@terreno/api 0.18.0 → 0.20.0

package/dist/secretProviders.js

@@ -84,8 +84,19 @@ var __read = (this && this.__read) || function (o, n) {
     }
     return ar;
 };
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GcpSecretProvider = exports.EnvSecretProvider = void 0;
+exports.CachingSecretProvider = exports.CompositeSecretProvider = exports.GcpSecretProvider = exports.EnvSecretProvider = void 0;
 var errors_1 = require("./errors");
 var logger_1 = require("./logger");
 /**
@@ -106,7 +117,11 @@ var EnvSecretProvider = /** @class */ (function () {
     function EnvSecretProvider() {
         this.name = "env";
     }
-    EnvSecretProvider.prototype.getSecret = function (secretName) {
+    /**
+     * Resolve a secret from an environment variable. Environment variables have no
+     * versions, so the optional `version` parameter is ignored.
+     */
+    EnvSecretProvider.prototype.getSecret = function (secretName, _version) {
         return __awaiter(this, void 0, void 0, function () {
             var envKey, value;
             var _a;
@@ -180,30 +195,42 @@ var GcpSecretProvider = /** @class */ (function () {
             });
         });
     };
-    GcpSecretProvider.prototype.getSecret = function (secretName) {
+    /**
+     * Resolve a secret from Google Cloud Secret Manager.
+     *
+     * @param secretName - A short secret id (e.g. "openai-api-key") or a full
+     *   resource path (e.g. "projects/p/secrets/s" or
+     *   "projects/p/secrets/s/versions/3").
+     * @param version - Optional version to resolve when `secretName` is a short id
+     *   (e.g. "3"). Defaults to "latest". Ignored when `secretName` already
+     *   contains an explicit `/versions/...` suffix.
+     */
+    GcpSecretProvider.prototype.getSecret = function (secretName, version) {
         return __awaiter(this, void 0, void 0, function () {
-            var client, resourceName, _a, version, payload, error_1;
+            var client, resolvedVersion, resourceName, _a, version_1, payload, error_1;
             var _b;
             return __generator(this, function (_c) {
                 switch (_c.label) {
                     case 0: return [4 /*yield*/, this.getClient()];
                     case 1:
                         client = _c.sent();
+                        resolvedVersion = version !== null && version !== void 0 ? version : "latest";
                         if (secretName.startsWith("projects/")) {
-                            resourceName = secretName.endsWith("/versions/latest")
+                            // Honor a full resource path. Only append a version when one is not present.
+                            resourceName = secretName.includes("/versions/")
                                 ? secretName
-                                : "".concat(secretName, "/versions/latest");
+                                : "".concat(secretName, "/versions/").concat(resolvedVersion);
                         }
                         else {
-                            resourceName = "projects/".concat(this.projectId, "/secrets/").concat(secretName, "/versions/latest");
+                            resourceName = "projects/".concat(this.projectId, "/secrets/").concat(secretName, "/versions/").concat(resolvedVersion);
                         }
                         _c.label = 2;
                     case 2:
                         _c.trys.push([2, 4, , 5]);
                         return [4 /*yield*/, client.accessSecretVersion({ name: resourceName })];
                     case 3:
-                        _a = __read.apply(void 0, [_c.sent(), 1]), version = _a[0];
-                        payload = (_b = version.payload) === null || _b === void 0 ? void 0 : _b.data;
+                        _a = __read.apply(void 0, [_c.sent(), 1]), version_1 = _a[0];
+                        payload = (_b = version_1.payload) === null || _b === void 0 ? void 0 : _b.data;
                         if (!payload) {
                             logger_1.logger.warn("GcpSecretProvider: secret ".concat(secretName, " has no payload"));
                             return [2 /*return*/, null];
@@ -225,3 +252,144 @@ var GcpSecretProvider = /** @class */ (function () {
     return GcpSecretProvider;
 }());
 exports.GcpSecretProvider = GcpSecretProvider;
+/**
+ * Secret provider that delegates to an ordered list of providers, returning the
+ * first non-null result.
+ *
+ * A provider that throws is warn-logged (secret name only — never the value) and
+ * resolution falls through to the next provider. This makes it easy to compose a
+ * primary provider with a fallback, e.g. GCP with an environment-variable
+ * fallback:
+ *
+ * @example
+ * ```typescript
+ * const provider = new CompositeSecretProvider([
+ *   new GcpSecretProvider({projectId: "my-project"}),
+ *   new EnvSecretProvider(),
+ * ]);
+ * const key = await provider.getSecret("openai-api-key");
+ * ```
+ */
+var CompositeSecretProvider = /** @class */ (function () {
+    function CompositeSecretProvider(providers) {
+        if (!providers || providers.length === 0) {
+            throw new errors_1.APIError({
+                status: 500,
