machine-bridge-mcp 3.0.0-beta.17 → 3.0.0-beta.21

package/src/worker/oauth-refresh-families.ts

@@ -2,7 +2,9 @@ import {
   emptyOAuthRefreshStore,
   isCurrentOAuthRefreshStore,
   upgradeOAuthRefreshStore,
+  type ConsumedOAuthRefreshToken,
   type OAuthRefreshStore,
+  type OAuthRefreshToken,
   type OAuthStore,
 } from "./oauth-state.ts";
 import { HttpError } from "./http.ts";
@@ -10,6 +12,8 @@ import { HttpError } from "./http.ts";
 export const OAUTH_REFRESH_STORE_KEY = "oauth-refresh";
 const MAX_CONSUMED_REFRESH_TOKENS = 4096;
 const MAX_REVOKED_REFRESH_FAMILIES = 1024;
+export const OAUTH_REFRESH_RETRY_GRACE_SECONDS = 30;
+export const MAX_REFRESH_RETRY_ISSUES = 2;
 const TOKEN_HASH_PATTERN = /^sha256:[a-f0-9]{64}$/;
 const FAMILY_ID_PATTERN = /^mcp_family_[A-Za-z0-9_-]{43}$/;
 
@@ -64,20 +68,41 @@ export function recordConsumedRefreshToken(
   oauthStore: OAuthStore,
   store: OAuthRefreshStore,
   tokenHash: string,
-  familyId: string,
+  source: OAuthRefreshToken,
   expiresAt: number,
   consumedAt = Math.floor(Date.now() / 1000),
 ): void {
-  if (!TOKEN_HASH_PATTERN.test(tokenHash) || !FAMILY_ID_PATTERN.test(familyId)) {
+  if (!TOKEN_HASH_PATTERN.test(tokenHash) || !FAMILY_ID_PATTERN.test(source.family_id)) {
     throw new Error("consumed refresh-token identity is invalid");
   }
   if (!Number.isSafeInteger(consumedAt) || !Number.isSafeInteger(expiresAt) || consumedAt <= 0 || expiresAt <= consumedAt) {
     throw new Error("consumed refresh-token lifetime is invalid");
   }
-  store.consumed[tokenHash] = { family_id: familyId, consumed_at: consumedAt, expires_at: expiresAt };
+  store.consumed[tokenHash] = {
+    family_id: source.family_id,
+    consumed_at: consumedAt,
+    expires_at: expiresAt,
+    retry_until: Math.min(expiresAt, consumedAt + OAUTH_REFRESH_RETRY_GRACE_SECONDS),
+    retry_issues: 0,
+    source: { ...source },
+  };
   pruneOAuthRefreshReplayState(store, oauthStore);
 }
 
+export function consumedRefreshRetrySource(
+  marker: ConsumedOAuthRefreshToken,
+  now = Math.floor(Date.now() / 1000),
+): OAuthRefreshToken | null {
+  if (!marker.source || !Number.isSafeInteger(marker.retry_until) || marker.retry_until! < now) return null;
+  if (!Number.isSafeInteger(marker.retry_issues) || marker.retry_issues! < 0 || marker.retry_issues! >= MAX_REFRESH_RETRY_ISSUES) return null;
+  return { ...marker.source };
+}
+
+export function recordConsumedRefreshRetry(marker: ConsumedOAuthRefreshToken): void {
+  const current = Number.isSafeInteger(marker.retry_issues) ? marker.retry_issues! : 0;
+  marker.retry_issues = current + 1;
+}
+
 export function pruneOAuthRefreshReplayState(store: OAuthRefreshStore, oauthStore?: OAuthStore): boolean {
   let changed = false;
   const consumed = Object.entries(store.consumed).sort((left, right) => (
@@ -102,8 +127,38 @@ export function pruneOAuthRefreshReplayState(store: OAuthRefreshStore, oauthStor
 
