@zackbart/connecta 0.40.0 → 0.42.0

package/dist/agent-routes.js

@@ -26,45 +26,8 @@
  *   catalogs with the description built for its own surface.
  */
 import { Context } from "effect";
-const NAMES = {
-    meta: Object.freeze({
-        search: "search_tools",
-        read: "call_tool",
-        write: "call_destructive_tool",
-        program: "execute_code",
-        authorize: "authorize_connector",
-        skills: "skills",
-    }),
-    code: Object.freeze({
-        search: "connecta.search inside execute_code",
-        read: "connecta.call inside execute_code",
-        write: "connecta.call inside execute_code",
-        program: "execute_code",
-        authorize: "authorize_connector",
-        skills: "skills",
-    }),
-    native: Object.freeze({
-        search: "your host's tool search",
-        read: "the original native tool",
-        write: "the original native tool",
-        program: "your host's tool search",
-        authorize: "the returned authorization handoff",
-        skills: "skills",
-    }),
-    "native-code": Object.freeze({
-        search: "your host's tool search",
-        read: "the original native tool",
-        write: "the original native tool",
-        program: "execute_code",
-        authorize: "the returned authorization handoff",
-        skills: "skills",
-    }),
-};
-/** The six-tool surface's names: the default wherever no other surface applies. */
-export const META_ROUTES = NAMES.meta;
-export function routeNames(surface) {
-    return NAMES[surface];
-}
+import { META_ROUTES, routeNames } from "./route-names.js";
+export { META_ROUTES, routeNames } from "./route-names.js";
 /** The names for the surface a connector operation serves; meta for contexts Connecta did not build. */
 export function routesOf(ctx) {
     return ctx?.routes ?? META_ROUTES;
@@ -86,11 +49,25 @@ const nativeAuthorize = {
     authorizeCall: () => "Give this error's nextAction to the user or operator.",
     authorizeAgain: "retry the original native call",
 };
+/**
+ * An auth error's message, once that error carries what authorize_connector
+ * would return: the fixed route text stops sending the agent to fetch it again.
+ * Only Connecta's own phrases change; provider wording around them stays.
+ */
+export function handoffInHand(message, connector) {
+    return message
+        .replaceAll(metaAuthorize.authorizeAndOpen(connector), nativeAuthorize.authorizeAndOpen())
+        .replaceAll(metaAuthorize.authorizeAndFollow(connector), nativeAuthorize.authorizeAndFollow())
+        .replaceAll(metaAuthorize.authorizeCall(connector), nativeAuthorize.authorizeCall())
+        .replaceAll(metaAuthorize.authorizeCall(), nativeAuthorize.authorizeCall())
+        .replaceAll(metaAuthorize.authorizeFor("recovery options"), nativeAuthorize.authorizeFor())
+        .replaceAll(metaAuthorize.authorizeFor("this connector"), nativeAuthorize.authorizeFor());
+}
 const nativeDirect = {
     directOnly: "when calling this tool directly",
     forDirect: "when calling this tool directly",
     onlyDirectRead: "only when calling this tool directly",
-    writeNeedsApproval: "Invoke it through its own native tool so the MCP host can request approval.",
+    writeNeedsApproval: "This name is bound to a read, so nothing was sent. Invoke it through its own write tool so the MCP host can request approval.",
 };
 const PHRASES = {
     meta: Object.freeze({
@@ -102,6 +79,15 @@ const PHRASES = {
         writeNeedsApproval: "Invoke it through call_destructive_tool so the MCP host can request approval.",
         ...metaAuthorize,
     }),
+    "read-route": Object.freeze({
+        program: "execute_read_code",
+        directOnly: "for a direct call_tool only",
+        forDirect: "for a direct call_tool",
+        onlyDirectRead: "only for a direct call_tool read",
+        callDirectlyAndPage: "call directly (call_tool, connecta.result to page)",
+        writeNeedsApproval: "Invoke it through call_destructive_tool so the MCP host can request approval.",
+        ...metaAuthorize,
+    }),
     // The eval code arm keeps the text its comparator protocol recorded.
     code: Object.freeze({
         program: "execute_code",
@@ -125,7 +111,10 @@ const PHRASES = {
         ...nativeAuthorize,
     }),
 };
-const SURFACES = new Map(Object.keys(NAMES).map((surface) => [NAMES[surface], surface]));
+const SURFACES = new Map(["meta", "read-route", "code", "native", "native-code"].map((surface) => [
+    routeNames(surface),
+    surface,
+]));
 /** The surface a names table belongs to; meta for a table Connecta did not build. */
 function routeSurface(routes) {
     return (routes && SURFACES.get(routes)) ?? "meta";
@@ -222,10 +211,10 @@ const programRouteConfigs = new WeakMap();
  * No package entry exports it and no configuration key selects it; the eval
  * code arm marks the configuration object it passes to createConnecta.
  */
-export function renderRoutesAsPrograms(config) {
-    programRouteConfigs.set(config, true);
+export function renderRoutesAsPrograms(config, searchOnly = false) {
+    programRouteConfigs.set(config, searchOnly ? { ...META_ROUTES, search: routeNames("code").search } : routeNames("code"));
 }
 /** The names every reply of a deployment built from `config` uses outside native pools. */
 export function deploymentRoutes(config) {
-    return programRouteConfigs.has(config) ? NAMES.code : NAMES.meta;
+    return programRouteConfigs.get(config) ?? META_ROUTES;
 }