+                title: "CompositeSecretProvider requires at least one provider",
+            });
+        }
+        this.providers = providers;
+        this.name = "composite(".concat(providers.map(function (p) { return p.name; }).join(","), ")");
+    }
+    CompositeSecretProvider.prototype.getSecret = function (secretName, version) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, _b, provider, value, error_2, message, e_1_1;
+            var e_1, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        _d.trys.push([0, 7, 8, 9]);
+                        _a = __values(this.providers), _b = _a.next();
+                        _d.label = 1;
+                    case 1:
+                        if (!!_b.done) return [3 /*break*/, 6];
+                        provider = _b.value;
+                        _d.label = 2;
+                    case 2:
+                        _d.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, provider.getSecret(secretName, version)];
+                    case 3:
+                        value = _d.sent();
+                        if (value !== null) {
+                            return [2 /*return*/, value];
+                        }
+                        return [3 /*break*/, 5];
+                    case 4:
+                        error_2 = _d.sent();
+                        message = error_2 instanceof Error ? error_2.message : String(error_2);
+                        logger_1.logger.warn("CompositeSecretProvider: provider ".concat(provider.name, " failed for secret ").concat(secretName, ": ").concat(message));
+                        return [3 /*break*/, 5];
+                    case 5:
+                        _b = _a.next();
+                        return [3 /*break*/, 1];
+                    case 6: return [3 /*break*/, 9];
+                    case 7:
+                        e_1_1 = _d.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 9];
+                    case 8:
+                        try {
+                            if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
+                        }
+                        finally { if (e_1) throw e_1.error; }
+                        return [7 /*endfinally*/];
+                    case 9: return [2 /*return*/, null];
+                }
+            });
+        });
+    };
+    return CompositeSecretProvider;
+}());
+exports.CompositeSecretProvider = CompositeSecretProvider;
+/**
+ * Secret provider that wraps any provider with an in-memory TTL cache.
+ *
+ * Cache entries are keyed by `secretName@version` so that pinned versions are
+ * cached independently. `null` results (secret not found) are cached too, to
+ * avoid hammering the underlying provider for missing secrets. Secret values are
+ * never logged.
+ *
+ * Use `clear()` to drop the entire cache (e.g. on rotation) or `clearKey()` to
+ * invalidate a single secret.
+ *
+ * @example
+ * ```typescript
+ * const provider = new CachingSecretProvider(
+ *   new CompositeSecretProvider([gcp, env]),
+ *   {ttlMs: 30_000}
+ * );
+ * ```
+ */
+var CachingSecretProvider = /** @class */ (function () {
+    function CachingSecretProvider(provider, options) {
+        var _a;
+        this.cache = new Map();
+        this.provider = provider;
+        this.ttlMs = (_a = options === null || options === void 0 ? void 0 : options.ttlMs) !== null && _a !== void 0 ? _a : 60000;
+        this.name = "caching(".concat(provider.name, ")");
+    }
+    CachingSecretProvider.prototype.cacheKey = function (secretName, version) {
+        return "".concat(secretName, "@").concat(version !== null && version !== void 0 ? version : "latest");
+    };
+    CachingSecretProvider.prototype.getSecret = function (secretName, version) {
+        return __awaiter(this, void 0, void 0, function () {
+            var key, now, cached, value;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        key = this.cacheKey(secretName, version);
+                        now = Date.now();
+                        cached = this.cache.get(key);
+                        if (cached && cached.expiresAt > now) {
+                            return [2 /*return*/, cached.value];
+                        }
+                        return [4 /*yield*/, this.provider.getSecret(secretName, version)];
+                    case 1:
+                        value = _a.sent();
+                        this.cache.set(key, { expiresAt: now + this.ttlMs, value: value });
+                        return [2 /*return*/, value];
+                }
+            });
+        });
+    };
+    /** Clears the entire cache. Useful on secret rotation and in tests. */
+    CachingSecretProvider.prototype.clear = function () {
+        this.cache.clear();
+    };
+    /** Invalidates a single cached secret by name (and optional version). */
+    CachingSecretProvider.prototype.clearKey = function (secretName, version) {
+        this.cache.delete(this.cacheKey(secretName, version));
+    };
+    return CachingSecretProvider;
+}());
+exports.CachingSecretProvider = CachingSecretProvider;

package/dist/secretProviders.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/secretProviders.test.js