 function validRefreshStoreRecords(store: OAuthRefreshStore): boolean {
   return Object.entries(store.tokens).every(([key, token]) => (
+    TOKEN_HASH_PATTERN.test(key) && validRefreshTokenRecord(token)
+  )) && Object.entries(store.consumed).every(([key, token]) => (
     TOKEN_HASH_PATTERN.test(key)
     && plainRecord(token)
+    && FAMILY_ID_PATTERN.test(token.family_id)
+    && validTimestamp(token.consumed_at)
+    && validTimestamp(token.expires_at)
+    && token.consumed_at < token.expires_at
+    && (token.retry_until === undefined || (
+      validTimestamp(token.retry_until)
+      && token.retry_until >= token.consumed_at
+      && token.retry_until <= token.expires_at
+    ))
+    && (token.retry_issues === undefined || (
+      Number.isSafeInteger(token.retry_issues)
+      && token.retry_issues >= 0
+      && token.retry_issues <= MAX_REFRESH_RETRY_ISSUES
+    ))
+    && (token.source === undefined || validRefreshTokenRecord(token.source))
+    && ((token.source === undefined && token.retry_until === undefined && token.retry_issues === undefined)
+      || (token.source !== undefined && token.retry_until !== undefined && token.retry_issues !== undefined
+        && token.source.family_id === token.family_id))
+  )) && Object.entries(store.revoked_families).every(([familyId, value]) => (
+    FAMILY_ID_PATTERN.test(familyId)
+    && plainRecord(value)
+    && value.reason === "replay"
+    && validTimestamp(value.expires_at)
+  ));
+}
+
+function validRefreshTokenRecord(token: OAuthRefreshToken): boolean {
+  return plainRecord(token)
     && /^mcp_client_[A-Za-z0-9_-]{43}$/.test(token.client_id)
     && /^acct_[A-Za-z0-9_-]{20,96}$/.test(token.account_id)
     && Number.isSafeInteger(token.account_version)
@@ -122,20 +177,7 @@ function validRefreshStoreRecords(store: OAuthRefreshStore): boolean {
     && validTimestamp(token.expires_at)
     && validTimestamp(token.family_expires_at)
     && token.issued_at < token.expires_at
-    && token.expires_at <= token.family_expires_at
-  )) && Object.entries(store.consumed).every(([key, token]) => (
-    TOKEN_HASH_PATTERN.test(key)
-    && plainRecord(token)
-    && FAMILY_ID_PATTERN.test(token.family_id)
-    && validTimestamp(token.consumed_at)
-    && validTimestamp(token.expires_at)
-    && token.consumed_at < token.expires_at
-  )) && Object.entries(store.revoked_families).every(([familyId, value]) => (
-    FAMILY_ID_PATTERN.test(familyId)
-    && plainRecord(value)
-    && value.reason === "replay"
-    && validTimestamp(value.expires_at)
-  ));
+    && token.expires_at <= token.family_expires_at;
 }
 
 function validTimestamp(value: unknown): value is number {

package/src/worker/oauth-state.ts

@@ -1,7 +1,7 @@
 import { normalizeAccountRole, type AccountRole } from "./access.ts";
 
 const OAUTH_STORE_SCHEMA_VERSION = 1;
-const OAUTH_REFRESH_STORE_SCHEMA_VERSION = 2;
+const OAUTH_REFRESH_STORE_SCHEMA_VERSION = 3;
 export const OFFLINE_ACCESS_SCOPE = "offline_access";
 const PASSWORD_TOKEN_PATTERN = /^[a-z][a-z0-9_]{2,31}_[A-Za-z0-9_-]{43}$/;
 const ACCOUNT_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]{1,62}[a-z0-9]$/;
@@ -70,6 +70,9 @@ export interface ConsumedOAuthRefreshToken {
   family_id: string;
   consumed_at: number;
   expires_at: number;
+  retry_until?: number;
+  retry_issues?: number;
+  source?: OAuthRefreshToken;
 }
 
 export interface RevokedOAuthRefreshFamily {
@@ -157,7 +160,15 @@ export function isCurrentOAuthRefreshStore(value: unknown): value is OAuthRefres
 export function upgradeOAuthRefreshStore(value: unknown): OAuthRefreshStore | null {
   if (isCurrentOAuthRefreshStore(value)) return value;
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const legacy = value as { schema_version?: unknown; tokens?: unknown };
+  const legacy = value as { schema_version?: unknown; tokens?: unknown; consumed?: unknown; revoked_families?: unknown };
+  if (legacy.schema_version === 2 && isRecord(legacy.tokens) && isRecord(legacy.consumed) && isRecord(legacy.revoked_families)) {
+    return {
+      schema_version: OAUTH_REFRESH_STORE_SCHEMA_VERSION,
+      tokens: legacy.tokens as OAuthRefreshStore["tokens"],
+      consumed: legacy.consumed as OAuthRefreshStore["consumed"],
+      revoked_families: legacy.revoked_families as OAuthRefreshStore["revoked_families"],
+    };
+  }
   if (legacy.schema_version !== 1 || !isRecord(legacy.tokens)) return null;
   const upgraded = emptyOAuthRefreshStore();
   const now = Math.floor(Date.now() / 1000);

