@indigoai-us/hq-cli 5.77.14 → 5.79.0

package/src/run/hq-plugin.test.ts

@@ -1,371 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { internal } from 'varlock';
-import {
-  installHqPlugin,
-  prewarmHqSecrets,
-  type InstallHqPluginOpts,
-  type PluginState,
-} from './hq-plugin.js';
-import { removeCacheEntry, writeCache } from '../utils/secrets-cache.js';
-
-// Prevent any test run from writing to ~/.hq/secrets-cache/.
-vi.mock('../utils/secrets-cache.js', () => {
-  return {
-    DEFAULT_SECRETS_CACHE_TTL_MS: 300000,
-    writeCache: vi.fn((): void => {}),
-    removeCacheEntry: vi.fn((): void => {}),
-    clearAllCache: (): { removed: number } => ({ removed: 0 }),
-  };
-});
-
-let tmpDir: string;
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hq-plugin-test-'));
-});
-
-afterEach(() => {
-  fs.rmSync(tmpDir, { recursive: true, force: true });
-});
-
-function makeMocks(overrides?: Partial<InstallHqPluginOpts>): InstallHqPluginOpts {
-  return {
-    resolveCompanyUid: async () => `test-uid-${Math.random().toString(36).slice(2)}`,
-    fetchBatch: async () => ({ secrets: [], errors: [] }),
-    ...overrides,
-  };
-}
-
-describe('hq-plugin', () => {
-  it('happy path: resolves hq() vars via batch fetch and cache', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    // Empty line after @hqCompany is required: varlock's env-spec parser only treats
-    // a decorator comment as a root (file-level) decorator when it is separated from the
-    // first var by a blank line. Without it, the decorator attaches to FOO as an item decorator.
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async (_uid, names) => ({
-        secrets: names.map((name) => ({ name, value: 'fixture-value' })),
-        errors: [],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await prewarmHqSecrets(graph, mocks, state);
-    await graph.resolveEnvValues();
-    expect(graph.getResolvedEnvObject().FOO).toBe('fixture-value');
-  });
-
-  it('zero-cache secrets still resolve from in-memory prewarm state within a single run', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async (_uid, names) => ({
-        secrets: names.map((name) => ({
-          name,
-          value: 'memory-only-value',
-          cacheTtlMs: 0,
-        })),
-        errors: [],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await prewarmHqSecrets(graph, mocks, state);
-    await graph.resolveEnvValues();
-
-    expect(graph.getResolvedEnvObject().FOO).toBe('memory-only-value');
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
-  });
-
-  it('controlled policy metadata overrides a malformed positive cache TTL', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => ({
-        secrets: [{
-          name: 'FOO',
-          value: 'memory-only-value',
-          tier: 'sensitive',
-          scriptLock: { mode: 'enforced' },
-          cacheTtlMs: 300000,
-        }],
-        errors: [],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await prewarmHqSecrets(graph, mocks, state);
-    await graph.resolveEnvValues();
-
-    expect(graph.getResolvedEnvObject().FOO).toBe('memory-only-value');
-    expect(writeCache).not.toHaveBeenCalled();
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
-  });
-
-  it('fails closed and evicts cache when the server omits a requested secret', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => ({ secrets: [], errors: [] }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await prewarmHqSecrets(graph, mocks, state);
-    await graph.resolveEnvValues();
-
-    const fooErrors = (graph as any).configSchema.FOO.errors as Array<{
-      message: string;
-    }>;
-    expect(fooErrors.some((e) => e.message.includes('not returned by vault'))).toBe(true);
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
-  });
-
-  it('fails closed and evicts cache when the server returns metadata without plaintext', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => ({
-        secrets: [{ name: 'FOO', cacheTtlMs: 0 }],
-        errors: [],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await prewarmHqSecrets(graph, mocks, state);
-    await graph.resolveEnvValues();
-
-    const fooErrors = (graph as any).configSchema.FOO.errors as Array<{
-      message: string;
-    }>;
-    expect(fooErrors.some((e) => e.message.includes('not returned by vault'))).toBe(true);
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
-  });
-
-  it('evicts every requested cache entry when batch authorization throws', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(
-      schemaPath,
-      `# @hqCompany("test")\n\nFOO=hq()\nBAR=hq()\n`,
-    );
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => {
-        throw new Error('Forbidden: batch authorization denied');
-      },
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-
-    await expect(prewarmHqSecrets(graph, mocks, state)).rejects.toThrow(
-      'Forbidden: batch authorization denied',
-    );
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'BAR');
-  });
-
-  it('rejects mixed success/error rows, clears memory, and evicts cache', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => ({
-        secrets: [{ name: 'FOO', value: 'sentinel-secret-value' }],
-        errors: [{ name: 'FOO', code: 'forbidden', message: 'Denied' }],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-
-    await expect(prewarmHqSecrets(graph, mocks, state)).rejects.toThrow(
-      'Invalid secret load response from vault',
-    );
-    expect(state.loadedSecretsByName.size).toBe(0);
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
-  });
-
-  it('rejects malformed response envelopes and evicts every requested entry', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(
-      schemaPath,
-      `# @hqCompany("test")\n\nFOO=hq()\nBAR=hq()\n`,
-    );
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => ({
-        secrets: [],
-        errors: undefined as unknown as [],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-
-    await expect(prewarmHqSecrets(graph, mocks, state)).rejects.toThrow(
-      'Invalid secret load response from vault',
-    );
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
-    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'BAR');
-  });
-
-  it('missing-company-error: throws when no @hqCompany and no companyOverride', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    // Schema has hq() resolver but no @hqCompany annotation and no opts.companyOverride
-    fs.writeFileSync(schemaPath, `FOO=hq()\n`);
-
-    const mocks = makeMocks();
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await expect(prewarmHqSecrets(graph, mocks, state)).rejects.toThrow(
-      '@hqCompany("...") not declared and --company not passed',
-    );
-  });
-
-  it('batch-error-passthrough-403: forbidden error is surfaced as ResolutionError', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    // Empty line after @hqCompany is required: varlock's env-spec parser only treats
-    // a decorator comment as a root (file-level) decorator when it is separated from the
-    // first var by a blank line. Without it, the decorator attaches to FOO as an item decorator.
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => ({
-        secrets: [],
-        errors: [{ name: 'FOO', code: 'forbidden' }],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await prewarmHqSecrets(graph, mocks, state);
-    await graph.resolveEnvValues();
-    // varlock collects ResolutionErrors on ConfigItem.errors (not re-thrown from resolveEnvValues).
-    // We verify the per-item error contains the forbidden diagnostic.
-    const fooErrors = (graph as any).configSchema['FOO'].errors as Array<{ message: string }>;
-    expect(fooErrors.some((e) => e.message.includes('No read permission for secret "FOO"'))).toBe(true);
-  });
-
-  // US-003 (secrets-server-proxy): the server refuses to batch-load a
-  // high-security ("nuclear") secret (code: high_security_denied, no plaintext).
-  // `hq run` injects plaintext into the child env, so it must surface this as a
-  // clear, actionable error pointing at the proxy — and never resolve a value.
-  it('high-security-denied: nuclear secret is surfaced as a proxy-pointing ResolutionError, no value', async () => {
-    const schemaPath = path.join(tmpDir, '.env.schema');
-    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nANTHROPIC_API_KEY=hq()\n`);
-
-    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
-    const mocks = makeMocks({
-      resolveCompanyUid: async () => uid,
-      fetchBatch: async () => ({
-        secrets: [],
-        errors: [
-          {
-            name: 'ANTHROPIC_API_KEY',
-            code: 'high_security_denied',
-            message: 'high-security; use the proxy',
-          },
-        ],
-      }),
-    });
-
-    let state!: PluginState;
-    const graph = await internal.loadEnvGraph({
-      entryFilePaths: [schemaPath],
-      afterInit: async (g) => {
-        state = installHqPlugin(g, mocks);
-      },
-    });
-    await prewarmHqSecrets(graph, mocks, state);
-    await graph.resolveEnvValues();
-
-    const errs = (graph as any).configSchema['ANTHROPIC_API_KEY'].errors as Array<{ message: string }>;
-    expect(errs.some((e) => /high-security/i.test(e.message) && /proxy/i.test(e.message))).toBe(true);
-    // No plaintext value was resolved for the nuclear secret.