@@ -0,0 +1,391 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var secretProviders_1 = require("./secretProviders");
+(0, bun_test_1.describe)("EnvSecretProvider", function () {
+    (0, bun_test_1.beforeEach)(function () {
+        delete process.env.MY_SECRET_KEY;
+    });
+    (0, bun_test_1.it)("resolves from a SCREAMING_SNAKE_CASE env var", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.MY_SECRET_KEY = "from-env";
+                    provider = new secretProviders_1.EnvSecretProvider();
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("my-secret-key")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBe("from-env");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns null when the env var is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    provider = new secretProviders_1.EnvSecretProvider();
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("my-secret-key")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBeNull();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("ignores the version parameter", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.MY_SECRET_KEY = "value";
+                    provider = new secretProviders_1.EnvSecretProvider();
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("my-secret-key", "5")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBe("value");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("CompositeSecretProvider", function () {
+    (0, bun_test_1.it)("throws when constructed with no providers", function () {
+        (0, bun_test_1.expect)(function () { return new secretProviders_1.CompositeSecretProvider([]); }).toThrow();
+    });
+    (0, bun_test_1.it)("returns the first non-null result", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var a, b, c, provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    a = { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, null];
+                        }); }); }, name: "a" };
+                    b = { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, "from-b"];
+                        }); }); }, name: "b" };
+                    c = { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, "from-c"];
+                        }); }); }, name: "c" };
+                    provider = new secretProviders_1.CompositeSecretProvider([a, b, c]);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBe("from-b");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("falls through to the next provider when one throws", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var failing, fallback, provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    failing = {
+                        getSecret: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                throw new Error("provider down");
+                            });
+                        }); },
+                        name: "failing",
+                    };
+                    fallback = { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, "from-fallback"];
+                        }); }); }, name: "fallback" };
+                    provider = new secretProviders_1.CompositeSecretProvider([failing, fallback]);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBe("from-fallback");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns null when every provider yields null", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var a, b, provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    a = { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, null];
+                        }); }); }, name: "a" };
+                    b = { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, null];
+                        }); }); }, name: "b" };
+                    provider = new secretProviders_1.CompositeSecretProvider([a, b]);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBeNull();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("forwards the version parameter to each provider", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var seen, a, b, provider;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    seen = [];
+                    a = {
+                        getSecret: function (_name, version) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                seen.push(version);
+                                return [2 /*return*/, null];
+                            });
+                        }); },
+                        name: "a",
+                    };
+                    b = {
+                        getSecret: function (_name, version) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                seen.push(version);
+                                return [2 /*return*/, "value"];
+                            });
+                        }); },
+                        name: "b",
+                    };
+                    provider = new secretProviders_1.CompositeSecretProvider([a, b]);
+                    return [4 /*yield*/, provider.getSecret("x", "7")];
+                case 1:
+                    _a.sent();
+                    (0, bun_test_1.expect)(seen).toEqual(["7", "7"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("builds a composite name from the underlying providers", function () {
+        var provider = new secretProviders_1.CompositeSecretProvider([
+            { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                    return [2 /*return*/, null];
+                }); }); }, name: "gcp" },
+            { getSecret: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                    return [2 /*return*/, null];
+                }); }); }, name: "env" },
+        ]);
+        (0, bun_test_1.expect)(provider.name).toBe("composite(gcp,env)");
+    });
+});
+(0, bun_test_1.describe)("CachingSecretProvider", function () {
+    (0, bun_test_1.it)("memoizes a value within the TTL (single underlying call)", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, underlying, provider, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    calls = 0;
+                    underlying = {
+                        getSecret: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls++;
+                                return [2 /*return*/, "value"];
+                            });
+                        }); },
+                        name: "underlying",
+                    };
+                    provider = new secretProviders_1.CachingSecretProvider(underlying, { ttlMs: 10000 });
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toBe("value");
+                    _b = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 2:
+                    _b.apply(void 0, [_c.sent()]).toBe("value");
