@voxgig/sdkgen 4.29.0 → 4.30.1

package/project/.sdk/tm/rust/feature/secrets/plugin/types.rs

@@ -1,29 +1,13 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/types.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/types.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Shared types. Deliberately small: the design's §19 budget says the
-//! library owns naming, configuration, lifecycle, ordering, binding and
-//! teardown, and nothing else.
-//!
-//! RUST FOLLOWS GO'S ONE DELIBERATE CHANGE (§18, P4): errors are RETURNED,
-//! not raised. Every fallible signature is `Result<_, PluginError>`, and
-//! the corpus compares by CODE, which survives the change intact.
 
 use super::value::Value;
 
-/// §5.1's seven statuses, and no more. A port that adds an eighth is
-/// diverging. `loading` and `closing` are observable only from inside a
-/// callback or from another thread.
 pub const STATUSES: [&str; 7] = [
     "declared", "loaded", "pending", "live", "failed", "loading", "closing",
 ];
 
-/// §12's detail fields, IN THIS FIXED ORDER.
-///
-/// The order is part of the contract, not a formatting preference. An
-/// earlier draft named six fields while other sections promised
-/// diagnostics that had nowhere to go, which would have left each port
-/// inventing its own order and breaking message parity.
 pub const DETAIL_ORDER: [&str; 16] = [
     "host", "ref", "name", "tag", "point", "key", "capability", "range", "version", "match",
     "candidates", "cycle", "holders", "refs", "path", "cause",
@@ -50,11 +34,6 @@ pub fn formaterror(code: &str, text: &str, details: &Value) -> String {
     format!("plugin/{}: {}{}", code, text, tail)
 }
 
-/// Every error carries a §12 code. Ports compare by CODE and never by
-/// message: wording is a port's own business, and pinning the words would
-/// make every translation a corpus change. The FORMAT, however, is pinned
-/// - a parseable message is what makes a log searchable across twenty
-/// languages.
 #[derive(Clone, Debug)]
 pub struct PluginError {
     pub code: String,
@@ -102,12 +81,10 @@ pub fn fail<T>(code: &str, text: &str, details: Value) -> Result<T, PluginError>
     Err(PluginError::new(code, text, details))
 }
 
-/// The §12 code of an error, or "" for one this library did not raise.
 pub fn codeof(err: &PluginError) -> &str {
     err.code.as_str()
 }
 
-/// A detail map, spelled once rather than at forty call sites.
 pub fn details(pairs: &[(&str, Value)]) -> Value {
     let mut out = Value::map();
     for (k, v) in pairs {
@@ -116,9 +93,6 @@ pub fn details(pairs: &[(&str, Value)]) -> Value {
     out
 }
 
-/// STABLE sort by a computed key. `sort_by` in the standard library is
-/// already stable, which is what the canonical's comparators need where
-/// they fall through to a `pos` or ref tie-break.
 pub fn stable_sort_by<T, K, F>(list: &mut [T], keyof: F)
 where
     F: Fn(&T) -> K,

package/project/.sdk/tm/rust/feature/secrets/plugin/value.rs

@@ -1,22 +1,6 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/value.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/value.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! The JSON value, and the only parser this port has.
-//!
-//! NO SERDE, AND NO CRATE GRAPH AT ALL (§16). The library is allowed
-//! exactly one runtime dependency, `voxgig/struct`, which has no rust
-//! port; everything else is the standard library. Parsing the corpus is a
-//! hundred lines, and a hundred lines is cheaper than a supply chain.
-//!
-//! `Map` is a `BTreeMap`, which is not a convenience: every port has to
-//! sort its keys before iterating - the canonical's status maps, export
-//! lookups and registry walks all depend on it - and a sorted map makes
-//! that the default rather than a discipline to remember.
-//!
-//! `Num` is `f64` because JSON HAS ONE NUMBER TYPE. The canonical is
-//! javascript, `1` and `1.0` are the same value there, and a port that
-//! split them would disagree with the corpus on which of two spellings a
-//! document used.
 
 use std::any::Any;
 use std::collections::BTreeMap;
@@ -90,9 +74,6 @@ impl Value {
         }
     }
 