-    expect((graph.getResolvedEnvObject() as Record<string, unknown>).ANTHROPIC_API_KEY).toBeUndefined();
-  });
-});

package/src/run/hq-plugin.ts

@@ -1,277 +0,0 @@
-import { ResolutionError } from 'varlock/plugin-lib';
-import type { Resolver } from 'varlock/plugin-lib';
-import {
-  DEFAULT_SECRETS_CACHE_TTL_MS,
-  writeCache,
-  removeCacheEntry,
-} from '../utils/secrets-cache.js';
-import type { SecretLoadResponse, SecretUsage } from '../commands/secrets.js';
-
-function normalizeCacheTtlMs(secret: SecretLoadResponse['secrets'][number]): number {
-  if (
-    secret.tier === 'sensitive' ||
-    secret.tier === 'nuclear' ||
-    secret.scriptLock?.mode === 'enforced'
-  ) {
-    return 0;
-  }
-  if (secret.cacheTtlMs === undefined) {
-    return DEFAULT_SECRETS_CACHE_TTL_MS;
-  }
-  return typeof secret.cacheTtlMs === 'number' &&
-    Number.isFinite(secret.cacheTtlMs) &&
-    secret.cacheTtlMs > 0
-    ? secret.cacheTtlMs
-    : 0;
-}
-
-export interface InstallHqPluginOpts {
-  companyOverride?: string;
-  resolveCompanyUid: (slug: string) => Promise<string>;
-  usage?: SecretUsage;
-  fetchBatch: (
-    uid: string,
-    names: string[],
-    usage?: SecretUsage,
-  ) => Promise<SecretLoadResponse>;
-}
-
-export interface PluginState {
-  schemaCompanySlug: string | null;
-  uid: string | null;
-  errorsByName: Map<string, { code: string; message?: string }>;
-  loadedSecretsByName: Map<string, string>;
-}
-
-export function installHqPlugin(graph: any /* EnvGraph */, opts: InstallHqPluginOpts) {
-  const pluginState: PluginState = {
-    schemaCompanySlug: null,
-    uid: null,
-    errorsByName: new Map(),
-    loadedSecretsByName: new Map(),
-  };
-
-  // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
-  // extract it at runtime from any already-registered built-in resolver's prototype.
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  let RuntimeResolver: any;
-  try {
-    const fns = graph.registeredResolverFunctions as Record<string, unknown>;
-    const first = Object.values(fns)[0];
-    if (first == null) throw new Error('registeredResolverFunctions is empty');
-    const proto = Object.getPrototypeOf(first) as { prototype?: { process?: unknown } } | null;
-    if (proto == null || typeof proto.prototype?.process !== 'function') {
-      throw new Error('prototype has no process method');
-    }
-    RuntimeResolver = proto;
-  } catch (e) {
-    throw new Error(
-      'varlock Resolver base class extraction failed — the varlock@1.0.0 d.ts/JS mismatch ' +
-      'may have been resolved; switch to `import { Resolver } from "varlock/plugin-lib"`. ' +
-      `Underlying: ${e instanceof Error ? e.message : String(e)}`,
-    );
-  }
-
-  // HqResolver is declared INSIDE installHqPlugin so its static def.resolve
-  // closes over `pluginState`. Module-scope declaration is forbidden — resolve()
-  // would hit `ReferenceError: pluginState is not defined`.
