@zackbart/connecta 0.40.0 → 0.41.0

package/dist/auth/downstream-oauth/consent.js

@@ -99,10 +99,38 @@ const FLOW_VERSION = 1;
  * flow record's fifteen minutes.
  */
 const PENDING_AUTHORIZATION_MAX_AGE_MS = 10 * 60 * 1000;
-export function discoveryBinding(state) {
-    return runEdge(authProgram(discoveryBindingNative, [state]));
+/**
+ * What a flow record without a sealer may keep of a URL: everything but its
+ * userinfo, query and fragment. Non-URLs and clean URLs stay exact, so an
+ * ordinary issuer or client id still compares byte for byte.
+ */
+export function withoutUrlSecrets(value) {
+    if (Array.isArray(value))
+        return value.map(withoutUrlSecrets);
+    if (plainObject(value)) {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, withoutUrlSecrets(item)]));
+    }
+    if (typeof value !== "string")
+        return value;
+    try {
+        const url = new URL(value);
+        if (!url.username && !url.password && !url.search && !url.hash)
+            return value;
+        url.username = url.password = url.search = url.hash = "";
+        return url.href;
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * `minimized` binds the discovery metadata without its URL secrets, for a
+ * record no key protects: that digest is unkeyed, so it may not cover them.
+ */
+export function discoveryBinding(state, minimized = false) {
+    return runEdge(authProgram(discoveryBindingNative, [state, minimized]));
 }
-const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, function (state) {
+const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, function (state, minimized = false) {
     return authFlow(function* () {
         return state
             ? {
@@ -111,7 +139,9 @@ const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, fu
                 ...(state.authorizationServerMetadata?.authorization_response_iss_parameter_supported === true
                     ? { issRequired: true }
                     : {}),
-                discovery: (yield authCall(oauthStateDigest, [JSON.stringify(state)])),
+                discovery: (yield authCall(oauthStateDigest, [
+                    JSON.stringify(minimized ? withoutUrlSecrets(state) : state),
+                ])),
             }
             : {};
     });
@@ -120,20 +150,26 @@ const discoveryBindingNative = /* @__PURE__ */ registerAuth(discoveryBinding, fu
 export const consentMethods = {
     encodeFlow: function (key, flow) {
         return authFlow(function* () {
-            const { verifier, ...rest } = flow;
+            const { binding, url, verifier, ...rest } = flow;
             const stored = { connectaOAuthFlow: FLOW_VERSION, ...rest };
-            if (verifier !== undefined) {
-                if (this.sealer) {
-                    stored.verifier = (yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authInvoke(this.sealer, "seal", [this.flowLabel(key, flow.epoch), verifier]);
-                        }),
-                    ]));
-                    stored.sealed = true;
-                }
-                else {
+            if (this.sealer) {
+                stored.record = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authInvoke(this.sealer, "seal", [
+                            this.flowRecordLabel(key, flow.epoch),
+                            JSON.stringify({ binding, url, verifier }),
+                        ]);
+                    }),
+                ]));
+            }
+            else {
+                // No key to protect it with: keep only what the callback must read.
+                // The consent URL is the first thing to go, so a repeated start mints
+                // a fresh consent rather than handing this one back.
+                if (binding)
+                    stored.binding = withoutUrlSecrets(binding);
+                if (verifier !== undefined)
                     stored.verifier = verifier;
-                }
             }
             return JSON.stringify(stored);
         }.bind(this));
@@ -146,7 +182,8 @@ export const consentMethods = {
                 typeof value.epoch !== "string" ||
                 typeof value.at !== "number" ||
                 (value.url !== undefined && typeof value.url !== "string") ||
-                (value.verifier !== undefined && typeof value.verifier !== "string")) {
+                (value.verifier !== undefined && typeof value.verifier !== "string") ||
+                (value.record !== undefined && typeof value.record !== "string")) {
                 return undefined;
             }
             const flow = {
@@ -156,23 +193,32 @@ export const consentMethods = {
                 ...(typeof value.url === "string" ? { url: value.url } : {}),
                 ...(value.consumed === true ? { consumed: true } : {}),
             };
-            if (!withVerifier || typeof value.verifier !== "string")
+            const sealedRecord = typeof value.record === "string";
+            if (!sealedRecord && (!withVerifier || typeof value.verifier !== "string"))
                 return flow;
-            if (value.sealed !== true)
+            if (!sealedRecord && value.sealed !== true)
                 return { ...flow, verifier: value.verifier };
             try {
                 if (!this.sealer)
                     return undefined;
+                const opened = (yield authInvoke(this, "wait", [
+                    authMethod(() => {
+                        return authInvoke(this.sealer, "open", [
+                            sealedRecord ? this.flowRecordLabel(key, flow.epoch) : this.flowLabel(key, flow.epoch),
+                            (sealedRecord ? value.record : value.verifier),
+                        ]);
+                    }),
+                ]));
+                if (!sealedRecord)
+                    return { ...flow, verifier: opened };
+                const record = parsed(opened);
+                if (!plainObject(record))
+                    return undefined;
                 return {
                     ...flow,
-                    verifier: (yield authInvoke(this, "wait", [
-                        authMethod(() => {
-                            return authInvoke(this.sealer, "open", [
-                                this.flowLabel(key, flow.epoch),
-                                value.verifier,
-                            ]);
-                        }),
-                    ])),
+                    ...(plainObject(record.binding) ? { binding: record.binding } : {}),
+                    ...(typeof record.url === "string" ? { url: record.url } : {}),
+                    ...(withVerifier && typeof record.verifier === "string" ? { verifier: record.verifier } : {}),
                 };
             }
             catch {
@@ -258,7 +304,10 @@ export const consentMethods = {
             const binding = this.configuredAuthorizationBinding() ?? {
                 ...(yield authInvoke(this, "wait", [
                     authMethod(() => {
-                        return authCall(discoveryBinding, [this.consentDiscovery ?? grant.body.discovery]);
+                        return authCall(discoveryBinding, [
+                            this.consentDiscovery ?? grant.body.discovery,
+                            !this.sealer,
+                        ]);
                     }),
                 ])),
                 issuer: discoveryIssuer(this.consentDiscovery) ?? grant.body.issuer,
@@ -442,7 +491,8 @@ export const consentMethods = {
             if (grant.epoch !== epoch)
                 throw this.flowSuperseded();
             (yield authInvoke(this, "checkFlowBinding", [grant]));
-            if (endpoint !== undefined && this.callback?.flow.binding?.tokenEndpoint !== String(endpoint)) {
+            if (endpoint !== undefined &&
+                this.flowValue(this.callback?.flow.binding?.tokenEndpoint) !== this.flowValue(String(endpoint))) {
                 throw this.flowSuperseded();
             }
             // Opening ciphertext may yield. Re-read the exact record after opening,