-    /// The value at a key, or `Null`. Absence and null read the same here
-    /// ON PURPOSE at the call sites that want a default; the call sites
-    /// that must tell them apart use `has` instead, and say so.
     pub fn get(&self, key: &str) -> Value {
         match self {
             Value::Map(m) => m.get(key).cloned().unwrap_or(Value::Null),
@@ -154,8 +135,6 @@ impl Value {
                     && a.iter()
                         .all(|(k, v)| b.get(k).map(|o| v.same(o)).unwrap_or(false))
             }
-            // Two opaque handles are the same only if they are the same
-            // allocation. Nothing in the corpus compares one.
             (Value::Opaque(a), Value::Opaque(b)) => Rc::ptr_eq(a, b),
             _ => false,
         }
@@ -175,9 +154,6 @@ impl Value {
             Value::Null => out.push_str("null"),
             Value::Bool(b) => out.push_str(if *b { "true" } else { "false" }),
             Value::Num(n) => {
-                // An integral f64 prints without a fractional part, so a
-                // `pos` of 3 renders as `3` and not `3.0` - JSON has one
-                // number type and the corpus writes them as it means them.
                 if n.fract() == 0.0 && n.is_finite() && n.abs() < 1e15 {
                     let _ = write!(out, "{}", *n as i64);
                 } else {
@@ -374,9 +350,6 @@ fn parse_string(b: &[char], at: &mut usize) -> Result<String, String> {
                             code = code * 16 + d;
                             *at += 1;
                         }
-                        // A surrogate PAIR is two escapes; a lone
-                        // surrogate is left as the replacement character
-                        // rather than failing the whole corpus.
                         if (0xD800..0xDC00).contains(&code)
                             && *at + 1 < b.len()
                             && '\\' == b[*at]

package/project/.sdk/tm/rust/feature/secrets/plugin/version.rs

@@ -1,19 +1,6 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/version.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/version.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Versions and ranges (§11.2).
-//!
-//! TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
-//! concrete version. A requirement declares `range`. A requirement is
-//! satisfied when the names match, the `match` passes, and:
-//!
-//!   the provider's `version` falls inside the requirement's `range`.
-//!
-//! That is the whole rule. There is no third field and no second
-//! comparison - an earlier draft added a provider-side `compat` range,
-//! which left three values and no statement of how they combine, and three
-//! defensible readings of one declaration is worse than the ambiguity it
-//! was introduced to fix.
 
 use super::types::{details, fail, PluginError};
 use super::value::Value;
@@ -64,10 +51,6 @@ fn parts(text: &str, whole: &str, field: &str) -> Option<Result<[u64; 3], Plugin
     Some(Ok(out))
 }
 
-/// Two forms and no more (§11.2):
-///
-///   '2.1'    >= 2.1.0 and < 3.0.0
-///   '~2.1'   >= 2.1.0 and < 2.2.0
 pub fn parse_range(range: &Value) -> Result<Value, PluginError> {
     let text = match range.as_str() {
         Some(s) if !s.is_empty() => s,
@@ -142,7 +125,6 @@ pub fn parse_version(version: &Value) -> Result<[u64; 3], PluginError> {
     }
 }
 
-/// The one satisfaction predicate: lo <= version < hi.
 pub fn satisfies(version: &Value, range: &Value) -> Result<bool, PluginError> {
     let v = parse_version(version)?;
     let r = parse_range(range)?;
@@ -166,7 +148,6 @@ fn triple(value: &Value) -> [u64; 3] {
     ]
 }
 
-/// The version triple as a comparable key, for the capability rank.
 pub fn version_parts(text: &str) -> Vec<i64> {
     text.split('.')
         .map(|p| p.parse::<i64>().unwrap_or(0))

package/project/.sdk/tm/rust/feature/secrets/plugins/aws/crypto.rs

@@ -1,20 +1,7 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/aws/src/crypto.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/aws/src/crypto.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! SHA-256 and HMAC-SHA256, hand-rolled.
-//!
-//! The Rust standard library ships no hash functions, and SigV4 signing
-//! needs exactly these two. Taking a crate for them would break the
-//! no-dependency rule that keeps ten ports honest, so - like JSON, HTTP,
-//! PEM and base64 before them - they live in-tree.
-//!
-//! SHA-256 is FIPS 180-4, implemented straight from the standard; HMAC is
-//! RFC 2104 over it. Both are proven against the spec's sigv4 known-answer
-//! cases, which include AWS's own published test vector - a signature is a
-//! chain of these primitives, so a single wrong bit anywhere fails there.
-
-/// The FIPS 180-4 round constants: the fractional parts of the cube roots
-/// of the first 64 primes.
+
 const K: [u32; 64] = [
     0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
     0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
@@ -28,8 +15,6 @@ const K: [u32; 64] = [
 
