Jonathan M HsiehandClaude Opus 5 1f8a790004 feat(secrets): address Secrets by namespace path ...

A Secret is identified by a namespace path plus a name, and resolution is
exact: a Secret under `["prod"]` is not visible from `["prod", "vision"]` and
never falls back to a parent.

- Every verb takes `namespace_path` keyword-only, defaulting to the root, and
  so does `EnvVarSecret`. Keyword-only from the start, so a later parameter
  cannot be mistaken for the path.
- `EnvVarSecret` pins the path at construction and records the full id --
  path plus name, joined with `$`. A worker resolves the id it was handed and
  never re-resolves against its own default namespace, so the same Function
  resolves the same Secret wherever it runs.
- A root path is omitted from the request body rather than sent empty, so a
  root request is byte identical to one from a client that predates this. That
  is what lets the parameter ship before every server implements it -- a
  server that does not is asked nothing new.
- Segments follow the Secret name rule, and necessarily so: the join has to
  read the same from either side, so neither may contain the delimiter.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XE1UwYKsgbb3USBfkqCE6v

2026-09-09 03:22:11 +00:00

..

lancedb

feat(secrets): address Secrets by namespace path

2026-09-09 03:22:11 +00:00

tests

feat(secrets): address Secrets by namespace path

2026-09-09 03:22:11 +00:00

type_tests

fix(python): expose inline types to downstream checkers (#3817)

2026-08-07 17:31:42 +08:00