@zackbart/connecta 0.37.0 → 0.38.0

package/documentation/auth.md

@@ -1286,16 +1286,13 @@ connector](#downstream-oauth-on-api) stores no client. A vault without the
 optional `seal`/`open` members keeps the body plaintext with a startup
 warning; no vault, plaintext as always.
 
-**From 0.28 (layout 2).** The first read of an owner's grant that finds no
-record reads layout 2 once: the active generation's issuer-stamped client,
-tokens, and discovery (sealed values open under their old keys), kept only
-when every credential carries a stamp and the stamps agree with each other
-and with discovery. It writes them as the grant record by compare-and-set,
-then deletes every layout-2 key, cleanup lineage included. A disconnected
-connector stays disconnected; a cancelled request migrates nothing. Grants
-from before issuer binding (v0.8.1 and earlier) and pending consents are not
-carried, so those connectors need Connect again. Rolling back past this
-release finds no layout-2 grant and needs consent.
+**Pre-layout-3 grants.** The layout-2 migration and historical-key cleanup
+are removed. An owner with only old keys is treated as unauthorized; a warning
+names the unsupported layout and the need to Connect again or migrate on
+0.37.1. The check inspects key names only, never old credential values, and
+leaves them untouched. Existing layout-3 records remain readable even with an
+obsolete cleanup marker. Complete every owner's grant migration on 0.37.1
+before upgrading, or reconnect afterward; follow [Retired layout migrations](./migration-retired-layouts.md).
 
 ## Starting, restarting, and disconnecting
 
@@ -1349,12 +1346,15 @@ with the gate a call passes:
 | Tokens (any expiry) | Connects; `ok`, or `auth_required` when a 401 needs consent | Connects; `ok` without starting a flow when healthy                                                                                                                                                                                                                                |
 
 A start without a challenge runs the same SDK flow as a 401 without
-`resource_metadata`. Issuer and resource checks, consent state, PKCE, and
+`resource_metadata`. An explicit start after a status check or call in the same
+request scope can start consent in the connection's original epoch; the status
+check and call remain passive. Issuer and resource checks, consent state, PKCE, and
 the CIMD, registration, and static-client order are unchanged, and nothing is
 sent to the MCP endpoint. A call never starts consent. A call's 401 that names
 per-tool metadata, such as `/.well-known/oauth-protected-resource/<tool>`,
-renews through it when the grant holds no discovery. That metadata must name
-the configured resource, as any other must. When renewal is refused, the grant
+renews through it when the grant holds no discovery. The challenged metadata
+URL must share the configured connector URL's origin, and its metadata must
+name the configured resource, as any other must. When renewal is refused, the grant
 loses its tokens and the next start hands out consent. Restart (`force: true`)
 removes the tokens first, so it starts consent unless the downstream or
 discovery fails.
@@ -1394,12 +1394,8 @@ exchange. Both built-in `finishAuth` adapters require `callbackParams` with a
 nonempty `state`, even with PKCE disabled or after a separate `verifyState` call.
 A missing state is refused before discovery, registration, or token dispatch.
 
-Layout-2 migration commits `cleanupPending` in the new grant before deleting
-historical keys. Every later grant read retries deletion, then clears the
-marker by CAS only when deletion succeeds. Restart preserves this obligation.
-Disconnect commits a tombstone with the marker and always removes historical
-keys for the connector and owner, including when a modern grant already exists.
-A crash during cleanup cannot restore the disconnected grant.
+Disconnect commits a layout-3 tombstone. Restart and Disconnect never read or
+restore historical layout-2 keys.
 
 Disconnect first removes the grant and fences its epoch with CAS. When that
 removed grant's saved authorization-server metadata advertises a revocation
@@ -1431,7 +1427,7 @@ lease's `claimed` to `dispatched` CAS and a separate fingerprint CAS at
 `oauth:refresh-spent:<sha256(refresh_token)>`. The latter must succeed before
 any HTTP request leaves. Connector and owner storage namespaces partition both
 records. Spent records have **no TTL**, contain no token, and are never deleted
-by completion, failure, migration cleanup, Restart, Disconnect, or epoch sweeps.
+by completion, failure, Restart, Disconnect, or epoch sweeps.
 Copy these durable records during storage migration.
 
