@voxgig/sdkgen 4.29.0 → 4.30.1

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson/http.rs

@@ -1,22 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/httpjson/src/http.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/httpjson/src/http.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Just enough HTTP to ask a vault for a secret.
-//!
-//! The Rust standard library has no HTTP client, so this speaks HTTP/1.1
-//! over a TcpStream directly: a GET or POST with headers and an optional
-//! body, a status line, and a response body delimited by Content-Length,
-//! by chunks, or by the connection closing.
-//!
-//! https goes over rustls - the one dependency this repo takes, and a
-//! deliberate one. A secrets library reaching a remote vault needs TLS, and
-//! hand-rolling TLS would be far worse than taking a well-audited crate.
-//! Server certificates are verified against the Mozilla root set, plus any
-//! extra roots named by `SEKRETO_CA_BUNDLE` - an internal Vault behind a
-//! private CA is the common case, not the exotic one.
-//!
-//! It is still not a general-purpose client: no redirect following, no
-//! keep-alive, no client certificates.
 
 use std::io::{Read, Write};
 use std::net::{SocketAddr, TcpStream, ToSocketAddrs};
@@ -26,7 +10,6 @@ use std::time::{Duration, Instant};
 use rustls::pki_types::{CertificateDer, ServerName};
 use rustls::{ClientConfig, ClientConnection, RootCertStore, StreamOwned};
 
-/// The environment variable naming extra trust roots, as a PEM bundle.
 pub const CABUNDLE: &str = "SEKRETO_CA_BUNDLE";
 
 /// Anything the exchange can run over: a plain TcpStream, or a rustls
@@ -34,16 +17,12 @@ pub const CABUNDLE: &str = "SEKRETO_CA_BUNDLE";
 trait ReadWrite: Read + Write {}
 impl<T: Read + Write> ReadWrite for T {}
 
-/// What a vault answered: the status code and the raw body.
 pub struct Response {
     pub status: u16,
     pub body: String,
 }
 
-/// A url split into the parts a request needs.
 struct Target {
-    /// The bare host: what we connect to, and what the certificate is
-    /// checked against. An IPv6 literal appears here without brackets.
     host: String,
     /// The authority as it goes in the `Host:` header. An IPv6 literal
     /// keeps its brackets, because `Host: 2001:db8::1:8200` is not a valid
@@ -54,40 +33,12 @@ struct Target {
     tls: bool,
 }
 
-/// How much of a response body will be read before the store is treated as
-/// having answered incoherently. Ports carry the same bound.
-///
-/// Far above anything real - the largest legitimate payload this library
-/// fetches is Doppler's whole-config download, measured in kilobytes. A bound
-/// is needed because the read timeout is not one: it is per-read, so a server
-/// that keeps sending resets it forever.
 const MAXBODY: u64 = 8 * 1024 * 1024;
 
 /// How long reaching a vault may take before it is treated as unreachable.
 /// Ports carry the same bound.
 const TIMEOUT: Duration = Duration::from_secs(10);
 
-/// Connect, but give up after TIMEOUT.
-///
-/// `TcpStream::connect` takes a host and a port and has NO bound: against an
-/// address that swallows SYNs it blocks for however long the kernel retries,
-/// which on Linux is a little over two minutes. Measured: still blocked at
-/// 25s against 10.255.255.1 where ten of the twelve ports gave up at 10 -
-/// this port and Zig were the two that did not.
-///
-/// `connect_timeout` is the bounded one, and it takes a resolved SocketAddr
-/// rather than a name, so the resolution has to happen here.
-///
-/// The bound is on the WHOLE attempt, not on each address. A name commonly
-/// resolves to several - a dual-stack host answers with both an A and an
-/// AAAA - and giving each the full ten seconds would make the real bound
-/// ten seconds times however many addresses the name cares to return, which
-/// is not a bound at all when the name is the attacker's. Each attempt gets
-/// what is left of the one deadline.
-///
-/// The bound does NOT cover the resolution itself, which std offers no way
-/// to bound - a DNS server that hangs still hangs. The connect is the part
-/// an attacker chooses.
 fn connect(host: &str, port: u16, url: &str) -> Result<TcpStream, String> {
     let unreachable =
         |why: String| format!("sekreto: cannot reach {}: {}", nakedurl(url), why);
@@ -99,10 +50,6 @@ fn connect(host: &str, port: u16, url: &str) -> Result<TcpStream, String> {
     connectall(addrs, TIMEOUT).map_err(unreachable)
 }
 
-/// Walk resolved addresses under one shared deadline.
-///
-/// Split out from `connect` so the deadline can be tested without waiting
-/// the real ten seconds.
 fn connectall(
     addrs: impl Iterator<Item = SocketAddr>,
     budget: Duration,
@@ -133,13 +80,6 @@ fn connectall(
     })
 }
 
