@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/zig/feature/secrets/plugin/version.zig

@@ -0,0 +1,139 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/version.zig)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Versions and ranges (§11.2).
+//!
+//! TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
+//! concrete version. A requirement declares `range`. A requirement is
+//! satisfied when the names match, the `match` passes, and the
+//! provider's `version` falls inside the requirement's `range`. That is
+//! the whole rule — there is no third field and no second comparison.
+
+const std = @import("std");
+const v = @import("value.zig");
+const t = @import("types.zig");
+
+/// A COMPONENT IS BOUNDED, like a ref is (§4's 1024).
+///
+/// The grammar admits an unbounded digit sequence, and every language
+/// then disagrees about what happens past its integer range: JavaScript
+/// silently loses precision, Go's Atoi errors (and a port ignoring that
+/// gets 0), C overflows, Python is exact, Haskell's Integer is
+/// unbounded. `satisfies("0", "9223372036854775808")` was false in the
+/// canonical and true in go, from the same corpus.
+///
+/// 2^31-1 because every port has a signed 32-bit integer, and no real
+/// version has ever needed more. Stated rather than left to arithmetic
+/// nobody agrees on. Found by review of the go port.
+const COMPONENT_MAX: i64 = 2147483647;
+
+const Parsed = struct { parts: [3]i64, overflow: bool };
+
+/// `^(\d+)(?:\.(\d+))?(?:\.(\d+))?$`, by hand: three components, digits
+/// only, no leading sign, no empty component. Written out rather than
+/// handed to a regex because the bound above has to be checked per
+/// component anyway.
+fn parse3(s: []const u8) ?Parsed {
+    if (s.len == 0) return null;
+    var out = Parsed{ .parts = .{ 0, 0, 0 }, .overflow = false };
+    var i: usize = 0;
+    var part: usize = 0;
+    while (part < 3) : (part += 1) {
+        if (i >= s.len) return if (part > 0) out else null; // fewer than three is fine
+        if (part > 0) {
+            if (s[i] != '.') return null;
+            i += 1;
+        }
+        const start = i;
+        var acc: i64 = 0;
+        while (i < s.len and s[i] >= '0' and s[i] <= '9') : (i += 1) {
+            if (!out.overflow) {
+                acc = acc * 10 + @as(i64, s[i] - '0');
+                if (acc > COMPONENT_MAX) out.overflow = true;
+            }
+        }
+        if (start == i) return null; // an empty component is not a number
+        out.parts[part] = acc;
+    }
+    return if (i == s.len) out else null;
+}
+
+fn triple(n: [3]i64) *v.Value {
+    const out = v.vlist();
+    for (n) |x| v.push(out, v.vnum(@floatFromInt(x)));
+    return out;
+}
+
+pub fn parserange(range: ?*v.Value) t.Err!*v.Value {
+    if (!v.isStr(range) or v.asStr(range).len == 0) {
+        const shown = if (v.isStr(range)) v.asStr(range) else "";
+        return t.fail("plugin_bad_range", v.print("invalid range: {s}", .{shown}), t.details1("range", if (v.isNull(range)) v.vnull() else range));
+    }
+    const s = v.asStr(range);
+    // Two forms and no more (§11.2):
+    //   '2.1'   >= 2.1.0 and < 3.0.0
+    //   '~2.1'  >= 2.1.0 and < 2.2.0
+    const tilde = s[0] == '~';
+    const body = if (tilde) s[1..] else s;
+
+    const p = parse3(body) orelse
+        return t.fail("plugin_bad_range", v.print("invalid range: {s}", .{s}), t.details1("range", range));
+    if (p.overflow) {
+        return t.fail("plugin_bad_range", v.print("version component out of range in {s}", .{s}), t.details1("range", range));
+    }
+
+    const lo = p.parts;
+    const hi: [3]i64 = if (tilde)
+        .{ p.parts[0], p.parts[1] + 1, 0 }
+    else
+        .{ p.parts[0] + 1, 0, 0 };
+
+    const out = v.vmap();
+    v.set(out, "lo", triple(lo));
+    v.set(out, "hi", triple(hi));
+    return out;
+}
+
+pub fn parseversion(version: ?*v.Value) t.Err!*v.Value {
+    if (!v.isStr(version)) {
+        return t.fail("plugin_bad_range", "invalid version", t.details1("version", if (v.isNull(version)) v.vnull() else version));
+    }
+    const s = v.asStr(version);
+    // `plugin_bad_range` either way — the same code the rest of the
+    // grammar's failures use, because "this is not a version I can
+    // compare" is one fact however it went wrong.