package/dist/auth/clerk.d.ts

@@ -4,7 +4,12 @@ export type { ClerkGateClient, ClerkUser } from "./clerk-sdk/client.js";
 export interface ClerkAuthOptions {
     publishableKey: string;
     secretKey: string;
-    /** Public base URL of this deployment. Defaults to the request origin. */
+    /**
+     * Public base URL of this deployment: what tokens' resource and sessions'
+     * `azp` are checked against. Defaults to `ConnectaConfig.publicUrl`. One of
+     * the two is required; a request's Host never substitutes for it. A local
+     * deployment names its loopback origin, such as `http://localhost:8787`.
+     */
     publicUrl?: string;
     /**
      * OAuth client IDs dedicated to this deployment, used only when a verified

package/dist/auth/clerk.js

@@ -436,7 +436,22 @@ function mcpPoolSuffix(pathname) {
     const match = /^\/mcp(\/[a-z0-9_-]+)$/.exec(pathname);
     return match ? match[1] : null;
 }
+function assertPublicUrl(value) {
+    if (value === undefined)
+        return;
+    let url;
+    try {
+        url = typeof value === "string" ? new URL(value) : undefined;
+    }
+    catch {
+        url = undefined;
+    }
+    if (!url || (url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password) {
+        throw new Error("clerkAuth: `publicUrl` must be an absolute http(s) URL without credentials.");
+    }
+}
 export function clerkAuth(opts) {
+    assertPublicUrl(opts.publicUrl);
     assertNoRetiredToolkitOptions("clerkAuth", opts);
     // Before the Clerk client, so a malformed key fails as a connecta
     // configuration error rather than however the SDK happens to treat it.
@@ -771,6 +786,7 @@ export function clerkAuth(opts) {
     return {
         kind: "clerk",
         interactiveOperator: true,
+        ...(opts.publicUrl === undefined ? { requiresPublicUrl: true } : {}),
         recognizesCredential: (request) => {
             if (authorizationCredential(request).kind !== "absent")
                 return !isMachineCredential(request);