 Each fingerprint record names its dispatch epoch, holder, and resolution state:
@@ -1475,13 +1471,13 @@ body contains tokens. Fetch has already sent the request body; a refresh
 fingerprint is resolved as a definitive failure and the grant requires re-consent. A
 redirected code exchange is refused and its SDK retry cannot resend the code.
 
-| Outcome after dispatch                                                                           | Result                                                                                                                                                                                                                       |
-| ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Valid tokens durably committed                                                                   | Mark the fingerprint resolved and release waiters with committed tokens. Within the epoch only a new fingerprint can be dispatched next.                                                                                     |
-| Definitive provider failure                                                                      | `auth_required`. Mark the fingerprint resolved and conditionally remove its grant tokens. Includes every 3xx without following it and complete failures such as 5xx, 408, 425, and 429.                                      |
-| Network or response-body loss, malformed or oversized success, deadline expiry, or process crash | `auth_required`. Mark the fingerprint ambiguous and conditionally remove its grant tokens. Identical-token re-consent cannot reopen it.                                                                                      |
-| Valid rotation whose grant commit retries are exhausted                                          | `auth_required`. Record the definitive commit failure as resolved and conditionally remove its grant tokens. Never return uncommitted tokens to the SDK.                                                                     |
-| Epoch changed during commit                                                                      | Drop the response tokens and record the definitive failure as resolved. Restart, Disconnect, or issuer replacement determines the newer grant. A consent that completed before this resolution cannot reuse its fingerprint. |
+| Outcome after dispatch                                                                           | Result                                                                                                                                                                                                                                             |
+| ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Valid tokens durably committed                                                                   | Mark the fingerprint resolved and release waiters with committed tokens. Within the epoch only a new fingerprint can be dispatched next.                                                                                                           |
+| Definitive provider failure                                                                      | `auth_required`. Mark the fingerprint resolved and conditionally remove its grant tokens. Includes every 3xx without following it and complete failures such as 5xx, 408, 425, and 429.                                                            |
+| Network or response-body loss, malformed or oversized success, deadline expiry, or process crash | `auth_required`. Mark the fingerprint ambiguous and conditionally remove its grant tokens when storage answers within the cleanup bound. An outstanding fingerprint remains fenced if storage stalls. Identical-token re-consent cannot reopen it. |
+| Valid rotation whose grant commit retries are exhausted                                          | `auth_required`. Record the definitive commit failure as resolved and conditionally remove its grant tokens. Never return uncommitted tokens to the SDK.                                                                                           |
+| Epoch changed during commit                                                                      | Drop the response tokens and record the definitive failure as resolved. Restart, Disconnect, or issuer replacement determines the newer grant. A consent that completed before this resolution cannot reuse its fingerprint.                       |
 
 Refreshes coalesce per owner and epoch within a runtime. Across isolates, a
 shared-storage record at `oauth:refresh:<epoch>:<sha256(refresh_token)>` is
@@ -1494,7 +1490,10 @@ storage-owned 120-second TTL. SQLite and D1 create and check expiry with the
 database clock inside each statement. Custom shared stores must also use a
 storage-owned clock. Cross-isolate clock comparisons never permit takeover of
 a dispatched record. The refresh HTTP request and response body have a
-20-second deadline. Contenders wait at most 35 seconds with 10 ms to 250 ms
+20-second deadline. After the response or a dispatched exchange failure,
+grant commit and cleanup share a separate 20-second deadline, including all
+storage reads, CAS retries, fingerprint resolution, and lease release.
+Contenders wait at most 35 seconds with 10 ms to 250 ms
 backoff. A waiter deadline returns retryable `unavailable`, keeps the grant,
 and starts no consent. It never permits resending a spent token.
 
@@ -1538,7 +1537,7 @@ preparation recorded the fingerprint as spent, it stays spent even if the send
 was subsequently cancelled or a local destination guard refused it.
 
 After dispatch, caller and SDK cancellation end only that caller's wait. The
-exchange and grant commit continue under the HTTP deadline. The runtime passes
+exchange and grant commit continue under their own deadlines. The runtime passes
 completion to Workers `waitUntil`; paths without that hook keep a background
 promise. The holder re-reads the grant and retries the commit with its in-memory
 response tokens up to 32 times after CAS contention or storage errors. Each
@@ -1547,6 +1546,16 @@ drops the response tokens. Another consent's credentials remain intact. A lost
 commit answer can be recovered by reading the committed grant. Exhausting the
 commit retries requires re-consent.
 
