@forgezero/agent 0.1.25 → 0.1.26

package/dist/fz-agent.js

@@ -25,30 +25,44 @@ class CacheError extends Error {
 var DEFAULT_TTL_MS = 60000;
 var DEFAULT_MAX_STALE_MS = 300000;
 function createSecretCache(options) {
-  const entries = new Map;
+  let entries = new Map;
   const now = options.now ?? (() => Date.now());
   const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
   const maxStaleMs = options.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
   let cursor = 0;
   let replicated = false;
   let lastSyncOkMs = now();
-  const loadScope = async () => {
+  const fetchScope = async () => {
+    const next = new Map;
     if (!options.list)
-      return { loaded: 0, failed: [] };
+      return { entries: next, loaded: 0, failed: [] };
     const names = await options.list();
     const failed = [];
-    let loaded = 0;
     for (const name of names) {
       try {
         const result = await options.fetch(name);
-        entries.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
-        loaded += 1;
+        next.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
       } catch {
         failed.push(name);
       }
     }
+    return { entries: next, loaded: next.size, failed };
+  };
+  const loadScope = async () => {
+    if (!options.list)
+      return { loaded: 0, failed: [] };
+    const snapshot = await fetchScope();
+    entries = snapshot.entries;
+    replicated = snapshot.failed.length === 0;
+    return { loaded: snapshot.loaded, failed: snapshot.failed };
+  };
+  const refreshScope = async () => {
+    const snapshot = await fetchScope();
+    if (snapshot.failed.length > 0) {
+      throw new CacheError("FETCH_FAILED", `Could not refresh ${snapshot.failed.length} assigned vault ${snapshot.failed.length === 1 ? "entry" : "entries"}.`);
+    }
+    entries = snapshot.entries;
     replicated = true;
-    return { loaded, failed };
   };
   return {
     names: () => [...entries.keys()],
@@ -82,13 +96,26 @@ function createSecretCache(options) {
       const result = await options.changes(cursor);
       if (result.resync) {
         const dropped = [...entries.keys()];
-        entries.clear();
+        if (options.list) {
+          await refreshScope();
+        } else {
+          entries.clear();
+        }
         cursor = 0;
         lastSyncOkMs = now();
-        if (options.list)
-          await loadScope();
         return { invalidated: dropped, cursor: 0, resync: true };
       }
+      if (options.list && result.changed.length > 0) {
+        const held = new Set(entries.keys());
+        await refreshScope();
+        cursor = result.version;
+        lastSyncOkMs = now();
+        return {
+          invalidated: result.changed.filter((name) => held.has(name) || entries.has(name)),
+          cursor,
+          resync: false
+        };
+      }
       const invalidated = [];
       for (const name of result.changed) {
         if (entries.delete(name))
@@ -2955,7 +2982,7 @@ function materializeWarpMdm(options) {
 }
 
 // src/version.ts
-var VERSION = "0.1.25";
+var VERSION = "0.1.26";
 
 // src/index.ts
 function loadOrCreateSeed(path) {

package/dist/fz.js

@@ -974,7 +974,7 @@ async function resolveIdentity(selector, socketPath) {
 }
 
 // src/version.ts
-var VERSION = "0.1.25";
+var VERSION = "0.1.26";
 
 // src/cli/index.ts
 var DEFAULT_MODE = THRESHOLD_MODES[0].id;

package/dist/node-vault.js

@@ -10,30 +10,44 @@ class CacheError extends Error {
 var DEFAULT_TTL_MS = 60000;
 var DEFAULT_MAX_STALE_MS = 300000;
 function createSecretCache(options) {
-  const entries = new Map;
+  let entries = new Map;
   const now = options.now ?? (() => Date.now());
   const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
   const maxStaleMs = options.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
   let cursor = 0;
   let replicated = false;
   let lastSyncOkMs = now();
-  const loadScope = async () => {
+  const fetchScope = async () => {
+    const next = new Map;
     if (!options.list)
-      return { loaded: 0, failed: [] };
+      return { entries: next, loaded: 0, failed: [] };
     const names = await options.list();
     const failed = [];
-    let loaded = 0;
     for (const name of names) {
       try {
         const result = await options.fetch(name);
-        entries.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
-        loaded += 1;
+        next.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
       } catch {
         failed.push(name);
       }
     }
+    return { entries: next, loaded: next.size, failed };
+  };
+  const loadScope = async () => {
+    if (!options.list)
+      return { loaded: 0, failed: [] };
+    const snapshot = await fetchScope();
+    entries = snapshot.entries;
+    replicated = snapshot.failed.length === 0;
+    return { loaded: snapshot.loaded, failed: snapshot.failed };
+  };
+  const refreshScope = async () => {
+    const snapshot = await fetchScope();
+    if (snapshot.failed.length > 0) {
+      throw new CacheError("FETCH_FAILED", `Could not refresh ${snapshot.failed.length} assigned vault ${snapshot.failed.length === 1 ? "entry" : "entries"}.`);
+    }
+    entries = snapshot.entries;
     replicated = true;
-    return { loaded, failed };
   };
   return {
     names: () => [...entries.keys()],
@@ -67,13 +81,26 @@ function createSecretCache(options) {
       const result = await options.changes(cursor);
       if (result.resync) {
         const dropped = [...entries.keys()];
-        entries.clear();
+        if (options.list) {
+          await refreshScope();
+        } else {
+          entries.clear();
+        }
         cursor = 0;
         lastSyncOkMs = now();
-        if (options.list)
-          await loadScope();
         return { invalidated: dropped, cursor: 0, resync: true };
       }
+      if (options.list && result.changed.length > 0) {
+        const held = new Set(entries.keys());
+        await refreshScope();
+        cursor = result.version;
+        lastSyncOkMs = now();
+        return {
+          invalidated: result.changed.filter((name) => held.has(name) || entries.has(name)),
+          cursor,
+          resync: false
+        };
+      }
       const invalidated = [];
       for (const name of result.changed) {
         if (entries.delete(name))

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.25";
+export declare const VERSION = "0.1.26";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
 	"name": "@forgezero/agent",
-	"version": "0.1.25",
+	"version": "0.1.26",
 	"type": "module",
 	"scripts": {
 		"check": "tsc --noEmit",