@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/js/test/feature/secrets/Secrets.test.js

@@ -379,6 +379,71 @@ describe('secrets', () => {
   })
 
 
+  // A MISS IS NOT A CACHEABLE ANSWER — sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // Default caching here, deliberately: `cache: true` is about holding a
+  // HIT, and holding the settled promise after a miss meant the chain was
+  // never asked again for the life of the client. A secret provisioned
+  // after startup (a mounted file, a vault policy granted a minute late)
+  // was invisible forever, and the only workaround was giving up hit
+  // caching entirely.
+  test('active: a MISS is re-asked, so a late secret is picked up',
+    async () => {
+      let calls = 0
+      const sdk = SDK.test({}, {
+        feature: {
+          secrets: {
+            active: true,
+            providers: [{
+              lookup(_name) {
+                calls++
+                // Absent on the first ask, present on the second.
+                return 1 < calls ? 'LATEKEY' : undefined
+              },
+              describe() { return 'late:test' },
+            }],
+          },
+        },
+      })
+
+      const first = await sdk.prepare({ path: '/' })
+      assert.equal(first.headers['authorization'], undefined,
+        'the first resolve missed, so no credential should go out')
+
+      const second = await sdk.prepare({ path: '/' })
+      credentialIs(second.headers['authorization'], 'LATEKEY')
+
+      assert.ok(1 < calls,
+        'the chain was asked once and the MISS cached: a secret that ' +
+        'appears later can never be picked up')
+    })
+
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  test('active: a HIT is still cached by default', async () => {
+    let calls = 0
+    const sdk = SDK.test({}, {
+      feature: {
+        secrets: {
+          active: true,
+          providers: [{
+            lookup(_name) { calls++; return 'KEY' + calls },
+            describe() { return 'counting:test' },
+          }],
+        },
+      },
+    })
+
+    await sdk.prepare({ path: '/' })
+    await sdk.prepare({ path: '/' })
+
+    assert.equal(calls, 1,
+      'a hit must be cached under the default cache: true')
+  })
+
+
   test('active: secret name is configurable', async () => {
     process.env[ENVPREFIX + 'API_TOKEN'] = 'TOKKEY01'
     try {
@@ -861,6 +926,14 @@ describe('secrets exchange', () => {
     assert.equal(stub.api().length, 1, 'a suppressed request must not be retried')
     assert.equal(stub.api()[0].auth, undefined,
       'no credential may be sent when auth is suppressed')
+
+    // AND NO PURCHASE. This is the half the API-call assertions cannot see:
+    // resolve() runs before _withRefresh's suppression check, so the
+    // refresh token used to go to the token endpoint in a request body
+    // even here. Stopping the retry does not unsend it.
+    assert.equal(stub.token().length, 0,
+      'auth: null suppressed the credential but the refresh token was ' +
+      'still POSTed to the exchange endpoint')
   })
 
 

package/project/.sdk/tm/js/test/vendor/omni/index.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (javascript/src/index.js)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/omni-js - shared multi-language test runner.
 //

package/project/.sdk/tm/js/test/vendor/omni/runner.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (javascript/src/runner.js)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/js/test/vendor/omni/util.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (javascript/src/util.js)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/kotlin/feature/SecretsFeature.kt

@@ -270,11 +270,19 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
     ctx.utility!!.fetcher = { ctx2, url, fetchdef -> transport(ctx2, url, fetchdef, inner) }
   }
 
-  // One resolution, shared by every concurrent caller. A settled SUCCESS is
+  // One resolution, shared by every concurrent caller. A settled HIT is
   // kept only when caching is on (`cache: false` means every resolve asks
   // the chain again); a FAILURE is always cleared, so a transient vault
   // outage never poisons the client permanently - the next operation asks
   // the chain again.
+  //
+  // A MISS is cleared too, however caching is set. That rule is sekreto's,
+  // not this feature's: `A miss is never cached: the next read asks again`,
+  // in sekreto's own source. Keeping a settled miss here would override
+  // that from the layer above, and a secret provisioned after startup - a
+  // mounted file, a policy granted a minute late - would never be picked up
+  // for the life of the client. `cache` is about caching a HIT; it was
+  // never a promise to keep saying no.
   fun resolve() {
     val ie = this.initerr
     if (null != ie) {
@@ -311,8 +319,9 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
 
     val call = mine!!
     var err: RuntimeException? = null
+    var hit = false
     try {
-      resolveonce()
+      hit = resolveonce()
     } catch (e: RuntimeException) {
       err = e
     } catch (e: Exception) {
@@ -325,7 +334,7 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
     this.lock.withLock {
       call.err = err
       call.done = true
-      if (null != err || !this.cache) {
+      if (null != err || !this.cache || !hit) {
         this.resolving = null
       }
       this.settled.signalAll()
@@ -336,8 +345,11 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
     }
   }
 
-  private fun resolveonce() {
-    val s = this.sek ?: return
+  // Resolve once, reporting whether a credential came out of it. That
+  // boolean is the whole of what resolve() needs to tell a cacheable HIT
+  // from a miss it must not keep.
+  private fun resolveonce(): Boolean {
+    val s = this.sek ?: return false
 
     // A provider ERROR throws out of here and fails the op (via the
     // transport gate); only a MISS (null) falls through.
@@ -353,7 +365,7 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
         // unreachable.)
         this.cred = found ?: ""
       }
-      return
+      return null != found
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -376,10 +388,23 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
       // A starting access token was supplied. Spend it: if it is stale the
       // API answers with an expiry status and the transport wrapper buys
       // another, which is the same path expiry takes anyway.
-      return
+      return true
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. withrefresh honours suppression
+    // for the RETRY, but it runs after this - by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (null == this.liveopts["auth"]) {
+      return false
     }
 
     buy()
+
+    return true
   }
 
   // transport wraps whatever transport was current at init.

