GeezerVison

Summary

• 403 eviction: an internal operation's 403 now drops this instance's cached client-credential token only when the token is at least 60s old. This is the same age gate the external-request path uses. Before, any 403 evicted a still-valid token, including Sim's own file-access refusals and per-record permission denials on providers such as DocuSign, so the next call minted a new token every time. A 401 still evicts immediately.
• Failure backoff: documented that the coordinated token cache backs off for 30 seconds after any failed exchange, whether the provider refused the credentials or had an outage. This matches the per-instance mint cache and the Vanta chain, so the policy is the same at every layer. No behavior change.
• Cleanups:
  • Removed redundant redirect: 'error' options, since fetchProvider already defaults to it.
  • The Zendesk saved token param uses the shared savedCredentialTokenParam helper.
  • The SailPoint minter takes its token URL from resolveSailPointHosts.
  • Corrected the TSDoc for SailPoint and HubSpot.

Type of Change

• Bug fix

Testing

• New behavioral tests, each red before the fix and green after:
  • The credential cache, on a fake clock, keeps a token refused at 30s and replaces one refused at 61s.
• 1479 targeted tests pass across lib/credentials, credential-service, lib/internal/sailpoint, tools/index.test.ts and tools/zendesk.
• bunx biome check, check:test-patterns, check:comment-hygiene, check:utils, check:explicit-any, check:tool-metadata and the pre-push type-check pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)