@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/c/feature/secrets/plugins/onepassword.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/onepassword.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/onepassword.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* 1Password Connect.
  *

package/project/.sdk/tm/c/feature/secrets/plugins/proc.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/proc.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/proc.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Running a child: the ONE object in this library that forks.
  *

package/project/.sdk/tm/c/feature/secrets/plugins/secretspec.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/secretspec.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/secretspec.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* SecretSpec, through its CLI.
  *

package/project/.sdk/tm/c/feature/secrets/plugins/sekretoplugins.h

@@ -1,7 +1,7 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/sekretoplugins.h)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/sekretoplugins.h)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* The ten provider kinds that are NOT built in, each a voxgig/plugin
+/* The eleven provider kinds that are NOT built in, each a voxgig/plugin
  * definition, plus the transport and the SigV4 signing that come with
  * them.
  *
@@ -10,13 +10,14 @@
  * four built-in kinds links none of this, which is the whole point of the
  * split (docs/design/plugin-providers.md).
  *
- * LINKING IS THE BOUNDARY, AND A HEADER IS NOT LINKING. Declaring all ten
+ * LINKING IS THE BOUNDARY, AND A HEADER IS NOT LINKING. Declaring all
+ * eleven
  * here costs a consumer nothing: what a binary carries is the objects its
  * link line names. A lean consumer links `plugins/hashicorp.o` and the
  * transport it needs, hands `sek_plugin_hashicorp()` to sek_options, and
  * never has AWS request signing, seven other vault clients or the child
  * process launcher in its binary. `sek_allplugins` is the opposite trade
- * and the honest one: it names all ten, so an object referencing it pulls
+ * and the honest one: it names all eleven, so an object referencing it pulls
  * every plugin in the library.
  *
  *     Definition *chain[] = {sek_plugin_hashicorp()};
@@ -65,16 +66,156 @@ Definition *sek_plugin_infisical(void);
 /* SecretSpec, through its CLI. */
 Definition *sek_plugin_secretspec(void);
 