+Expiry of the commit/cleanup deadline reports `OAuth refresh outcome is unknown`
+and requires authorization. Every exit settles the local flight and releases its
+owner partition without awaiting further storage. Late storage answers cannot
+resume the expired coordinator or start another commit or completion write.
+An already submitted CAS may still land; unconfirmed grant commits leave the
+durable spent fingerprint outstanding, so the consumed token cannot be sent
+again. Later callers read durable state rather than joining an expired local
+flight. If cleanup could not finish, the storage-owned holder TTL allows them
+to record an ambiguous outcome and conditionally discard the old grant.
+
 Lease release uses CAS after the commit or re-consent decision. Completion
 records include a SHA-256 digest of the committed token response, excluding
 the local issuer stamp. Waiters can adopt that committed response even when
@@ -1649,13 +1658,37 @@ program returns, logs, and emits, and relayed input prompts. Each redaction
 projects the whole value: string and number leaves in serialization order,
 JSON objects, arrays, and string literals parsed into their own leaves whether
 they are wire text or a string inside a result, and errors' own fields. The
-joined projection is matched once, so a value split across adjacent leaves,
+joined projection is matched, so a value split across adjacent leaves,
 such as text blocks or array items, is found; each match is replaced only in
 the leaves it touches, and the containers around them keep their shape. A
-number that a match touches becomes the string `[redacted]`, so the JSON stays
-valid. Text is reserialized only when something changed; otherwise its original
-bytes remain. Serialized JSON whose keys, syntax, and leaves together hold a run
+number touched by a match is first checked again beside the replaced string
+pieces, with adjacent numbers checked together: a number stays numeric when
+string replacement breaks the match. Every replacement is then checked in the
+lane as it will be returned, including partial string replacements and whole
+numbers, typed binary, decoded binary, whole-field private values and unchecked
+runs. Omitted error numbers contribute empty text; a changed error name
+contributes one whole placeholder, including when its JSON text had several
+leaves. Whole JSON withholding and scalars withheld during the walk contribute
+their placeholders before settling. A new match touching a kept piece withholds
+that whole part. The lane is checked again until nothing changes, including
+runs formed from `[redacted]`
+and a kept string piece or number, within a string or across leaves. A span
+wholly inside a placeholder remains the placeholder.
+Each changing round withholds at least one more part, so there are at most as
+many changing rounds as parts. Every round, including its bookkeeping, shares
+the call's work budget; an unaffordable leaf or seam check withholds every
+participant, including previously untouched neighbours and every originally
+touched number still awaiting retention. A marker that could not itself be
+scanned remains in its seam windows. Unchanged lanes pay for no recheck.
+Joined and leaf-by-leaf checks follow the same rule; large lanes check
+changed parts and the seams touching them without rereading unchanged leaf
+interiors. Bounded lanes and deep escapes withhold changed numbers whole.
+Text is reserialized only when something changed; otherwise its original bytes
+remain. Serialized JSON whose keys, syntax, and leaves together hold a run
 that no single leaf holds, as a value spanning tokens does, is withheld whole.
+Settling covers the joined leaves and whole replacement markers; object keys,
+JSON punctuation and fixed framing do not join that lane. Keys are checked
+alone, and serialized token-spanning matches use the whole-JSON rule above.
 Matching runs on the raw text and through one more layer of JSON string escapes
 at a time while the last layer still decodes an escape, at most eight layers;
 text still holding escapes past that is withheld. Each decoded layer is scanned
@@ -1682,7 +1715,8 @@ fields that are refused instead of rewritten. Object keys are checked on their
 own, and a key holding a match is renamed. Image, audio, resource-blob, or
 `format: "base64"` content, or a REST body's `base64` beside its `contentType`,
 is checked as text and also decoded whole and checked as bytes and as UTF-8,
-then withheld whole as the base64 of `[redacted]` on a match; content that is
+then withheld whole as the base64 of `[redacted]` on a match, or empty if
+that replacement encoding cannot be returned safely; content that is
 not valid base64 as it stands is still checked through every text view. Base64
 or base64url in any string is decoded and checked in each of the string's text
 views: the text itself, the text with one layer of JSON escapes decoded
@@ -1771,10 +1805,15 @@ Every other value becomes the data JSON shows for it, checked, or is withheld:
 
