@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/py/pkg/feature/secrets_feature.py

@@ -201,21 +201,31 @@ class ProjectNameSecretsFeature(ProjectNameBaseFeature):
     def PreSpec(self, _ctx):
         return self.resolve()
 
-    # Resolve the apikey before the first request. A successful resolve is
+    # Resolve the apikey before the first request. A successful HIT is
     # reused while caching is on; with `cache: False` the chain is asked
     # again on every call - holding the first answer forever would make
     # the documented option a lie. A provider ERROR raises (fails the op)
     # and leaves nothing cached, so a transient vault outage does not
     # poison the client after the vault recovers.
+    #
+    # A MISS is not marked resolved either, however caching is set. That
+    # rule is sekreto's, not this feature's: `A miss is never cached: the
+    # next read asks again`, in sekreto's own source. Marking a settled
+    # miss here would override that from the layer above, and a secret
+    # provisioned after startup - a mounted file, a policy granted a minute
+    # late - would never be picked up for the life of the client. `cache`
+    # is about caching a HIT; it was never a promise to keep saying no.
     def resolve(self):
         if self._resolved and self._cache:
             return
-        self._resolve_once()
-        self._resolved = True
+        self._resolved = self._resolve_once()
 
+    # Resolve once, reporting whether a credential came out of it. That
+    # bool is the whole of what resolve() needs to tell a cacheable HIT
+    # from a miss it must not retain.
     def _resolve_once(self):
         if self._sekreto is None:
-            return
+            return False
 
         # Miss-vs-error: `try_` answers None for "no store has it" and
         # RAISES for "a store could not answer" - only the miss falls
@@ -242,7 +252,7 @@ class ProjectNameSecretsFeature(ProjectNameBaseFeature):
                 if self._client.options.get("apikey") == self._lastset:
                     self._client.options["apikey"] = ""
                 self._lastset = None
-            return
+            return found is not None
 
         # Exchanging: what the chain resolved is the REFRESH token, kept
         # for every later purchase. A miss is not fatal here - an explicit
@@ -255,10 +265,22 @@ class ProjectNameSecretsFeature(ProjectNameBaseFeature):
             # A starting access token was supplied. Spend it: if it is
             # stale the API answers 401 and the transport wrapper buys
             # another, which is the same path expiry takes anyway.
-            return
+            return True
+
+        # `auth: None` is the documented way to send NO credential, and a
+        # purchase is a credential-bearing call: the refresh token goes to
+        # the token endpoint in the request body. _with_refresh honours
+        # suppression for the RETRY, but it runs after this - by then the
+        # refresh token has already left the process, and no later check
+        # can call it back. The suppression has to be honoured here, before
+        # the first purchase, or it only ever half-held.
+        if self._client.options_map().get("auth") is None:
+            return False
 
         self._client.options["apikey"] = self._buy()
 
+        return True
+
     # Buy an access token with the refresh token. (ts shares one in-flight
     # purchase between concurrent async callers; python resolves
     # synchronously, so the sharing that remains observable is the

package/project/.sdk/tm/py/pkg/utility/voxgig_struct/voxgig_struct.py

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/struct 0.1.1 (python/voxgig_struct/voxgig_struct.py)
-# Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Copyright (c) 2025 Voxgig Ltd. MIT LICENSE.
 #

package/project/.sdk/tm/py/test/feature/secrets/test_secrets.py

@@ -107,6 +107,18 @@ class TestSecrets(unittest.TestCase):
         self.assertEqual(1, len(transport.calls))
         return transport.calls[0]["fetchdef"].get("headers") or {}
 
+    def _lastwire(self, sdk, transport):
+        """Drive one operation and read the headers off the LAST call, so a
+        test can operate more than once on the same client."""
+        utility = sdk._utility
+        ctx = utility.make_context({"opname": "load"}, sdk.get_root_ctx())
+        utility.feature_hook(ctx, "PreSpec")
+
+        fetchdef = sdk.prepare({"path": "/"})
+        res, err = utility.fetcher(ctx, fetchdef["url"], fetchdef)
+        self.assertIsNone(err)
+        return transport.calls[-1]["fetchdef"].get("headers") or {}
+
     def assert_credential(self, headers, token):
         # The Authorization header carries the SPEC's credential prefix,
         # which a TEMPLATE cannot know - assert on the CREDENTIAL and let
@@ -196,6 +208,71 @@ class TestSecrets(unittest.TestCase):
         with self.assertRaises(RuntimeError):
             utility.feature_hook(ctx, "PreSpec")
 
