@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/cpp/test/vendor/omni/json.hpp

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (cpp/src/json.hpp)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The omni JSON value model, with a small in-tree parser.
 //

package/project/.sdk/tm/cpp/test/vendor/omni/omni.hpp

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (cpp/src/omni.hpp)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (C++ port).
 //

package/project/.sdk/tm/cpp/test/vendor/omni/util.hpp

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (cpp/src/util.hpp)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/csharp/feature/SecretsFeature.cs

@@ -321,11 +321,19 @@ public class SecretsFeature : BaseFeature
     // ---------------------------------------------------------------
     // Resolution.
 
-    // One resolution, shared by every concurrent caller. A settled SUCCESS
-    // is kept only when caching is on (`cache: false` means every resolve
+    // One resolution, shared by every concurrent caller. A settled HIT is
+    // kept only when caching is on (`cache: false` means every resolve
     // asks the chain again); a FAILURE is always cleared, so a transient
     // vault outage never poisons the client permanently - the next
     // operation asks the chain again.
+    //
+    // A MISS is cleared too, however caching is set. That rule is
+    // sekreto's, not this feature's: `A miss is never cached: the next read
+    // asks again`, in sekreto's own source. Keeping a settled miss here
+    // would override that from the layer above, and a secret provisioned
+    // after startup - a mounted file, a policy granted a minute late -
+    // would never be picked up for the life of the client. `cache` is about
+    // caching a HIT; it was never a promise to keep saying no.
     private void Resolve()
     {
         if (null != _initerr)
@@ -361,9 +369,10 @@ public class SecretsFeature : BaseFeature
         }
 
         Exception? err = null;
+        var hit = false;
         try
         {
-            ResolveOnce();
+            hit = ResolveOnce();
         }
         catch (Exception ex)
         {
@@ -373,7 +382,7 @@ public class SecretsFeature : BaseFeature
         lock (_mu)
         {
             call.Err = err;
-            if (null != err || !_cache)
+            if (null != err || !_cache || !hit)
             {
                 _resolving = null;
             }
@@ -386,11 +395,14 @@ public class SecretsFeature : BaseFeature
         }
     }
 
-    private void ResolveOnce()
+    // Resolve once, reporting whether a credential came out of it. That
+    // bool is the whole of what Resolve() needs to tell a cacheable HIT
+    // from a miss it must not keep.
+    private bool ResolveOnce()
     {
         if (null == _sek)
         {
-            return;
+            return false;
         }
 
         // TryGet returns null on a MISS and THROWS on a provider error -
@@ -410,7 +422,7 @@ public class SecretsFeature : BaseFeature
                 // HITS while one is set and this branch is unreachable.)
                 _cred = found ?? "";
             }
-            return;
+            return null != found;
         }
 
         // Exchanging: what the chain resolved is the REFRESH token, kept
@@ -441,10 +453,24 @@ public class SecretsFeature : BaseFeature
             // stale the API answers with an expiry status and the transport
             // wrapper buys another, which is the same path expiry takes
             // anyway.
-            return;
+            return true;
+        }
+
+        // `auth: null` is the documented way to send NO credential, and a
+        // purchase is a credential-bearing call: the refresh token goes to
+        // the token endpoint in the request body. WithRefresh honours
+        // suppression for the RETRY, but it runs after this - by then the
+        // refresh token has already left the process, and no later check
+        // can call it back. The suppression has to be honoured here, before
+        // the first purchase, or it only ever half-held.
+        if (AuthSuppressed())
+        {
+            return false;
         }
 
         Buy();
+
+        return true;
     }
 
     // ---------------------------------------------------------------

package/project/.sdk/tm/csharp/feature/secrets/plugin/Capability.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Capability.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Catalog.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Catalog.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Config.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Config.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Definition.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Definition.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 

package/project/.sdk/tm/csharp/feature/secrets/plugin/Depend.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Depend.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Entry.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Entry.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Env.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Env.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Export.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Export.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Graph.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Graph.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Host.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Host.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Inst.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Inst.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Json.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Json.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Order.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Order.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Plugin.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Plugin.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Point.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Point.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Refs.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Refs.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Resolve.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Resolve.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Types.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Types.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugin/Version.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (csharp/src/Version.cs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 using System;
 using System.Collections.Generic;

package/project/.sdk/tm/csharp/feature/secrets/plugins/Aws.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Aws.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Secrets Manager and SSM Parameter Store, as voxgig/plugin
 // definitions - and the SigV4 signing they need.

package/project/.sdk/tm/csharp/feature/secrets/plugins/AzureSecrets.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/AzureSecrets.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Azure Key Vault, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/Boru.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Boru.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The boru vault, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/Child.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Child.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Running a child process, for the two provider kinds that shell out.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/Doppler.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Doppler.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Doppler, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/GcpSecrets.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/GcpSecrets.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // GCP Secret Manager, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/Hashicorp.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Hashicorp.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // HashiCorp Vault, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/HttpJson.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/HttpJson.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The shared HTTP-JSON client the plugin provider kinds talk through -
 // bounded, redirect-refusing - and the two small helpers that go with it.