-  class HqResolver extends RuntimeResolver {
-    static def = {
-      name: 'hq',
-      impliesSensitive: true,
-      argsSchema: { type: 'array' as const, arrayMaxLength: 1 },
-      resolve: async function (this: HqResolver) {
-        // `pluginState` is captured by this inner-class closure;
-        // `prewarmHqSecrets(graph, opts, state)` server-authorizes and populates
-        // the in-memory values before `graph.resolveEnvValues()` calls us.
-        const explicit = this.arrArgs?.[0]?.staticValue;
-        const secretName = (typeof explicit === 'string' && explicit) ? explicit : this._ownerKey;
-        if (!secretName) {
-          throw new ResolutionError('hq() resolver could not determine secret name (missing owner key)');
-        }
-        const err = pluginState.errorsByName.get(secretName);
-        if (err) {
-          if (err.code === 'forbidden') {
-            throw new ResolutionError(`No read permission for secret "${secretName}" — ask an admin to share it via \`hq secrets share ${secretName} --with <you> --permission read\``);
-          }
-          if (err.code === 'not_found') {
-            throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
-          }
-          // High-security ("nuclear") secret: the server refuses to vend it on
-          // the local-injection path. It can ONLY be used through the
-          // server-side proxy, so `hq run` (which injects plaintext into the
-          // child env) can never load it. Surface a clear, actionable error.
-          if (err.code === 'high_security_denied') {
-            throw new ResolutionError(`Secret "${secretName}" is high-security and cannot be injected locally — it can only be used via the HQ secret proxy (POST /secrets/{companyUid}/proxy/{path}), which keeps the plaintext server-side. Remove it from this schema's locally-injected vars.`);
-          }
-          throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
-        }
-        if (pluginState.uid == null) {
-          throw new ResolutionError('Internal error: prewarmHqSecrets was not called before resolveEnvValues');
-        }
-        const inMemory = pluginState.loadedSecretsByName.get(secretName);
-        if (inMemory != null) {
-          return inMemory;
-        }
-        throw new ResolutionError(
-          `Secret "${secretName}" was not returned by vault after server authorization`,
-        );
-      },
-    };
-
-    // Captured during process(parent); used by resolve() to fall back to the var key.
-    private _ownerKey?: string;
-
-    process(parent?: Parameters<Resolver['process']>[0]) {
-      super.process(parent);
-      if (parent != null && typeof (parent as { key?: unknown }).key === 'string') {
-        this._ownerKey = (parent as { key: string }).key;
-      }
-    }
-  }
-
-  // varlock@1.0.0's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
-  // so `@hq.company` is not valid syntax. We register as `@hqCompany` (camelCase) instead.
-  // Schema files must use `# @hqCompany("slug")` followed by a blank line so the parser
-  // treats it as a file-level root decorator rather than an item decorator for the next var.
-  graph.registerRootDecorator({
-    name: 'hqCompany',
-    isFunction: true,
-    process: (decoratorValue: any) => {
-      const slug = decoratorValue.arrArgs?.[0]?.staticValue;
-      return typeof slug === 'string' ? slug : null;
-    },
-    execute: (slug: string | null) => {
-      if (slug) pluginState.schemaCompanySlug = slug;
-    },
-  });
-
-  graph.registerResolver(HqResolver);
-
-  // Returned so `prewarmHqSecrets(graph, opts, state)` can read schemaCompanySlug
-  // and write `uid` + `errorsByName`. The state is held by the closure; the returned handle
-  // is purely for the prewarm helper.
