@voxgig/sdkgen 4.29.0 → 4.30.1

package/project/.sdk/tm/go/feature/secrets/plugins/doppler/doppler.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/doppler/doppler.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/doppler/doppler.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The doppler plugin: Doppler, one bulk download per config. Needs
 // HTTPS. A port of typescript/plugins/doppler.ts.
@@ -15,12 +15,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// Provider reads Doppler.
-//
-// The whole config is downloaded once - Doppler's own bulk endpoint - and
-// answered from memory, like a remote .env: api.token is the API_TOKEN
-// entry. A service token is config-scoped, so project and config are only
-// needed with broader tokens.
 type Provider struct {
 	Token   string
 	Project string

package/project/.sdk/tm/go/feature/secrets/plugins/gcpsecrets/gcpsecrets.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/gcpsecrets/gcpsecrets.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/gcpsecrets/gcpsecrets.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The gcpsecrets plugin: GCP Secret Manager. Needs HTTPS. A port of
 // typescript/plugins/gcpsecrets.ts.
@@ -18,17 +18,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// Provider reads GCP Secret Manager.
-//
-// api.token reads secret api_token (dots flattened to `_`; Secret Manager
-// ids have no hierarchy and reject dots), latest version. The token comes
-// from config, then GOOGLE_OAUTH_ACCESS_TOKEN, then the GCE/GKE metadata
-// server - so on Google's own platform no credential configuration is
-// needed at all.
-//
-// The metadata call itself is plain http to a link-local host by platform
-// design; no credential rides on it, so checkaddr guards the Secret
-// Manager address instead.
 type Provider struct {
 	Project      string
 	Token        string

package/project/.sdk/tm/go/feature/secrets/plugins/hashicorp/hashicorp.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/hashicorp/hashicorp.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/hashicorp/hashicorp.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The hashicorp plugin: HashiCorp Vault, and OpenBao. Needs HTTPS, and
 // the filesystem for a kubernetes service-account JWT. A port of
@@ -18,20 +18,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// Provider reads HashiCorp Vault.
-//
-// KV v2 (the default): api.token reads {addr}/v1/{mount}/data/api and takes
-// the `token` field of data.data. KV v1 (KV: 1) reads {addr}/v1/{mount}/api
-// and takes the field of data. A 404 means "not here", which is a miss
-// rather than an error, so a vault can sit in a chain with fallbacks.
-//
-// A Vault Enterprise namespace rides the X-Vault-Namespace header, on
-// logins as well as reads.
-//
-// Instead of being handed a token, the provider can log in: Kubernetes
-// auth (the pod's service-account JWT, from its conventional path) or
-// AppRole. A failed login is an error, never a miss - it means this store
-// could not answer at all.
 type Provider struct {
 	Addr           string
 	Token          string

package/project/.sdk/tm/go/feature/secrets/plugins/httpjson/httpjson.go

@@ -1,14 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/httpjson/httpjson.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/httpjson/httpjson.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// The HTTP half of every plugin that speaks to a store over the wire, in
-// one place and OUTSIDE the core: a chain of built-ins never links this
-// package, which is what keeps `net/http` out of a binary whose secrets
-// come from the environment and a .env file.
-//
-// One JSON round-trip, bounded in time and in size, refusing redirects and
-// ignoring proxies; and the small helpers every store client needs to read
-// a decoded body. A port of typescript/plugins/httpjson.ts.
 package httpjson
 
 import (
@@ -31,37 +23,11 @@ var client = &http.Client{
 	CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
 		return http.ErrUseLastResponse
 	},
-	// A secrets client dials the address it was configured with and nowhere
-	// else. http.DefaultTransport reads HTTP_PROXY; its resolver exempts
-	// loopback, so the local dev vault was never exposed - but the GCP and
-	// Azure metadata endpoints are not loopback, and the access tokens they
-	// return would have gone through whatever the variable named, which can
-	// read them and substitute its own.
 	Transport: &http.Transport{Proxy: nil},
 }
 
-// maxbody is how much of a response body will be read before the store is
-// treated as having answered incoherently. Ports carry the same bound.
-//
-// Far above anything real - the largest legitimate payload this library
-// fetches is Doppler's whole-config download, measured in kilobytes. A bound
-// is needed because the TIMEOUT is not one: ten seconds on a loopback or
-// datacentre link is gigabytes, and the body is accumulated in memory before
-// it is parsed. This runs on an application's startup path, so the failure is
-// the application never starting.
 const maxbody = 8 * 1024 * 1024
 