package/project/.sdk/tm/csharp/feature/secrets/plugins/Infisical.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Infisical.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Infisical, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/OnePassword.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/OnePassword.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // 1Password Connect, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/SecretSpec.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/SecretSpec.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // SecretSpec, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/csharp/feature/secrets/plugins/Sigv4.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Sigv4.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/csharp/feature/secrets/sekreto/Json.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/src/Json.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Just enough JSON for sekreto.
 //

package/project/.sdk/tm/csharp/feature/secrets/sekreto/Providers.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/src/Providers.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The four BUILT-IN provider kinds, and what a provider is.
 //

package/project/.sdk/tm/csharp/feature/secrets/sekreto/Sekreto.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/src/Sekreto.cs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/csharp/test/feature/secrets/SecretsFeatureTest.cs

@@ -652,6 +652,82 @@ public class SecretsFeatureTest
             "out; the wire saw " + last.Auth);
     }
 
+    // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+    // feature used to override from the layer above.
+    //
+    // DEFAULT caching here, which is the whole point: `cache: true` is
+    // about holding a HIT, and keeping the settled resolution after a miss
+    // meant the chain was never asked again for the life of the client. A
+    // secret provisioned after startup (a mounted file, a vault policy
+    // granted a minute late) was invisible forever, and the only workaround
+    // was giving up hit caching entirely.
+    [Fact]
+    public void CachedMissIsReasked()
+    {
+        var present = false;
+        var calls = 0;
+        var late = new ProbeProvider
+        {
+            Fn = _ =>
+            {
+                calls++;
+                return present ? "LATEKEY01" : null;
+            },
+        };
+
+        var w = new Wire();
+        var client = SecretsClient(w, new Dictionary<string, object?>
+        {
+            ["feature"] = ProviderOpts(late, null),
+        });
+
+        DriveEntityOp(client, w);
+        var first = w.Api()[0];
+        Assert.True(!first.HasAuth || "" == first.Auth,
+            "the chain has nothing yet, so no credential should go out");
+
+        var asked = calls;
+        Assert.True(0 < asked);
+
+        // The secret is provisioned while the client is live.
+        present = true;
+
+        DriveEntityOp(client, w);
+        CredentialIs(w.Api()[w.Api().Count - 1].Auth, "LATEKEY01");
+
+        Assert.True(asked < calls,
+            "the MISS was cached: a secret that appears later can never be picked up");
+    }
+
+    // The other half of the same rule: a HIT is still cached by default, so
+    // the fix above must not turn every request into a chain walk.
+    [Fact]
+    public void CachedHitIsKept()
+    {
+        var calls = 0;
+        var counting = new ProbeProvider
+        {
+            Fn = _ =>
+            {
+                calls++;
+                return "STABLEKEY01";
+            },
+        };
+
+        var w = new Wire();
+        var client = SecretsClient(w, new Dictionary<string, object?>
+        {
+            ["feature"] = ProviderOpts(counting, null),
+        });
+
+        DriveEntityOp(client, w);
+        DriveEntityOp(client, w);
+
+        Assert.True(1 == calls,
+            "a hit must be cached under the default cache: true, chain asked " +
+            calls + " times");
+    }
+
     [Fact]
     public void CacheFalseAsksTheChainOnEveryResolve()
     {
@@ -1455,6 +1531,15 @@ public class SecretsFeatureTest
             Assert.False(w.Api()[0].HasAuth,
                 "no credential may be sent when auth is suppressed, got " +
                 w.Api()[0].Auth);
+
+            // AND NO PURCHASE. Resolve() runs before WithRefresh's
+            // suppression check, so the refresh token used to go to the
+            // token endpoint in a request body even here. Stopping the
+            // retry does not unsend it, and only the token endpoint can
+            // see this.
+            Assert.True(0 == w.Token().Count,
+                "auth null suppressed the credential but the refresh token was " +
+                "still POSTed to the exchange endpoint");
         }
         finally
         {

package/project/.sdk/tm/csharp/test/vendor/omni/Runner.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (csharp/src/Runner.cs)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (C# port).
 //

package/project/.sdk/tm/csharp/test/vendor/omni/Util.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (csharp/src/Util.cs)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/csharp/utility/struct/Struct.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.1 (csharp/Struct.cs)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
 

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/capability.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/capability.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Capability do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/catalog.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/catalog.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Catalog do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/config.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/config.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Config do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/depend.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/depend.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Depend do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/env.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/env.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Env do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/error.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/error.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Error do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/export.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/export.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Export do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/graph.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/graph.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Graph do
   @moduledoc """

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/host.ex

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/host.ex)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 defmodule Voxgig.Plugin.Host do
   @moduledoc """