code: func connectLeafWatch(params map[string]interface{}) (WatcherFunc, error) {
  	// We don't support stale since certs are cached locally in the agent.
  
  	var serviceName string
  	if err := assignValue(params, "service", &serviceName); err != nil {
  		return nil, err
  	}
  
  	fn := func(p *Plan) (BlockingParamVal, interface{}, error) {
  		agent := p.client.Agent()
  		opts := makeQueryOptionsWithContext(p, false)
  		defer p.cancelFunc()
  
  		leaf, meta, err := agent.ConnectCALeaf(serviceName, &opts)
  		if err != nil {
  			return nil, nil, err
  		}
  
  		return WaitIndexVal(meta.LastIndex), leaf, err
  	}
  	return fn, nil
  }
docs: // connectLeafWatch is used to watch for changes to Connect Leaf certificates
  // for given local service id.