+    # --- a miss is not a cacheable answer ---
+
+    # sekreto's own rule, which this feature used to override from the
+    # layer above: `A miss is never cached: the next read asks again`.
+    #
+    # DEFAULT caching in both tests below, which is the whole point.
+    # `cache: True` is about holding a HIT; holding the settled miss meant
+    # the chain was never asked again for the life of the client, so a
+    # secret provisioned after startup (a mounted file, a vault policy
+    # granted a minute late) was invisible forever.
+    def test_a_cached_miss_is_reasked(self):
+        state = {"present": False, "calls": 0}
+
+        def lookup(name):
+            state["calls"] += 1
+            return "LATEKEY01" if state["present"] else None
+
+        sdk, transport = self._sdk({
+            "feature": {"secrets": {
+                "active": True,
+                "providers": [{"lookup": lookup, "describe": lambda: "late:test"}],
+            }},
+        })
+
+        headers = self._lastwire(sdk, transport)
+        self.assertNotIn("authorization", headers,
+                         "the chain has nothing yet, so no credential "
+                         "should go out")
+
+        asked = state["calls"]
+        self.assertLess(0, asked)
+
+        # The secret is provisioned while the client is live.
+        state["present"] = True
+
+        headers = self._lastwire(sdk, transport)
+        self.assert_credential(headers, "LATEKEY01")
+
+        self.assertLess(asked, state["calls"],
+                        "the MISS was cached: a secret that appears later "
+                        "can never be picked up")
+
+    def test_a_cached_hit_is_kept(self):
+        # The other half of the same rule: a HIT is still cached by
+        # default, so the fix above must not turn every request into a
+        # chain walk.
+        state = {"calls": 0}
+
+        def lookup(name):
+            state["calls"] += 1
+            return "STABLEKEY01"
+
+        sdk, transport = self._sdk({
+            "feature": {"secrets": {
+                "active": True,
+                "providers": [{"lookup": lookup, "describe": lambda: "counting:test"}],
+            }},
+        })
+
+        self._lastwire(sdk, transport)
+        self._lastwire(sdk, transport)
+
+        self.assertEqual(1, state["calls"],
+                         "a hit must be cached under the default cache: True")
+
     # --- auth: None suppression ---
 
     def test_auth_none_still_suppresses_the_credential(self):
@@ -283,6 +360,43 @@ class TestSecretsReviewPins(unittest.TestCase):
             srv.shutdown()
             srv.server_close()
 
+    def test_auth_none_buys_no_token_at_all(self):
+        # `auth: None` SUPPRESSES THE PURCHASE, not just the retry.
+        #
+        # resolve() runs before _with_refresh's suppression check, so the
+        # refresh token used to go to the token endpoint in a request body
+        # even here. Stopping the retry does not unsend it - and only the
+        # token endpoint can see this, which is why the API-header
+        # assertion above is not enough.
+        tricky = "REFRESH01"
+        _TokenEndpoint.refresh_seen = None
+
+        srv = http.server.HTTPServer(("127.0.0.1", 0), _TokenEndpoint)
+        thread = threading.Thread(target=srv.serve_forever, daemon=True)
+        thread.start()
+        try:
+            sdk = secrets_sdk({
+                "base": "http://127.0.0.1:%d/api" % srv.server_port,
+                "auth": None,
+                "feature": {"secrets": {
+                    "active": True,
+                    "name": "refresh_token",
+                    "exchange": {"active": True, "refresh": tricky},
+                }},
+            })
+
+            utility = sdk._utility
+            ctx = utility.make_context({"opname": "load"}, sdk.get_root_ctx())
+            utility.feature_hook(ctx, "PreSpec")
+
+            self.assertIsNone(_TokenEndpoint.refresh_seen,
+                              "auth: None suppressed the credential but the "
+                              "refresh token was still POSTed to the "
+                              "exchange endpoint")
+        finally:
+            srv.shutdown()
+            srv.server_close()
+
     def test_uncached_miss_retracts_the_credential(self):
         # `cache: False` re-asks the chain per operation; when a provider
         # that answered once reports a MISS (a revoked secret), the value

package/project/.sdk/tm/py/test/voxgig_omni/__init__.py

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni 0.1.0 (python/voxgig_omni/__init__.py)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 """voxgig_omni - shared multi-language test runner."""
 

