@clef-sh/agent 0.1.24-beta.166 → 0.1.24-beta.169

package/dist/agent.cjs

@@ -190837,6 +190837,11 @@ function resolveConfig(env = process.env) {
 // ../runtime/src/secrets-cache.ts
 var SecretsCache = class {
   snapshot = null;
+  // Tracks the last successful refresh attempt, including no-op refreshes
+  // where the source returned identical content. TTL is measured against
+  // this — not against `swappedAt` — so a stable artifact doesn't cause
+  // the cache to "expire" while polling is healthy.
+  lastRefreshAt = null;
   /** Replace the cached secrets in a single reference assignment. */
   swap(values, revision) {
     if (this.snapshot) {
@@ -190848,12 +190853,23 @@ var SecretsCache = class {
     for (const [ns, bucket] of Object.entries(values)) {
       cloned[ns] = { ...bucket };
     }
-    this.snapshot = { values: cloned, revision, swappedAt: Date.now() };
+    const now = Date.now();
+    this.snapshot = { values: cloned, revision, swappedAt: now };
+    this.lastRefreshAt = now;
   }
-  /** Whether the cache has exceeded the given TTL (seconds). */
+  /**
+   * Bump the freshness clock without touching cached values. Called by the
+   * poller when a fetch succeeds but the artifact is unchanged (same content
+   * hash or same revision) — proves the source is still reachable and the
+   * cached secrets are still authoritative.
+   */
+  markFresh() {
+    this.lastRefreshAt = Date.now();
+  }
+  /** Whether the last successful refresh has exceeded the given TTL (seconds). */
   isExpired(ttlSeconds) {
-    if (!this.snapshot) return false;
-    return (Date.now() - this.snapshot.swappedAt) / 1e3 > ttlSeconds;
+    if (this.lastRefreshAt === null) return false;
+    return (Date.now() - this.lastRefreshAt) / 1e3 > ttlSeconds;
   }
   /** Clear the cached snapshot, zeroing values first (best-effort). */
   wipe() {
@@ -190863,11 +190879,16 @@ var SecretsCache = class {
       }
     }
     this.snapshot = null;
+    this.lastRefreshAt = null;
   }
-  /** Epoch ms when the cache was last swapped, or null if never loaded. */
+  /** Epoch ms when the cache values last *changed*, or null if never loaded. */
   getSwappedAt() {
     return this.snapshot?.swappedAt ?? null;
   }
+  /** Epoch ms of the last successful refresh attempt (incl. no-op), or null. */
+  getLastRefreshAt() {
+    return this.lastRefreshAt;
+  }
   /**
    * Get a single secret value.
    *
@@ -193536,8 +193557,10 @@ var ArtifactPoller = class {
    */
   async fetchAndDecrypt() {
     const result = await this.fetchRaw();
-    if (!result) return;
-    await this.validateDecryptAndCache(result.artifact, result.contentHash);
+    if (result) {
+      await this.validateDecryptAndCache(result.artifact, result.contentHash);
+    }
+    this.options.cache.markFresh();
   }
   /**
    * Fetch and validate the artifact without decrypting.
@@ -193546,7 +193569,10 @@ var ArtifactPoller = class {
    */
   async fetchAndValidate() {
     const result = await this.fetchRaw();
-    if (!result) return;
+    if (!result) {
+      this.options.cache.markFresh();
+      return;
+    }
     const artifact = this.validateArtifact(result.artifact);
     this.options.encryptedStore.swap(artifact);
     this.lastRevision = artifact.revision;
@@ -194420,7 +194446,7 @@ function healthHandler(cache5, cacheTtl, encryptedStore) {
         status: "ok",
         mode: "cached",
         revision: cache5.getRevision(),
-        lastRefreshAt: cache5.getSwappedAt(),
+        lastRefreshAt: cache5.getLastRefreshAt(),
         expired
       });
     }
@@ -194783,7 +194809,7 @@ async function initialFetch(poller, jitMode, encryptedStore, cache5, sourceDesc)
 }
 
 // package.json
-var version5 = "0.1.24-beta.166";
+var version5 = "0.1.24-beta.169";
 
 // src/main.ts
 var isLambda = !!process.env.AWS_LAMBDA_RUNTIME_API;