+/* A mini vault: every secret a project owns, encrypted, in one file. A
+ * plugin because it needs crypto, which is the line the four built-in
+ * kinds stay behind. Its own API is below. */
+Definition *sek_plugin_minivault(void);
+
+/* ---- the mini vault ------------------------------------------------ */
+
+/* A chain READS; writing is a deliberate act with an API of its own, so
+ * the `minivault` definition publishes `vault` beside `provider` and
+ * `sek_vaultof` reads it back off the host. The handle is opaque: what a
+ * key may do is what the file says, and a caller holding the struct it
+ * is recorded in could flip its own permission.
+ *
+ * Everything here is pool-owned, like the rest of this library: a vault
+ * dies with the pool it was opened from. */
+typedef struct sek_minivault sek_minivault;
+
+/* The key id a vault gets when a caller names none. */
+#define SEK_VAULT_MASTERKEY "master"
+
+/* The PBKDF2-HMAC-SHA256 round count when a caller names none. */
+#define SEK_VAULT_ITERATIONS 210000
+
+/* The export key the vault API is published under, beside the `provider`
+ * key every kind publishes. */
+#define SEK_VAULT_EXPORT "vault"
+
+/* What a key may do. `grants` is empty for a master key, which reads and
+ * writes every name there is; it is sorted, and every read of it answers
+ * with a COPY, so what a caller is handed cannot become what the vault
+ * believes. */
+typedef struct {
+  const char *key;
+  int master;
+  int write;
+  sek_list *grants;
+} sek_vaultinfo;
+
+/* How a vault file is opened as one key. */
+typedef struct {
+  /* The vault file. */
+  const char *file;
+  /* Which key to open with. NULL means SEK_VAULT_MASTERKEY. */
+  const char *key;
+  /* What unwraps that key. */
+  const char *passphrase;
+  /* The PBKDF2 round count used when this handle CREATES a key. Reading
+   * uses what the file records for the key being opened. Zero means the
+   * library default. */
+  int iterations;
+  /* Make the file, with this key as its master, if it is not there.
+   *
+   * Off by default. A missing vault is far more often a broken
+   * deployment than a new one, and a store that invents itself where a
+   * real vault was meant to be answers every read with a miss. */
+  int create;
+} sek_vaultoptions;
+
+/* What mints a restricted key. */
+typedef struct {
+  /* The id the new key answers to. */
+  const char *key;
+  /* What unwraps it. Nothing else does, and no master can recover it - a
+   * lost restricted passphrase is re-granted, never read back. */
+  const char *passphrase;
+  /* The names the key may read. A name that does not exist yet is
+   * allowed and means what it says: the key reads it once a master
+   * writes it. */
+  sek_list *names;
+  /* Whether it may overwrite the values it can read. */
+  int write;
+  /* PBKDF2 rounds for this key, defaulting to the opening handle's. */
+  int iterations;
+} sek_vaultgrant;
+
+/* Open a vault file as one key.
+ *
+ * The handle is LAZY. Nothing is read, and no passphrase is stretched,
+ * until a call needs the file - so putting a vault in a chain of ten
+ * providers costs ten objects rather than ten PBKDF2 runs. */
+sek_err sek_vault_open(sek_pool *pool, const sek_vaultoptions *options, sek_minivault **out);
+
+/* Make a vault file and answer a handle on its master key.
+ *
+ * Refuses a file that is already there: a vault is created once, and
+ * overwriting one discards every secret in it along with every key that
+ * could read them. */
+sek_err sek_vault_create(sek_pool *pool, const sek_vaultoptions *options, sek_minivault **out);
+
+const char *sek_vault_file(sek_minivault *vault);
+const char *sek_vault_key(sek_minivault *vault);
+
+/* Derive the key and read the file NOW rather than at first use. */
+sek_err sek_vault_info(sek_minivault *vault, sek_vaultinfo **out);
+
+/* Forget the derived keys. The next call opens again. */
+void sek_vault_close(sek_minivault *vault);
+
+/* The names this key can read, sorted. */
+sek_err sek_vault_list(sek_minivault *vault, sek_list **out);
+
+/* The value, or a MISS (`*out == NULL`). A name the vault does not hold
+ * and a name this key was not granted are both a miss. */
+sek_err sek_vault_get(sek_minivault *vault, const char *name, char **out);
+sek_err sek_vault_has(sek_minivault *vault, const char *name, int *out);
+
+/* Write a value. A master writes any name; a restricted key holding
+ * `write` overwrites the names it was granted, and creates none. */
+sek_err sek_vault_set(sek_minivault *vault, const char *name, const char *value);
+
+/* Drop a name. Master only. */
+sek_err sek_vault_remove(sek_minivault *vault, const char *name);
+
+/* Every key in the file, with what it may do. Master only. */
+sek_err sek_vault_keys(sek_minivault *vault, sek_vaultinfo ***out, size_t *count);
+
+/* Mint a restricted key. Master only. */
+sek_err sek_vault_grant(sek_minivault *vault, const sek_vaultgrant *spec);
+
+/* Drop a key. Master only.
+ *
+ * Anyone who already copied the file keeps whatever that key could read,
+ * so revoking bars future reads of the LIVE file and `sek_vault_rotate`
+ * is what takes a secret back. */
+sek_err sek_vault_revoke(sek_minivault *vault, const char *key);
+
+/* Take a new root key, re-encrypt every value under it, and DROP EVERY
+ * OTHER KEY. Master only.
+ *
+ * The other keys go because they must: their rings are sealed under
+ * passphrases this process does not have, so there is no way to hand
+ * them keys they can unwrap. Re-grant afterwards. */
+sek_err sek_vault_rotate(sek_minivault *vault);
+
+/* The vault behind a store in a chain, as its programmatic API. A NULL
+ * or empty `store` takes the unqualified alias: one vault in the chain
+ * resolves whatever it is called, and two refuse rather than picking
+ * one. */
+sek_err sek_vaultof(sek_pool *pool, sek_sekreto *sek, const char *store, sek_minivault **out);
+
 /* ---- the full set -------------------------------------------------- */
 