package/dist/auth/cloudflare-access.js

@@ -1,8 +1,9 @@
+import { Effect } from "effect";
 import { withAuthenticationDeadline } from "../auth-admission.js";
 import { validIdentityReference } from "../identity.js";
 import { authorizationCredential } from "../inbound-credential.js";
 import { attachFailureFacts } from "../operator-record.js";
-import { authCall, authFlow, authInvoke, authMethod } from "./native.js";
+import { authCall, authFlow, authMethod } from "./native.js";
 function identityString(identity, field) {
     const value = identity[field];
     return typeof value === "string" && validIdentityReference({ namespace: "cloudflare-access", id: value })
@@ -15,12 +16,30 @@ function unauthorized(reason) {
         response: attachFailureFacts(Response.json({ error: "Cloudflare Access authentication required" }, { status: 401, headers: { "WWW-Authenticate": 'Bearer scope="openid email"', "Cache-Control": "no-store" } }), { reason }),
     };
 }
-function unavailable(problem) {
+function unavailable(problem, identityLookup) {
     return {
         ok: false,
-        response: attachFailureFacts(Response.json({ error: "Cloudflare Access identity unavailable", problem }, { status: 503, headers: { "Cache-Control": "no-store", "Retry-After": "1" } }), { reason: problem === "identity_unavailable" ? "access_identity_unavailable" : problem }),
+        response: attachFailureFacts(Response.json({ error: "Cloudflare Access identity unavailable", problem }, { status: 503, headers: { "Cache-Control": "no-store", "Retry-After": "1" } }), {
+            reason: problem === "identity_unavailable" ? "access_identity_unavailable" : problem,
+            ...(identityLookup ? { identityLookup } : {}),
+        }),
     };
 }
+let lookups = 0;
+let isolateCold = true;
+const lookupSettled = () => {
+    lookups--;
+};
+function lookupIdentity(access) {
+    lookups++;
+    try {
+        return Promise.resolve(access.getIdentity()).finally(lookupSettled);
+    }
+    catch (error) {
+        lookups--;
+        throw error;
+    }
+}
 /**
  * Trust the identity Cloudflare Access attached to this direct Worker
  * invocation. Access has already validated the browser session, Managed OAuth
@@ -50,16 +69,39 @@ export function cloudflareAccessAuth() {
                 if (typeof access.aud !== "string" || !/^[\x21-\x7e]{1,256}$/.test(access.aud))
                     return unavailable("access_audience_invalid");
                 let identity;
+                const started = performance.now();
+                const cold = isolateCold;
+                isolateCold = false;
+                let rejected = false;
                 try {
                     identity = (yield authCall(withAuthenticationDeadline, [
                         request,
-                        authMethod(() => {
-                            return authInvoke(access, "getIdentity", []);
-                        }),
+                        authMethod((signal) => authFlow(function* () {
+                            for (let attempt = 0;; attempt++) {
+                                signal.throwIfAborted();
+                                try {
+                                    return (yield authCall(lookupIdentity, [access]));
+                                }
+                                catch (error) {
+                                    if (attempt === 1) {
+                                        rejected = true;
+                                        throw error;
+                                    }
+                                }
+                                // Only a rejected identity lookup retries. A hung lookup never
+                                // overlaps a second one; this sleep shares the original deadline.
+                                yield Effect.sleep(100 + Math.floor(Math.random() * 151));
+                            }
+                        })),
                     ]));
                 }
                 catch {
-                    return unavailable("identity_unavailable");
+                    return unavailable("identity_unavailable", {
+                        outcome: rejected ? "rejected" : "timeout",
+                        durationMs: Math.max(0, Math.round(performance.now() - started)),
+                        cold,
+                        inFlight: lookups,
+                    });
                 }
                 // Access binds ctx.access.aud to its Worker application at the edge.
                 // Service credentials can pass that edge, but connecta machines must

