
-                        return false;
-                    let written;
-                    try {
-                        written = (yield authInvoke(this, "wait", [
-                            authMethod(() => {
-                                return authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded], options.beforeWrite && (() => options.beforeWrite?.()));
-                            }),
-                            signal,
-                        ]));
-                    }
-                    catch {
-                        if (signal?.aborted)
-                            throw aborted(signal);
-                        // A store's own error can quote the value it refused.
-                        throw this.credentialWriteError();
-                    }
-                    if (written) {
-                        if (next.epoch !== grant.epoch)
-                            this.epoch = next.epoch;
-                        return true;
-                    }
-                }
-                throw this.credentialWriteError();
-            }.bind(this));
-        }, KvOAuthProvider.prototype.updateGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "writeCredential", function (field, value, issuer, refreshConsent) {
-            return authFlow(function* () {
-                (yield authInvoke(this, "updateGrant", [
-                    (grant) => {
-                        const body = issuer !== undefined && grant.body.issuer !== issuer ? { issuer } : { ...grant.body };
-                        if (field === "client")
-                            body.client = value;
-                        else {
-                            body.tokens = value;
-                            delete body.refreshConsent;
-                            if (refreshConsent)
-                                body.refreshConsent = refreshConsent;
-                        }
-                        return this.withIssuer(grant, body);
-                    },
-                ]));
-                // A flow may invalidate what it wrote itself.
-                this.seen[field] = fingerprint(field === "client" ? value.value : value);
-            }.bind(this));
-        }, KvOAuthProvider.prototype.writeCredential);
-        registerAuthMethod(KvOAuthProvider.prototype, "bindingForGrant", function (grant) {
-            return authFlow(function* () {
-                const configured = this.configuredAuthorizationBinding();
-                return configured
-                    ? { ...configured, issuer: grant.body.issuer }
-                    : {
-                        ...(yield authInvoke(this, "wait", [
-                            authMethod(() => {
-                                return authCall(discoveryBinding, [grant.body.discovery]);
-                            }),
-                        ])),
-                        issuer: grant.body.issuer,
-                        clientId: grant.body.client?.value.client_id,
-                    };
-            }.bind(this));
-        }, KvOAuthProvider.prototype.bindingForGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "checkFlowBinding", function (grant) {
-            return authFlow(function* () {
-                const binding = this.callback?.flow.binding;
-                if (!binding ||
-                    fingerprint(binding) !== fingerprint((yield authInvoke(this, "bindingForGrant", [grant])))) {
-                    throw this.flowSuperseded();
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.checkFlowBinding);
-        registerAuthMethod(KvOAuthProvider.prototype, "encodeFlow", function (key, flow) {
-            return authFlow(function* () {
-                const { verifier, ...rest } = flow;
-                const stored = { connectaOAuthFlow: FLOW_VERSION, ...rest };
-                if (verifier !== undefined) {
-                    if (this.sealer) {
-                        stored.verifier = (yield authInvoke(this, "wait", [
-                            authMethod(() => {
-                                return authInvoke(this.sealer, "seal", [
-                                    this.flowLabel(key, flow.epoch),
-                                    verifier,
-                                ]);
-                            }),
-                        ]));
-                        stored.sealed = true;
-                    }
-                    else {
-                        stored.verifier = verifier;
-                    }
-                }
-                return JSON.stringify(stored);
-            }.bind(this));
-        }, KvOAuthProvider.prototype.encodeFlow);
-        registerAuthMethod(KvOAuthProvider.prototype, "openFlow", function (key, raw, withVerifier) {
-            return authFlow(function* () {
-                const value = parsed(raw);
-                if (!plainObject(value) ||
-                    value.connectaOAuthFlow !== FLOW_VERSION ||
-                    typeof value.epoch !== "string" ||
-                    typeof value.at !== "number" ||
-                    (value.url !== undefined && typeof value.url !== "string") ||
-                    (value.verifier !== undefined && typeof value.verifier !== "string")) {
-                    return undefined;
-                }
-                const flow = {
-                    epoch: value.epoch,
-                    at: value.at,
-                    ...(plainObject(value.binding) ? { binding: value.binding } : {}),
-                    ...(typeof value.url === "string" ? { url: value.url } : {}),
-                    ...(value.consumed === true ? { consumed: true } : {}),
-                };
-                if (!withVerifier || typeof value.verifier !== "string")
-                    return flow;
-                if (value.sealed !== true)
-                    return { ...flow, verifier: value.verifier };
-                try {
-                    if (!this.sealer)
-                        return undefined;
-                    return {
-                        ...flow,
-                        verifier: (yield authInvoke(this, "wait", [
-                            authMethod(() => {
-                                return authInvoke(this.sealer, "open", [
-                                    this.flowLabel(key, flow.epoch),
-                                    value.verifier,
-                                ]);
-                            }),
-                        ])),
-                    };
-                }
-                catch {
-                    if (this.signal?.aborted)
-                        throw aborted(this.signal);
-                    this.sealer?.warn(`[connecta] connector "${this.connectorId}" has a sealed OAuth consent ` +
-                        "the configured vault cannot open; its callback is refused.");
-                    return undefined;
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.openFlow);
-        registerAuthMethod(KvOAuthProvider.prototype, "latestConsent", function () {
-            return authFlow(function* () {
-                const grant = (yield authInvoke(this, "boundGrant", []));
-                if (grant.flow === undefined)
-                    return undefined;
-                const key = oauthFlowKeys.flow(grant.flow);
-                const raw = (yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "get", [key]);
-                    }),
-                ]));
-                const flow = raw === null ? undefined : (yield authInvoke(this, "openFlow", [key, raw, false]));
-                return flow && !flow.consumed && flow.epoch === grant.epoch && flow.url !== undefined
-                    ? { ...flow, url: flow.url }
-                    : undefined;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.latestConsent);
-        registerAuthMethod(KvOAuthProvider.prototype, "liveEpoch", function () {
-            return authFlow(function* () {
