@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/rb/test/feature/secrets/secrets_feature_test.rb

@@ -574,6 +574,69 @@ class SecretsFeatureTest < Minitest::Test
       "after the chain reports a miss the retracted credential must not go out; the wire saw #{last['auth'].inspect}")
   end
 
+  # A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+  # feature used to override from the layer above.
+  #
+  # DEFAULT caching here, which is the whole point: `cache: true` is about
+  # holding a HIT, and keeping the settled resolution after a miss meant the
+  # chain was never asked again for the life of the client. A secret
+  # provisioned after startup (a mounted file, a vault policy granted a
+  # minute late) was invisible forever, and the only workaround was giving
+  # up hit caching entirely.
+  def test_a_cached_miss_is_reasked
+    present = false
+    calls = 0
+    wire = Wire.new
+    client = secrets_client(wire, {
+      "feature" => { "secrets" => {
+        "active" => true,
+        "providers" => [CustomProvider.new { |_name|
+          calls += 1
+          present ? "LATEKEY01" : nil
+        }],
+      } },
+    })
+
+    drive_op(client, wire)
+    first = wire.api[0]
+    refute(first["has"] && !first["auth"].to_s.empty?,
+      "the chain has nothing yet, so no credential should go out")
+
+    asked = calls
+    assert_operator asked, :>, 0
+
+    # The secret is provisioned while the client is live.
+    present = true
+
+    drive_op(client, wire)
+    assert_credential(wire.api[-1]["auth"], "LATEKEY01")
+
+    assert_operator calls, :>, asked,
+      "the MISS was cached: a secret that appears later can never be picked up"
+  end
+
+  # The other half of the same rule: a HIT is still cached by default, so
+  # the fix above must not turn every request into a chain walk.
+  def test_a_cached_hit_is_kept
+    calls = 0
+    wire = Wire.new
+    client = secrets_client(wire, {
+      "feature" => { "secrets" => {
+        "active" => true,
+        "providers" => [CustomProvider.new { |_name|
+          calls += 1
+          "STABLEKEY01"
+        }],
+      } },
+    })
+
+    drive_op(client, wire)
+    drive_op(client, wire)
+
+    assert_equal 1, calls,
+      "a hit must be cached under the default cache: true"
+  end
+
   def test_auth_nil_suppresses_the_credential_chain_or_no_chain
     setenv("APIKEY", "ENVKEY03")
     wire = Wire.new
@@ -697,6 +760,36 @@ class SecretsFeatureTest < Minitest::Test
     clearenv("REFRESH_TOKEN")
   end
 
+  # `auth: nil` SUPPRESSES THE PURCHASE, not just the retry.
+  #
+  # resolve runs before _with_refresh's suppression check, so the refresh
+  # token used to go to the token endpoint in a request body even here.
+  # Stopping the retry does not unsend it - this asserts on the token
+  # endpoint, which is the half the API-header assertions cannot see.
+  def test_auth_nil_buys_no_token_at_all
+    setenv("REFRESH_TOKEN", "REFRESH01")
+    wire = Wire.new
+    wire.apistatus = [401]
+
+    client = secrets_client(wire, {
+      "auth" => nil,
+      "feature" => secrets_opts({
+        "name" => "refresh_token",
+        "exchange" => { "active" => true },
+      }),
+    })
+
+    drive_op(client, wire)
+
+    assert_equal 0, wire.token.length,
+      "auth nil suppressed the credential but the refresh token was still " \
+      "POSTed to the exchange endpoint"
+    refute wire.api[0]["has"],
+      "no credential may be sent when auth is suppressed"
+  ensure
+    clearenv("REFRESH_TOKEN")
+  end
+
   # A second refusal on a token bought moments ago is a real failure, not a
   # spin: exactly one rebuy, and the refusal is returned as it stands.
   def test_a_second_refusal_is_returned_as_is

package/project/.sdk/tm/rb/test/vendor/omni/runner.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni sdk-20260908-1556-0 (ruby/lib/voxgig_omni/runner.rb)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni: the shared multi-language test runner.
 #

package/project/.sdk/tm/rb/test/vendor/omni/util.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni sdk-20260908-1556-0 (ruby/lib/voxgig_omni/util.rb)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni internal JSON utilities.
 #

package/project/.sdk/tm/rb/test/vendor/omni/voxgig_omni.rb

@@ -1,5 +1,5 @@
 # VENDORED: @voxgig/omni sdk-20260908-1556-0 (ruby/lib/voxgig_omni.rb)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # voxgig_omni - shared multi-language test runner.
 