package/dist/auth/downstream-oauth/consent.js

@@ -99,10 +99,38 @@ const FLOW_VERSION = 1;
  * flow record's fifteen minutes.
  */
 const PENDING_AUTHORIZATION_MAX_AGE_MS = 10 * 60 * 1000;
-export function discoveryBinding(state) {
-    return runEdge(authProgram(discoveryBindingNative, [state]));
+/**
+ * What a flow record without a sealer may keep of a URL: everything but its
+ * userinfo, query and fragment. Non-URLs and clean URLs stay exact, so an
+ * ordinary issuer or client id still compares byte for byte.
+ */
+export function withoutUrlSecrets(value) {
+    if (Array.isArray(value))
+        return value.map(withoutUrlSecrets);
+    if (plainObject(value)) {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, withoutUrlSecrets(item)]));
+    }
+    if (typeof value !== "string")
+        return value;
+    try {
+        const url = new URL(value);
+        if (!url.username && !url.password && !url.search && !url.hash)
+            return value;
+        url.username = url.password = url.search = url.hash = "";
+        return url.href;
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * `minimized` binds the discovery metadata without its URL secrets, for a
+ * record no key protects: that digest is unkeyed, so it may not cover them.
+ */
+export function discoveryBinding(state, minimized = false) {
+    return runEdge(authProgram(discoveryBindingNative, [state, minimized]));
 }
-const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, function (state) {
+const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, function (state, minimized = false) {
     return authFlow(function* () {
         return state
             ? {
@@ -111,7 +139,9 @@ const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, fu
                 ...(state.authorizationServerMetadata?.authorization_response_iss_parameter_supported === true
                     ? { issRequired: true }
                     : {}),
-                discovery: (yield authCall(oauthStateDigest, [JSON.stringify(state)])),
+                discovery: (yield authCall(oauthStateDigest, [
+                    JSON.stringify(minimized ? withoutUrlSecrets(state) : state),
+                ])),
             }
             : {};
     });
@@ -120,20 +150,26 @@ const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, fu
 export const consentMethods = {
     encodeFlow: function (key, flow) {
         return authFlow(function* () {
-            const { verifier, ...rest } = flow;
+            const { binding, url, verifier, ...rest } = flow;
             const stored = { connectaOAuthFlow: FLOW_VERSION, ...rest };
-            if (verifier !== undefined) {
-                if (this.sealer) {
-                    stored.verifier = (yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authInvoke(this.sealer, "seal", [this.flowLabel(key, flow.epoch), verifier]);
-                        }),
-                    ]));
-                    stored.sealed = true;
-                }
-                else {
+            if (this.sealer) {
+                stored.record = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authInvoke(this.sealer, "seal", [
+                            this.flowRecordLabel(key, flow.epoch),
+                            JSON.stringify({ binding, url, verifier }),
+                        ]);
+                    }),
+                ]));
+            }
+            else {
+                // No key to protect it with: keep only what the callback must read.
+                // The consent URL is the first thing to go, so a repeated start mints
+                // a fresh consent rather than handing this one back.
+                if (binding)
+                    stored.binding = withoutUrlSecrets(binding);
+                if (verifier !== undefined)
                     stored.verifier = verifier;
-                }
             }
             return JSON.stringify(stored);
         }.bind(this));
@@ -146,7 +182,8 @@ export const consentMethods = {
                 typeof value.epoch !== "string" ||
                 typeof value.at !== "number" ||
                 (value.url !== undefined && typeof value.url !== "string") ||
-                (value.verifier !== undefined && typeof value.verifier !== "string")) {
+                (value.verifier !== undefined && typeof value.verifier !== "string") ||
+                (value.record !== undefined && typeof value.record !== "string")) {
                 return undefined;
             }
             const flow = {
@@ -156,23 +193,32 @@ export const consentMethods = {
                 ...(typeof value.url === "string" ? { url: value.url } : {}),
                 ...(value.consumed === true ? { consumed: true } : {}),
             };
-            if (!withVerifier || typeof value.verifier !== "string")
+            const sealedRecord = typeof value.record === "string";
+            if (!sealedRecord && (!withVerifier || typeof value.verifier !== "string"))
                 return flow;
-            if (value.sealed !== true)
+            if (!sealedRecord && value.sealed !== true)
                 return { ...flow, verifier: value.verifier };
             try {
                 if (!this.sealer)
                     return undefined;
+                const opened = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authInvoke(this.sealer, "open", [
+                            sealedRecord ? this.flowRecordLabel(key, flow.epoch) : this.flowLabel(key, flow.epoch),
+                            (sealedRecord ? value.record : value.verifier),
+                        ]);
+                    }),
+                ]));
+                if (!sealedRecord)
+                    return { ...flow, verifier: opened };
+                const record = parsed(opened);
+                if (!plainObject(record))
+                    return undefined;
                 return {
                     ...flow,
-                    verifier: (yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authInvoke(this.sealer, "open", [
-                                this.flowLabel(key, flow.epoch),
-                                value.verifier,
-                            ]);
-                        }),
-                    ])),
+                    ...(plainObject(record.binding) ? { binding: record.binding } : {}),
+                    ...(typeof record.url === "string" ? { url: record.url } : {}),
+                    ...(withVerifier && typeof record.verifier === "string" ? { verifier: record.verifier } : {}),
                 };
             }
             catch {
@@ -258,7 +304,10 @@ export const consentMethods = {
             const binding = this.configuredAuthorizationBinding() ?? {
                 ...(yield authInvoke(this, "wait", [
                     authMethod(() => {
-                        return authCall(discoveryBinding, [this.consentDiscovery ?? grant.body.discovery]);
+                        return authCall(discoveryBinding, [
+                            this.consentDiscovery ?? grant.body.discovery,
+                            !this.sealer,
+                        ]);
                     }),
                 ])),
                 issuer: discoveryIssuer(this.consentDiscovery) ?? grant.body.issuer,
@@ -442,7 +491,8 @@ export const consentMethods = {
             if (grant.epoch !== epoch)
                 throw this.flowSuperseded();
             (yield authInvoke(this, "checkFlowBinding", [grant]));
-            if (endpoint !== undefined && this.callback?.flow.binding?.tokenEndpoint !== String(endpoint)) {
+            if (endpoint !== undefined &&
+                this.flowValue(this.callback?.flow.binding?.tokenEndpoint) !== this.flowValue(String(endpoint))) {
                 throw this.flowSuperseded();
             }
             // Opening ciphertext may yield. Re-read the exact record after opening,