 Typed binary is withheld as `[redacted]` when its bytes hold a match, checked as
 decoded binary content is, or when one of the numbers JSON shows for it does:
-its elements and, for the `Uint8Array` returned, its bytes, each checked as a
-JSON number and joined with its neighbours. A one-to-three-character numeric
-private value, such as `7`, therefore withholds a typed array holding that
-element, as it withholds an equal JSON number. Each of those numbers is an entry
+the returned `Uint8Array`'s byte numbers join neighbouring leaves directly.
+For non-byte typed arrays, a separate projection substitutes the original
+element numbers for the byte numbers, keeping the same neighbours. Neither
+numeric view interrupts the other; the raw byte view is checked on its own.
+A match in either numeric projection withholds the binary as one whole part,
+so its placeholder is checked beside its neighbours before return. Each number
+is also checked as a whole field: a one-to-three-character numeric private
+value, such as `7`, withholds a typed array holding that element, as it
+withholds an equal JSON number. Each of those numbers is an entry
 of the walk's 1,048,576-entry budget, so binary past it is withheld whole.
 Connecta returns downstream binary as base64 text, which none of this limits;
 only in-process code can return a typed array. With nothing registered for a
@@ -1857,7 +1896,33 @@ structured value, and before result paging, emits, and program outputs/errors/lo
 
 `remoteMcp()` learns server-side fetch URLs from a 401's `resource_metadata`,
 its `authorization_servers`, and advertised token and registration endpoints.
-To prevent a downstream from targeting the host's private network:
+A challenged `resource_metadata` URL must have the same origin as the
+configured connector `url`: scheme, host, and port after normal URL parsing.
+This applies during status, authorization starts, and tool calls. A different
+origin is refused before SDK discovery, with non-retryable
+`connector_call_failed` and a fixed message that includes no challenged URL
+or host; there is no allowlist.
+
+Before every SDK discovery read, including authorization callbacks and flows
+without a challenge, a cached `resourceMetadataUrl` outside the configured
+origin (or a malformed URL) and its cached resource document are discarded
+from the discovery state given to the SDK. The stored grant is not changed by
+that read. The SDK rediscovers resource metadata using the current same-origin
+challenge, or the configured resource's same-origin well-known locations when
+there is no challenge. The cached authorization-server binding is retained so
+callback issuer checks still apply. If rediscovery changes a pending consent's
+discovery binding, its callback refuses before code exchange; start a new
+consent. If same-origin resource metadata returns 404, the cached
+authorization-server fallback can still complete consent against its stored
+binding. A foreign cached metadata URL is never requested, including when an older SDK flow saved only the URL after a 404.
+
+Paths may differ: a resource at `https://crm.example.com/mcp` may challenge with
+`https://crm.example.com/oauth/resources/tickets`. Google's per-tool shape,
+`https://bigquery.googleapis.com/.well-known/oauth-protected-resource/<tool>`,
+is likewise accepted for a resource on `https://bigquery.googleapis.com`.
+
+Other advertised OAuth URLs follow these rules to prevent a downstream from
+targeting the host's private network:
 
 - A URL on the connector's configured origin is trusted; the operator wrote it.
 - Any other URL must be `https` and must not name a private host: `localhost`
@@ -1869,8 +1934,9 @@ To prevent a downstream from targeting the host's private network:
   working. LAN and link-local addresses stay refused.
 
 A refused URL is never requested. Discovery, registration, and code exchange
-fail with a non-retryable `connector_call_failed` naming the host and nothing
-else from the URL. A refused refresh never reaches the token endpoint. If the
+fail with a non-retryable `connector_call_failed`. Resource-metadata origin
+refusals include no advertised host; other URL refusals name only the host. A
+refused refresh never reaches the token endpoint. If the
 send gate already recorded its fingerprint, that fingerprint remains blocked
 and the grant requires re-consent. Redirects cannot route around the
 rule; token requests never follow them, and resource redirects follow only
@@ -1908,8 +1974,8 @@ anything, so SDK hook order cannot mix servers or cross a reset.
 
 Management follows `maintainers` and pool `members`; no resolver configures it. The former `identity.credentialAdministration`,
 `identity.personalConnection`, `identity.accessTokenManagement`, and
-`identity.activityAccess` each fail construction naming their replacement,
-and so does the `identity` section itself, even empty.
+`identity.activityAccess` fail construction as unknown options under `identity`,
+including an empty `identity` section.
 
 | Action                                    | Who may                                                                                                                                        |
 | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -1998,16 +2064,35 @@ identity, or unusable user ids refuse. Access service credentials can admit the
 request at the edge, but connecta requires a `cta_` token at `/agent/<pool>`
 for machine identity.
 