package/src/worker/oauth-token-derivation.ts

@@ -0,0 +1,33 @@
+const DERIVATION_DOMAIN = "machine-bridge-mcp/oauth-refresh-replacement/v1";
+
+export async function deriveRefreshReplacementPair(
+  keyMaterial: string,
+  consumedRefreshToken: string,
+): Promise<{ accessToken: string; refreshToken: string }> {
+  if (!keyMaterial) throw new Error("OAuth token derivation key is not configured");
+  if (!/^mcp_rt_[A-Za-z0-9_-]{43}$/.test(consumedRefreshToken)) {
+    throw new Error("refresh replacement seed is invalid");
+  }
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(keyMaterial),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const [accessDigest, refreshDigest] = await Promise.all([
+    crypto.subtle.sign("HMAC", key, encoder.encode(`${DERIVATION_DOMAIN}\0access\0${consumedRefreshToken}`)),
+    crypto.subtle.sign("HMAC", key, encoder.encode(`${DERIVATION_DOMAIN}\0refresh\0${consumedRefreshToken}`)),
+  ]);
+  return {
+    accessToken: `mcp_at_${base64Url(new Uint8Array(accessDigest))}`,
+    refreshToken: `mcp_rt_${base64Url(new Uint8Array(refreshDigest))}`,
+  };
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}