package/dist/auth/downstream-oauth/grant-store.js

@@ -16,6 +16,15 @@ const DISCONNECTED_EPOCH_PREFIX = "disconnected:";
 const GRANT_VERSION = 3;
 /** Attempts at one grant write while other writers keep winning. */
 export const MAX_GRANT_WRITES = 32;
+/** Token commits and their status fence are the same CAS, never separate writes. */
+export function nextTokenGrant(grant, body) {
+    const revision = (grant.tokenRevision ?? 0) + 1;
+    if (!Number.isSafeInteger(revision))
+        throw new Error("OAuth grant revision exhausted");
+    const next = { ...grant, body, tokenRevision: revision };
+    delete next.observation;
+    return next;
+}
 export function plainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -32,6 +41,8 @@ function storedGrant(raw) {
     return plainObject(value) &&
         value.connectaOAuth === GRANT_VERSION &&
         typeof value.epoch === "string" &&
+        (value.tokenRevision === undefined ||
+            (Number.isSafeInteger(value.tokenRevision) && value.tokenRevision >= 0)) &&
         (value.flow === undefined || typeof value.flow === "string") &&
         (value.sealed === undefined || typeof value.sealed === "string")
         ? value
@@ -105,6 +116,8 @@ export const grantStoreMethods = {
             const stored = {
                 connectaOAuth: GRANT_VERSION,
                 epoch: grant.epoch,
+                ...(grant.tokenRevision !== undefined ? { tokenRevision: grant.tokenRevision } : {}),
+                ...(grant.observation ? { observation: grant.observation } : {}),
                 ...(grant.flow !== undefined ? { flow: grant.flow } : {}),
             };
             if (Object.keys(grant.body).length > 0) {
@@ -160,6 +173,11 @@ export const grantStoreMethods = {
             }
             const grant = {
                 epoch: stored.epoch,
+                ...(stored.tokenRevision !== undefined ? { tokenRevision: stored.tokenRevision } : {}),
+                ...(stored.observation?.revision === (stored.tokenRevision ?? 0) &&
+                    (stored.observation.outcome === "accepted" || stored.observation.outcome === "refused")
+                    ? { observation: { revision: stored.observation.revision, outcome: stored.observation.outcome } }
+                    : {}),
                 ...(stored.flow !== undefined ? { flow: stored.flow } : {}),
                 body: grantBody(body),
             };
@@ -189,7 +207,12 @@ export const grantStoreMethods = {
                 authMethod(() => authStorage(this.storage, "get", [GRANT])),
             ]));
             const grant = (yield authInvoke(this, "openGrant", [raw]));
-            return { epoch: grant.epoch, ...(grant.body.tokens ? { tokens: grant.body.tokens } : {}) };
+            return {
+                epoch: grant.epoch,
+                ...(grant.body.tokens ? { tokens: grant.body.tokens } : {}),
+                ...(grant.body.issuer !== undefined ? { issuer: grant.body.issuer } : {}),
+                ...(grant.observation ? { observation: grant.observation } : {}),
+            };
         }.bind(this));
     },
     readGrant: function (signal) {
@@ -309,7 +332,8 @@ export const grantStoreMethods = {
                         if (refreshConsent)
                             body.refreshConsent = refreshConsent;
                     }
-                    return this.withIssuer(grant, body);
+                    const next = this.withIssuer(grant, body);
+                    return field === "tokens" ? nextTokenGrant(next, body) : next;
                 },
             ]));
             if (field === "tokens")
@@ -318,6 +342,20 @@ export const grantStoreMethods = {
             this.seen[field] = fingerprint(field === "client" ? value.value : value);
         }.bind(this));
     },
+    recordTokenOutcome: function (snapshot, outcome) {
+        if (outcome !== "accepted" && outcome !== "refused")