 /// The SHA-256 digest of a byte string.
 pub fn sha256(data: &[u8]) -> [u8; 32] {
-    // The initial hash: the fractional parts of the square roots of the
-    // first 8 primes.
     let mut hash: [u32; 8] = [
         0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab,
         0x5be0cd19,

package/project/.sdk/tm/rust/feature/secrets/plugins/aws/sigv4.rs

@@ -1,19 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/aws/src/sigv4.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/aws/src/sigv4.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! AWS Signature Version 4, hand-rolled.
-//!
-//! The AWS providers need exactly one thing from the AWS SDK - request
-//! signing - and taking the SDK for it would break the no-dependency rule
-//! that keeps ten ports honest. SigV4 is a stable, published algorithm
-//! built from HMAC-SHA256, which this port carries in-tree (src/crypto.rs).
-//!
-//! `sigv4` is pure: the caller passes the timestamp, so the same input
-//! yields the same signature everywhere. That is what lets the shared spec
-//! carry known-answer cases that all ten ports must reproduce bit-for-bit,
-//! and lets the integration mock recompute the signature server-side.
-//!
-//! A port of typescript/src/Sigv4.ts, which is canonical.
 
 use std::collections::BTreeMap;
 
@@ -35,8 +22,6 @@ pub struct Sigv4Input {
     pub secret: String,
     /// STS session token; signed as x-amz-security-token when non-empty.
     pub session: String,
-    /// The signing moment, `YYYYMMDDTHHMMSSZ`. Passed in, never sampled,
-    /// so the function stays pure.
     pub datetime: String,
 }
 
@@ -160,13 +145,6 @@ pub fn sigv4(input: &Sigv4Input) -> Answer<Sigv4Output> {
 
     let date = input.datetime.get(..8).unwrap_or(&input.datetime);
 
-    // Every header that will be signed: the caller's extras, plus host and
-    // x-amz-date (and the session token when present), lower-cased and
-    // trimmed the way the canonical form requires. A BTreeMap keeps them in
-    // the sorted order the canonical form also requires.
-    // Canonical header values are trimmed AND internally collapsed -
-    // AWS folds sequential whitespace to one space before signing, so a
-    // header like "a  b" must sign as "a b" or the service refuses it.
     let mut headers: BTreeMap<String, String> = BTreeMap::new();
     for (key, value) in &input.headers {
         headers.insert(

package/project/.sdk/tm/rust/feature/secrets/plugins/aws.rs

@@ -1,13 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/aws/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/aws/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! The two AWS providers - Secrets Manager and SSM Parameter Store -
-//! and the request signing they need, as voxgig/plugin definitions.
-//!
-//! SIGV4 TRAVELS WITH THEM, which is the sharpest instance of the split:
-//! the core of no port imports a hash function, and `crypto.rs` here is
-//! the only SHA-256 in this repository's Rust. A chain of built-in kinds
-//! links neither it nor the HTTP client it signs for.
 
 pub mod crypto;
 pub mod sigv4;
@@ -23,7 +16,6 @@ use super::httpjson::{fetchjson, firstof, headerrefs, http, textat, trimslash, J
 
 pub use self::sigv4::{sigv4, Sigv4Input, Sigv4Output};
 
-/// The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now.
 fn awsnow() -> String {
     let seconds = SystemTime::now()
         .duration_since(UNIX_EPOCH)
@@ -44,9 +36,6 @@ fn awsnow() -> String {
     )
 }
 
-/// Days since the epoch as a civil date - the classic era-based
-/// conversion (Howard Hinnant's `civil_from_days`), exact for any date
-/// the epoch can name.
 fn civildate(days: i64) -> (i64, u32, u32) {
     let z = days + 719468;
     let era = if 0 <= z { z } else { z - 146096 } / 146097;
@@ -166,14 +155,6 @@ fn awsmiss(body: &Option<Json>, types: &[&str]) -> bool {
     types.iter().any(|name| errtype.contains(name))
 }
 
-/// AWS Secrets Manager.
-///
-/// `api.token` reads the secret named `api` (the vaultref path, so
-/// `db.pass.main` reads `db/pass`) and takes the `token` field of its
-/// JSON SecretString - the AWS idiom of one JSON map per secret. A
-/// SecretString that is not JSON is the value itself, under the
-/// conventional field `value`. Requests are SigV4-signed in-tree; see
-/// src/sigv4.rs.
 pub struct AwsSecretsProvider {
     pub region: String,
     pub keyid: String,

package/project/.sdk/tm/rust/feature/secrets/plugins/azuresecrets.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/azuresecrets/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/azuresecrets/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The Azure Key Vault provider, as a voxgig/plugin definition.
 