package/src/worker/oauth-token-issuance.ts

@@ -0,0 +1,106 @@
+import {
+  pruneClientRecordByExpiry,
+  pruneRecordByExpiry,
+  randomToken,
+  sha256Hex,
+  type OAuthCode,
+  type OAuthRefreshStore,
+  type OAuthRefreshToken,
+  type OAuthStore,
+} from "./oauth-state.ts";
+import { HttpError, json } from "./http.ts";
+import { OAUTH_REFRESH_STORE_KEY } from "./oauth-refresh-families.ts";
+import { deriveRefreshReplacementPair } from "./oauth-token-derivation.ts";
+
+const ACCESS_TOKEN_TTL_SECONDS = 15 * 60;
+const REFRESH_TOKEN_IDLE_TTL_SECONDS = 60 * 60 * 24 * 14;
+const REFRESH_TOKEN_FAMILY_TTL_SECONDS = 60 * 60 * 24 * 30;
+const MAX_ACCESS_TOKENS = 500;
+const MAX_ACCESS_TOKENS_PER_CLIENT = 20;
+const MAX_REFRESH_TOKENS = 500;
+const MAX_REFRESH_TOKENS_PER_CLIENT = 20;
+
+type OAuthLock = <T>(callback: () => Promise<T>) => Promise<T>;
+export type OAuthRefreshEvent = "rotated" | "retry_issued" | "retry_exhausted" | "family_revoked" | "rejected";
+
+export interface OAuthTokenExchangeOptions {
+  storage: DurableObjectStorage;
+  tokenVersion: string;
+  serverName: string;
+  loadOAuthStore: () => Promise<OAuthStore>;
+  withLock: OAuthLock;
+  onRefreshEvent?: (event: OAuthRefreshEvent) => void;
+}
+
+export interface IssuedTokenPair {
+  accessToken: string;
+  refreshToken: string;
+}
+
+export async function issueTokenPair(
+  oauthStore: OAuthStore,
+  refreshStore: OAuthRefreshStore,
+  source: OAuthCode | OAuthRefreshToken,
+  tokenVersion: string,
+  dpopJkt?: string,
+  issuance: { derivationSeed?: string; issuedAt?: number } = {},
+): Promise<IssuedTokenPair> {
+  if (!tokenVersion) throw new HttpError(503, "server_error", "OAuth token version is not configured");
+  const now = Number.isSafeInteger(issuance.issuedAt) && Number(issuance.issuedAt) > 0
+    ? Number(issuance.issuedAt)
+    : Math.floor(Date.now() / 1000);
+  const familyId = "family_id" in source && source.family_id ? source.family_id : randomToken("mcp_family");
+  const familyExpiresAt = "family_expires_at" in source && source.family_expires_at
+    ? source.family_expires_at
+    : now + REFRESH_TOKEN_FAMILY_TTL_SECONDS;
+  if (familyExpiresAt <= now) throw new HttpError(400, "invalid_grant", "refresh-token family expired");
+  const issued = issuance.derivationSeed
+    ? await deriveRefreshReplacementPair(tokenVersion, issuance.derivationSeed)
+    : { accessToken: randomToken("mcp_at"), refreshToken: randomToken("mcp_rt") };
+  const { accessToken, refreshToken } = issued;
+  const common = {
+    client_id: source.client_id,
+    account_id: source.account_id,
+    account_version: source.account_version,
+    role: source.role,
+    scope: source.scope,
+    resource: source.resource,
+    version: tokenVersion,
+    family_id: familyId,
+    ...(dpopJkt ? { dpop_jkt: dpopJkt } : {}),
+  };
+  oauthStore.tokens[`sha256:${await sha256Hex(accessToken)}`] = {
+    ...common,
+    expires_at: now + ACCESS_TOKEN_TTL_SECONDS,
+  };
+  refreshStore.tokens[`sha256:${await sha256Hex(refreshToken)}`] = {
+    ...common,
+    family_id: familyId,
+    family_expires_at: familyExpiresAt,
+    issued_at: now,
+    expires_at: Math.min(now + REFRESH_TOKEN_IDLE_TTL_SECONDS, familyExpiresAt),
+  };
+  pruneClientRecordByExpiry(oauthStore.tokens, source.client_id, MAX_ACCESS_TOKENS_PER_CLIENT);
+  pruneRecordByExpiry(oauthStore.tokens, MAX_ACCESS_TOKENS);
+  pruneClientRecordByExpiry(refreshStore.tokens, source.client_id, MAX_REFRESH_TOKENS_PER_CLIENT);
+  pruneRecordByExpiry(refreshStore.tokens, MAX_REFRESH_TOKENS);
+  return { accessToken, refreshToken };
+}
+
+export function tokenResponse(issued: IssuedTokenPair, scope: string, dpopJkt?: string): Response {
+  return json({
+    access_token: issued.accessToken,
+    refresh_token: issued.refreshToken,
+    token_type: dpopJkt ? "DPoP" : "Bearer",
+    expires_in: ACCESS_TOKEN_TTL_SECONDS,
+    scope,
+  });
+}
+
+export async function saveOAuthStores(
+  oauthStore: OAuthStore,
+  refreshStore: OAuthRefreshStore,
+  storage: DurableObjectStorage,
+): Promise<void> {
+  await storage.put({ oauth: oauthStore, [OAUTH_REFRESH_STORE_KEY]: refreshStore });
+}

package/src/worker/oauth-tokens.ts

@@ -1,35 +1,17 @@
-import {
-  normalizeOAuthScope, pkceS256, pruneClientRecordByExpiry, pruneRecordByExpiry,
-  randomToken, safeEqual, sha256Hex,
-  type OAuthCode, type OAuthRefreshStore, type OAuthRefreshToken, type OAuthStore,
-} from "./oauth-state.ts";
-import { HttpError, json, parseRequestBody } from "./http.ts";
-import { loadOAuthRefreshStore, OAUTH_REFRESH_STORE_KEY, recordConsumedRefreshToken, revokeOAuthRefreshFamily } from "./oauth-refresh-families.ts";
 import { consumeDpopProof, verifyDpopProof, type VerifiedDpopProof } from "./dpop.ts";
+import { json, parseRequestBody } from "./http.ts";
+import { loadOAuthRefreshStore } from "./oauth-refresh-families.ts";
+import { exchangeRefreshToken } from "./oauth-refresh-exchange.ts";
+import {
+  issueTokenPair,
+  saveOAuthStores,
+  tokenResponse,
+  type OAuthTokenExchangeOptions,
+} from "./oauth-token-issuance.ts";
+import { pkceS256, safeEqual } from "./oauth-state.ts";
 