package/dist/auth/downstream-oauth/grant-store.js

@@ -16,6 +16,15 @@ const DISCONNECTED_EPOCH_PREFIX = "disconnected:";
 const GRANT_VERSION = 3;
 /** Attempts at one grant write while other writers keep winning. */
 export const MAX_GRANT_WRITES = 32;
+/** Token commits and their status fence are the same CAS, never separate writes. */
+export function nextTokenGrant(grant, body) {
+    const revision = (grant.tokenRevision ?? 0) + 1;
+    if (!Number.isSafeInteger(revision))
+        throw new Error("OAuth grant revision exhausted");
+    const next = { ...grant, body, tokenRevision: revision };
+    delete next.observation;
+    return next;
+}
 export function plainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -32,6 +41,8 @@ function storedGrant(raw) {
     return plainObject(value) &&
         value.connectaOAuth === GRANT_VERSION &&
         typeof value.epoch === "string" &&
+        (value.tokenRevision === undefined ||
+            (Number.isSafeInteger(value.tokenRevision) && value.tokenRevision >= 0)) &&
         (value.flow === undefined || typeof value.flow === "string") &&
         (value.sealed === undefined || typeof value.sealed === "string")
         ? value
@@ -105,6 +116,8 @@ export const grantStoreMethods = {
             const stored = {
                 connectaOAuth: GRANT_VERSION,
                 epoch: grant.epoch,
+                ...(grant.tokenRevision !== undefined ? { tokenRevision: grant.tokenRevision } : {}),
+                ...(grant.observation ? { observation: grant.observation } : {}),
                 ...(grant.flow !== undefined ? { flow: grant.flow } : {}),
             };
             if (Object.keys(grant.body).length > 0) {
@@ -160,6 +173,11 @@ export const grantStoreMethods = {
             }
             const grant = {
                 epoch: stored.epoch,
+                ...(stored.tokenRevision !== undefined ? { tokenRevision: stored.tokenRevision } : {}),
+                ...(stored.observation?.revision === (stored.tokenRevision ?? 0) &&
+                    (stored.observation.outcome === "accepted" || stored.observation.outcome === "refused")
+                    ? { observation: { revision: stored.observation.revision, outcome: stored.observation.outcome } }
+                    : {}),
                 ...(stored.flow !== undefined ? { flow: stored.flow } : {}),
                 body: grantBody(body),
             };
@@ -189,7 +207,12 @@ export const grantStoreMethods = {
                 authMethod(() => authStorage(this.storage, "get", [GRANT])),
             ]));
             const grant = (yield authInvoke(this, "openGrant", [raw]));
-            return { epoch: grant.epoch, ...(grant.body.tokens ? { tokens: grant.body.tokens } : {}) };
+            return {
+                epoch: grant.epoch,
+                ...(grant.body.tokens ? { tokens: grant.body.tokens } : {}),
+                ...(grant.body.issuer !== undefined ? { issuer: grant.body.issuer } : {}),
+                ...(grant.observation ? { observation: grant.observation } : {}),
+            };
         }.bind(this));
     },
     readGrant: function (signal) {
@@ -309,7 +332,8 @@ export const grantStoreMethods = {
                         if (refreshConsent)
                             body.refreshConsent = refreshConsent;
                     }
-                    return this.withIssuer(grant, body);
+                    const next = this.withIssuer(grant, body);
+                    return field === "tokens" ? nextTokenGrant(next, body) : next;
                 },
             ]));
             if (field === "tokens")
@@ -318,6 +342,20 @@ export const grantStoreMethods = {
             this.seen[field] = fingerprint(field === "client" ? value.value : value);
         }.bind(this));
     },
+    recordTokenOutcome: function (snapshot, outcome) {
+        if (outcome !== "accepted" && outcome !== "refused")