@@ -13,17 +13,6 @@ use super::httpjson::{
     expiryseconds, fetchjson, http, renewdue, renewtime, textat, trimslash,
 };
 
-/// Azure Key Vault.
-///
-/// `api.token` reads secret `api-token` (dots flattened to `-`; Key
-/// Vault names allow nothing else), current version. The token comes
-/// from config, then a client-credentials login when tenant/clientid/
-/// clientsecret are given, then the IMDS managed-identity endpoint - so
-/// on Azure's own platform no credential configuration is needed.
-///
-/// As with GCP, the IMDS call is plain http to a link-local host by
-/// platform design and carries no credential; the login and vault
-/// addresses are `checkaddr`-guarded.
 #[derive(Default)]
 pub struct AzureSecretsProvider {
     pub vault: String,

package/project/.sdk/tm/rust/feature/secrets/plugins/boru.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/boru/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/boru/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The boru vault provider, as a voxgig/plugin definition.
 //!
@@ -13,30 +13,6 @@ use crate::feature::secrets::plugin::catalog::Definition;
 use crate::feature::secrets::sekreto::{checkaddr, checkname, providerplugin, Answer, Provider, SekretoError};
 use super::httpjson::{fetchjson, textat, trimslash};
 
-/// A boru vault (https://github.com/boru-lang/boru).
-///
-/// Two ways in, both boru's own.
-///
-/// With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
-/// secret on stdout and nothing else. The passphrase is read by boru
-/// itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
-/// config and never puts it on a command line, where it would show up in
-/// the process table.
-///
-/// With an `addr`, boru's wire protocol: `boru vault serve` publishes a
-/// read-only, HashiCorp-shaped provision API (boru's
-/// design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
-/// from `boru vault grant`. A sekreto name is already a valid boru
-/// alias, and boru aliases keep their dots, so `api.token` is the single
-/// path segment `api.token` - not the `api`/`token` split a HashiCorp KV
-/// gets. The value is the `value` field. A 404 is a miss; anything else
-/// the server refuses (a revoked capability, a sealed vault) is an
-/// error.
-///
-/// boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
-/// credential *broker*, built precisely so the caller never receives the
-/// credential. `vault serve` is the provision endpoint, built to hand
-/// the value back - that is the one sekreto uses.
 pub struct BoruProvider {
     pub command: String,
     pub namespace: String,
@@ -147,8 +123,6 @@ impl Provider for BoruProvider {
     }
 }
 
-/// Does this boru failure mean "no such secret" rather than "I could not
-/// answer"? Matched on boru's own wording for a missing alias.
 fn borumiss(why: &str) -> bool {
     why.contains("no alias named")
 }

package/project/.sdk/tm/rust/feature/secrets/plugins/doppler.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/doppler/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/doppler/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The Doppler provider, as a voxgig/plugin definition.
 
@@ -12,12 +12,6 @@ use crate::feature::secrets::sekreto::{checkaddr, envkey, providerplugin, Answer
 use super::httpjson::json::Json;
 use super::httpjson::{fetchjson, http, trimslash};
 
-/// Doppler.
-///
-/// The whole config is downloaded once - Doppler's own bulk endpoint -
-/// and answered from memory, like a remote .env: `api.token` is the
-/// `API_TOKEN` entry. A service token is config-scoped, so project and
-/// config are only needed with broader tokens.
 #[derive(Default)]
 pub struct DopplerProvider {
     pub token: String,

package/project/.sdk/tm/rust/feature/secrets/plugins/gcpsecrets.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/gcpsecrets/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/gcpsecrets/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The GCP Secret Manager provider, as a voxgig/plugin definition.
 
@@ -15,17 +15,6 @@ use super::httpjson::{
     expiryseconds, fetchjson, firstof, http, renewdue, renewtime, textat, trimslash,
 };
 
-/// GCP Secret Manager.
-///
-/// `api.token` reads secret `api_token` (dots flattened to `_`; Secret
-/// Manager ids have no hierarchy and reject dots), latest version. The
-/// token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
-/// GCE/GKE metadata server - so on Google's own platform no credential
-/// configuration is needed at all.
-///
-/// The metadata call itself is plain http to a link-local host by
-/// platform design; no credential rides on it, so `checkaddr` guards the
-/// Secret Manager address instead.
 #[derive(Default)]
 pub struct GcpSecretsProvider {
     pub project: String,

package/project/.sdk/tm/rust/feature/secrets/plugins/hashicorp.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/hashicorp/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/hashicorp/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The HashiCorp Vault provider, as a voxgig/plugin definition.
 //!
@@ -20,20 +20,6 @@ use super::httpjson::{
     expiryseconds, fetchjson, headerrefs, renewdue, renewtime, textat, trimslash,
 };
 
-/// HashiCorp Vault.
-///
-/// KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
-/// and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
-/// `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
-/// "not here" - a miss - so a vault can sit in a chain with fallbacks.
-///
-/// A Vault Enterprise namespace rides the X-Vault-Namespace header, on
-/// logins as well as reads.
-///
-/// Instead of being handed a token, the provider can log in: Kubernetes
-/// auth (the pod's service-account JWT, from its conventional path) or
-/// AppRole. A failed login is an error, never a miss - it means this
-/// store could not answer at all.
 #[derive(Default)]
 pub struct HashicorpProvider {
     pub addr: String,