-                return (yield authInvoke(this, "readGrant", [])).grant.epoch;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.liveEpoch);
-        registerAuthMethod(KvOAuthProvider.prototype, "operatorDisconnected", function () {
-            return authFlow(function* () {
-                return isDisconnectedEpoch((yield authInvoke(this, "liveEpoch", [])));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.operatorDisconnected);
-        registerAuthMethod(KvOAuthProvider.prototype, "beginFlow", function (expectedEpoch) {
-            return authFlow(function* () {
-                const epoch = (yield authInvoke(this, "liveEpoch", []));
-                if (expectedEpoch !== undefined && epoch !== expectedEpoch)
-                    throw this.flowSuperseded();
-                this.epoch = epoch;
-                this.bound = true;
-                return epoch;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.beginFlow);
-        registerAuthMethod(KvOAuthProvider.prototype, "flowEpoch", function () {
-            return authFlow(function* () {
-                return this.epoch ?? (yield authInvoke(this, "liveEpoch", []));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.flowEpoch);
-        registerAuthMethod(KvOAuthProvider.prototype, "bindFlow", function () {
-            return authFlow(function* () {
-                const { grant } = (yield authInvoke(this, "readGrant", []));
-                const epoch = this.callback?.flow.epoch ?? this.epoch ?? grant.epoch;
-                if (grant.epoch !== epoch)
-                    throw this.flowSuperseded();
-                this.epoch = epoch;
-                this.bound = true;
-                this.codeExchange = true;
-                (yield authInvoke(this, "checkFlowBinding", [grant]));
-                this.seen = {
-                    client: fingerprint(grant.body.client?.value),
-                    tokens: fingerprint(grant.body.tokens),
-                };
-            }.bind(this));
-        }, KvOAuthProvider.prototype.bindFlow);
-        registerAuthMethod(KvOAuthProvider.prototype, "verifyCallbackState", function (state) {
-            return authFlow(function* () {
-                if (this.callback?.key ===
-                    oauthFlowKeys.flow((yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authCall(oauthStateDigest, [state]);
-                        }),
-                    ]))))
-                    return true;
-                return (yield authInvoke(this, "verifyState", [state]));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.verifyCallbackState);
-        registerAuthMethod(KvOAuthProvider.prototype, "clientInformation", function (ctx) {
-            return authFlow(function* () {
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                const { body } = (yield authInvoke(this, "activeGrant", []));
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                const client = this.clientOptions?.client;
-                if (!body.client && !this.allowAuthorization)
-                    throw this.authorizationRefused();
-                if (client) {
-                    if ((ctx && ctx.issuer !== client.issuer) || body.issuer !== client.issuer)
-                        throw this.flowSuperseded();
-                    if (body.client &&
-                        (body.client.value.client_id !== client.clientId || body.client.binding !== this.clientBinding))
-                        throw this.flowSuperseded();
-                    return {
-                        client_id: client.clientId,
-                        issuer: client.issuer,
-                        token_endpoint_auth_method: this.clientMetadata.token_endpoint_auth_method,
-                        ...(client.clientSecret !== undefined ? { client_secret: client.clientSecret } : {}),
-                    };
-                }
-                if (!body.client || (ctx && body.issuer !== ctx.issuer))
-                    return undefined;
-                this.seen.client = fingerprint(body.client.value);
-                return ctx ? { ...body.client.value, issuer: ctx.issuer } : body.client.value;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.clientInformation);
-        registerAuthMethod(KvOAuthProvider.prototype, "saveClientInformation", function (info, ctx) {
-            return authFlow(function* () {
-                try {
-                    const { body } = (yield authInvoke(this, "boundGrant", []));
-                    const registrationPath = this.clientOptions?.client
-                        ? "static"
-                        : body.client?.value.client_id === info.client_id && body.client.registrationPath
-                            ? body.client.registrationPath
-                            : this.clientMetadataUrl &&
-                                body.discovery?.authorizationServerMetadata?.client_id_metadata_document_supported === true
-                                ? "cimd"
-                                : "dcr";
-                    (yield authInvoke(this, "writeCredential", [
-                        "client",
-                        {
-                            value: this.clientOptions?.client ? { client_id: this.clientOptions.client.clientId } : info,
-                            registrationPath,
-                            ...(this.clientBinding !== undefined ? { binding: this.clientBinding } : {}),
-                        },
-                        ctx?.issuer,
-                    ]));
-                }
-                catch (error) {
-                    if (!this.signal?.aborted)
-                        throw error;
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.saveClientInformation);
-        registerAuthMethod(KvOAuthProvider.prototype, "registrationPath", function () {
-            return authFlow(function* () {
-                const { body } = (yield authInvoke(this, "boundGrant", []));
-                return body.client?.registrationPath;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.registrationPath);
-        registerAuthMethod(KvOAuthProvider.prototype, "validatedIssuerOrigin", function () {
-            return authFlow(function* () {
-                const { body } = (yield authInvoke(this, "boundGrant", []));
-                const state = body.discovery;
-                if (!state ||
-                    state.authorizationServerMetadata?.issuer !== state.authorizationServerUrl ||
-                    body.issuer !== state.authorizationServerUrl)
-                    return undefined;
-                this.assertCredentialFree(state, body);
-                return new URL(state.authorizationServerUrl).origin;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.validatedIssuerOrigin);
-        registerAuthMethod(KvOAuthProvider.prototype, "discoveryState", function () {
-            return authFlow(function* () {
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                const { body } = (yield authInvoke(this, "activeGrant", []));
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                let state = body.discovery;
-                if (state?.resourceMetadataUrl && this.clientOptions?.resourceOrigin) {
-                    let sameOrigin = false;
-                    try {
-                        sameOrigin = new URL(state.resourceMetadataUrl).origin === this.clientOptions.resourceOrigin;
-                    }
-                    catch {
-                        // A malformed legacy URL is no more usable than a foreign one.
-                    }
-                    if (!sameOrigin) {
-                        // Never hand the SDK a legacy foreign URL or its resource
-                        // document. Keep the issuer binding for callbacks, but force
-                        // same-origin resource discovery on every SDK path. This read
-                        // does not mutate the stored grant.