package/project/.sdk/tm/py/test/voxgig_omni/runner.py

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni 0.1.0 (python/voxgig_omni/runner.py)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 """Omni: the shared multi-language test runner.
 

package/project/.sdk/tm/py/test/voxgig_omni/util.py

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni 0.1.0 (python/voxgig_omni/util.py)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 """Omni internal JSON utilities.
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/capability.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/capability.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/catalog.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/catalog.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/config.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/config.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/depend.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/depend.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/env.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/env.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/export.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/export.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/graph.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/graph.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/host.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/host.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/order.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/order.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/point.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/point.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/ref.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/ref.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/resolve.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/resolve.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/types.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/types.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin/version.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin/version.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_plugin.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ruby/lib/voxgig_plugin.rb)
-# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/addr.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/addr.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/aws.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/aws.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/azuresecrets.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/azuresecrets.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/boru.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/boru.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/doppler.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/doppler.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/gcpsecrets.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/gcpsecrets.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/hashicorp.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/hashicorp.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/httpjson.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/httpjson.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/infisical.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/infisical.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/onepassword.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/onepassword.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/secretspec.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/secretspec.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/sigv4.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/sigv4.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/providers.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/providers.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/sekreto.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/sekreto.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets_feature.rb

@@ -222,11 +222,19 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
     _with_refresh(ctx, url, fetchdef, inner)
   end
 
-  # One resolution, shared by every concurrent caller. A settled SUCCESS is
+  # One resolution, shared by every concurrent caller. A settled HIT is
   # kept only when caching is on (`cache: false` means every request asks
   # the chain again); a FAILURE is never cached, so a transient vault
   # outage does not poison the client after the vault recovers.
   #
+  # A MISS is not kept either, however caching is set. That rule is
+  # sekreto's, not this feature's: `A miss is never cached: the next read
+  # asks again`, in sekreto's own source. Keeping a settled miss here would
+  # override that from the layer above, and a secret provisioned after
+  # startup - a mounted file, a policy granted a minute late - would never
+  # be picked up for the life of the client. `cache` is about caching a
+  # HIT; it was never a promise to keep saying no.
+  #
   # Answers the error rather than raising it: the caller is the transport
   # gate, whose contract is a [value, err] pair.
   def resolve
@@ -236,20 +244,23 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
       return nil if @resolved
 
       begin
-        _resolve_once
+        hit = _resolve_once
       rescue StandardError => e
         return e
       end
 
-      @resolved = true if @cache
+      @resolved = true if @cache && hit
       nil
     end
   end
 
   private
 
+  # Resolve once, answering whether a credential came out of it. That
+  # boolean is the whole of what resolve needs to tell a cacheable HIT from
+  # a miss it must not keep.
   def _resolve_once
-    return if @sekreto.nil?
+    return false if @sekreto.nil?
 
     # Miss-vs-error: `try` answers nil for "no store has it" and RAISES for
     # "a store could not answer" - only the miss falls through.
@@ -264,7 +275,7 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
       # the chain HITS while one is set and the miss branch is
       # unreachable.)
       _setcred(found)
-      return
+      return !found.nil?
     end
 
     # Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -283,9 +294,20 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
     # A starting access token was supplied. Spend it: if it is stale the
     # API answers with an expiry status and the wrapper buys another, which
     # is the same path expiry takes anyway.
-    return unless apikey.nil? || apikey.empty?
+    return true unless apikey.nil? || apikey.empty?
+
+    # `auth: nil` is the documented way to send NO credential, and a
+    # purchase is a credential-bearing call: the refresh token goes to the
+    # token endpoint in the request body. _with_refresh honours suppression
+    # for the RETRY, but it runs after this - by then the refresh token has
+    # already left the process, and no later check can call it back. The
+    # suppression has to be honoured here, before the first purchase, or it
+    # only ever half-held.
+    return false if @liveopts["auth"].nil?
 
     _buy
+
+    true
   end
 
   # Buy a token and try the request again when the API says the current one