+            return Effect.void;
+        return authInvoke(this, "updateGrant", [
+            (grant) => {
+                if (grant.epoch !== snapshot.epoch || (grant.tokenRevision ?? 0) !== snapshot.revision || !grant.body.tokens)
+                    return undefined;
+                if (grant.observation?.revision === snapshot.revision && grant.observation.outcome === outcome)
+                    return undefined;
+                return { ...grant, observation: { revision: snapshot.revision, outcome } };
+            },
+            { epoch: snapshot.epoch, quiet: true },
+        ]);
+    },
     bindingForGrant: function (grant) {
         return authFlow(function* () {
             const configured = this.configuredAuthorizationBinding();
@@ -326,7 +364,7 @@ export const grantStoreMethods = {
                 : {
                     ...(yield authInvoke(this, "wait", [
                         authMethod(() => {
-                            return authCall(discoveryBinding, [grant.body.discovery]);
+                            return authCall(discoveryBinding, [grant.body.discovery, !this.sealer]);
                         }),
                     ])),
                     issuer: grant.body.issuer,
@@ -338,7 +376,8 @@ export const grantStoreMethods = {
         return authFlow(function* () {
             const binding = this.callback?.flow.binding;
             if (!binding ||
-                fingerprint(binding) !== fingerprint((yield authInvoke(this, "bindingForGrant", [grant])))) {
+                fingerprint(this.flowValue(binding)) !==
+                    fingerprint(this.flowValue((yield authInvoke(this, "bindingForGrant", [grant]))))) {
                 throw this.flowSuperseded();
             }
         }.bind(this));
@@ -384,9 +423,14 @@ export const grantStoreMethods = {
             };
         }.bind(this));
     },
-    resetAuthorization: function (operatorDisconnected = false, preserveClient = false) {
+    resetAuthorization: function (operatorDisconnected = false, preserveClient = false, refused) {
         return authFlow(function* () {
-            const operation = authInvoke(this, "performReset", [operatorDisconnected, preserveClient]);
+            const operation = authInvoke(this, "performReset", [
+                operatorDisconnected,
+                preserveClient,
+                undefined,
+                refused,
+            ]);
             if (!this.onReset)
                 return (yield operation);
             const reset = runEdge(operation);
@@ -404,11 +448,18 @@ export const grantStoreMethods = {
             return (yield authValue(() => reset));
         }.bind(this));
     },
-    performReset: function (operatorDisconnected, preserveClient, revoke) {
+    performReset: function (operatorDisconnected, preserveClient, revoke, refused) {
         return authFlow(function* () {
             const epoch = `${operatorDisconnected ? DISCONNECTED_EPOCH_PREFIX : ACTIVE_EPOCH_PREFIX}${crypto.randomUUID()}`;
             for (let attempt = 0; attempt < MAX_GRANT_WRITES; attempt++) {
                 const { raw, grant } = (yield authInvoke(this, "readGrant", [null]));
+                // Compare again on every CAS attempt: recovery may have changed the
+                // epoch, token revision, or observation since Connect read it.
+                if (refused &&
+                    (grant.epoch !== refused.epoch ||
+                        (grant.tokenRevision ?? 0) !== refused.revision ||
+                        grant.observation?.outcome !== "refused"))
+                    return;
                 const carried = preserveClient && !operatorDisconnected ? this.carriableClient(grant) : undefined;
                 const encoded = (yield authInvoke(this, "encodeGrant", [{ epoch, body: carried ?? {} }, null]));
                 let written;