-const ACCESS_TOKEN_TTL_SECONDS = 15 * 60;
-const REFRESH_TOKEN_IDLE_TTL_SECONDS = 60 * 60 * 24 * 14;
-const REFRESH_TOKEN_FAMILY_TTL_SECONDS = 60 * 60 * 24 * 30;
+export type { OAuthRefreshEvent } from "./oauth-token-issuance.ts";
 const OAUTH_BODY_LIMIT_BYTES = 64 * 1024;
-const MAX_ACCESS_TOKENS = 500;
-const MAX_ACCESS_TOKENS_PER_CLIENT = 20;
-const MAX_REFRESH_TOKENS = 500;
-const MAX_REFRESH_TOKENS_PER_CLIENT = 20;
-
-type OAuthLock = <T>(callback: () => Promise<T>) => Promise<T>;
-
-interface OAuthTokenExchangeOptions {
-  storage: DurableObjectStorage;
-  tokenVersion: string;
-  serverName: string;
-  loadOAuthStore: () => Promise<OAuthStore>;
-  withLock: OAuthLock;
-}
-
-interface IssuedTokenPair {
-  accessToken: string;
-  refreshToken: string;
-}
 
 export async function exchangeOAuthToken(
   request: Request,
@@ -73,10 +55,7 @@ async function exchangeAuthorizationCode(
     }
     const client = oauthStore.clients[record.client_id];
     if (!client) return json({ error: "invalid_grant", error_description: "unknown client" }, 400);
-
-    if (dpop && !(await consumeDpopProof(options.storage, dpop))) {
-      return json({ error: "invalid_dpop_proof" }, 400);
-    }
+    if (dpop && !(await consumeDpopProof(options.storage, dpop))) return json({ error: "invalid_dpop_proof" }, 400);
     const issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion, dpop?.jkt);
     delete oauthStore.codes[code];
     client.last_used_at = Math.floor(Date.now() / 1000);
@@ -84,154 +63,3 @@ async function exchangeAuthorizationCode(
     return tokenResponse(issued, record.scope, dpop?.jkt);
   });
 }
-
-async function exchangeRefreshToken(
-  body: Record<string, unknown>,
-  base: string,
-  options: OAuthTokenExchangeOptions,
-  dpop?: VerifiedDpopProof,
-): Promise<Response> {
-  const refreshToken = String(body.refresh_token ?? "");
-  if (!/^mcp_rt_[A-Za-z0-9_-]{43}$/.test(refreshToken)) return json({ error: "invalid_grant" }, 400);
-  return options.withLock(async () => {
-    const oauthStore = await options.loadOAuthStore();
-    const refreshStore = await loadOAuthRefreshStore(oauthStore, options.storage);
-    const refreshKey = `sha256:${await sha256Hex(refreshToken)}`;
-    const record = refreshStore.tokens[refreshKey];
-    if (!record) {
-      const consumed = refreshStore.consumed[refreshKey];
-      if (consumed && consumed.expires_at > Math.floor(Date.now() / 1000)) {
-        revokeOAuthRefreshFamily(oauthStore, refreshStore, consumed.family_id, consumed.expires_at);
-        await saveOAuthStores(oauthStore, refreshStore, options.storage);
-      }
-      return json({ error: "invalid_grant" }, 400);
-    }
-    if (record.dpop_jkt && record.dpop_jkt !== dpop?.jkt) return json({ error: "invalid_dpop_proof" }, 400);
-    if (!record.dpop_jkt && dpop?.jkt) record.dpop_jkt = dpop.jkt;
-    if (refreshStore.revoked_families[record.family_id]) {
-      delete refreshStore.tokens[refreshKey];
-      await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
-      return json({ error: "invalid_grant" }, 400);
-    }
-    if (String(body.client_id ?? "") !== record.client_id) {
-      return json({ error: "invalid_grant", error_description: "client mismatch" }, 400);
-    }
-    if (String(body.resource ?? record.resource) !== record.resource || record.resource !== `${base}/mcp`) {
-      return json({ error: "invalid_target", error_description: "resource mismatch" }, 400);
-    }
-    if (body.scope !== undefined && normalizeOAuthScope(body.scope, options.serverName) !== record.scope) {
-      return json({ error: "invalid_scope" }, 400);
-    }
-    if (!options.tokenVersion) {
-      throw new HttpError(503, "server_error", "OAuth token version is not configured");
-    }
-    const account = oauthStore.accounts[record.account_id];
-    const client = oauthStore.clients[record.client_id];
-    if (
-      !record.version
-      || !(await safeEqual(record.version, options.tokenVersion))
-      || !account