+    const p = parse3(s) orelse
+        return t.fail("plugin_bad_range", v.print("invalid version: {s}", .{s}), t.details1("version", version));
+    if (p.overflow) {
+        return t.fail("plugin_bad_range", v.print("version component out of range in {s}", .{s}), t.details1("version", version));
+    }
+    return triple(p.parts);
+}
+
+pub fn vercmp(a: ?*v.Value, b: ?*v.Value) i32 {
+    var i: usize = 0;
+    while (i < 3) : (i += 1) {
+        const x = v.asNum(v.at(a, i));
+        const y = v.asNum(v.at(b, i));
+        if (x != y) return if (x < y) -1 else 1;
+    }
+    return 0;
+}
+
+pub fn satisfies(version: ?*v.Value, range: ?*v.Value) t.Err!bool {
+    const ver = try parseversion(version);
+    const r = try parserange(range);
+    return vercmp(ver, v.get(r, "lo")) >= 0 and vercmp(ver, v.get(r, "hi")) < 0;
+}
+
+/// `satisfies` for the internal callers that treat an unparseable
+/// version or range as "does not satisfy" — Capability and Graph, both
+/// of which run over data the corpus has already admitted.
+pub fn satisfiesq(version: ?*v.Value, range: ?*v.Value) bool {
+    return satisfies(version, range) catch {
+        // TAKE FIRST: the parked diagnostic is discarded deliberately
+        // here, and leaving it parked would hand it to the next handler.
+        _ = t.take();
+        return false;
+    };
+}

package/project/.sdk/tm/zig/feature/secrets/plugins/aws.zig

@@ -0,0 +1,294 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/aws.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! AWS Secrets Manager and SSM Parameter Store - one sekreto plugin,
+//! two kinds: `awssecrets` and `awsparams`.
+//!
+//! Requests are SigV4-signed in-tree (sigv4.zig, beside this file): the
+//! HMAC-SHA256 that needs lives here and not in the core, so a chain
+//! that never names AWS never links a hash function.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+const sigv4 = @import("sigv4.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// Region and credentials, from config first and the standard AWS_*
+/// environment variables second. Missing either is an error: an AWS store
+/// with no credentials could not answer.
+const AwsAuth = struct {
+    region: []const u8,
+    keyid: []const u8,
+    secret: []const u8,
+    session: []const u8,
+};
+
+/// The common half of both AWS providers.
+const Aws = struct {
+    config: sekreto.Config,
+    region: []const u8,
+    keyid: []const u8,
+    secret: []const u8,
+    session: []const u8,
+    addr: []const u8,
+    prefix: []const u8,
+
+    fn auth(self: Aws, alloc: Allocator) Allocator.Error!Answer(AwsAuth) {
+        const region = httpjson.firstof(self.config, self.region, &.{ "AWS_REGION", "AWS_DEFAULT_REGION" });
+        const keyid = httpjson.firstof(self.config, self.keyid, &.{"AWS_ACCESS_KEY_ID"});
+        const secret = httpjson.firstof(self.config, self.secret, &.{"AWS_SECRET_ACCESS_KEY"});
+        const session = httpjson.firstof(self.config, self.session, &.{"AWS_SESSION_TOKEN"});
+
+        if (0 == region.len) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: aws: no region (set region or AWS_REGION)",
+                .{},
+            ) };
+        }
+
+        if (0 == keyid.len or 0 == secret.len) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: aws: no credentials (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)",
+                .{},
+            ) };
+        }
+
+        return .{ .ok = .{ .region = region, .keyid = keyid, .secret = secret, .session = session } };
+    }
+
+    /// One signed call to an AWS JSON-1.1 API.