package/dist/auth/downstream-oauth/refresh-records.js

@@ -4,7 +4,7 @@ import { fromSignal } from "../../runtime/run.js";
 import { OAUTH_REFRESH_LEASE_SECONDS, oauthRefreshActiveKeys, oauthRefreshKeys, oauthRefreshSpentKeys, } from "../../storage/keys.js";
 import { authCall, authCatch, authFlow, authInvoke, authMethod, authStorage, authStorageMany } from "../native.js";
 import { tokenExpiry } from "../oauth-grant.js";
-import { GRANT, MAX_GRANT_WRITES, epochOf, parsed, plainObject } from "./grant-store.js";
+import { nextTokenGrant, GRANT, MAX_GRANT_WRITES, epochOf, parsed, plainObject } from "./grant-store.js";
 import { aborted, refreshTokensDigest, refreshWait } from "./refresh-coordinator.js";
 import { oauthStateDigest } from "./consent.js";
 export function storedRefreshSpent(raw) {
@@ -378,10 +378,11 @@ export const refreshRecordMethods = {
                     const committed = issuer !== undefined ? { ...tokens, issuer } : tokens;
                     const { expiresAt: _previous, ...body } = grant.body;
                     const expiresAt = tokenExpiry(committed, issuedAt);
-                    const next = {
-                        ...grant,
-                        body: { ...body, tokens: committed, ...(expiresAt !== undefined ? { expiresAt } : {}) },
-                    };
+                    const next = nextTokenGrant(grant, {
+                        ...body,
+                        tokens: committed,
+                        ...(expiresAt !== undefined ? { expiresAt } : {}),
+                    });
                     const encoded = (yield authInvoke(this, "encodeGrant", [next, null]));
                     if ((yield authStorage(this.storage, "compareAndSet", [GRANT, raw, encoded]))) {
                         this.observe(next);