 /* Every plugin this library ships, in one call. Answers the count and
- * points `*out` at a static array of the ten definitions.
+ * points `*out` at a static array of the eleven definitions.
  *
  * IT IS ALSO THE THING TO AVOID IF SIZE MATTERS. Naming this pulls every
- * plugin object into the link - request signing and eight HTTP clients
- * included - which is the cost the split exists to remove. It exists for
- * the callers that genuinely want all ten: the CLI, the conformance
- * suite, an app whose chain is decided at run time. */
+ * plugin object into the link - request signing, eight HTTP clients and
+ * an AEAD included - which is the cost the split exists to remove. It
+ * exists for the callers that genuinely want all eleven: the CLI, the
+ * conformance suite, an app whose chain is decided at run time. */
 size_t sek_allplugins(Definition ***out);
 
 /* ---- transport ----------------------------------------------------- */

package/project/.sdk/tm/c/feature/secrets/plugins/sha256.c

@@ -1,16 +1,22 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/sha256.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/sha256.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* SHA-256 and HMAC-SHA256, by hand.
  *
- * This port links libcrypto, and these are still written out. That is the
- * rule and not an oversight: the dependency exception in AGENTS.md covers
- * cryptographic TRANSPORT, and nothing else. Rust is the worked
- * precedent - `ring` sits inside rustls's dependency closure and
- * rust/src/crypto.rs carries both primitives anyway. Calling libcrypto's
- * EVP_Digest for a SigV4 signature would quietly widen the exception from
- * "we do not hand-roll TLS" to "we use whatever the TLS library ships",
- * which is a different and much larger claim.
+ * This port links libcrypto, and these are still written out. The rule
+ * they were written under said the dependency exception covered
+ * cryptographic TRANSPORT and nothing else; AGENTS.md now says
+ * cryptography, because the mini vault needs a block cipher to protect
+ * secrets at rest and a table-driven AES passes every known-answer test
+ * in the world while still handing its key to anyone who can time a
+ * cache. These two stay anyway, and the widened rule says so outright:
+ * they work, a SigV4 signature is a chain of them so one wrong bit fails
+ * the published vectors loudly, and rewriting them buys nothing.
+ *
+ * The narrower claim they were written for is also still true of them:
+ * calling libcrypto's EVP_Digest here would make the exception "we use
+ * whatever the TLS library ships" for a signature that needs no library
+ * at all.
  *
  * THIS OBJECT EXISTS SO THAT ONLY THE SIGNER PULLS IT. The aws plugin is
  * the only thing in the library that hashes anything, and a static

package/project/.sdk/tm/c/feature/secrets/plugins/sigv4.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/sigv4.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/sigv4.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* AWS Signature Version 4, hand-rolled.
  *

package/project/.sdk/tm/c/feature/secrets/plugins/support.h

@@ -1,10 +1,13 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/support.h)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/support.h)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* What the PLUGINS share and the core must never link: the HTTP
  * transport, the TLS seam, the SHA-256 primitives SigV4 is built from,
  * the two encoders, a child process and a clock.
  *
+ * Not the mini vault: it shares nothing, so its own API is published in
+ * `sekretoplugins.h` where a consumer can reach it.
+ *
  * ONE TRANSLATION UNIT PER CAPABILITY, and that is a link-time decision
  * rather than a filing preference. A static archive is pulled in an
  * object at a time, so a plugin that signs nothing must not sit in the
@@ -30,12 +33,13 @@
 