-It never reads `Cf-Access-Jwt-Assertion`, fetches signing keys, or accepts a
-caller's JWT. Missing or malformed trusted context returns 401. A rejected
-human identity, including a service identity or an unusable user id, returns 403. A thrown identity lookup or its five-second deadline returns retryable
+It never parses or verifies `Cf-Access-Jwt-Assertion`, fetches signing keys, or
+accepts a caller's JWT. The assertion header's presence is only an untrusted
+hint that Access context was expected: without `ctx.access`, that request
+returns retryable 503 with `problem: "access_context_unavailable"`, including
+the first request on a fresh instance. It grants no identity and never falls
+back to another provider. Missing context without an assertion still returns 401. An unusable trusted AUD returns retryable 503 with
+`problem: "access_audience_invalid"`; it never proceeds to identity lookup.
+A rejected human identity, including a service identity or an unusable user
+id, returns 403. A thrown identity lookup or its five-second deadline returns retryable
 503 with `problem: "identity_unavailable"` and `Retry-After: 1`. Every refusal
-carries `Cache-Control: no-store`. None of these failures admits an identity,
+carries `Cache-Control: no-store`; every unavailable-verification 503 carries
+`Retry-After: 1` and no `WWW-Authenticate` challenge. None of these failures admits an identity,
 and an unavailable lookup never falls back to another provider. The operator
 UI can re-request admission after a failure without a browser reload. It does not support Node, a `cloudflared` origin, or a Service Binding
 hop.
 Connecta configuration still decides connector access and management: `maintainers` and pool `members`.
 
+Every operator-surface 401 emits `[connecta] operator_refused` through the
+deployment logger. Its checked record contains `accessContext` (a boolean),
+`authorizationHeader` (`absent`, `bearer`, or `invalid`), and a closed `reason`
+code. Access codes distinguish `access_context_missing` from
+`access_authorization_header_rejected`; `authentication_provider_missing`
+identifies the generic route fallthrough, `authorization_header_invalid` a
+malformed header, and `authentication_failed` an unclassified provider refusal.
+Access verification 503s emit `[connecta] Cloudflare Access verification unavailable`
+with the same facts and `access_context_unavailable`, `access_audience_invalid`,
+or `access_identity_unavailable`. These records contain no header values,
+assertions, cookies, identities, URLs, response bodies, or exception text.
+
 Protect the Worker with a Worker-level Access application whose destination is
 `{ "type": "worker", "worker_id": "<the Worker script tag>" }`. A traditional
 hostname-level application blocks the URL but does not attach `ctx.access` to
@@ -2438,6 +2523,15 @@ need `consumeAuthError` to accept error callbacks, sharing `finishAuth`'s atomic
 consent claim. Reissue
 pending consent links after upgrading; callbacks without a saved initiating user cannot complete.
 
+A connector declares code-exchange support by implementing `finishAuth`. Omit
+that hook when the connector cannot exchange a code; `remoteMcp()` exposes it
+only for `auth: { type: "oauth" }`. A code-exchange connector without
+`verifyState` logs a construction warning naming the missing hook, and its
+browser callback refuses every request before exchanging a code. Implement
+`verifyState` to enable completion; credential, request-token (including Google
+service-account tokens), principal-forwarding, and header auth need no callback
+or state hook.
+
 Custom connectors may implement `verifyCallbackParameters(params, ctx)` for
 provider-specific callback assertions. The route calls it after successful
 state verification and before issuer validation, handoff consumption, error
@@ -2678,6 +2772,15 @@ transport, are not stored or described, and a changed token replaces the client.
 This mode refuses cleartext non-loopback origins. Optional `auth.headers` carry
 static protocol/catalog controls and cannot set Authorization.
 