-  return pluginState;
-}
-
-export async function prewarmHqSecrets(
-  graph: any /* EnvGraph */,
-  opts: InstallHqPluginOpts,
-  state: PluginState,
-): Promise<void> {
-  const queue: Array<{ key: string; secretName: string }> = [];
-  for (const [key, item] of Object.entries(graph.configSchema)) {
-    const resolver = (item as any).valueResolver;
-    if (resolver?.def?.name === 'hq') {
-      const explicit = resolver.arrArgs?.[0]?.staticValue;
-      const secretName = (typeof explicit === 'string' && explicit) ? explicit : key;
-      queue.push({ key, secretName });
-    }
-  }
-
-  if (queue.length === 0) {
-    return;
-  }
-
-  let slug: string;
-  if (state.schemaCompanySlug) {
-    slug = state.schemaCompanySlug;
-  } else if (opts.companyOverride) {
-    slug = opts.companyOverride;
-  } else {
-    throw new Error('@hqCompany("...") not declared and --company not passed');
-  }
-
-  const uid = await opts.resolveCompanyUid(slug);
-
-  const uniqueNames = [...new Set(queue.map((q) => q.secretName))];
-
-  if (uniqueNames.length > 100) {
-    throw new Error(
-      `hq run supports at most 100 hq() resolvers per schema; got ${uniqueNames.length}`,
-    );
-  }
-  state.loadedSecretsByName.clear();
-  state.errorsByName = new Map();
-
-  let result: SecretLoadResponse;
-  try {
-    result = await opts.fetchBatch(uid, uniqueNames, opts.usage);
-    if (!Array.isArray(result.secrets) || !Array.isArray(result.errors)) {
-      throw new Error('Invalid secret load response from vault');
-    }
-
-    const errorsByName = new Map<string, { code: string; message?: string }>();
-    const returnedNames = new Set<string>();
-    const requestedNames = new Set(uniqueNames);
-    const seenNames = new Set<string>();
-    for (const rawSecret of result.secrets) {
-      if (!rawSecret || typeof rawSecret !== 'object') {
-        throw new Error('Invalid secret load response from vault');
-      }
-      const s = rawSecret as SecretLoadResponse['secrets'][number];
-      if (
-        typeof s.name !== 'string' ||
-        !requestedNames.has(s.name) ||
-        seenNames.has(s.name) ||
-        (s.value != null && typeof s.value !== 'string')
-      ) {
-        throw new Error('Invalid secret load response from vault');
-      }
-      seenNames.add(s.name);
-      if (s.value == null) {
-        errorsByName.set(s.name, {
-          code: 'not_returned',
-          message: 'not returned by vault after server authorization',
-        });
-        removeCacheEntry(uid, s.name);
-        continue;
-      }
-      returnedNames.add(s.name);
-      state.loadedSecretsByName.set(s.name, s.value);
-      const cacheTtlMs = normalizeCacheTtlMs(s);
-      if (cacheTtlMs > 0) {
-        writeCache(uid, s.name, s.value, cacheTtlMs);
-      } else {
-        removeCacheEntry(uid, s.name);
-      }
-    }
-    for (const rawError of result.errors) {
-      if (!rawError || typeof rawError !== 'object') {
-        throw new Error('Invalid secret load response from vault');
-      }
-      const e = rawError as { name?: unknown; code?: unknown; message?: unknown };
-      if (
-        typeof e.name !== 'string' ||
-        !requestedNames.has(e.name) ||
-        seenNames.has(e.name) ||
-        typeof e.code !== 'string' ||
-        (e.message !== undefined && typeof e.message !== 'string')
-      ) {
-        throw new Error('Invalid secret load response from vault');
-      }
-      seenNames.add(e.name);
-      errorsByName.set(e.name, { code: e.code, message: e.message });
-      state.loadedSecretsByName.delete(e.name);
-      removeCacheEntry(uid, e.name);
-    }
-    for (const name of uniqueNames) {
-      if (!returnedNames.has(name) && !errorsByName.has(name)) {
-        errorsByName.set(name, {
-          code: 'not_returned',
-          message: 'not returned by vault after server authorization',
-        });
-        removeCacheEntry(uid, name);
-      }
-    }
-    state.errorsByName = errorsByName;
-    state.uid = uid;
-  } catch (err) {
-    state.loadedSecretsByName.clear();
-    state.errorsByName = new Map();
-    for (const name of uniqueNames) {
-      removeCacheEntry(uid, name);
-    }
-    throw err;
-  }
-}