Skip to main content

NexusClient::create

Validates the configuration, authenticates, and performs the initial sync before returning. NexusClient is Clone (an Arc bump) and Debug (credentials redacted).
Errors: Config, Unauthorized, BadRequest, Forbidden, NotFound, Billing, RateLimited, Quarantined, SyncFailed, WifNotConfigured, WifTokenExchangeFailed, DeveloperCredentials, SessionExpired, Transport, ResponseTooLarge, Json - the mandatory initial sync (and, with WIF, the token exchange) can surface any status-mapping or parsing error, not only the ones tied to construction.

Read methods (synchronous)

They read the in-memory snapshot: no network call, and they never block on one. A stale snapshot is served as-is while a single background refresh runs.
get_secret returns text secrets only. find_flag returns None for an absent flag, which is a different answer from present-and-false.

File-type secrets

The file is mode 0600 inside a private, unguessable, mode-0700 directory owned by this client, created with create_new + O_NOFOLLOW and renamed into place - so a reader never sees a half-written file and no other local user can read it. The filename is a hash, so neither the key nor the value appears in the path your application logs. Two clients holding the same secret get different paths. A secret removed on the server is removed from disk on the next sync, and everything is deleted on close() or when the last clone of the client is dropped. get_secret_file_path enforces the same authorisation gates as get_secret. On Windows there is no 0600 equivalent - the file inherits the private directory’s ACL.

Write methods (async, secret key required)

A public key is refused with PublicKeyRestricted before any HTTP call. Keys are percent-encoded into the path.

evaluate_ab

Batch-evaluates AB Testing flags. AbAddonNotAvailable on 403, RateLimited on 429. A result that is not a boolean is reported as an error rather than silently read as false. Attribute values are strings. The service compares them with eq, neq and in, so string equality is the whole of what a cohort rule can express. At most 200 keys per call; an empty keys array is rejected by the service. Available identically on the blocking client, without .await.

sync

Forces a sync, ignoring the billing and quarantine back-offs - the caller asked for it. Syncs are serialised, so a burst produces one request at a time and an older snapshot can never overwrite a newer one.

Live updates and shutdown

run_stream() starts SSE live updates on a tokio task and is idempotent - a second call opens no second connection. See SSE live updates.
Dropping the handle leaves the stream running. close() stops all background work and removes materialised file-type secrets. It is final - nothing restarts them, and an in-flight sync cannot re-arm them - and idempotent. Cache reads keep working afterwards. The same cleanup runs automatically when the last clone of the client is dropped, including while the stream is active.

blocking::NexusClient

With the blocking feature, westyx_nexus::blocking::NexusClient mirrors every method above without .await, plus as_async() to reach the async client underneath. It owns a small runtime on its own threads, so its calls work from anywhere - including inside another runtime.

NexusError

#[non_exhaustive] - match with a _ arm. See Error handling for the full table.