-                        state = { ...state };
-                        delete state.resourceMetadataUrl;
-                        delete state.resourceMetadata;
-                    }
-                }
-                this.assertCredentialFree(state, body);
-                // Bind consent to durable discovery until the SDK saves a new
-                // state. A same-origin metadata 404 can leave the cache unchanged.
-                this.consentDiscovery = body.discovery;
-                return state;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.discoveryState);
-        registerAuthMethod(KvOAuthProvider.prototype, "saveDiscoveryState", function (state) {
-            return authFlow(function* () {
-                this.assertCredentialFree(state, (yield authInvoke(this, "boundGrant", [])).body);
-                const issuer = discoveryIssuer(state);
-                if (this.clientOptions?.client && issuer !== this.clientOptions.client.issuer)
-                    throw this.flowSuperseded();
-                if (!this.allowAuthorization && !(yield authInvoke(this, "boundGrant", [])).body.client)
-                    throw this.authorizationRefused();
-                this.consentDiscovery = state;
-                (yield authInvoke(this, "updateGrant", [
-                    (grant) => {
-                        const body = grant.body.issuer !== issuer ? (issuer !== undefined ? { issuer } : {}) : { ...grant.body };
-                        this.assertCredentialFree(state, grant.body);
-                        body.discovery = state;
-                        return this.withIssuer(grant, body);
-                    },
-                ]));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.saveDiscoveryState);
-        registerAuthMethod(KvOAuthProvider.prototype, "tokens", function (ctx) {
-            return authFlow(function* () {
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                const grant = (yield authInvoke(this, "activeGrant", []));
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                const { tokens } = grant.body;
-                if (!tokens || (ctx && grant.body.issuer !== ctx.issuer))
-                    return undefined;
-                this.seen.tokens = fingerprint(tokens);
-                if (!ctx)
-                    return tokens;
-                this.refreshBasis = { accessToken: tokens.access_token, epoch: grant.epoch, issuer: ctx.issuer };
-                return { ...tokens, issuer: ctx.issuer };
-            }.bind(this));
-        }, KvOAuthProvider.prototype.tokens);
-        registerAuthMethod(KvOAuthProvider.prototype, "saveTokens", function (tokens, ctx) {
-            return authFlow(function* () {
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                if (this.refreshFailure?.kind === "dead")
-                    throw this.authorizationRefused();
-                // The coordinator stored this refresh already, or handed on another's.
-                if (this.storedRefresh !== undefined && tokens.access_token === this.storedRefresh)
-                    return;
-                const refreshConsent = this.exchangeConsent &&
-                    tokens.refresh_token !== undefined &&
-                    this.exchangeConsent.digest ===
-                        (yield authInvoke(this, "wait", [
-                            authMethod(() => {
-                                return authCall(oauthStateDigest, [tokens.refresh_token]);
-                            }),
-                        ]))
-                    ? this.exchangeConsent
-                    : undefined;
-                (yield authInvoke(this, "writeCredential", ["tokens", tokens, ctx?.issuer, refreshConsent]));
-                this.refreshFailure = undefined;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.saveTokens);
-        registerAuthMethod(KvOAuthProvider.prototype, "state", function () {
-            return authValue(() => {
-                if (!this.allowAuthorization)
-                    throw this.authorizationRefused();
-                const state = randomState();
-                this.consent = { state };
-                return state;
-            });
-        }, KvOAuthProvider.prototype.state);
-        registerAuthMethod(KvOAuthProvider.prototype, "saveCodeVerifier", function (verifier) {
-            return authValue(() => {
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                if (!this.allowAuthorization)
-                    throw this.authorizationRefused();
-                this.consent = { ...this.consent, verifier };
-            });
-        }, KvOAuthProvider.prototype.saveCodeVerifier);
-        registerAuthMethod(KvOAuthProvider.prototype, "codeVerifier", function () {
-            return authValue(() => {
-                const verifier = this.callback?.flow.verifier ?? this.consent.verifier;
-                if (verifier === undefined) {
-                    throw new Error(`No PKCE code verifier for "${this.connectorId}"`);
-                }
-                return verifier;
-            });
-        }, KvOAuthProvider.prototype.codeVerifier);
-        registerAuthMethod(KvOAuthProvider.prototype, "redirectToAuthorization", function (authorizationUrl) {
-            return authFlow(function* () {
-                if (this.signal?.aborted)
-                    return;
-                if (!this.allowAuthorization)
-                    throw this.authorizationRefused();
-                for (const [name, value] of this.clientOptions?.authorizationParams ?? []) {
-                    authorizationUrl.searchParams.set(name, value);
-                }
-                this.assertCredentialFree(authorizationUrl.toString(), (yield authInvoke(this, "boundGrant", [])).body, true);
-                const state = this.consent.state ?? authorizationUrl.searchParams.get("state");
-                if (!state)
-                    throw new Error(`OAuth consent for "${this.connectorId}" carries no state`);
-                const client = this.clientOptions?.client;
-                if (client && !(yield authInvoke(this, "boundGrant", [])).body.client) {
-                    (yield authInvoke(this, "saveClientInformation", [
-                        { client_id: client.clientId },
-                        { issuer: client.issuer },
-                    ]));
-                }
-                const configured = this.configuredAuthorizationBinding();
-                if (configured?.issuer !== undefined) {
-                    const issuer = configured.issuer;
-                    // Static adapters do not save discovery or client configuration. Publish
-                    // their server identity before consent so a changed endpoint fences the
-                    // old grant before any code exchange can leave.