-/// A url without its query string, for messages.
-///
-/// A query here carries the vault path, the secret name or a filter -
-/// `secretPath=/prod/payments/stripe` - which does not belong in a log or a
-/// stack trace. `providers.rs` strips it at every message it raises; this
-/// file did not, at nine sites, including the two most likely in production
-/// (an unreachable vault and a TLS failure).
 fn nakedurl(url: &str) -> &str {
     match url.find('?') {
         Some(at) => &url[..at],
@@ -195,8 +135,6 @@ fn split(url: &str) -> Result<Target, String> {
     })
 }
 
-/// Decode standard base64: a PEM body, a GCP secret payload, an AWS
-/// SecretBinary.
 pub fn unbase64(text: &str) -> Option<Vec<u8>> {
     const ALPHABET: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
@@ -223,7 +161,6 @@ pub fn unbase64(text: &str) -> Option<Vec<u8>> {
     Some(out)
 }
 
-/// Pull every certificate out of a PEM bundle.
 fn pemcerts(text: &str) -> Vec<CertificateDer<'static>> {
     const OPEN: &str = "-----BEGIN CERTIFICATE-----";
     const CLOSE: &str = "-----END CERTIFICATE-----";
@@ -271,12 +208,10 @@ fn rootstore() -> RootCertStore {
     roots
 }
 
-/// GET a url with one extra header.
 pub fn get(url: &str, header: &str, value: &str) -> Result<Response, String> {
     getwith(url, &[(header, value)])
 }
 
-/// GET a url with a set of headers.
 pub fn getwith(url: &str, headers: &[(&str, &str)]) -> Result<Response, String> {
     request("GET", url, headers, None)
 }
@@ -330,7 +265,6 @@ pub fn request(
     exchange(&mut stream, method, &target, headers, body, url)
 }
 
-/// Write the request and read the response, over whatever the transport is.
 fn exchange(
     stream: &mut impl ReadWrite,
     method: &str,
@@ -394,7 +328,6 @@ fn exchange(
     let head = String::from_utf8_lossy(&raw[..split_at]).to_string();
     let rawbody = &raw[split_at + 4..];
 
-    // "HTTP/1.1 200 OK" - the second field is the status.
     let status = head
         .lines()
         .next()
@@ -424,21 +357,11 @@ fn exchange(
     Ok(Response { status, body })
 }
 
-/// The offset of `needle` in `hay`, if it is there.
 fn findbytes(hay: &[u8], needle: &[u8]) -> Option<usize> {
     hay.windows(needle.len())
         .position(|window| window == needle)
 }
 
-/// Join a chunked body back together.
-///
-/// Each chunk is a hex length, CRLF, that many bytes, CRLF. A zero length
-/// ends the body; any trailer after it is ignored.
-///
-/// Bytes, not `str`: a chunk length counts bytes, and a boundary may fall
-/// inside a multibyte character. Slicing a `str` at such an offset panics,
-/// so a secret containing any non-ASCII character could take the process
-/// down rather than come back.
 fn dechunk(raw: &[u8]) -> Option<Vec<u8>> {
     let mut out = Vec::new();
     let mut rest = raw;
@@ -446,7 +369,6 @@ fn dechunk(raw: &[u8]) -> Option<Vec<u8>> {
     loop {
         let at = findbytes(rest, b"\r\n")?;
 
-        // A chunk length may carry extensions after a `;`.
         let header = std::str::from_utf8(&rest[..at]).ok()?;
         let size = usize::from_str_radix(header.split(';').next()?.trim(), 16).ok()?;
 
@@ -466,7 +388,6 @@ fn dechunk(raw: &[u8]) -> Option<Vec<u8>> {
     }
 }
 
-/// Percent-encode a query-string value.
 pub fn urlencode(text: &str) -> String {
     let mut out = String::new();
 
@@ -492,15 +413,6 @@ mod tests {
         format!("10.255.255.{}:8200", last).parse().unwrap()
     }
 
-    /// Several unreachable addresses must share one deadline, not each get
-    /// their own: a name that resolves to N of them would otherwise cost
-    /// N times the bound, and the name can be the attacker's.
-    ///
-    /// This needs addresses that SWALLOW a SYN rather than refuse it, and
-    /// whether any given address does is the network's business, not this
-    /// crate's. So the single-address case is measured first: if it comes
-    /// back fast the addresses are being refused, there is nothing to time,
-    /// and the test says so instead of passing on a technicality.
     #[test]
     fn addresses_share_one_deadline() {
         let start = Instant::now();
@@ -524,8 +436,6 @@ mod tests {
 
         assert!(three.is_err(), "10.255.255.0/24 must not connect");
 