-      || !account.active
-      || account.version !== record.account_version
-      || account.role !== record.role
-      || !client
-      || client.trusted_account_id !== account.account_id
-      || client.trusted_account_version !== account.version
-      || client.trusted_role !== account.role
-    ) {
-      delete refreshStore.tokens[refreshKey];
-      await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
-      return json({ error: "invalid_grant" }, 400);
-    }
-
-    if (dpop && !(await consumeDpopProof(options.storage, dpop))) {
-      return json({ error: "invalid_dpop_proof" }, 400);
-    }
-    let issued: IssuedTokenPair;
-    try {
-      issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion, dpop?.jkt);
-    } catch (error) {
-      if (error instanceof HttpError && error.code === "invalid_grant") {
-        delete refreshStore.tokens[refreshKey];
-        await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
-        return json({ error: "invalid_grant" }, 400);
-      }
-      throw error;
-    }
-    delete refreshStore.tokens[refreshKey];
-    recordConsumedRefreshToken(
-      oauthStore,
-      refreshStore,
-      refreshKey,
-      record.family_id,
-      record.family_expires_at,
-      Math.floor(Date.now() / 1000),
-    );
-    client.last_used_at = Math.floor(Date.now() / 1000);
-    await saveOAuthStores(oauthStore, refreshStore, options.storage);
-    return tokenResponse(issued, record.scope, dpop?.jkt || record.dpop_jkt);
-  });
-}
-
-async function issueTokenPair(
-  oauthStore: OAuthStore,
-  refreshStore: OAuthRefreshStore,
-  source: OAuthCode | OAuthRefreshToken,
-  tokenVersion: string,
-  dpopJkt?: string,
-): Promise<IssuedTokenPair> {
-  if (!tokenVersion) throw new HttpError(503, "server_error", "OAuth token version is not configured");
-  const now = Math.floor(Date.now() / 1000);
-  const familyId = "family_id" in source && source.family_id ? source.family_id : randomToken("mcp_family");
-  const familyExpiresAt = "family_expires_at" in source && source.family_expires_at
-    ? source.family_expires_at
-    : now + REFRESH_TOKEN_FAMILY_TTL_SECONDS;
-  if (familyExpiresAt <= now) throw new HttpError(400, "invalid_grant", "refresh-token family expired");
-  const accessToken = randomToken("mcp_at");
-  const refreshToken = randomToken("mcp_rt");
-  const common = {
-    client_id: source.client_id,
-    account_id: source.account_id,
-    account_version: source.account_version,
-    role: source.role,
-    scope: source.scope,
-    resource: source.resource,
-    version: tokenVersion,
-    family_id: familyId,
-    ...(dpopJkt ? { dpop_jkt: dpopJkt } : {}),
-  };
-  oauthStore.tokens[`sha256:${await sha256Hex(accessToken)}`] = {
-    ...common,
-    expires_at: now + ACCESS_TOKEN_TTL_SECONDS,
-  };
-  refreshStore.tokens[`sha256:${await sha256Hex(refreshToken)}`] = {
-    ...common,
-    family_id: familyId,
-    family_expires_at: familyExpiresAt,
-    issued_at: now,
-    expires_at: Math.min(now + REFRESH_TOKEN_IDLE_TTL_SECONDS, familyExpiresAt),
-  };
-  pruneClientRecordByExpiry(oauthStore.tokens, source.client_id, MAX_ACCESS_TOKENS_PER_CLIENT);
-  pruneRecordByExpiry(oauthStore.tokens, MAX_ACCESS_TOKENS);
-  pruneClientRecordByExpiry(refreshStore.tokens, source.client_id, MAX_REFRESH_TOKENS_PER_CLIENT);
-  pruneRecordByExpiry(refreshStore.tokens, MAX_REFRESH_TOKENS);
-  return { accessToken, refreshToken };
-}
-
-function tokenResponse(issued: IssuedTokenPair, scope: string, dpopJkt?: string): Response {
-  return json({
-    access_token: issued.accessToken,
-    refresh_token: issued.refreshToken,
-    token_type: dpopJkt ? "DPoP" : "Bearer",
-    expires_in: ACCESS_TOKEN_TTL_SECONDS,
-    scope,
-  });
-}
-
-async function saveOAuthStores(
-  oauthStore: OAuthStore,
-  refreshStore: OAuthRefreshStore,
-  storage: DurableObjectStorage,
-): Promise<void> {
-  await storage.put({ oauth: oauthStore, [OAUTH_REFRESH_STORE_KEY]: refreshStore });
-}