+            return Effect.void;
+        return authInvoke(this, "updateGrant", [
+            (grant) => {
+                if (grant.epoch !== snapshot.epoch || (grant.tokenRevision ?? 0) !== snapshot.revision || !grant.body.tokens)
+                    return undefined;
+                if (grant.observation?.revision === snapshot.revision && grant.observation.outcome === outcome)
+                    return undefined;
+                return { ...grant, observation: { revision: snapshot.revision, outcome } };
+            },
+            { epoch: snapshot.epoch, quiet: true },
+        ]);
+    },
     bindingForGrant: function (grant) {
         return authFlow(function* () {
             const configured = this.configuredAuthorizationBinding();
@@ -326,7 +364,7 @@ export const grantStoreMethods = {
                 : {
                     ...(yield authInvoke(this, "wait", [
                         authMethod(() => {
-                            return authCall(discoveryBinding, [grant.body.discovery]);
+                            return authCall(discoveryBinding, [grant.body.discovery, !this.sealer]);
                         }),
                     ])),
                     issuer: grant.body.issuer,
@@ -338,7 +376,8 @@ export const grantStoreMethods = {
         return authFlow(function* () {
             const binding = this.callback?.flow.binding;
             if (!binding ||
-                fingerprint(binding) !== fingerprint((yield authInvoke(this, "bindingForGrant", [grant])))) {
+                fingerprint(this.flowValue(binding)) !==
+                    fingerprint(this.flowValue((yield authInvoke(this, "bindingForGrant", [grant]))))) {
                 throw this.flowSuperseded();
             }
         }.bind(this));
@@ -384,9 +423,14 @@ export const grantStoreMethods = {
             };
         }.bind(this));
     },
-    resetAuthorization: function (operatorDisconnected = false, preserveClient = false) {
+    resetAuthorization: function (operatorDisconnected = false, preserveClient = false, refused) {
         return authFlow(function* () {
-            const operation = authInvoke(this, "performReset", [operatorDisconnected, preserveClient]);
+            const operation = authInvoke(this, "performReset", [
+                operatorDisconnected,
+                preserveClient,
+                undefined,
+                refused,
+            ]);
             if (!this.onReset)
                 return (yield operation);
             const reset = runEdge(operation);
@@ -404,11 +448,18 @@ export const grantStoreMethods = {
             return (yield authValue(() => reset));
         }.bind(this));
     },
-    performReset: function (operatorDisconnected, preserveClient, revoke) {
+    performReset: function (operatorDisconnected, preserveClient, revoke, refused) {
         return authFlow(function* () {
             const epoch = `${operatorDisconnected ? DISCONNECTED_EPOCH_PREFIX : ACTIVE_EPOCH_PREFIX}${crypto.randomUUID()}`;
             for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
                 const { raw, grant } = (yield authInvoke(this, "readGrant", [null]));
+                // Compare again on every CAS attempt: recovery may have changed the
+                // epoch, token revision, or observation since Connect read it.
+                if (refused &&
+                    (grant.epoch !== refused.epoch ||
+                        (grant.tokenRevision ?? 0) !== refused.revision ||
+                        grant.observation?.outcome !== "refused"))
+                    return;
                 const carried = preserveClient && !operatorDisconnected ? this.carriableClient(grant) : undefined;
                 const encoded = (yield authInvoke(this, "encodeGrant", [{ epoch, body: carried ?? {} }, null]));
                 let written;