-                    (yield authInvoke(this, "updateGrant", [
-                        (grant) => (grant.body.issuer === issuer ? undefined : this.withIssuer(grant, { issuer })),
-                    ]));
-                }
-                const epoch = (yield authInvoke(this, "flowEpoch", []));
-                this.epoch = epoch;
-                const digest = (yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authCall(oauthStateDigest, [state]);
-                    }),
-                ]));
-                const key = oauthFlowKeys.flow(digest);
-                const url = authorizationUrl.toString();
-                const { verifier } = this.consent;
-                const grant = (yield authInvoke(this, "boundGrant", []));
-                this.assertCredentialFree(url, grant.body, true);
-                const binding = this.configuredAuthorizationBinding() ?? {
-                    ...(yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authCall(discoveryBinding, [this.consentDiscovery ?? grant.body.discovery]);
-                        }),
-                    ])),
-                    issuer: discoveryIssuer(this.consentDiscovery) ?? grant.body.issuer,
-                    clientId: authorizationUrl.searchParams.get("client_id") ?? grant.body.client?.value.client_id,
-                };
-                const record = (yield authInvoke(this, "encodeFlow", [
-                    key,
-                    {
-                        epoch,
-                        at: Date.now(),
-                        binding,
-                        url,
-                        ...(verifier !== undefined ? { verifier } : {}),
-                    },
-                ]));
-                if (this.signal?.aborted)
-                    return;
-                if (!(yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "compareAndSet", [
-                            key,
-                            null,
-                            record,
-                            { ttlSeconds: OAUTH_FLOW_TTL_SECONDS },
-                        ]);
-                    }),
-                ]))) {
-                    throw new Error(`OAuth consent for "${this.connectorId}" reused a state`);
-                }
-                let published = false;
-                try {
-                    published = (yield authInvoke(this, "updateGrant", [
-                        (grant) => ({ ...grant, flow: digest }),
-                        { epoch },
-                    ]));
-                }
-                finally {
-                    if (!published)
-                        (yield authCatch(authInvoke(this, "wait", [
-                            authMethod(() => {
-                                return authStorage(this.storage, "compareAndSet", [key, record, null]);
-                            }),
-                        ]), () => { }));
-                }
-                if (published)
-                    this.published = { epoch, url };
-            }.bind(this));
-        }, KvOAuthProvider.prototype.redirectToAuthorization);
-        registerAuthMethod(KvOAuthProvider.prototype, "consentUrl", function (signal) {
-            signal = signal === undefined ? this.signal : signal;
-            return authFlow(function* () {
-                const published = this.published;
-                if (!published)
-                    return undefined;
-                if (epochOf((yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "get", [GRANT]);
-                    }),
-                    signal,
-                ]))) !== published.epoch)
-                    throw this.flowSuperseded();
-                this.assertCredentialFree(published.url, (yield authInvoke(this, "boundGrant", [signal])).body, true);
-                return published.url;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.consentUrl);
-        registerAuthMethod(KvOAuthProvider.prototype, "pendingAuthorizationUrl", function () {
-            return authFlow(function* () {
-                const url = (yield authInvoke(this, "latestConsent", []))?.url;
-                this.assertCredentialFree(url, (yield authInvoke(this, "boundGrant", [])).body, true);
-                return url;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.pendingAuthorizationUrl);
-        registerAuthMethod(KvOAuthProvider.prototype, "reusablePendingAuthorizationUrl", function () {
-            return authFlow(function* () {
-                const consent = (yield authInvoke(this, "latestConsent", []));
-                if (!consent || Math.abs(Date.now() - consent.at) >= PENDING_AUTHORIZATION_MAX_AGE_MS) {
-                    return undefined;
-                }
-                this.assertCredentialFree(consent.url, (yield authInvoke(this, "boundGrant", [])).body, true);
-                let clientId;
-                try {
-                    clientId = new URL(consent.url).searchParams.get("client_id");
-                }
-                catch {
-                    return undefined;
-                }
-                const client = (yield authInvoke(this, "clientInformation", []));
-                return clientId !== null && client?.client_id === clientId ? consent.url : undefined;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.reusablePendingAuthorizationUrl);
-        registerAuthMethod(KvOAuthProvider.prototype, "verifyState", function (candidate) {
-            return authFlow(function* () {
-                this.callback = undefined;
-                if (candidate === null)
-                    return false;
-                const key = oauthFlowKeys.flow((yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authCall(oauthStateDigest, [candidate]);
-                    }),
-                ])));
-                const raw = (yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "get", [key]);
-                    }),
-                ]));
-                const flow = raw === null ? undefined : (yield authInvoke(this, "openFlow", [key, raw, true]));
-                if (raw === null || !flow || flow.consumed)
-                    return false;
-                this.callback = { key, raw, flow, claimed: false };
-                this.epoch = flow.epoch;
-                return true;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.verifyState);
-        registerAuthMethod(KvOAuthProvider.prototype, "claimCodeExchange", function () {
-            return authFlow(function* () {
-                if (this.exchangeRefusal)
-                    return this.exchangeRefusal.clone();
-                (yield authInvoke(this, "claimConsent", []));
-                return undefined;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.claimCodeExchange);
-        registerAuthMethod(KvOAuthProvider.prototype, "consumeAuthError", function () {
-            return authFlow(function* () {
-                const { grant } = (yield authInvoke(this, "readGrant", []));
-                if (!this.callback || grant.epoch !== this.callback.flow.epoch)
-                    throw this.flowSuperseded();
-                (yield authInvoke(this, "checkFlowBinding", [grant]));
-                (yield authInvoke(this, "claimConsent", []));
-                this.callback = undefined;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.consumeAuthError);
-        registerAuthMethod(KvOAuthProvider.prototype, "claimConsent", function () {
-            return authFlow(function* () {
-                const callback = this.callback;
-                if (!callback)
-                    throw this.flowSuperseded();
-                if (callback.claimed)
-                    throw new OAuthCallbackClaimedError(this.connectorId);
-                callback.claimed = true;
-                const { epoch, at } = callback.flow;
-                const claimed = JSON.stringify({
-                    connectaOAuthFlow: FLOW_VERSION,
-                    epoch,
-                    at,
-                    consumed: true,
-                });
-                const remaining = Math.ceil((at + OAUTH_FLOW_TTL_SECONDS * 1000 - Date.now()) / 1000);
-                const ttlSeconds = Math.min(OAUTH_FLOW_TTL_SECONDS, Math.max(1, remaining));
-                if ((yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "compareAndSet", [
-                            callback.key,
-                            callback.raw,
-                            claimed,
-                            { ttlSeconds },
-                        ]);
-                    }),
-                ]))) {
-                    return;
-                }
-                if (epochOf((yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "get", [GRANT]);
-                    }),
-                ]))) !== epoch)
-                    throw this.flowSuperseded();
-                throw new OAuthCallbackClaimedError(this.connectorId);
-            }.bind(this));
-        }, KvOAuthProvider.prototype.claimConsent);
-        registerAuthMethod(KvOAuthProvider.prototype, "dispatchCodeExchange", function (send, endpoint) {
-            return authFlow(function* () {
-                const epoch = this.epoch;
-                if (!this.codeExchange || epoch === undefined)
-                    throw this.flowSuperseded();
-                const raw = (yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "get", [GRANT]);
-                    }),
-                ]));
-                const grant = (yield authInvoke(this, "openGrant", [raw]));
-                if (grant.epoch !== epoch)
-                    throw this.flowSuperseded();
-                (yield authInvoke(this, "checkFlowBinding", [grant]));
-                if (endpoint !== undefined && this.callback?.flow.binding?.tokenEndpoint !== String(endpoint)) {
-                    throw this.flowSuperseded();
-                }
-                // Opening ciphertext may yield. Re-read the exact record after opening,
-                // then check and send in the same reaction, without another await.