-        // Three at 300ms each is 900ms; one shared deadline is 300ms. The
-        // slack is for a loaded machine, and is still far below per-address.
         assert!(
             took < BUDGET * 2,
             "three addresses took {:?} against a {:?} budget: \

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson/json.rs

@@ -1,11 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/httpjson/src/json.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/httpjson/src/json.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Minimal JSON support for sekreto.
-//!
-//! sekreto adds no third-party dependencies, so it carries just enough JSON
-//! to read a vault's answer and write the CLI's own line of output. It is
-//! deliberately not a general-purpose library.
 
 use std::collections::BTreeMap;
 
@@ -42,7 +37,6 @@ impl Json {
     }
 }
 
-/// Render a number without a trailing `.0`, so 5.0 prints as `5`.
 pub fn numstr(value: f64) -> String {
     if value.is_finite() && value == value.trunc() && value.abs() < 1e15 {
         return format!("{}", value as i64);

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson.rs

@@ -1,17 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/httpjson/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/httpjson/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! The HTTP-JSON client the vault plugins share, and the helpers that go
-//! with it.
-//!
-//! It lives under `plugins/` because a chain of BUILT-IN kinds must never
-//! link it: `http.rs` is a TCP socket and a rustls session, and the core
-//! reads at most a local file. `voxgig_sekreto` does not depend on this
-//! crate; this crate depends on it.
-//!
-//! `json.rs` travels with it rather than staying in the core for the same
-//! reason it was written at all: the only things that parse JSON here are
-//! the vault clients and the CLI that calls a JSON API.
 
 pub mod http;
 pub mod json;
@@ -24,13 +13,10 @@ use super::super::sekreto::{Answer, SekretoError};
 
 pub use self::json::Json;
 
-/// A base URL with one trailing slash removed, so paths join cleanly.
 pub fn trimslash(addr: &str) -> &str {
     addr.strip_suffix('/').unwrap_or(addr)
 }
 
-/// The first non-empty answer: the configured value, then each named
-/// environment variable in turn.
 pub fn firstof(config: &str, envnames: &[&str]) -> String {
     if !config.is_empty() {
         return config.to_string();
@@ -47,7 +33,6 @@ pub fn firstof(config: &str, envnames: &[&str]) -> String {
     String::new()
 }
 
-/// Owned headers as the borrowed pairs the http client takes.
 pub fn headerrefs(headers: &[(String, String)]) -> Vec<(&str, &str)> {
     headers
         .iter()
@@ -55,7 +40,6 @@ pub fn headerrefs(headers: &[(String, String)]) -> Vec<(&str, &str)> {
         .collect()
 }
 
-/// What a store answered: the status, and the body when it parsed as JSON.
 pub struct JsonResponse {
     pub status: u16,
     pub body: Option<Json>,
@@ -73,10 +57,6 @@ pub fn fetchjson(
 
     let parsed = self::json::parse(&response.body);
 
-    // A success status promised JSON; a body that does not parse means
-    // the store could not answer coherently, and treating it as a miss
-    // would fall through to a weaker store. Error statuses may carry
-    // any body - they are decided on status alone.
     if 200 == response.status && parsed.is_none() {
         return Err(SekretoError::new(format!(
             "sekreto: malformed response from {}",
@@ -96,9 +76,6 @@ pub fn fetchjson(
 /// renewed on a guess.
 pub fn renewtime(seconds: f64) -> Option<Instant> {
     if 0.0 < seconds && seconds.is_finite() {
-        // Clamp before constructing the Duration: from_secs_f64 panics on a
-        // non-finite or too-large value, and a token expiry comes from the
-        // (untrusted) auth response. A century is more than any real lease.
         let bounded = (seconds - 60.0).max(1.0).min(3_153_600_000.0);
         Some(Instant::now() + Duration::from_secs_f64(bounded))
     } else {
@@ -106,22 +83,16 @@ pub fn renewtime(seconds: f64) -> Option<Instant> {
     }
 }
 
-/// The expiry a login response named, in seconds - zero when it named
-/// none (or named it unreadably). Some stores send the number as a JSON
-/// string, so the text form is parsed rather than the number taken.
 pub fn expiryseconds(body: &Option<Json>, path: &[&str]) -> f64 {
     textat(body, path)
         .and_then(|text| text.parse::<f64>().ok())
         .unwrap_or(0.0)
 }
 
-/// Is a cached login token due for renewal? A token that never expires
-/// (a configured one, or one whose login named no expiry) never is.
 pub fn renewdue(renewat: &RefCell<Option<Instant>>) -> bool {
     renewat.borrow().map_or(false, |at| Instant::now() >= at)
 }
 
-/// The value at a path of map keys, as text - or None when absent or null.
 pub fn textat(body: &Option<Json>, path: &[&str]) -> Option<String> {
     let mut at = body.as_ref()?;
 

package/project/.sdk/tm/rust/feature/secrets/plugins/infisical.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/infisical/src/lib.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/infisical/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The Infisical provider, as a voxgig/plugin definition.
 