+    fn call(
+        self: Aws,
+        alloc: Allocator,
+        service: []const u8,
+        target: []const u8,
+        payload: []const u8,
+    ) Allocator.Error!httpjson.Result {
+        const credentials = switch (try self.auth(alloc)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        // The China partition lives under its own suffix; every other
+        // commercial region is plain amazonaws.com.
+        const suffix: []const u8 = if (std.mem.startsWith(u8, credentials.region, "cn-"))
+            ".amazonaws.com.cn"
+        else
+            ".amazonaws.com";
+
+        const addr = if (0 != self.addr.len)
+            self.addr
+        else
+            try std.fmt.allocPrint(alloc, "https://{s}.{s}{s}", .{ service, credentials.region, suffix });
+
+        switch (try sekreto.checkaddr(alloc, addr)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        const url = try std.fmt.allocPrint(alloc, "{s}/", .{httpjson.trimslash(addr)});
+
+        const unsigned = [_]sigv4.Pair{
+            .{ .name = "content-type", .value = "application/x-amz-json-1.1" },
+            .{ .name = "x-amz-target", .value = target },
+        };
+
+        const signed = try sigv4.sign(alloc, .{
+            .method = "POST",
+            .url = url,
+            .headers = &unsigned,
+            .body = payload,
+            .service = service,
+            .region = credentials.region,
+            .keyid = credentials.keyid,
+            .secret = credentials.secret,
+            .session = credentials.session,
+            .datetime = try awsnow(alloc, self.config.io),
+        });
+
+        var headers: std.ArrayList(httpjson.Header) = .empty;
+        for (unsigned) |header| {
+            try headers.append(alloc, .{ .name = header.name, .value = header.value });
+        }
+        for (signed) |header| {
+            try headers.append(alloc, .{ .name = header.name, .value = header.value });
+        }
+
+        return httpjson.fetchjson(alloc, self.config.io, .POST, url, headers.items, payload);
+    }
+};
+
+/// The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now.
+fn awsnow(alloc: Allocator, io: std.Io) Allocator.Error![]const u8 {
+    const seconds: u64 = @intCast(@divTrunc(httpjson.nowms(io), 1000));
+
+    const day = std.time.epoch.EpochSeconds{ .secs = seconds };
+    const yearday = day.getEpochDay().calculateYearDay();
+    const monthday = yearday.calculateMonthDay();
+    const clock = day.getDaySeconds();
+
+    return std.fmt.allocPrint(alloc, "{d:0>4}{d:0>2}{d:0>2}T{d:0>2}{d:0>2}{d:0>2}Z", .{
+        yearday.year,
+        monthday.month.numeric(),
+        monthday.day_index + 1,
+        clock.getHoursIntoDay(),
+        clock.getMinutesIntoHour(),
+        clock.getSecondsIntoMinute(),
+    });
+}
+
+/// Does this AWS error body name one of the not-found types? Those are a
+/// miss; every other failure is a store that could not answer.
+fn awsmiss(body: ?std.json.Value, want: []const u8) bool {
+    const errtype = httpjson.jstr(httpjson.jget(body, "__type")) orelse return false;
+    return null != std.mem.indexOf(u8, errtype, want);
+}
+
+/// AWS Secrets Manager.
+///
+/// `api.token` reads the secret named `api` (the vaultref path, so
+/// `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+/// SecretString - the AWS idiom of one JSON map per secret. A SecretString
+/// that is not JSON is the value itself, under the conventional field
+/// `value`. Requests are SigV4-signed in-tree; see sigv4.zig.
