Summary

• Port the cloudflare-mcp refresh guard into shared mcp-common.
• Convert local OAuth errors to extend the provider OAuthError so token callback failures become structured /token OAuth responses instead of raw 500s.
• Add in-isolate singleflight, KV in-flight markers, terminal failure caching, and downstream grant revocation for upstream invalid_grant.
• Wrap MCP/DO request handling for benign destroyed disconnects and log them as warnings.

Why

Fleet logs showed repeated upstream refresh-token invalid_grant errors across MCP workers. Once the upstream refresh token is permanently dead, retrying the downstream grant loops forever and floods logs. This makes the shared OAuth handler fail fast and force reauthorization.

Validation

• pnpm --filter @repo/mcp-common test
• pnpm exec turbo check:types --filter=@repo/mcp-common --filter=cloudflare-ai-gateway-mcp-server --filter=auditlogs --filter=cloudflare-autorag-mcp-server --filter=cloudflare-browser-mcp-server --filter=cloudflare-casb-mcp-server --filter=dex-analysis --filter=dns-analytics --filter=graphql-mcp-server --filter=logpush --filter=cloudflare-radar-mcp-server --filter=containers-mcp --filter=workers-bindings --filter=workers-builds --filter=workers-observability --filter=docs-ai-search --filter=docs-vectorize
• pnpm check:format (passes; prettier plugin prints existing import sorting aborted due to babel parsing error warning)