-// SafeURL is a url with its query string removed, for messages.
-//
-// A query here carries the vault path, the secret name or a filter -
-// `secretPath=/prod/payments/stripe` - which does not belong in a log or a
-// stack trace. Every message in this file goes through it.
-//
-// It exists because the obvious spelling was silently defeated: the messages
-// used to strip the query themselves and then append err.Error(), and a
-// *url.Error prints as `Get "<full url>": <reason>` - putting the query
-// straight back. Stripping in one place, and using it on the wrapped error
-// too, is what makes the intent hold.
 func SafeURL(target string) string {
 	return strings.SplitN(target, "?", 2)[0]
 }
@@ -86,9 +52,6 @@ func Call(method string, target string, headers map[string]string, payload strin
 
 	response, err := client.Do(request)
 	if nil != err {
-		// The error is scrubbed too, not just the prefix: *url.Error prints
-		// as `Get "<full url>": <reason>`, so appending it verbatim undid
-		// the stripping on the line above.
 		return 0, nil, sekreto.Fail("sekreto: cannot reach " + SafeURL(target) + ": " +
 			strings.ReplaceAll(err.Error(), target, SafeURL(target)))
 	}
@@ -108,10 +71,6 @@ func Call(method string, target string, headers map[string]string, payload strin
 
 	var body any
 	if err := json.Unmarshal(text, &body); nil != err {
-		// A success status promised JSON; a body that does not parse means
-		// the store could not answer coherently, and treating it as a miss
-		// would fall through to a weaker store. Error statuses may carry
-		// any body - they are decided on status alone.
 		if http.StatusOK == response.StatusCode {
 			return response.StatusCode, nil, sekreto.Fail("sekreto: malformed response from " +
 				SafeURL(target))
@@ -122,14 +81,10 @@ func Call(method string, target string, headers map[string]string, payload strin
 	return response.StatusCode, body, nil
 }
 
-// Get GETs a URL, returning the status and decoded body. A 404 is a
-// normal answer here, not a failure: it means the vault has no such secret.
 func Get(target string, headers map[string]string) (int, any, error) {
 	return Call(http.MethodGet, target, headers, "")
 }
 
-// Dig walks a decoded JSON body by key, answering nil as soon as a step is
-// not an object or the key is absent.
 func Dig(body any, keys ...string) any {
 	node := body
 
@@ -144,8 +99,6 @@ func Dig(body any, keys ...string) any {
 	return node
 }
 
-// DigText is Dig rendered as text, with nil (and so any missing step)
-// answering the empty string.
 func DigText(body any, keys ...string) string {
 	value := Dig(body, keys...)
 	if nil == value {
@@ -154,10 +107,6 @@ func DigText(body any, keys ...string) string {
 	return ToString(value)
 }
 
-// ToNumber reads a decoded JSON value as a number the way the canonical
-// port's Number() does: numbers pass through, numeric strings parse
-// (Azure's IMDS hands expires_in back as a string), and anything else -
-// missing, malformed - is zero.
 func ToNumber(value any) float64 {
 	switch typed := value.(type) {
 	case float64:
@@ -173,9 +122,6 @@ func ToNumber(value any) float64 {
 	}
 }
 
-// Expiry is the moment a login token should be renewed: shortly before
-// its lifetime (in seconds, from the login response) runs out. A missing
-// or zero lifetime answers the zero time, which means never renew.
 func Expiry(lifetime any) time.Time {
 	seconds := ToNumber(lifetime)
 	if 0 >= seconds {
@@ -190,14 +136,10 @@ func Expiry(lifetime any) time.Time {
 	return time.Now().Add(time.Duration(wait * float64(time.Second)))
 }
 
-// Due reports whether a renewal moment has arrived; the zero time never
-// arrives.
 func Due(renewat time.Time) bool {
 	return !renewat.IsZero() && !time.Now().Before(renewat)
 }
 