-                return (yield authInvoke(this, "wait", [
-                    authMethod(() => {
-                        return authThen(authStorage(this.storage, "get", [GRANT]), authMethod((current) => {
-                            return authFlow(function* () {
-                                if (this.signal?.aborted)
-                                    throw aborted(this.signal);
-                                if (current !== raw)
-                                    throw this.flowSuperseded();
-                                const sent = send();
-                                sent.catch(() => { });
-                                return (yield authValue(() => sent));
-                            }.bind(this));
-                        }));
-                    }),
-                ]));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.dispatchCodeExchange);
-        registerAuthMethod(KvOAuthProvider.prototype, "recordCodeExchangeTokens", function (tokens) {
-            return authFlow(function* () {
-                this.exchangeConsent = undefined;
-                if (tokens.refresh_token === undefined)
-                    return;
-                try {
-                    const digest = (yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authCall(oauthStateDigest, [tokens.refresh_token]);
-                        }),
-                    ]));
-                    const resolution = (yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authStorage(this.storage, "get", [oauthRefreshSpentKeys.spent(digest)]);
-                        }),
-                    ]));
-                    const spent = storedRefreshSpent(resolution);
-                    // Observing the exact resolved storage write before consent completion
-                    // proves their order without comparing isolate clocks. A consent that
-                    // saw outstanding/ambiguous cannot become eligible on a delayed save.
-                    if (spent?.state === "resolved")
-                        this.exchangeConsent = { digest, resolution: resolution };
-                }
-                catch {
-                    if (this.signal?.aborted)
-                        throw aborted(this.signal);
-                    throw this.credentialWriteError();
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.recordCodeExchangeTokens);
-        registerAuthMethod(KvOAuthProvider.prototype, "invalidateCredentials", function (scope) {
-            return authFlow(function* () {
-                if (this.signal?.aborted)
-                    throw aborted(this.signal);
-                const fields = {
-                    all: ["client", "tokens", "discovery"],
-                    client: ["client"],
-                    tokens: ["tokens"],
-                    discovery: ["discovery"],
-                    verifier: [],
-                }[scope];
-                if (fields.length > 0) {
-                    (yield authInvoke(this, "updateGrant", [
-                        (grant) => {
-                            const body = { ...grant.body };
-                            let changed = false;
-                            for (const field of fields) {
-                                const current = field === "client" ? body.client?.value : body[field];
-                                if (current === undefined)
-                                    continue;
-                                if (field !== "discovery" && fingerprint(current) !== this.seen[field])
-                                    continue;
-                                delete body[field];
-                                changed = true;
-                            }
-                            return changed ? { ...grant, body } : undefined;
-                        },
-                        { quiet: true },
-                    ]));
-                }
-                // The SDK invalidates after a refused refresh and then starts over, which
-                // on `invalid_client` means registering a new client. A passive request
-                // must not begin authorization, so it ends here, as auth_required.
-                if (!this.allowAuthorization && this.refreshFailure?.kind === "dead") {
-                    throw this.authorizationRefused();
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.invalidateCredentials);
-        registerAuthMethod(KvOAuthProvider.prototype, "claimRefresh", function (epoch, requested, signal, sharedWait) {
-            return authFlow(function* () {
-                const waiting = sharedWait ?? refreshWait(signal);
-                const wait = waiting.run;
-                const read = (key) => authCall(wait, [authMethod(() => authStorage(this.storage, "get", [key]))]);
-                const discard = () => authCall(wait, [
-                    authMethod(() => authInvoke(this, "discardRefusedGrant", [requested, epoch, waiting.transfer, waiting.signal])),
-                ]);
-                const tokens = () => authCall(wait, [
-                    authMethod(() => authInvoke(this, "storedTokens", [waiting.signal])),
-                ]);
-                let delay = 10;
-                try {
-                    const digest = (yield authCall(wait, [
-                        authMethod(() => {
-                            return authCall(oauthStateDigest, [requested ?? ""]);
-                        }),
-                    ]));
-                    const key = oauthRefreshKeys.lease(epoch, digest);
-                    const spentKey = oauthRefreshSpentKeys.spent(digest);
-                    while (!waiting.signal.aborted) {
-                        const current = (yield tokens());
-                        if (current?.refresh_token !== requested || (current && this.refreshedSinceRead(current, epoch))) {
-                            if (!current)
-                                this.recordRefreshFailure({ kind: "dead" });
-                            return current
-                                ? this.adoptRefresh(current)
-                                : Response.json({ error: "invalid_grant" }, { status: 400 });
-                        }
-                        const raw = (yield read(key));
-                        const stored = raw === null ? undefined : parsed(raw);
-                        const committed = plainObject(stored) &&
-                            (stored.completed === true ||
-                                (stored.state === "claimed" && typeof stored.predecessor === "string")) &&
-                            current !== undefined &&
-                            stored.tokenDigest ===
-                                (yield authCall(wait, [
-                                    authMethod(() => {
-                                        return authCall(refreshTokensDigest, [current]);
-                                    }),
-                                ]));
-                        const completed = committed && stored.completed === true;
-                        if (plainObject(stored) && (plainObject(stored.verdict) || (stored.completed === true && !committed))) {
-                            this.recordRefreshFailure({ kind: "dead" });
-                            (yield discard());
-                            throw new UnauthorizedError("OAuth refresh grant is no longer active.");
-                        }
-                        if (plainObject(stored) && stored.state !== "claimed" && !completed) {
-                            // Never compare another isolate's clock for a sent request. The
-                            // durable record survives expiry of this storage-owned liveness key.