package/src/worker/observability.ts

@@ -10,6 +10,8 @@ export class WorkerObservability {
   private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0, unmatched_results: 0 };
   private readonly sockets = { candidates: 0, authenticated: 0, ready: 0, disconnected: 0, protocol_errors: 0 };
   private readonly streamTransport = { subscribers_opened: 0, subscribers_replaced: 0, terminal_pushes: 0, terminal_recipients: 0, protocol_errors: 0 };
+  private readonly oauthRefresh = { rotated: 0, retry_issued: 0, retry_exhausted: 0, family_revoked: 0, rejected: 0 };
+  private readonly durableBudget = { stream_rows_written_estimate: 0, alarm_sets: 0, alarm_deletes: 0, alarm_noops: 0 };
   private readonly errors = new Map<string, number>();
   private readonly tools = new Map<string, { started: number; completed: number; failed: number; active: number }>();
 
@@ -43,6 +45,7 @@ export class WorkerObservability {
   }
 
   unmatchedResult(): void { this.calls.unmatched_results += 1; }
+  recordError(code: string): void { this.incrementError(code); }
 
   socketCandidate(): void { this.sockets.candidates += 1; }
   socketAuthenticated(): void { this.sockets.authenticated += 1; }
@@ -68,6 +71,20 @@ export class WorkerObservability {
     this.incrementError("stream_subscriber_protocol_error");
   }
 
+  oauthRefreshEvent(event: "rotated" | "retry_issued" | "retry_exhausted" | "family_revoked" | "rejected"): void {
+    this.oauthRefresh[event] += 1;
+  }
+
+  streamStorageRowsWritten(rows: number): void {
+    this.durableBudget.stream_rows_written_estimate += Math.max(0, Math.floor(rows));
+  }
+
+  runtimeAlarmMutation(action: "set" | "delete" | "noop"): void {
+    if (action === "set") this.durableBudget.alarm_sets += 1;
+    else if (action === "delete") this.durableBudget.alarm_deletes += 1;
+    else this.durableBudget.alarm_noops += 1;
+  }
+
   snapshot(): Record<string, unknown> {
     return {
       uptime_ms: Math.max(0, performance.now() - this.startedAt),
@@ -75,6 +92,8 @@ export class WorkerObservability {
       calls: { ...this.calls },
       sockets: { ...this.sockets },
       stream_transport: { ...this.streamTransport },
+      oauth_refresh: { ...this.oauthRefresh },
+      durable_budget: { ...this.durableBudget },
       errors: Object.fromEntries([...this.errors.entries()].sort(([left], [right]) => left.localeCompare(right))),
       tools: Object.fromEntries([...this.tools.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([name, metric]) => [name, { ...metric }])),
     };

package/src/worker/pending-admission.ts

@@ -0,0 +1,15 @@
+export class PendingAdmissionGate {
+  private tail: Promise<void> = Promise.resolve();
+
+  async run<T>(operation: () => T | Promise<T>): Promise<T> {
+    let release: () => void = () => {};
+    const predecessor = this.tail;
+    this.tail = new Promise<void>((resolve) => { release = resolve; });
+    await predecessor;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+}

package/src/worker/pending-call-contract.ts

@@ -2,9 +2,10 @@ export type PendingCallOutcome =
   | { ok: true; value: unknown }
   | { ok: false; error: Error };
 