+pub const AwsSecretsProvider = struct {
+    aws: Aws,
+
+    pub fn lookup(self: *AwsSecretsProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        const ref = switch (try sekreto.vaultref(alloc, name)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const payload = try httpjson.jsonobject(alloc, &.{.{ .key = "SecretId", .value = ref.path }});
+
+        const res = switch (try self.aws.call(alloc, "secretsmanager", "secretsmanager.GetSecretValue", payload)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        if (400 == res.status and awsmiss(res.body, "ResourceNotFoundException")) {
+            return .{ .ok = null };
+        }
+
+        if (200 != res.status) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: aws secretsmanager error: {d}",
+                .{res.status},
+            ) };
+        }
+
+        const text = httpjson.jstr(httpjson.jget(res.body, "SecretString")) orelse {
+            // A binary secret has no fields to address; only the
+            // conventional `value` field can mean "the bytes themselves".
+            const binary = httpjson.jstr(httpjson.jget(res.body, "SecretBinary")) orelse return .{ .ok = null };
+            if (!std.mem.eql(u8, "value", ref.field)) {
+                return .{ .ok = null };
+            }
+            // A payload that will not decode was reported as null - a
+            // MISS - so the chain carried on to a weaker store. A store
+            // that answered incoherently could not answer.
+            return .{ .ok = try sekreto.unbase64(alloc, binary) orelse
+                return .{ .err = try sekreto.fail(alloc, "sekreto: aws secretsmanager: undecodable secret", .{}) } };
+        };
+
+        const parsed = std.json.parseFromSlice(std.json.Value, alloc, text, .{}) catch {
+            // A plain-string secret is the whole value; it has no named
+            // fields.
+            return .{ .ok = if (std.mem.eql(u8, "value", ref.field)) text else null };
+        };
+
+        if (.object == parsed.value) {
+            return .{ .ok = httpjson.jstr(httpjson.jget(parsed.value, ref.field)) };
+        }
+
+        return .{ .ok = if (std.mem.eql(u8, "value", ref.field)) text else null };
+    }
+
+    pub fn describe(self: *AwsSecretsProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        // sekreto.Config only, never the environment: describe() feeds the spec's
+        // sources group, which must answer the same everywhere.
+        return std.fmt.allocPrint(alloc, "awssecrets:{s}", .{self.aws.region});
+    }
+
+    pub fn deinit(_: *AwsSecretsProvider, _: Allocator) void {}
+};
+
+/// AWS SSM Parameter Store.
+///
+/// `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+/// prefix path), decrypted. Parameter Store carries flat strings, so there
+/// is no field indirection.
+pub const AwsParamsProvider = struct {
+    aws: Aws,
+
+    pub fn lookup(self: *AwsParamsProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        const param = switch (try sekreto.awsparam(alloc, name, self.aws.prefix)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const payload = try std.fmt.allocPrint(
+            alloc,
+            "{{\"Name\":{s},\"WithDecryption\":true}}",
+            .{try httpjson.jsonstring(alloc, param)},
+        );
+
+        const res = switch (try self.aws.call(alloc, "ssm", "AmazonSSM.GetParameter", payload)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        if (400 == res.status and awsmiss(res.body, "ParameterNotFound")) {
+            return .{ .ok = null };
+        }
+
+        if (200 != res.status) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: aws ssm error: {d}", .{res.status}) };
+        }
+
+        return .{ .ok = httpjson.jstr(httpjson.jget(httpjson.jget(res.body, "Parameter"), "Value")) };
+    }
+
+    pub fn describe(self: *AwsParamsProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        return std.fmt.allocPrint(alloc, "awsparams:{s}{s}", .{ self.aws.region, self.aws.prefix });
+    }
+
+    pub fn deinit(_: *AwsParamsProvider, _: Allocator) void {}
+};
+
+fn awsof(config: sekreto.Config, spec: ProviderSpec) Aws {
+    return .{
+        .config = config,
+        .region = spec.region,
+        .keyid = spec.keyid,
+        .secret = spec.secret,
+        .session = spec.session,
+        .addr = spec.addr,
+        .prefix = spec.prefix,
+    };
+}
+
+fn makesecrets(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, AwsSecretsProvider, .{ .aws = awsof(config, spec) }) };
+}
+
+fn makeparams(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, AwsParamsProvider, .{ .aws = awsof(config, spec) }) };
+}
+
+/// The `awssecrets` kind.