-                            const active = typeof stored.activeKey === "string"
-                                ? (yield read(stored.activeKey))
-                                : null;
-                            if (active === null) {
-                                const refused = JSON.stringify({ ...stored, verdict: { kind: "dead" } });
-                                if ((yield authCall(wait, [
-                                    authMethod(() => {
-                                        return authStorage(this.storage, "compareAndSet", [key, raw, refused], () => waiting.transfer());
-                                    }),
-                                ]))) {
-                                    (yield authCall(wait, [
-                                        authMethod(() => {
-                                            return authInvoke(this, "resolveRefreshSpent", [
-                                                { key, spentKey, spentExpected: null, raw: raw },
-                                                "ambiguous",
-                                            ]);
-                                        }),
-                                    ]));
-                                    this.recordRefreshFailure({ kind: "dead" });
-                                    (yield discard());
-                                    throw new UnauthorizedError("OAuth refresh outcome is unknown; authorization required.");
-                                }
-                                continue;
-                            }
-                        }
-                        else {
-                            const spentExpected = (yield read(spentKey));
-                            if (spentExpected !== null) {
-                                const spent = storedRefreshSpent(spentExpected);
-                                const consent = (yield authCall(wait, [
-                                    authMethod(() => {
-                                        return authInvoke(this, "boundGrant", [waiting.signal]);
-                                    }),
-                                ])).body.refreshConsent;
-                                if (spent?.state !== "resolved" ||
-                                    !(
-                                    // A completed lease proves these exact tokens committed.
-                                    // Reusable refresh tokens may start another generation,
-                                    // but only after its own dispatch is durably resolved.
-                                    (committed &&
-                                        spent.epoch === epoch &&
-                                        spent.holder === (completed ? stored.holder : stored.predecessor)) ||
-                                        (spent.epoch !== epoch && consent?.digest === digest && consent.resolution === spentExpected))) {
-                                    // Lease and fingerprint are separate records. A competing
-                                    // generation can advance both between these reads; retry
-                                    // its new lease instead of discarding a live grant.
-                                    const latestLease = (yield read(key));
-                                    if (latestLease !== raw)
-                                        continue;
-                                    // Reset can sweep the old lease while its request remains live.
-                                    // Only storage-owned expiry can make an outstanding send ambiguous.
-                                    if (spent?.state === "outstanding" && (yield read(spent.activeKey)) === null) {
-                                        (yield authCall(wait, [
-                                            authMethod(() => {
-                                                return authStorage(this.storage, "compareAndSet", [spentKey, spentExpected, JSON.stringify({ ...spent, state: "ambiguous" })], () => waiting.transfer());
-                                            }),
-                                        ]));
-                                    }
-                                    this.recordRefreshFailure({ kind: "dead" });
-                                    (yield discard());
-                                    throw new UnauthorizedError("OAuth refresh token was already spent; authorization required.");
-                                }
-                            }
-                            if (raw === null ||
-                                completed ||
-                                (plainObject(stored) &&
-                                    typeof stored.expiresAt === "number" &&
-                                    stored.expiresAt <= this.refreshNow())) {
-                                // Clock skew can replace an unsent claim; its dispatch CAS then loses.
-                                const predecessor = completed
-                                    ? stored.holder
-                                    : plainObject(stored)
-                                        ? stored.predecessor
-                                        : undefined;
-                                const claimed = JSON.stringify({
-                                    connectaOAuthRefresh: 1,
-                                    holder: crypto.randomUUID(),
-                                    state: "claimed",
-                                    expiresAt: this.refreshNow() + OAUTH_REFRESH_LEASE_SECONDS * 1000,
-                                    ...(committed && typeof predecessor === "string" && typeof stored.tokenDigest === "string"
-                                        ? {
-                                            predecessor,
-                                            tokenDigest: stored.tokenDigest,
-                                        }
-                                        : {}),
-                                });
-                                let won;
-                                try {
-                                    won = (yield authCall(wait, [
-                                        authMethod(() => {
-                                            return authStorage(this.storage, "compareAndSet", [key, raw, claimed], () => waiting.transfer());
-                                        }),
-                                    ]));
-                                }
-                                catch {
-                                    throw this.credentialWriteError();
-                                }
-                                if (won) {
-                                    try {
-                                        const latest = (yield tokens());
-                                        if (latest?.refresh_token !== requested || (latest && this.refreshedSinceRead(latest, epoch))) {
-                                            (yield authCall(wait, [
-                                                authMethod(() => {
-                                                    return authInvoke(this, "releaseRefresh", [
-                                                        { key, spentKey, spentExpected, raw: claimed },
-                                                    ]);
-                                                }),
-                                            ]));
-                                            return latest
-                                                ? this.adoptRefresh(latest)
-                                                : Response.json({ error: "invalid_grant" }, { status: 400 });
-                                        }
-                                        return { key, spentKey, spentExpected, raw: claimed };
-                                    }
-                                    catch (error) {
-                                        if (!waiting.signal.aborted) {
-                                            (yield authCall(wait, [
-                                                authMethod(() => {
-                                                    return authInvoke(this, "releaseRefresh", [
-                                                        { key, spentKey, spentExpected, raw: claimed },
-                                                    ]);
-                                                }),
-                                            ]));
-                                        }
-                                        throw error;
-                                    }
-                                }
-                            }
-                        }
-                        (yield Effect.raceAllFirst([Effect.sleep(delay), fromSignal(waiting.signal)]));
-                        delay = Math.min(250, delay * 2);
-                    }
-                }
-                catch (error) {
-                    if (!waiting.signal.aborted)
-                        throw error;
-                }
-                finally {
-                    if (!sharedWait)
-                        waiting.close();
-                }
-                throw this.refreshContended();
-            }.bind(this));
-        }, KvOAuthProvider.prototype.claimRefresh);
-        registerAuthMethod(KvOAuthProvider.prototype, "dispatchRefresh", function (lease, send, waiting) {
-            return authFlow(function* () {
-                const stored = parsed(lease.raw);
-                const epoch = (yield authInvoke(waiting, "run", [
-                    authMethod(() => {
-                        return authInvoke(this, "flowEpoch", []);
-                    }),
-                ]));
-                const activeKey = oauthRefreshActiveKeys.holder(epoch, stored.holder);
-                (yield authInvoke(waiting, "run", [
-                    authMethod(() => {
-                        return authStorage(this.storage, "set", [
-                            activeKey,
-                            JSON.stringify({ connectaOAuthRefresh: 1 }),
-                            {
-                                ttlSeconds: OAUTH_REFRESH_LEASE_SECONDS,
-                            },
-                        ]);
-                    }),
-                ]));
-                const dispatched = JSON.stringify({
-                    ...stored,
-                    state: "dispatched",
-                    activeKey,
-                });
-                const won = (yield authInvoke(waiting, "run", [
-                    authMethod(() => authStorage(this.storage, "compareAndSet", [lease.key, lease.raw, dispatched])),
-                ]));
-                if (!won)
-                    throw this.refreshContended();
-                lease.raw = dispatched;
-                if (waiting.signal.aborted)
-                    throw aborted(waiting.signal);
-                // One CAS owns the fingerprint across epochs and generations. Only a
-                // proven successful commit or later consent may replace a resolved send.