package/dist/auth/downstream-oauth.js

@@ -6,7 +6,7 @@ import { SentSecrets } from "../sent-secrets.js";
 import { authenticateRemoteClient, downstreamClientMetadata, remoteClientAuthMethod, } from "./downstream-client-metadata.js";
 import { authMethods } from "./native.js";
 import { OAUTH_REFRESH_SKEW_MS } from "./oauth-grant.js";
-import { consentMethods } from "./downstream-oauth/consent.js";
+import { consentMethods, withoutUrlSecrets } from "./downstream-oauth/consent.js";
 import { ACTIVE_EPOCH_PREFIX, GRANT, grantStoreMethods, isDisconnectedEpoch, } from "./downstream-oauth/grant-store.js";
 import { aborted, tokenResponse, } from "./downstream-oauth/refresh-coordinator.js";
 import { refreshRecordMethods } from "./downstream-oauth/refresh-records.js";
@@ -32,8 +32,7 @@ export function authorizingContext(ctx) {
     return deriveContext(ctx, { allowAuthorization: true });
 }
 /** A local destination guard proved that no OAuth HTTP request left. */
-export class OAuthRequestNotSentError extends ConnectorCallError {
-}
+export { OAuthRequestNotSentError } from "./oauth-request-not-sent.js";
 /**
  * OAuthClientProvider over one owner's grant record and its consents' flow
  * records, in one connector's namespace.
@@ -157,6 +156,7 @@ export class KvOAuthProvider {
         this.observed = tokens
             ? {
                 epoch: grant.epoch,
+                revision: grant.tokenRevision ?? 0,
                 accessToken: tokens.access_token,
                 refreshable: typeof tokens.refresh_token === "string" && tokens.refresh_token !== "",
                 ...(expiresAt !== undefined ? { expiresAt } : {}),
@@ -195,7 +195,7 @@ export class KvOAuthProvider {
         if (!this.callback ||
             (issuer === null
                 ? this.callback.flow.binding?.issRequired === true
-                : issuer !== this.callback.flow.binding?.issuer)) {
+                : this.flowValue(issuer) !== this.flowValue(this.callback.flow.binding?.issuer))) {
             throw new ConnectorCallError("connector_call_failed", `Connector "${this.connectorId}" authorization callback issuer does not match its consent; nothing was exchanged.`);
         }
     }
@@ -203,6 +203,14 @@ export class KvOAuthProvider {
     flowLabel(key, epoch) {
         return `${key}:${epoch}`;
     }
+    /** The sealed record's own label, so a verifier's ciphertext cannot stand in for it. */
+    flowRecordLabel(key, epoch) {
+        return `${this.flowLabel(key, epoch)}:record`;
+    }
+    /** A binding value as this provider's flow records hold it, for comparison. */
+    flowValue(value) {
+        return this.sealer ? value : withoutUrlSecrets(value);
+    }
     isOperatorDisconnectedEpoch(epoch) {
         return isDisconnectedEpoch(epoch);
     }

package/dist/auth/oauth-request-not-sent.js

@@ -0,0 +1,4 @@
+import { ConnectorCallError } from "../errors.js";
+/** A local destination guard proved that no OAuth HTTP request left. */
+export class OAuthRequestNotSentError extends ConnectorCallError {
+}