+pub const awssecrets: sekreto.Definition = sekreto.providerplugin("awssecrets", makesecrets);
+
+/// The `awsparams` kind.
+pub const awsparams: sekreto.Definition = sekreto.providerplugin("awsparams", makeparams);

package/project/.sdk/tm/zig/feature/secrets/plugins/azuresecrets.zig

@@ -0,0 +1,222 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/azuresecrets.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Azure Key Vault - a sekreto plugin. Needs HTTPS.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// Azure Key Vault.
+///
+/// `api.token` reads secret `api-token` (dots flattened to `-`; Key Vault
+/// names allow nothing else), current version. The token comes from config,
+/// then a client-credentials login when tenant/clientid/clientsecret are
+/// given, then the IMDS managed-identity endpoint - so on Azure's own
+/// platform no credential configuration is needed.
+///
+/// As with GCP, the IMDS call is plain http to a link-local host by platform
+/// design and carries no credential; the login and vault addresses are
+/// `checkaddr`-guarded.
+pub const AzureSecretsProvider = struct {
+    alloc: Allocator,
+    config: sekreto.Config,
+    vault: []const u8,
+    token: []const u8,
+    tenant: []const u8,
+    clientid: []const u8,
+    clientsecret: []const u8,
+    loginaddr: []const u8,
+    imdsaddr: []const u8,
+    apiversion: []const u8,
+    livetoken: ?[]const u8,
+    renewat: i64,
+
+    const RESOURCE = "https://vault.azure.net";
+
+    fn login(self: *AzureSecretsProvider, alloc: Allocator) Allocator.Error!Answer([]const u8) {
+        if (0 != self.token.len) {
+            return .{ .ok = self.token };
+        }
+
+        if (0 != self.tenant.len and 0 != self.clientid.len and 0 != self.clientsecret.len) {
+            const loginaddr = if (0 != self.loginaddr.len)
+                self.loginaddr
+            else
+                "https://login.microsoftonline.com";
+
+            switch (try sekreto.checkaddr(alloc, loginaddr)) {
+                .err => |message| return .{ .err = message },
+                .ok => {},
+            }
+
+            const url = try std.fmt.allocPrint(
+                alloc,
+                "{s}/{s}/oauth2/v2.0/token",
+                .{ httpjson.trimslash(loginaddr), self.tenant },
+            );
+
+            const form = try std.fmt.allocPrint(
+                alloc,
+                "grant_type=client_credentials&client_id={s}&client_secret={s}&scope={s}",
+                .{
+                    try httpjson.escape(alloc, self.clientid),
+                    try httpjson.escape(alloc, self.clientsecret),
+                    try httpjson.escape(alloc, RESOURCE ++ "/.default"),
+                },
+            );
+
+            const headers = [_]httpjson.Header{
+                .{ .name = "content-type", .value = "application/x-www-form-urlencoded" },
+            };
+
+            const res = switch (try httpjson.fetchjson(alloc, self.config.io, .POST, url, &headers, form)) {
+                .err => |message| return .{ .err = message },
+                .ok => |got| got,
+            };
+
+            const access = httpjson.jstr(httpjson.jget(res.body, "access_token"));
+
+            if (200 != res.status or null == access) {
+                return .{ .err = try sekreto.fail(
+                    alloc,
+                    "sekreto: azure login failed: {d}",
+                    .{res.status},
+                ) };
+            }
+
+            self.renewat = httpjson.renewafter(self.config.io, httpjson.jnum(httpjson.jget(res.body, "expires_in")));
+            return .{ .ok = access.? };
+        }
+
+        const imds = if (0 != self.imdsaddr.len) self.imdsaddr else "http://169.254.169.254";
+
+        const url = try std.fmt.allocPrint(
+            alloc,
