fix: deduplicate concurrent signer credential refreshes

Cargo.toml

@@ -57,6 +57,7 @@ hmac = "0.13"
 http = "1"
 jiff = "0.2"
 log = "0.4"
+mea = "0.6.4"
 pem = "4.0"
 percent-encoding = "2"
 p256 = { version = "0.14.0", default-features = false, features = ["ecdsa"] }

core/Cargo.toml

@@ -41,6 +41,7 @@ hmac = { workspace = true }
 http = { workspace = true }
 jiff = { workspace = true }
 log = { workspace = true }
+mea = { workspace = true }
 percent-encoding = { workspace = true }
 sha1 = { workspace = true }
 sha2 = { workspace = true }

core/src/lib.rs

@@ -53,8 +53,11 @@
 //! [`SigningCredential::is_valid`] controls whether a cached credential can be reused
 //! without refresh. [`SigningCredential::is_valid_at`] checks exact usability at the
 //! timestamp returned by [`SignRequest::required_valid_until`]. A refreshed credential
-//! only needs to satisfy the exact operation requirement; provider errors are returned
-//! without retrying internally or falling back to the old cached credential.
+//! only needs to satisfy the exact operation requirement. Credential refresh is
+//! serialized per shared cache, so concurrent cold or stale callers reuse a successful
+//! refresh. Refresh failures are not cached, so the next waiting or later caller can
+//! retry. Provider errors are returned without retrying internally or falling back to
+//! the old cached credential.
 //!
 //! ## Example
 //!