@@ -15,12 +15,6 @@ use super::httpjson::{
     expiryseconds, fetchjson, http, renewdue, renewtime, textat, trimslash,
 };
 
-/// Infisical.
-///
-/// `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
-/// convention is environment-style keys) at a secret path in one
-/// environment of a project. Auth is a token, or a universal-auth
-/// (machine identity) login with clientid/clientsecret.
 #[derive(Default)]
 pub struct InfisicalProvider {
     pub addr: String,

package/project/.sdk/tm/rust/feature/secrets/plugins/minivault/format.rs

@@ -1,41 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (rust/plugins/minivault/src/format.rs)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (rust/plugins/minivault/src/format.rs)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! The mini vault's file format, and the key hierarchy over it.
-//!
-//! A port of typescript/plugins/minivault.ts, which is canonical. The
-//! bytes are the contract: a vault written by any port is read by every
-//! other, and the vaults committed under `test/fixture/` pin that rather
-//! than leaving it to agreement.
-//!
-//! ```text
-//! magic       4   'SKMV'
-//! version     1   FORMAT
-//! kdf         1   1 = PBKDF2-HMAC-SHA256
-//! cipher      1   1 = AES-256-GCM
-//! reserved    1   0
-//! keycount    4   u32
-//! per key:
-//!   id        1 + bytes            the key id, PLAINTEXT
-//!   salt      1 + bytes
-//!   iters     4                    PBKDF2 rounds for this key
-//!   ring      1 + iv, 4 + bytes    sealed under the passphrase
-//!   meta      1 + iv, 4 + bytes    sealed under the vault's meta key
-//! entrycount  4   u32
-//! per entry:
-//!   id        1 + bytes            the blinded lookup id
-//!   name      1 + iv, 4 + bytes    sealed under the vault's name key
-//!   value     1 + iv, 4 + bytes    sealed under that secret's own key
-//! ```
-//!
-//! Integers are big-endian and every length precedes its bytes, so the
-//! file is written with the same two primitives it is read with.
-//!
-//! NOTHING OUTSIDE A KEY RECORD IS PLAINTEXT. Secret names are sealed,
-//! and an entry is addressed by a blinded id derived from its own key, so
-//! a restricted key finds what it was granted without the file ever
-//! naming the rest. What the file does show anyone is the key ids and how
-//! many secrets there are.
 
 use std::num::NonZeroU32;
 
@@ -83,13 +48,6 @@ pub fn fail<T>(text: &str) -> Answer<T> {
     Err(SekretoError::new(format!("sekreto: minivault: {}", text)))
 }
 
-/// The largest key id the format can record.
-///
-/// `small` writes a length in ONE byte. A longer id wraps that byte and
-/// the writer then appends the whole thing, so every field after it
-/// shifts: a grant with a 300-character id would replace a working vault
-/// with an unreadable one, and say nothing. Checked where an id is
-/// ACCEPTED, so the refusal names the id rather than the file.
 pub const IDMAX: usize = 255;
 
 pub fn checkid(id: &str, what: &str) -> Answer<()> {
@@ -132,13 +90,6 @@ pub fn kek(passphrase: &str, salt: &[u8], iters: u32) -> Answer<Vec<u8>> {
     Ok(out)
 }
 
-/// The key one named secret's value is encrypted with.
-///
-/// DERIVED, never stored, for a master: it holds the root key and so
-/// reaches every name, including ones written after it was made. A
-/// restricted key holds the derived keys it was granted and nothing that
-/// produces another, so every other name is ciphertext to it in exactly
-/// the way it is to a stranger.
 pub fn secretkey(root: &[u8], name: &str) -> Vec<u8> {
     mac(root, &format!("{}{}", AAD_SECRET, name))
 }
@@ -257,13 +208,6 @@ struct Reader<'a> {
 }
 
 impl<'a> Reader<'a> {
-    /// Reads `length` bytes, or refuses.
-    ///
-    /// The bound is checked AGAINST WHAT IS LEFT, as a u64, never by
-    /// adding the length to the cursor. A damaged vault can encode a
-    /// length at or above `u32::MAX`, and adding that to `at` on a 32-bit
-    /// target wraps - so the slice bound goes backwards and the process
-    /// panics instead of reporting the damaged file this exists to report.
     fn take(&mut self, length: u64) -> Answer<&'a [u8]> {
         if ((self.bytes.len() - self.at) as u64) < length {
             return fail("the vault file is truncated");