-                lease.spentRaw = JSON.stringify({
-                    connectaOAuthRefreshSpent: 1,
-                    epoch,
-                    holder: stored.holder,
-                    activeKey,
-                    state: "outstanding",
-                });
-                let unspent;
-                try {
-                    unspent = (yield authInvoke(waiting, "run", [
-                        authMethod(() => authStorage(this.storage, "compareAndSet", [
-                            lease.spentKey,
-                            lease.spentExpected,
-                            lease.spentRaw,
-                        ])),
-                    ]));
-                }
-                catch {
-                    this.recordRefreshFailure({ kind: "dead" });
-                    throw new UnauthorizedError("OAuth refresh dispatch could not be recorded; authorization required.");
-                }
-                if (!unspent) {
-                    this.recordRefreshFailure({ kind: "dead" });
-                    throw new UnauthorizedError("OAuth refresh token was already spent; authorization required.");
-                }
-                // Final owner check and physical submission share one reaction.
-                // Submission already transferred ownership to the coordinator. Only
-                // its own deadline can stop this send; the departed caller cannot.
-                if (waiting.signal.aborted)
-                    throw aborted(waiting.signal);
-                return (yield authCall(send, []));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.dispatchRefresh);
-        registerAuthMethod(KvOAuthProvider.prototype, "releaseRefresh", function (lease, verdict, tokens, resolution = "ambiguous") {
-            return authFlow(function* () {
-                const stored = parsed(lease.raw);
-                // Unsent successors restore the prior completed proof; other unsent
-                // claims may be removed. Dispatched outcomes never reopen a send.
-                const next = stored.state === "claimed"
-                    ? stored.predecessor && stored.tokenDigest
-                        ? JSON.stringify({
-                            ...stored,
-                            holder: stored.predecessor,
-                            state: "dispatched",
-                            completed: true,
-                        })
-                        : null
-                    : JSON.stringify({
-                        ...stored,
-                        ...(tokens
-                            ? {
-                                completed: true,
-                                tokenDigest: (yield authCall(refreshTokensDigest, [tokens])),
-                            }
-                            : { verdict: { kind: "dead" } }),
-                    });
-                // Verdicts contain fixed typed facts; no downstream causes or text.
-                if (verdict)
-                    this.recordRefreshFailure(verdict);
-                (yield authInvoke(this, "resolveRefreshSpent", [lease, resolution]));
-                const released = (yield authCatch(authStorage(this.storage, "compareAndSet", [lease.key, lease.raw, next]), () => false));
-                if (released && stored.activeKey)
-                    (yield authCatch(authStorage(this.storage, "delete", [stored.activeKey]), () => { }));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.releaseRefresh);
-        registerAuthMethod(KvOAuthProvider.prototype, "resolveRefreshSpent", function (lease, state) {
-            return authFlow(function* () {
-                try {
-                    const raw = lease.spentRaw ?? (yield authStorage(this.storage, "get", [lease.spentKey]));
-                    const spent = storedRefreshSpent(raw);
-                    const holder = parsed(lease.raw).holder;
-                    if (spent?.state !== "outstanding" || spent.holder !== holder)
-                        return;
-                    // The timestamp belongs to this resolution write, never to dispatch.
-                    // Consent copies the exact stored receipt, so wall clocks grant no sends.
-                    (yield authStorage(this.storage, "compareAndSet", [
-                        lease.spentKey,
-                        raw,
-                        JSON.stringify({
-                            ...spent,
-                            state,
-                            ...(state === "resolved" ? { resolvedAt: Date.now() } : {}),
-                        }),
-                    ]));
-                }
-                catch {
-                    // A lost resolution answer leaves outstanding or the durable outcome;
-                    // either blocks replay until a later consent observes a resolved write.
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.resolveRefreshSpent);
-        registerAuthMethod(KvOAuthProvider.prototype, "storedTokens", function (signal = null) {
-            return authFlow(function* () {
-                return (yield authInvoke(this, "boundGrant", [signal])).body.tokens;
-            }.bind(this));
-        }, KvOAuthProvider.prototype.storedTokens);
-        registerAuthMethod(KvOAuthProvider.prototype, "storeRefresh", function (epoch, requested, tokens, issuer) {
-            return authFlow(function* () {
-                for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
-                    try {
-                        const { raw, grant } = (yield authInvoke(this, "readGrant", [null]));
-                        if (grant.epoch !== epoch || (issuer !== undefined && grant.body.issuer !== issuer))
-                            return undefined;
-                        if (grant.body.tokens?.refresh_token !== requested)
-                            return grant.body.tokens;
-                        const committed = issuer !== undefined ? { ...tokens, issuer } : tokens;
-                        const encoded = (yield authInvoke(this, "encodeGrant", [
-                            { ...grant, body: { ...grant.body, tokens: committed } },
-                            null,
-                        ]));
-                        if ((yield authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded])))
-                            return committed;
-                    }
-                    catch {
-                        // A failed or lost CAS answer may still have committed. Re-read the
-                        // epoch and retry these in-memory tokens without another HTTP request.