 /* FIPS 180-4 SHA-256 and RFC 2104 HMAC-SHA256, hand-rolled.
  *
- * Hand-rolled even though this port links libcrypto, and that is the
- * rule, not an oversight: the TLS exception covers cryptographic
- * TRANSPORT and nothing else. Rust is the worked precedent - `ring` is
- * already inside rustls's dependency closure and rust/src/crypto.rs still
- * carries both primitives. Both are proved by the SigV4 known-answer
- * vectors: a signature is a chain of these, so one wrong bit fails there.
+ * Hand-rolled even though this port links libcrypto. AGENTS.md's
+ * dependency exception now covers cryptography rather than only
+ * cryptographic TRANSPORT - `minivault.c` takes its AES-256-GCM from
+ * libcrypto for exactly that reason - and says these two stay where they
+ * are regardless: they work, and they are proved by the SigV4
+ * known-answer vectors, because a signature is a chain of these and one
+ * wrong bit fails there.
  *
  * `sha256.c` and nothing else. The aws plugin is the only thing in the
  * library that names these, and a link of any other plugin must not pull

package/project/.sdk/tm/c/feature/secrets/plugins/tls.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/tls.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/plugins/tls.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The TLS binding, and the only file in this port that names OpenSSL.
  *

package/project/.sdk/tm/c/feature/secrets/sekreto/internal.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/src/internal.h)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/src/internal.h)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* What the CORE's own files share, and a consumer never sees: the string
  * helpers and the one local-file read the four built-in kinds need.
@@ -79,8 +79,23 @@ int sek_absent(int why);
  * spec's own key names, the shape a config document would have. */
 Value *sek_optionsof(const sek_spec *spec);
 
+/* ...and back, as a kind's `define` reads it. Every string is copied
+ * into the pool: the options map lives in voxgig/plugin's arena, which
+ * this library never resets, and copying keeps the ownership rule - a
+ * provider's strings come from the pool it was built with - true rather
+ * than true by accident.
+ *
+ * Not static to providers.c because `minivault` writes its own `define`,
+ * publishing two exports where every other kind publishes one. */
+sek_spec sek_specof(sek_pool *pool, Value *options);
+
 void sek_build_begin(sek_pool *pool);
 void sek_build_end(void);
 sek_provider *sek_build_at(double index);
 
+/* The pool this construction allocates from, and where a hand-written
+ * `define` puts the provider it built. NULL outside a sek_new. */
+sek_pool *sek_build_pool(void);
+double sek_build_keep(sek_provider *provider);
+
 #endif /* VOXGIG_SEKRETO_INTERNAL_H */

package/project/.sdk/tm/c/feature/secrets/sekreto/json.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/src/json.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/src/json.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* sekreto's own JSON.
  *
@@ -93,7 +93,7 @@ static void pushitem(sek_pool *pool, sek_json *arr, sek_json *item) {
   arr->itemlen++;
 }
 
-static void sek_json_assign_member(sek_pool *pool, sek_json *obj, const char *key, sek_json *val) {
+static void putkey(sek_pool *pool, sek_json *obj, const char *key, sek_json *val) {
   size_t index;
 
   for (index = 0; index < obj->maplen; index++) {
@@ -128,7 +128,7 @@ void sek_json_push(sek_pool *pool, sek_json *arr, sek_json *item) {
 }
 
 void sek_json_set(sek_pool *pool, sek_json *obj, const char *key, sek_json *val) {
-  sek_json_assign_member(pool, obj, key, val);
+  putkey(pool, obj, key, val);
 }
 
 /* ---- reads --------------------------------------------------------- */
@@ -607,7 +607,7 @@ static sek_json *readobject(reader *rd) {
       return NULL;
     }
 