package/dist/auth/downstream-oauth/refresh-coordinator.js

@@ -188,8 +188,11 @@ export class OAuthRefreshCoordinator {
                 // Production adapters resolve the required host policy before a code or
                 // refresh claim can consume its single-use credential. Custom SDK leaves
                 // may supply their own policy; this hook performs no I/O and owns no data.
+                // Each also registers the request's credentials before this point, as `api()`
+                // does in this hook: a refresh outlives its caller once claimed, and a sealing
+                // run must not publish ahead of that. `remoteMcp()` does so around its SDK flows.
                 if (isOAuthCredentialRequest(init))
-                    prepareCredentialRequest?.();
+                    prepareCredentialRequest?.(input, init);
                 if (isRefreshTokenRequest(init)) {
                     const signal = requestSignal && init?.signal
                         ? AbortSignal.any([requestSignal, init.signal])

package/dist/auth/downstream-oauth/refresh-records.js

@@ -4,7 +4,7 @@ import { fromSignal } from "../../runtime/run.js";
 import { OAUTH_REFRESH_LEASE_SECONDS, oauthRefreshActiveKeys, oauthRefreshKeys, oauthRefreshSpentKeys, } from "../../storage/keys.js";
 import { authCall, authCatch, authFlow, authInvoke, authMethod, authStorage, authStorageMany } from "../native.js";
 import { tokenExpiry } from "../oauth-grant.js";
-import { GRANT, MAX_GRANT_WRITES, epochOf, parsed, plainObject } from "./grant-store.js";
+import { nextTokenGrant, GRANT, MAX_GRANT_WRITES, epochOf, parsed, plainObject } from "./grant-store.js";
 import { aborted, refreshTokensDigest, refreshWait } from "./refresh-coordinator.js";
 import { oauthStateDigest } from "./consent.js";
 export function storedRefreshSpent(raw) {
@@ -378,10 +378,11 @@ export const refreshRecordMethods = {
                     const committed = issuer !== undefined ? { ...tokens, issuer } : tokens;
                     const { expiresAt: _previous, ...body } = grant.body;
                     const expiresAt = tokenExpiry(committed, issuedAt);
-                    const next = {
-                        ...grant,
-                        body: { ...body, tokens: committed, ...(expiresAt !== undefined ? { expiresAt } : {}) },
-                    };
+                    const next = nextTokenGrant(grant, {
+                        ...body,
+                        tokens: committed,
+                        ...(expiresAt !== undefined ? { expiresAt } : {}),
+                    });
                     const encoded = (yield authInvoke(this, "encodeGrant", [next, null]));
                     if ((yield authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded]))) {
                         this.observe(next);