-export type PendingCallSettlement =
-  | { kind: "promise"; resolve: (value: unknown) => void; reject: (error: Error) => void }
-  | { kind: "event"; settle: (outcome: PendingCallOutcome) => void | Promise<void> };
+export type PendingCallSettlement = {
+  resolve: (value: unknown) => void;
+  reject: (error: Error) => void;
+};
 
 export interface PendingCallRecord {
   id: string;
@@ -36,7 +37,3 @@ export interface RegisterPendingCall {
   signal?: AbortSignal;
   onAbort?: (record: PendingCallRecord) => Error;
 }
-
-export interface RegisterEventPendingCall extends RegisterPendingCall {
-  settle: (outcome: PendingCallOutcome) => void | Promise<void>;
-}

package/src/worker/pending-calls.ts

@@ -1,4 +1,4 @@
-import type { PendingCallOutcome, PendingCallRecord, PendingCallSettlement, RegisterEventPendingCall, RegisterPendingCall } from "./pending-call-contract.ts";
+import type { PendingCallOutcome, PendingCallRecord, PendingCallSettlement, RegisterPendingCall } from "./pending-call-contract.ts";
 import { PendingCallDeadlines, type PendingCallDeadlineOptions } from "./pending-call-deadlines.ts";
 
 export class PendingCallRegistrationError extends Error {
@@ -41,15 +41,10 @@ export class PendingCallRegistry {
     let resolveResult!: (value: unknown) => void;
     let rejectResult!: (error: Error) => void;
     const result = new Promise<unknown>((resolve, reject) => { resolveResult = resolve; rejectResult = reject; });
-    this.add(input, { kind: "promise", resolve: resolveResult, reject: rejectResult });
+    this.add(input, { resolve: resolveResult, reject: rejectResult });
     return result;
   }
 
-  registerEvent(input: RegisterEventPendingCall): void {
-    this.assertCanRegister(input);
-    this.add(input, { kind: "event", settle: input.settle });
-  }
-
   resolve(id: string, socket: WebSocket, value: unknown): Promise<boolean> {
     const record = this.byId.get(id);
     return !record || record.socket !== socket ? Promise.resolve(false) : this.finish(id, { ok: true, value });
@@ -101,7 +96,7 @@ export class PendingCallRegistry {
 
   snapshot(): { active: number; detached: number; request_keys: number; maximum: number; oldest_ms: number; by_tool: Record<string, number> } {
     const now = this.deadlines.now();
-    const byTool: Record<string, number> = {};
+    const byTool = Object.create(null) as Record<string, number>;
     let detached = 0;
     let oldestMs = 0;
     for (const record of this.byId.values()) {
@@ -161,8 +156,7 @@ export class PendingCallRegistry {
   private async finish(id: string, outcome: PendingCallOutcome): Promise<boolean> {
     const record = this.take(id);
     if (!record) return false;
-    if (record.settlement.kind === "promise") outcome.ok ? record.settlement.resolve(outcome.value) : record.settlement.reject(outcome.error);
-    else await record.settlement.settle(outcome);
+    outcome.ok ? record.settlement.resolve(outcome.value) : record.settlement.reject(outcome.error);
     return true;
   }
 

package/src/worker/runtime-alarm-storage.ts

@@ -0,0 +1,35 @@
+export interface AlarmStorage {
+  getAlarm(): Promise<number | null>;
+  setAlarm(scheduledTime: number | Date): Promise<void>;
+  deleteAlarm(): Promise<void>;
+}
+
+export async function writeEarliestRuntimeAlarm(input: {
+  storage: AlarmStorage;
+  nextDeadline: number;
+  now: number;
+  onError: (error: unknown) => void;
+  onMutation?: (action: "set" | "delete" | "noop") => void;
+}): Promise<void> {
+  try {
+    const current = await input.storage.getAlarm();
+    if (!Number.isFinite(input.nextDeadline)) {
+      if (current === null) {
+        input.onMutation?.("noop");
+        return;
+      }
+      await input.storage.deleteAlarm();
+      input.onMutation?.("delete");
+      return;
+    }
+    const target = Math.max(input.now, input.nextDeadline);
+    if (current !== null && current > input.now && current <= target) {
+      input.onMutation?.("noop");
+      return;
+    }
+    await input.storage.setAlarm(target);
+    input.onMutation?.("set");
+  } catch (error) {
+    input.onError(error);
+  }
+}