+                    (0, bun_test_1.expect)(calls).toBe(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("re-fetches after clear()", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, underlying, provider, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    calls = 0;
+                    underlying = {
+                        getSecret: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls++;
+                                return [2 /*return*/, "value-".concat(calls)];
+                            });
+                        }); },
+                        name: "underlying",
+                    };
+                    provider = new secretProviders_1.CachingSecretProvider(underlying, { ttlMs: 10000 });
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toBe("value-1");
+                    provider.clear();
+                    _b = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 2:
+                    _b.apply(void 0, [_c.sent()]).toBe("value-2");
+                    (0, bun_test_1.expect)(calls).toBe(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("re-fetches after the TTL expires", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, underlying, provider, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    calls = 0;
+                    underlying = {
+                        getSecret: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls++;
+                                return [2 /*return*/, "value-".concat(calls)];
+                            });
+                        }); },
+                        name: "underlying",
+                    };
+                    provider = new secretProviders_1.CachingSecretProvider(underlying, { ttlMs: 1 });
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toBe("value-1");
+                    return [4 /*yield*/, new Promise(function (resolve) { return setTimeout(resolve, 5); })];
+                case 2:
+                    _c.sent();
+                    _b = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toBe("value-2");
+                    (0, bun_test_1.expect)(calls).toBe(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("caches different versions independently", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var seen, underlying, provider, _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    seen = [];
+                    underlying = {
+                        getSecret: function (_name, version) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                seen.push(version);
+                                return [2 /*return*/, "v-".concat(version !== null && version !== void 0 ? version : "latest")];
+                            });
+                        }); },
+                        name: "underlying",
+                    };
+                    provider = new secretProviders_1.CachingSecretProvider(underlying, { ttlMs: 10000 });
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x", "1")];
+                case 1:
+                    _a.apply(void 0, [_d.sent()]).toBe("v-1");
+                    _b = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x", "2")];
+                case 2:
+                    _b.apply(void 0, [_d.sent()]).toBe("v-2");
+                    // Cached hits, no additional underlying calls.
+                    _c = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("x", "1")];
+                case 3:
+                    // Cached hits, no additional underlying calls.
+                    _c.apply(void 0, [_d.sent()]).toBe("v-1");
+                    (0, bun_test_1.expect)(seen).toEqual(["1", "2"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("clearKey invalidates a single secret", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, underlying, provider;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    calls = 0;
+                    underlying = {
+                        getSecret: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls++;
+                                return [2 /*return*/, "value-".concat(calls)];
+                            });
+                        }); },
+                        name: "underlying",
+                    };
+                    provider = new secretProviders_1.CachingSecretProvider(underlying, { ttlMs: 10000 });
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 1:
+                    _a.sent();
+                    provider.clearKey("x");
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 2:
+                    _a.sent();
+                    (0, bun_test_1.expect)(calls).toBe(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("caches null results", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, underlying, provider, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    calls = 0;
+                    underlying = {
+                        getSecret: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls++;
+                                return [2 /*return*/, null];
+                            });
+                        }); },
+                        name: "underlying",
+                    };
+                    provider = new secretProviders_1.CachingSecretProvider(underlying, { ttlMs: 10000 });
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("missing")];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toBeNull();
+                    _b = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("missing")];
+                case 2:
+                    _b.apply(void 0, [_c.sent()]).toBeNull();
+                    (0, bun_test_1.expect)(calls).toBe(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/package.json

@@ -109,5 +109,5 @@
     "updateSnapshot": "bun test --update-snapshots"
   },
   "types": "dist/index.d.ts",
-  "version": "0.18.0"
+  "version": "0.20.0"
 }

package/src/actions.openApi.test.ts

@@ -7,7 +7,7 @@ import {addAuthRoutes, setupAuth} from "./auth";
 import {setupServer} from "./expressServer";
 import {Permissions} from "./permissions";
 import {TerrenoApp} from "./terrenoApp";
-import {authAsUser, FoodModel, setupDb, UserModel} from "./tests";
+import {FoodModel, setupDb, UserModel} from "./tests";
 import {z} from "./zodOpenApi";
 
 const foodActionPermissions = {

package/src/actions.ts

@@ -9,7 +9,6 @@ import {loadDocOr404} from "./docLoader";
 import {APIError} from "./errors";
 import {defaultOpenApiErrorResponses} from "./openApi";
 import {checkPermissions, type PermissionMethod} from "./permissions";
-import {z} from "./zodOpenApi";
 
 // At least two characters: leading letter plus one or more alphanumeric/_/- chars.
 export const ACTION_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]+$/;