-                    }
-                }
-                throw this.credentialWriteError();
-            }.bind(this));
-        }, KvOAuthProvider.prototype.storeRefresh);
-        registerAuthMethod(KvOAuthProvider.prototype, "discardRefusedGrant", function (refreshToken, epoch, beforeWrite, signal) {
-            return authFlow(function* () {
-                try {
-                    (yield authInvoke(this, "updateGrant", [
-                        (grant) => {
-                            if (grant.body.tokens?.refresh_token !== refreshToken)
-                                return undefined;
-                            const { tokens: _refused, ...body } = grant.body;
-                            return { ...grant, body };
-                        },
-                        {
-                            epoch,
-                            quiet: true,
-                            commit: true,
-                            ...(beforeWrite ? { beforeWrite } : {}),
-                            ...(signal ? { signal } : {}),
-                        },
-                    ]));
-                }
-                catch {
-                    // See above: a refusal that could not be recorded recurs, it does not hide.
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.discardRefusedGrant);
-        registerAuthMethod(KvOAuthProvider.prototype, "resetAuthorization", function (operatorDisconnected = false, preserveClient = false) {
-            return authFlow(function* () {
-                const operation = authInvoke(this, "performReset", [operatorDisconnected, preserveClient]);
-                if (!this.onReset)
-                    return (yield operation);
-                const reset = runEdge(operation);
-                this.onReset?.(reset);
-                return (yield authValue(() => reset));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.resetAuthorization);
-        registerAuthMethod(KvOAuthProvider.prototype, "disconnectAuthorization", function (send) {
-            return authFlow(function* () {
-                const operation = authInvoke(this, "performReset", [true, false, send]);
-                if (!this.onReset)
-                    return (yield operation);
-                const reset = runEdge(operation);
-                this.onReset?.(reset);
-                return (yield authValue(() => reset));
-            }.bind(this));
-        }, KvOAuthProvider.prototype.disconnectAuthorization);
-        registerAuthMethod(KvOAuthProvider.prototype, "performReset", function (operatorDisconnected, preserveClient, revoke) {
-            return authFlow(function* () {
-                const epoch = `${operatorDisconnected ? DISCONNECTED_EPOCH_PREFIX : ACTIVE_EPOCH_PREFIX}${crypto.randomUUID()}`;
-                for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
-                    const { raw, grant } = (yield authInvoke(this, "readGrant", [null]));
-                    const carried = preserveClient && !operatorDisconnected ? this.carriableClient(grant) : undefined;
-                    const encoded = (yield authInvoke(this, "encodeGrant", [{ epoch, body: carried ?? {} }, null]));
-                    let written;
-                    try {
-                        written = (yield authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded]));
-                    }
-                    catch {
-                        throw this.credentialWriteError();
-                    }
-                    if (written) {
-                        this.refreshCoordinator?.retire(grant.epoch);
-                        try {
-                            (yield authInvoke(this, "sweepConsents", []));
-                            (yield authInvoke(this, "sweepRefreshLeases", []));
-                        }
-                        finally {
-                            if (revoke) {
-                                const snapshot = this.revocationSnapshot(grant.body);
-                                (yield authCall(revokeDownstreamGrant, [snapshot.body, revoke, snapshot.client]));
-                            }
-                        }
-                        return;
-                    }
-                }
-                throw this.credentialWriteError();
-            }.bind(this));
-        }, KvOAuthProvider.prototype.performReset);
-        registerAuthMethod(KvOAuthProvider.prototype, "sweepConsents", function () {
-            return authFlow(function* () {
-                try {
-                    const consents = [];
-                    for (const key of (yield authStorage(this.storage, "list", [oauthFlowKeys.prefix]))) {
-                        const raw = (yield authStorage(this.storage, "get", [key]));
-                        if (raw !== null)
-                            consents.push([key, raw]);
-                    }
-                    const live = epochOf((yield authStorage(this.storage, "get", [GRANT])));
-                    for (const [key, raw] of consents) {
-                        const flow = parsed(raw);
-                        if (plainObject(flow) && flow.epoch === live)
-                            continue;
-                        (yield authStorage(this.storage, "compareAndSet", [key, raw, null]));
-                    }
-                }
-                catch {
-                    // Hygiene only: the epoch, not this, fences a stale consent.
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.sweepConsents);
-        registerAuthMethod(KvOAuthProvider.prototype, "sweepRefreshLeases", function () {
-            return authFlow(function* () {
-                try {
-                    const records = [];
-                    // A reset may sweep an old lease while its HTTP request is still live.
-                    // Keep holder liveness until completion or its storage-owned TTL: spent
-                    // records in later epochs still use it to distinguish live from crashed.
-                    for (const key of (yield authStorage(this.storage, "list", [oauthRefreshKeys.prefix]))) {
-                        const raw = (yield authStorage(this.storage, "get", [key]));
-                        if (raw !== null)
-                            records.push([key, raw]);
-                    }
-                    const live = epochOf((yield authStorage(this.storage, "get", [GRANT])));
-                    for (const [key, raw] of records) {
-                        if (!key.startsWith(`${oauthRefreshKeys.prefix}${live}:`)) {
-                            (yield authStorage(this.storage, "compareAndSet", [key, raw, null]));
-                        }
-                    }
-                }
-                catch {
-                    // Stale dispatch records cannot grant credentials: epochs never recur.
-                }
-            }.bind(this));
-        }, KvOAuthProvider.prototype.sweepRefreshLeases);
+        authMethods(KvOAuthProvider.prototype, {
+            ...grantStoreMethods,
+            ...consentMethods,
+            ...sdkHookMethods,
+            ...refreshRecordMethods,
+        });
     }
 }