package/project/.sdk/tm/rust/feature/secrets/plugin/capability.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/capability.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Capabilities (§11.1).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/catalog.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/catalog.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The definition catalog (§10.1).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/config.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/config.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The declarative document (§9): normalization, and the ten-level
 //! precedence ladder.

package/project/.sdk/tm/rust/feature/secrets/plugin/depend.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/depend.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dependency cardinality, policy, and the restart graph (§11.3).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/env.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/env.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Environment overrides (§9.5) - level 7 of the ladder.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/export.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/export.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Exports (§11).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/graph.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/graph.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Whole-graph resolution (§11.4) - a phase, not a discovery.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/host.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/host.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The host: the lifecycle state machine (§5), extension points (§6), and
 //! resource capture (§8).

package/project/.sdk/tm/rust/feature/secrets/plugin/mod.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/lib.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 pub mod value;
 pub mod types;

package/project/.sdk/tm/rust/feature/secrets/plugin/order.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/order.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Ordering (§7) - one rule, one place.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/point.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/point.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Extension points (§6). Three kinds, chosen because they are what the
 //! two existing systems actually needed, and no more.

package/project/.sdk/tm/rust/feature/secrets/plugin/refs.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/refs.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Identity: name+tag, written `name$tag` (§4).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/resolve.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/resolve.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dynamic resolution (§10.2) - name to candidate module ids.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/types.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/types.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Shared types. Deliberately small: the design's §19 budget says the
 //! library owns naming, configuration, lifecycle, ordering, binding and

package/project/.sdk/tm/rust/feature/secrets/plugin/value.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/value.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The JSON value, and the only parser this port has.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/version.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/version.rs)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Versions and ranges (§11.2).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugins/aws/crypto.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/aws/src/crypto.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! SHA-256 and HMAC-SHA256, hand-rolled.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugins/aws/sigv4.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/aws/src/sigv4.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! AWS Signature Version 4, hand-rolled.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugins/aws.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/aws/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The two AWS providers - Secrets Manager and SSM Parameter Store -
 //! and the request signing they need, as voxgig/plugin definitions.

package/project/.sdk/tm/rust/feature/secrets/plugins/azuresecrets.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/azuresecrets/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The Azure Key Vault provider, as a voxgig/plugin definition.
 

package/project/.sdk/tm/rust/feature/secrets/plugins/boru.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/boru/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The boru vault provider, as a voxgig/plugin definition.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugins/doppler.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/doppler/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The Doppler provider, as a voxgig/plugin definition.
 

package/project/.sdk/tm/rust/feature/secrets/plugins/gcpsecrets.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/gcpsecrets/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The GCP Secret Manager provider, as a voxgig/plugin definition.
 

package/project/.sdk/tm/rust/feature/secrets/plugins/hashicorp.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/hashicorp/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The HashiCorp Vault provider, as a voxgig/plugin definition.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson/http.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/httpjson/src/http.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Just enough HTTP to ask a vault for a secret.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson/json.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/httpjson/src/json.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Minimal JSON support for sekreto.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/httpjson/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The HTTP-JSON client the vault plugins share, and the helpers that go
 //! with it.

package/project/.sdk/tm/rust/feature/secrets/plugins/infisical.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/infisical/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The Infisical provider, as a voxgig/plugin definition.
 

package/project/.sdk/tm/rust/feature/secrets/plugins/onepassword.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/onepassword/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The 1Password Connect provider, as a voxgig/plugin definition.
 