package/dist/auth/static-oauth.js

@@ -547,12 +547,14 @@ export function staticOAuth(id, config) {
     // A token that lives under a minute is due again at once: the invocation's
     // check renews it, and the handler sends it while it is unexpired.
     const earlyRenewed = new EarlyRenewals();
-    /**
-     * One call's grant use; submitted refresh work keeps the coordinator's owner.
-     * `renewAgain` is the invocation's check, which renews any due token,
-     * even one this request's earlier renewal produced.
-     */
     const grantFor = (ctx, requestOwned = false, renewAgain = false) => {
+        const observations = new Map();
+        const capture = (provider, token) => {
+            const seen = provider.observed;
+            if (seen?.accessToken === token)
+                observations.set(token, { epoch: seen.epoch, revision: seen.revision });
+            return token;
+        };
         let provider;
         const use = authMethod((work) => {
             return authView(ctx, authMethod((signal) => {
@@ -611,9 +613,9 @@ export function staticOAuth(id, config) {
                                     true,
                                 ]));
                                 earlyRenewed.record(scope, tokens.access_token, fresh, provider.observedExpiry(fresh));
-                                return fresh;
+                                return capture(provider, fresh);
                             }
-                            return tokens.access_token;
+                            return capture(provider, tokens.access_token);
                         });
                     }),
                 ]);
@@ -621,10 +623,21 @@ export function staticOAuth(id, config) {
             refresh: authMethod((stale) => {
                 return authCall(use, [
                     authMethod((provider, live) => {
-                        return authCall(renewedToken, [provider, live, stale, requestOwned]);
+                        return authFlow(function* () {
+                            const token = (yield authCall(renewedToken, [provider, live, stale, requestOwned]));
+                            return capture(provider, token);
+                        });
                     }),
                 ]);
             }),
+            observe: authMethod((token, outcome) => {
+                const snapshot = observations.get(token);
+                if (!snapshot)
+                    return Effect.void;
+                return authCall(use, [
+                    authMethod((provider) => authInvoke(provider, "recordTokenOutcome", [snapshot, outcome])),
+                ]).pipe(Effect.asVoid, Effect.catch(() => Effect.void));
+            }),
             rejected: authMethod(() => {
                 return authView(ctx, authMethod(() => {
                     return authValue(() => {
@@ -735,6 +748,10 @@ export function staticOAuth(id, config) {
                         const grant = grantFor(ctx, auxiliary);
                         const stale = (yield authInvoke(grant, "token", []));
                         const { response: first, dispatch } = (yield authCall(send, [stale]));
+                        if (first.status === 401 || (first.status >= 200 && first.status < 300))
+                            yield authInvoke(grant, "observe", [stale, first.status === 401 ? "refused" : "accepted"]);
+                        if (signal.aborted)
+                            throw signal.reason;
                         if (first.status !== 401)
                             return first;
                         try {
@@ -773,6 +790,10 @@ export function staticOAuth(id, config) {
                             throw signal.reason;
                         renewedAfterUnauthorized(dispatch, stale, accessToken);
                         const { response: second } = (yield authCall(send, [accessToken]));
+                        if (second.status === 401 || (second.status >= 200 && second.status < 300))
+                            yield authInvoke(grant, "observe", [accessToken, second.status === 401 ? "refused" : "accepted"]);
+                        if (signal.aborted)
+                            throw signal.reason;
                         if (second.status !== 401)
                             return second;
                         void second.body?.cancel().catch(() => { });
@@ -800,7 +821,7 @@ export function staticOAuth(id, config) {
             }), auxiliary));
         });
     });
-    const statusOf = authMethod((ctx, provider) => {
+    const statusOf = authMethod((ctx, provider, forCall = false) => {
         return authFlow(function* () {
             if (rejectedScopes.has(scopeOf(ctx))) {
                 return {
@@ -808,16 +829,18 @@ export function staticOAuth(id, config) {
                     message: "Authorization required \u2014 the downstream rejected this connector's OAuth grant.",
                 };
             }
-            // A status read never starts authorization: this provider cannot, and
-            // nothing here calls the SDK. A stored grant for the configured token
-            // endpoint is healthy until a call says otherwise — the downstream is
-            // asked nothing.
-            if ((yield authInvoke(provider, "operatorDisconnected", []))) {
+            // Peek opens the current grant without migration writes or authorization.
+            const grant = (yield authInvoke(provider, "peekGrant", []));
+            if (provider.isOperatorDisconnectedEpoch(grant.epoch))
                 return { state: "auth_required", message: disconnectedMessage };
-            }
-            return (yield authInvoke(provider, "tokens", [issuerContext]))
-                ? { state: "ok" }
-                : { state: "auth_required", message: AUTH_REQUIRED_MESSAGE };
+            if (!grant.tokens || grant.issuer !== settings.identity)
+                return { state: "auth_required", message: AUTH_REQUIRED_MESSAGE };
+            return !forCall && grant.observation?.outcome === "refused"
+                ? {
+                    state: "auth_required",
+                    message: "Authorization required — the downstream rejected this connector's OAuth grant.",
+                }
+                : { state: "ok" };
         });
     });
     const status = authMethod((ctx) => {
@@ -832,7 +855,9 @@ export function staticOAuth(id, config) {
     const prepareCall = authMethod((ctx) => {
         return authFlow(function* () {
             const provider = providerFor(ctx);
-            const state = (yield authCall(statusOf, [ctx, provider]));
+            // A persisted API refusal is diagnostic, not proof the next request will fail.
+            // Keep the request-local latch, but let a later invocation observe recovery.
+            const state = (yield authCall(statusOf, [ctx, provider, true]));
             if (state.state === "ok" && provider.renewalDue() !== undefined)
                 (yield authInvoke(grantFor(ctx, false, true), "token", []));
             return state;
@@ -849,8 +874,13 @@ export function staticOAuth(id, config) {
                 : (yield authInvoke(provider, "operatorDisconnected", []));
             if (ctx.signal?.aborted)
                 throw ctx.signal.reason;
-            if (opts?.force || disconnected) {
-                (yield authInvoke(provider, "resetAuthorization", []));
+            const observed = (yield authInvoke(provider, "peekGrant", []));
+            const refused = observed.observation?.outcome === "refused";
+            if (opts?.force || disconnected || refused || rejectedScopes.has(scopeOf(original))) {
+                const fence = !opts?.force && !disconnected && refused
+                    ? { epoch: observed.epoch, revision: observed.observation.revision }
+                    : undefined;
+                (yield authInvoke(provider, "resetAuthorization", [false, false, fence]));
                 rejectedScopes.delete(scopeOf(original));
             }
             else {