-    sek_json_assign_member(rd->pool, out, key, val);
+    putkey(rd->pool, out, key, val);
     skipspace(rd);
 
     if (rd->at >= rd->len) {

package/project/.sdk/tm/c/feature/secrets/sekreto/providers.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/src/providers.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/src/providers.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* What a provider is, what its declarative form looks like, how a provider
  * kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.
@@ -19,7 +19,8 @@
  * THIS FILE NAMES NO SOCKET, NO CHILD PROCESS AND NO HASH FUNCTION. What
  * makes a kind built in is that it needs nothing of the platform beyond
  * the environment and reading a local file; every kind that opens a
- * socket, signs a request or spawns a process is a plugin under
+ * socket, signs a request, spawns a process or does cryptography is a
+ * plugin under
  * `plugins/`, in its own translation unit, linked only by a binary whose
  * link line names it (docs/design/plugin-providers.md).
  *
@@ -471,6 +472,8 @@ static const strfield STRFIELDS[] = {
     SEK_FIELD("config", config),
     SEK_FIELD("environment", environment),
     SEK_FIELD("path", path),
+    SEK_FIELD("passphrase", passphrase),
+    SEK_FIELD("vaultkey", vaultkey),
 };
 
 static const strfield AUTHFIELDS[] = {
@@ -526,6 +529,17 @@ Value *sek_optionsof(const sek_spec *spec) {
     vset(options, "kv", vnum(spec->kv));
   }
 
+  /* Written only when set, like every string above: zero and false are
+   * what "not configured" means for these two, and a minivault spec that
+   * named neither would otherwise carry both. */
+  if (0 != spec->iterations) {
+    vset(options, "iterations", vnum(spec->iterations));
+  }
+
+  if (spec->create) {
+    vset(options, "create", vbool(1));
+  }
+
   if (NULL != spec->auth) {
     Value *auth = vmap();
     for (index = 0; index < sizeof(AUTHFIELDS) / sizeof(AUTHFIELDS[0]); index++) {
@@ -547,10 +561,12 @@ Value *sek_optionsof(const sek_spec *spec) {
  * never frees; copying keeps the ownership rule this header states - a
  * provider's strings come from the pool it was built with - true anyway,
  * rather than true by accident. */
-static sek_spec specof(sek_pool *pool, Value *options) {
+sek_spec sek_specof(sek_pool *pool, Value *options) {
   sek_spec spec = sek_spec_new(NULL);
   Value *values = vget(options, "values");
   Value *kv = vget(options, "kv");
+  Value *iterations = vget(options, "iterations");
+  Value *create = vget(options, "create");
   Value *auth = vget(options, "auth");
   size_t index;
 
@@ -577,6 +593,12 @@ static sek_spec specof(sek_pool *pool, Value *options) {
     spec.haskv = 1;
   }
 
+  if (visnum(iterations)) {
+    spec.iterations = (int)vasnum(iterations);
+  }
+
+  spec.create = visbool(create) && vasbool(create);
+
   if (vismap(auth)) {
     sek_authspec *use = (sek_authspec *)sek_alloc(pool, sizeof(sek_authspec));
     for (index = 0; index < sizeof(AUTHFIELDS) / sizeof(AUTHFIELDS[0]); index++) {
@@ -623,6 +645,8 @@ void sek_build_begin(sek_pool *pool) {
 
 void sek_build_end(void) { BUILDING = NULL; }
 
+sek_pool *sek_build_pool(void) { return NULL == BUILDING ? NULL : BUILDING->pool; }
+
 /* The provider a definition exported, by the index it exported. Answers
  * NULL for an index no `define` of this construction handed out, which is
  * how a Definition that is not a provider plugin at all is caught.
@@ -642,7 +666,10 @@ sek_provider *sek_build_at(double index) {
   return BUILDING->built[(size_t)index];
 }
 
-static double keep(sek_provider *provider) {
+/* Not static, because `minivault` writes its own `define` - it publishes
+ * two exports where every other kind publishes one - and must put the
+ * provider it built in the same place this one does. */
+double sek_build_keep(sek_provider *provider) {
   if (BUILDING->len == BUILDING->cap) {
     size_t cap = 0 == BUILDING->cap ? 8 : BUILDING->cap * 2;
     sek_provider **bigger =
@@ -677,7 +704,7 @@ static void provider_define(Inst *inst) {
   sek_spec spec;
   sek_err err;
 