+            "{s}/metadata/identity/oauth2/token?api-version=2018-02-01&resource={s}",
+            .{ httpjson.trimslash(imds), try httpjson.escape(alloc, RESOURCE) },
+        );
+
+        const headers = [_]httpjson.Header{.{ .name = "Metadata", .value = "true" }};
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const access = httpjson.jstr(httpjson.jget(res.body, "access_token"));
+
+        if (200 != res.status or null == access) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: azure: no token, no client credentials, and IMDS did not answer",
+                .{},
+            ) };
+        }
+
+        self.renewat = httpjson.renewafter(self.config.io, httpjson.jnum(httpjson.jget(res.body, "expires_in")));
+        return .{ .ok = access.? };
+    }
+
+    pub fn lookup(self: *AzureSecretsProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        if (0 == self.vault.len) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: azure: no vault", .{}) };
+        }
+
+        // Only an explicit scheme is a URL; a vault NAMED httpvault must
+        // still become https://httpvault.vault.azure.net.
+        const vaulturl = if (std.mem.startsWith(u8, self.vault, "http://") or
+            std.mem.startsWith(u8, self.vault, "https://"))
+            self.vault
+        else
+            try std.fmt.allocPrint(alloc, "https://{s}.vault.azure.net", .{self.vault});
+
+        switch (try sekreto.checkaddr(alloc, vaulturl)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        if (null == self.livetoken or httpjson.nowms(self.config.io) >= self.renewat) {
+            const fresh = switch (try self.login(alloc)) {
+                .err => |message| return .{ .err = message },
+                .ok => |got| got,
+            };
+            if (self.livetoken) |old| {
+                self.alloc.free(old);
+            }
+            self.livetoken = try self.alloc.dupe(u8, fresh);
+        }
+
+        const flat = switch (try sekreto.flatname(alloc, name, "-")) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const version = if (0 != self.apiversion.len) self.apiversion else "7.4";
+
+        const url = try std.fmt.allocPrint(
+            alloc,
+            "{s}/secrets/{s}?api-version={s}",
+            .{ httpjson.trimslash(vaulturl), flat, version },
+        );
+
+        const bearer = try std.fmt.allocPrint(alloc, "Bearer {s}", .{self.livetoken.?});
+        const headers = [_]httpjson.Header{.{ .name = "authorization", .value = bearer }};
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        if (404 == res.status) {
+            return .{ .ok = null };
+        }
+
+        if (200 != res.status) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: azure error: {d}: {s}",
+                .{ res.status, httpjson.nakedurl(url) },
+            ) };
+        }
+
+        return .{ .ok = httpjson.jstr(httpjson.jget(res.body, "value")) };
+    }
+
+    pub fn describe(self: *AzureSecretsProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        return std.fmt.allocPrint(alloc, "azuresecrets:{s}", .{self.vault});
+    }
+
+    pub fn deinit(self: *AzureSecretsProvider, alloc: Allocator) void {
+        if (self.livetoken) |token| {
+            alloc.free(token);
+        }
+    }
+};
+
+fn make(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, AzureSecretsProvider, .{
+        .alloc = alloc,
+        .config = config,
+        .vault = spec.vault,
+        .token = spec.token,
+        .tenant = spec.tenant,
+        .clientid = spec.clientid,
+        .clientsecret = spec.clientsecret,
+        .loginaddr = spec.loginaddr,
+        .imdsaddr = spec.imdsaddr,
+        .apiversion = spec.apiversion,
+        .livetoken = null,
+        .renewat = httpjson.NEVER,
+    }) };
+}
+
+/// The `azuresecrets` kind.
+pub const azuresecrets: sekreto.Definition = sekreto.providerplugin("azuresecrets", make);