package/project/.sdk/tm/rust/feature/secrets/plugins/secretspec.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/secretspec/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The SecretSpec provider, as a voxgig/plugin definition.
 //!

package/project/.sdk/tm/rust/feature/secrets/sekreto/addr.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/src/addr.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The plaintext-address guard, in the core because it is pure - a
 //! handful of string steps, no socket - and because it is on the spec:

package/project/.sdk/tm/rust/feature/secrets/sekreto/mod.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! sekreto: one interface for secrets, wherever they live.
 //!

package/project/.sdk/tm/rust/feature/secrets/sekreto/providers.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/src/providers.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! What a provider is, what its declarative form looks like, how a
 //! provider kind becomes a voxgig/plugin definition - and the four

package/project/.sdk/tm/rust/feature/secrets/sekreto/sekreto.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/src/sekreto.rs)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! sekreto: one interface for secrets, wherever they live.
 //!

package/project/.sdk/tm/rust/feature/secrets.rs

@@ -507,9 +507,17 @@ fn secrets_call(state: &Rc<RefCell<SecretsState>>, arg: &Value) -> Value {
 
 // ---- resolution ---------------------------------------------------------
 
-// One resolution, shared by every request. A settled SUCCESS is kept only
-// when caching is on; a FAILURE is never kept, so a transient vault outage
-// never poisons the client permanently - the next operation asks again.
+// One resolution, shared by every request. A settled HIT is kept only when
+// caching is on; a FAILURE is never kept, so a transient vault outage never
+// poisons the client permanently - the next operation asks again.
+//
+// A MISS is not kept either, however caching is set. That rule is
+// sekreto's, not this feature's: `A miss is never cached: the next read
+// asks again`, in sekreto's own source. Keeping a settled miss here would
+// override that from the layer above, and a secret provisioned after
+// startup - a mounted file, a policy granted a minute late - would never be
+// picked up for the life of the client. `cache` is about caching a HIT; it
+// was never a promise to keep saying no.
 fn resolve(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
     {
         let s = state.borrow();
@@ -522,9 +530,9 @@ fn resolve(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
     }
 
     match resolve_once(state) {
-        Ok(()) => {
+        Ok(hit) => {
             let cache = state.borrow().cache;
-            if cache {
+            if cache && hit {
                 state.borrow_mut().resolved = true;
             }
             Ok(())
@@ -536,11 +544,14 @@ fn resolve(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
     }
 }
 
-fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
+// Resolve once, answering whether a credential came out of it. That bool is
+// the whole of what resolve needs to tell a cacheable HIT from a miss it
+// must not keep.
+fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<bool, ProjectNameError> {
     let name = {
         let s = state.borrow();
         if s.sek.is_none() {
-            return Ok(());
+            return Ok(false);
         }
         s.secretname.clone()
     };
@@ -568,8 +579,9 @@ fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameErro
             // apikey OPTION is never lost here - it seats FIRST in the
             // chain as a memory provider, so the chain HITS while one is
             // set and the miss branch is unreachable.)
+            let hit = found.is_some();
             s.cred = found.unwrap_or_default();
-            return Ok(());
+            return Ok(hit);
         }
 
         // Exchanging: what the chain resolved is the REFRESH token, kept
@@ -589,11 +601,22 @@ fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameErro
             // A starting access token was supplied. Spend it: if it is
             // stale the API answers with an expiry status and the wrapper
             // buys another, which is the same path expiry takes anyway.
-            return Ok(());
+            return Ok(true);
+        }
+
+        // `auth: null` is the documented way to send NO credential, and a
+        // purchase is a credential-bearing call: the refresh token goes to
+        // the token endpoint in the request body. with_refresh honours
+        // suppression for the RETRY, but it runs after this - by then the
+        // refresh token has already left the process, and no later check
+        // can call it back. The suppression has to be honoured here, before
+        // the first purchase, or it only ever half-held.
+        if !authactive(&s.options) {
+            return Ok(false);
         }
     }
 