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Capability.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Capability.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Catalog.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Catalog.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Config.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Config.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Depend.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Depend.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Env.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Env.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Export.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Export.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Graph.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Graph.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Host.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Host.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Json.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Json.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Order.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Order.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Plugin.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Plugin.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Point.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Point.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Refs.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Refs.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Resolve.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Resolve.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Types.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Types.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/plugin/Version.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (kotlin/src/Version.kt)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.feature.secrets.plugin
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/Json.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/src/Json.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON support for sekreto.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/Provider.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/src/Provider.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // A source of secrets.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/Providers.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/src/Providers.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // THE BUILT-IN PROVIDER KINDS - the same four in every port.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/Sekreto.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/src/Sekreto.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/Spec.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/src/Spec.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The declarative form of a provider, and the credentials it may carry.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/Support.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/src/Support.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // How a provider kind becomes a voxgig/plugin definition.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Aws.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Aws.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The two AWS stores, as voxgig/plugin definitions.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Azuresecrets.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Azuresecrets.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Azure Key Vault, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Boru.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Boru.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // A boru vault, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Doppler.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Doppler.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Doppler, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Gcpsecrets.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Gcpsecrets.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // GCP Secret Manager, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Hashicorp.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Hashicorp.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // HashiCorp Vault, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Httpjson.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Httpjson.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The shared HTTP-JSON transport, and the child-process runner.
 //

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Infisical.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Infisical.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Infisical, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Onepassword.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Onepassword.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // 1Password Connect, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Secretspec.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Secretspec.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // SecretSpec, as a voxgig/plugin definition.
 

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Sigv4.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Sigv4.kt)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/kotlin/test/feature/secrets/SecretsTest.kt

@@ -449,6 +449,67 @@ class SecretsTest {
       "a chain MISS must leave the header off, got \"" + w.api()[0].auth + "\"")
   }
 
+  // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // DEFAULT caching here, which is the whole point: `cache: true` is about
+  // holding a HIT, and keeping the settled resolution after a miss meant
+  // the chain was never asked again for the life of the client. A secret
+  // provisioned after startup (a mounted file, a vault policy granted a
+  // minute late) was invisible forever, and the only workaround was giving
+  // up hit caching entirely.
+  @Test
+  fun aCachedMissIsReasked() {
+    var present = false
+    var calls = 0
+    val w = Wire()
+    val client = secretsClient(w, map(
+      "feature" to chainOpts(TestProvider({ _ ->
+        synchronized(this) {
+          calls++
+          if (present) "LATEKEY01" else null
+        }
+      }, "late:test")),
+    ))
+
+    driveEntityOp(client, w)
+    val first = w.api()[0]
+    assertFalse(first.hasAuth && "" != first.auth,
+      "the chain has nothing yet, so no credential should go out")
+
+    val asked = synchronized(this) { calls }
+    assertTrue(0 < asked)
+
+    // The secret is provisioned while the client is live.
+    synchronized(this) { present = true }
+
+    driveEntityOp(client, w)
+    credentialIs(w.api().last().auth, "LATEKEY01")
+
+    assertTrue(asked < synchronized(this) { calls },
+      "the MISS was cached: a secret that appears later can never be picked up")
+  }
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  @Test
+  fun aCachedHitIsKept() {
+    var calls = 0
+    val w = Wire()
+    val client = secretsClient(w, map(
+      "feature" to chainOpts(TestProvider({ _ ->
+        synchronized(this) { calls++ }
+        "STABLEKEY01"
+      }, "counting:test")),
+    ))
+
+    driveEntityOp(client, w)
+    driveEntityOp(client, w)
+
+    assertEquals(1, synchronized(this) { calls },
+      "a hit must be cached under the default cache: true")
+  }
+
   @Test
   fun authNullSuppressesTheCredentialChainOrNoChain() {
     val w = Wire()
@@ -1114,6 +1175,14 @@ class SecretsTest {
     assertFalse(w.api()[0].hasAuth,
       "no credential may be sent when auth is suppressed, got \"" +
         w.api()[0].auth + "\"")
+
+    // AND NO PURCHASE. resolve() runs before withrefresh's suppression
+    // check, so the refresh token used to go to the token endpoint in a
+    // request body even here. Stopping the retry does not unsend it, and
+    // only the token endpoint can see this.
+    assertEquals(0, w.token().size,
+      "auth null suppressed the credential but the refresh token was still " +
+        "POSTed to the exchange endpoint")
   }
 
   @Test

package/project/.sdk/tm/kotlin/test/vendor/omni/Json.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (kotlin/src/Json.kt)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The omni JSON value model, with a small in-tree parser.
 //

package/project/.sdk/tm/kotlin/test/vendor/omni/Runner.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (kotlin/src/Runner.kt)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (Kotlin port).
 //

package/project/.sdk/tm/kotlin/test/vendor/omni/Util.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (kotlin/src/Util.kt)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/kotlin/utility/struct/Struct.kt

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.1 (kotlin/src/main/kotlin/voxgig/struct/Struct.kt)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package KOTLINPACKAGE.utility.struct