-// ToString renders a decoded JSON scalar the way the canonical port's
-// String() does.
 func ToString(value any) string {
 	switch typed := value.(type) {
 	case string:

package/project/.sdk/tm/go/feature/secrets/plugins/infisical/infisical.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/infisical/infisical.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/infisical/infisical.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The infisical plugin: Infisical. Needs HTTPS. A port of
 // typescript/plugins/infisical.ts.
@@ -16,12 +16,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// Provider reads Infisical.
-//
-// api.token reads the secret keyed API_TOKEN (Infisical's own convention
-// is environment-style keys) at a secret path in one environment of a
-// project. Auth is a token, or a universal-auth (machine identity) login
-// with clientid/clientsecret.
 type Provider struct {
 	Addr         string
 	Token        string

package/project/.sdk/tm/go/feature/secrets/plugins/minivault/format.go

@@ -1,39 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/minivault/format.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/minivault/format.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// The mini vault's file format, and the key hierarchy over it.
-//
-// A port of typescript/plugins/minivault.ts, which is canonical. The
-// bytes are the contract: a vault written by any port is read by every
-// other, and testdata/fixture.skmv pins that rather than leaving it to
-// agreement.
-//
-//	magic       4   'SKMV'
-//	version     1   Format
-//	kdf         1   1 = PBKDF2-HMAC-SHA256
-//	cipher      1   1 = AES-256-GCM
-//	reserved    1   0
-//	keycount    4   uint32
-//	per key:
-//	  id        1 + bytes      the key id, PLAINTEXT
-//	  salt      1 + bytes
-//	  iters     4              PBKDF2 rounds for this key
-//	  ring      1 + iv, 4 + bytes    sealed under the passphrase
-//	  meta      1 + iv, 4 + bytes    sealed under the vault's meta key
-//	entrycount  4   uint32
-//	per entry:
-//	  id        1 + bytes      the blinded lookup id
-//	  name      1 + iv, 4 + bytes    sealed under the vault's name key
-//	  value     1 + iv, 4 + bytes    sealed under that secret's own key
-//
-// Integers are big-endian and every length precedes its bytes, so the
-// file is written with the same two primitives it is read with.
-//
-// NOTHING OUTSIDE A KEY RECORD IS PLAINTEXT. Secret names are sealed,
-// and an entry is addressed by a blinded id derived from its own key, so
-// a restricted key finds what it was granted without the file ever
-// naming the rest. What the file does show anyone is the key ids and how
-// many secrets there are.
 package minivault
 
 import (
@@ -97,13 +64,6 @@ func fail(text string) error {
 	return sekreto.Fail("sekreto: minivault: " + text)
 }
 
-// idMax is the largest key id the format can record.
-//
-// `small` writes a length in ONE byte. A longer id wrapped that byte and
-// the writer then appended the whole thing, so every field after it
-// shifted: a Grant with a 300-character id replaced a working vault with
-// an unreadable one, and said nothing. Checked where an id is ACCEPTED,
-// so the refusal names the id rather than the file.
 const idMax = 255
 
 func checkid(id string, what string) error {
@@ -128,12 +88,6 @@ func mac(key []byte, text string) []byte {
 	return h.Sum(nil)
 }
 
-// pbkdf2sha256 is PBKDF2 with HMAC-SHA256, in-tree.
-//
-// crypto/pbkdf2 arrived in Go 1.24 and this module targets 1.21, and the
-// no-dependency rule says a missing standard-library piece is written
-// small rather than taken from a package. RFC 8018 section 5.2, with the
-// one-block-at-a-time loop the specification states.
 func pbkdf2sha256(passphrase string, salt []byte, iters int, length int) []byte {
 	out := []byte{}
 	block := make([]byte, 4)
@@ -169,13 +123,6 @@ func kek(passphrase string, salt []byte, iters int) []byte {
 	return pbkdf2sha256(passphrase, salt, iters, keyLen)
 }
 
-// secretkey is the key one named secret's value is encrypted with.
-//
-// DERIVED, never stored, for a master: it holds the root key and so
-// reaches every name, including ones written after it was made. A
-// restricted key holds the derived keys it was granted and nothing that
-// produces another, so every other name is ciphertext to it in exactly
-// the way it is to a stranger.
 func secretkey(root []byte, name string) []byte {
 	return mac(root, aadSecret+name)
 }
@@ -300,13 +247,6 @@ type reader struct {
 	err   error
 }
 
-// take reads `length` bytes, or records the refusal.
-//
-// The bound is checked as a UINT64 against what is left, never by adding
-// it to `at` in int arithmetic. On a 32-bit target a damaged vault can
-// encode a length at or above 0x80000000, which becomes a NEGATIVE int:
-// the slice bound goes backwards and the process panics instead of
-// reporting the damaged file this function exists to report.
 func (read *reader) take64(length uint64) []byte {
 	if nil != read.err {
 		return nil