-  spec = specof(BUILDING->pool, inst_options(inst));
+  spec = sek_specof(BUILDING->pool, inst_options(inst));
 
   err = kind->make(BUILDING->pool, &spec, &made);
 
@@ -690,7 +717,7 @@ static void provider_define(Inst *inst) {
     fail(SEK_ERROR_CODE, err, details2("ref", vstr(inst_ref(inst)), "cause", vstr(err)));
   }
 
-  inst_export(inst, SEK_PROVIDER_EXPORT, vnum(keep(made)));
+  inst_export(inst, SEK_PROVIDER_EXPORT, vnum(sek_build_keep(made)));
 }
 
 Definition *sek_providerplugin(sek_providerkind *slot, const char *kind, sek_makefn make) {
@@ -809,5 +836,6 @@ size_t sek_builtins(Definition ***out) {
 const char *const SEK_BUILTIN_KINDS[] = {"env", "memory", "dotenv", "file", NULL};
 
 const char *const SEK_PLUGIN_KINDS[] = {
-    "hashicorp", "boru",        "awssecrets", "awsparams", "gcpsecrets",
-    "azuresecrets", "onepassword", "doppler",  "infisical", "secretspec", NULL};
+    "hashicorp",    "boru",        "awssecrets", "awsparams",  "gcpsecrets",
+    "azuresecrets", "onepassword", "doppler",    "infisical",  "secretspec",
+    "minivault",    NULL};

package/project/.sdk/tm/c/feature/secrets/sekreto/sekreto.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/src/sekreto.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/src/sekreto.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* sekreto: one interface for secrets, wherever they live.
  *

package/project/.sdk/tm/c/feature/secrets/sekreto/sekreto.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/src/sekreto.h)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/src/sekreto.h)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* sekreto: one interface for secrets, wherever they live.
  *
@@ -129,6 +129,10 @@ typedef struct {
 sek_list *sek_list_new(sek_pool *pool);
 void sek_list_add(sek_list *list, const char *text);
 
+/* Sorted by byte value, in place. Ordinary string work, so it is here
+ * with the list rather than wherever the first caller happened to be. */
+void sek_list_sort(sek_list *list);
+
 /* ---- json ---------------------------------------------------------- */
 
 typedef enum {
@@ -301,6 +305,17 @@ typedef struct {
   const char *config;
   const char *environment;
   const char *path;
+  /* minivault: the passphrase that unwraps `vaultkey`. */
+  const char *passphrase;
+  /* minivault: which key in the vault file to open with, defaulting to
+   * `master`. Named apart from `keyid` because that already means an AWS
+   * access key id. */
+  const char *vaultkey;
+  /* minivault: PBKDF2 rounds, used only when a key is created. Zero
+   * means unset, so the library's own default still applies. */
+  int iterations;
+  /* minivault: make the vault file if it is not there. */
+  int create;
 
   /* A provider already built, joining the chain as it is - `kind` unset.
    * This is how a custom provider that is not a plugin gets in. Never

package/project/.sdk/tm/c/feature/secrets/sekreto/util.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/src/util.c)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (c/src/util.c)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The arena, the buffer, and the two ordered containers everything else
  * is built from.
@@ -314,6 +314,20 @@ void sek_list_add(sek_list *list, const char *text) {
   list->len++;
 }
 
+static int bytext(const void *left, const void *right) {
+  return strcmp(*(const char *const *)left, *(const char *const *)right);
+}
+
+/* By BYTE VALUE, which is what `strcmp` is and what every other port
+ * sorts a name list by. A locale-aware comparison would put the same
+ * three secret names in a different order on a machine with a different
+ * LC_COLLATE, and the shared spec compares whole lists. */
+void sek_list_sort(sek_list *list) {
+  if (1 < list->len) {
+    qsort(list->items, list->len, sizeof(char *), bytext);
+  }
+}
+
 /* ---- small string helpers ------------------------------------------ */
 
 int sek_empty(const char *text) { return NULL == text || '\0' == text[0]; }