-    buy(state).map(|_| ())
+    buy(state).map(|_| true)
 }
 
 // ---- the transport seam -------------------------------------------------

package/project/.sdk/tm/rust/tests/feature/secrets/main.rs

@@ -989,6 +989,90 @@ fn cache_false_asks_the_chain_on_every_request() {
     credential_is(call_auth(&wire.api(), 1), "KEY2");
 }
 
+// A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this feature
+// used to override from the layer above.
+//
+// DEFAULT caching here, which is the whole point: `cache: true` is about
+// holding a HIT (the test below pins that half), and keeping the settled
+// resolution after a miss meant the chain was never asked again for the life
+// of the client. A secret provisioned after startup (a mounted file, a vault
+// policy granted a minute late) was invisible forever.
+#[test]
+fn cache_true_re_asks_after_a_miss() {
+    let wire = Wire::new();
+    let calls = Rc::new(RefCell::new(0i64));
+    let present = Rc::new(RefCell::new(false));
+    let n = calls.clone();
+    let p = present.clone();
+
+    let client = sdk(
+        &wire,
+        vec![providers(vec![callable(move |_name| {
+            *n.borrow_mut() += 1;
+            if *p.borrow() {
+                Value::str("LATEKEY01")
+            } else {
+                Value::Noval
+            }
+        })])],
+    );
+
+    client
+        .direct(jo(vec![("path", Value::str("/one"))]))
+        .expect("direct");
+    assert_eq!(
+        call_auth(&wire.api(), 0),
+        None,
+        "the chain has nothing yet, so no credential should go out: {}",
+        wire.trace()
+    );
+
+    let asked = *calls.borrow();
+    assert!(0 < asked, "the chain was never asked");
+
+    // The secret is provisioned while the client is live.
+    *present.borrow_mut() = true;
+
+    client
+        .direct(jo(vec![("path", Value::str("/two"))]))
+        .expect("direct");
+
+    assert!(
+        asked < *calls.borrow(),
+        "the MISS was cached: a secret that appears later can never be picked up"
+    );
+    credential_is(call_auth(&wire.api(), 1), "LATEKEY01");
+}
+
+// The other half of the same rule: a HIT is still cached by default, so the
+// fix above must not turn every request into a chain walk.
+#[test]
+fn cache_true_keeps_a_hit() {
+    let wire = Wire::new();
+    let calls = Rc::new(RefCell::new(0i64));
+    let n = calls.clone();
+
+    let client = sdk(
+        &wire,
+        vec![providers(vec![callable(move |_name| {
+            *n.borrow_mut() += 1;
+            Value::str("STABLEKEY01")
+        })])],
+    );
+
+    for _ in 0..2 {
+        client
+            .direct(jo(vec![("path", Value::str("/thing"))]))
+            .expect("direct");
+    }
+
+    assert_eq!(
+        *calls.borrow(),
+        1,
+        "a hit must be cached under the default cache: true"
+    );
+}
+
 // An UNCACHED miss after a hit is a revocation: the resolved value must
 // stop going out.
 #[test]
@@ -1403,6 +1487,18 @@ fn exchange_auth_null_suppresses_and_is_never_retried() {
         "no credential may be sent when auth is suppressed: {}",
         wire.trace()
     );
+
+    // AND NO PURCHASE. resolve() runs before with_refresh's suppression
+    // check, so the refresh token used to go to the token endpoint in a
+    // request body even here. Stopping the retry does not unsend it, and
+    // only the token endpoint can see this.
+    assert_eq!(
+        wire.token().len(),
+        0,
+        "auth null suppressed the credential but the refresh token was still \
+         POSTed to the exchange endpoint: {}",
+        wire.trace()
+    );
 }
 
 // The exchange with NO system.fetch: the ordinary case, where make_options

package/project/.sdk/tm/rust/tests/vendor/omni/json.rs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (rust/src/json.rs)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The omni JSON value model, with a small in-tree parser.
 //!