+Status reports `auth_required` when a request-token or principal resolver returns
+an empty or invalid token or throws a typed authentication failure, including
+authentication failures from `googleServiceAccountToken`. Resolution failure
+sends no request to the MCP endpoint. Status uses the existing fixed authorization
+notice and never includes the resolver's error message. Typed outage and
+permission failures, and a resolver that throws anything other than a typed
+`ConnectorCallError`, remain error statuses; such an untyped failure still fails
+calls with `auth_required`.
+
 Return the same token for the same caller while it remains valid, and cache a
 minted token until shortly before it expires. A value that changes on every
 resolution replaces the client each time; a change that lands while a call
@@ -2736,11 +2839,26 @@ auth: {
   returns the same token. `token.invalidate(rejected, ctx, { principal })`
   receives the principal the rejected token was minted for.
 - Catalog listing needs an admitted caller like any call, and its cache stays
-  partitioned per caller. Operator status and catalog checks carry no caller,
-  so they report `auth_required` without connecting.
+  partitioned per caller. An operator status/catalog check forwards that
+  request's admitted caller under the same `accept` policy and refusal rules
+  as a call. It checks the resolver, custom `fetch` and downstream connection
+  and catalog as that operator; it never substitutes another identity.
+- Without an admitted caller, status returns the non-error `per_caller` state
+  with "Authenticates as each caller; verified on use." It does not resolve a
+  token or contact the downstream. Calls and catalog reads still refuse a
+  missing caller with `auth_required`. An admitted caller who fails `accept`
+  receives the same refusal from status as from a call. The operator page
+  offers no secret-configuration diagnosis or fix prompt for this refusal.
+  `per_caller` is an additive member of the public `ConnectorStatus["state"]`
+  union; consumers with exhaustive state handling must account for it.
 - The connector stays shared. Connecta keeps no per-principal credential state
   and never stores, logs or describes the principal or the token. `describe()`
   reports `mode: "request"` as for any request resolver.
+- The resolver's returned token is registered as a credential: every eight-unit
+  run of it is withheld from all agent output in that request. An unsigned
+  principal reference must therefore be opaque, such as the principal id or a
+  random handle. Never return an email such as `alice@example.com` or another
+  domain-bearing string that also appears in the deployment's own names.
 
 #### Over a Workers service binding
 
@@ -2777,9 +2895,11 @@ could name any person. A signature verified with a deployment-held key is also
 safe on a public route.
 
 `fetch` carries every MCP request, including handshakes, catalog reads, calls,
-writes and session close. Global fetch is never used for that connector. The
-configured `url` stays the logical origin: its HTTPS rule, cleartext refusal,
-redirect policy and same-origin redirect checks apply unchanged. A request for
+writes and session close. Global fetch is never used for that connector. RPC
+responses returned by this fetch are disposed when the owning request ends,
+including responses that arrive after cancellation; their bodies remain
+available during that request. The configured `url` stays the logical origin:
+its HTTPS rule, cleartext refusal, redirect policy and same-origin redirect checks apply unchanged. A request for
 any other origin is refused before it reaches `fetch`. Each request, writes
 included, is handed to `fetch` once with `redirect: "manual"`, and a dispatched
 write is never sent again, so `fetch` must not retry or follow redirects. On
@@ -3000,10 +3120,6 @@ The encoding lattice is exactly this, and anything outside it is out of scope:
   lattice, so redaction is not a defense against a downstream that reshapes a
   value on purpose.
 
-`test/sent-secret-output-boundary.test.ts` holds the evidence, including its
-`review round 3`, `review round 4` and `review round 5` blocks for these limits;
-`test/writeonly-wire-redaction.node.test.ts` runs the QuickJS guest cases.
-
 ### Source and tests
 
 [Decision 0007](https://github.com/zackbart/connecta/blob/main/decisions/0007-agent-pool-layout.md)
@@ -3026,8 +3142,6 @@ Downstream OAuth implementation and evidence are in
 [downstream-oauth.ts](https://github.com/zackbart/connecta/blob/main/src/auth/downstream-oauth.ts),
 [static-oauth.ts](https://github.com/zackbart/connecta/blob/main/src/auth/static-oauth.ts),
 [OAuth connect tests](https://github.com/zackbart/connecta/blob/main/test/oauth-connect.test.ts),
-[callback fencing](https://github.com/zackbart/connecta/blob/main/test/oauth-callback-fencing.test.ts),
-[refresh leases](https://github.com/zackbart/connecta/blob/main/test/oauth-refresh-lease.test.ts),
 and [API OAuth tests](https://github.com/zackbart/connecta/blob/main/test/api-oauth.test.ts).
 Use the test pointers within each section for narrower failure cases.