@voxgig/sdkgen 4.29.0 → 4.30.1

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sekreto.ts

@@ -1,47 +1,25 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/Sekreto.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// sekreto: one interface for secrets, wherever they live.
-//
-// A Sekreto is an ordered chain of providers. `get` asks each in turn and
-// returns the first hit, so an app can be configured from environment
-// variables in development and a vault in production without changing a
-// line of its own code.
-//
-// This file is CANONICAL. Every other port is a translation of it, and
-// spec/sekreto.json is the behavioural contract they all run.
-
-// THE CORE IMPORTS NO PROVIDER THAT OPENS A SOCKET, SPAWNS A PROCESS OR
-// SIGNS A REQUEST. The four built-in kinds - env, memory, dotenv, file -
-// read at most a local file; every other kind is a voxgig/plugin
-// definition under plugins/, and a chain may name one only if the
-// calling project handed it in through `plugins`. That is what keeps an
-// SDK whose chain is `[dotenv, env]` from carrying AWS request signing
-// and seven HTTP vault clients. See docs/design/plugin-providers.md.
+
 import { checktag, formatref, makecatalog, makehost } from '../plugin'
 import type { Catalog, Definition, Host } from '../plugin'
 
 import { ERROR_CODE, PROVIDER_EXPORT, Provider, ProviderSpec } from './provider/support'
 import { BUILTINS, KINDS } from './provider/builtin'
 
-/** A secret name: dot-separated lowercase segments, e.g. `api.token`. */
 export type Name = string
 
 export type SekretoOptions = {
-  /** The provider chain, in resolution order. An entry is a live
-   * provider, or the declarative spec of one - `{ kind, ...config }`. */
   providers?: (Provider | ProviderSpec)[]
   /** The provider kinds beyond the built-ins that `providers` may name,
    * as voxgig/plugin definitions. Static and explicit: the calling
    * project imports the plugins it needs and passes them here, and a
    * kind it did not pass is unknown to this Sekreto. */
   plugins?: Definition[]
-  /** Cache resolved values (default: true). */
   cache?: boolean
 }
 
-/** Anything sekreto refuses to do: a bad name, a missing secret, a
- * provider that could not be reached. */
 export class SekretoError extends Error {
   constructor(message: string) {
     super(message)
@@ -51,7 +29,6 @@ export class SekretoError extends Error {
 
 const NAMEPART = /^[a-z0-9_]+$/
 
-/** Is this a well-formed secret name? */
 export function validname(name: any): boolean {
   if ('string' !== typeof name || 0 === name.length) {
     return false
@@ -75,7 +52,6 @@ export function checkname(name: any): string {
   return name
 }
 
-/** The environment-variable key for a name: `api.token` -> `API_TOKEN`. */
 export function envkey(name: Name, prefix?: string): string {
   checkname(name)
   return (prefix || '') + name.split('.').join('_').toUpperCase()
@@ -97,16 +73,6 @@ export function vaultref(name: Name): { path: string; field: string } {
   return { path: parts.slice(0, -1).join('/'), field: parts[parts.length - 1] }
 }
 
-/** A name flattened to one segment: `api.token` -> `api_token` (GCP
- * Secret Manager, `_`) or `api-token` (Azure Key Vault, `-`).
- *
- * Those stores have no path hierarchy and reject dots in ids, so the
- * dots become the store's conventional separator. With `-` as the
- * separator, underscores flatten too: Azure Key Vault's alphabet is
- * letters, digits and hyphens only, and a valid sekreto name like
- * `with_underscore` must still be representable there. (The resulting
- * `.`/`_` collision mirrors the documented envkey behaviour, where
- * both already map to `_`.) */
 export function flatname(name: Name, sep: string): string {
   checkname(name)
   const flat = name.split('.').join(sep)
@@ -128,11 +94,6 @@ export function awsparam(name: Name, prefix?: string): string {
   return base + '/' + name.split('.').join('/')
 }
 
-/** Parse `.env` text into a map of raw keys to values.
- *
- * Deliberately small: `KEY=value`, optional `export`, `#` comments on their
- * own line, and single- or double-quoted values (double quotes also
- * unescape `\n`, `\r`, `\t` and `\\`). A line with no `=` is skipped. */
 export function parsedotenv(text: string): Record<string, string> {
   const out: Record<string, string> = {}
 
@@ -197,20 +158,6 @@ function unescape(text: string): string {
   return out
 }
 
-/** Replace known secret values in text with `[redacted]`.
- *
- * Only values of four characters or more are replaced: shorter ones are
- * too likely to appear in ordinary text, and redacting them would make
- * logs unreadable without making them safer.
- *
- * Longest first, which is not a detail. Replacing in the order the
- * values arrived meant a shorter secret that prefixes a longer one ate
- * the prefix and left the rest in the log: with `db.pass` = `abcd` from
- * the environment and `api.token` = `abcd1234` from the vault, and the
- * environment resolved first, `token=abcd1234` came out as
- * `token=[redacted]1234` — four characters of the vault token still
- * there. Longest first makes the longer secret match before anything can
- * eat its head. */
 export function redact(text: string, values: string[]): string {
   let out = 'string' === typeof text ? text : ''
 
@@ -218,8 +165,6 @@ export function redact(text: string, values: string[]): string {
     (value) => 'string' === typeof value && 4 <= value.length,
   )
 
-  // A copy: `values` belongs to the caller (it is `seen` when called
-  // through Sekreto.redact), and sorting in place would reorder it.
   for (const value of [...usable].sort((left, right) => right.length - left.length)) {
     out = out.split(value).join('[redacted]')
   }
@@ -232,27 +177,12 @@ export function redact(text: string, values: string[]): string {
  * handed in directly, which no instance backs. */
 type Entry = { store: string; ref: string; provider: Provider }
 
-/** One resolved value. Kept as a list rather than a map so that the store
- * a value came from stays attached, and so redaction order is stable. */
 type Cached = { store: string; name: Name; value: string }
 
-/** The store name a live provider answers to.
- *
- * `describe()` opens with the provider's kind - `hashicorp:...`,
- * `dotenv:...`, plain `env` - so the kind is the natural default, and a
- * custom provider gets a sensible name without having to implement
- * anything extra. A spec'd provider's store is its `name` or its `kind`,
- * decided before the provider exists. */
 function storename(provider: Provider): string {
   return provider.describe().split(':')[0]
 }
 
-/** The message for a kind the catalog does not hold.
- *
- * A kind sekreto has never heard of is a typo; a kind that exists as a
- * plugin but was not passed in is the split working as designed and
- * telling you what to pass. Collapsing the two was the first thing that
- * made the split confusing to use. */
 function unknownkind(kind: any, catalog: Catalog): string {
   const known = -1 !== KINDS.plugin.indexOf(String(kind))
   return (
@@ -262,8 +192,6 @@ function unknownkind(kind: any, catalog: Catalog): string {
   )
 }
 
-/** A SekretoError that crossed the plugin boundary comes back out as
- * itself, byte for byte. Anything else is not sekreto's to rewrite. */
 function unwrap(err: any): any {
   if (err && ERROR_CODE === err.code && err.details && 'string' === typeof err.details.cause) {
     return new SekretoError(err.details.cause)
@@ -271,20 +199,11 @@ function unwrap(err: any): any {
   return err
 }
 
-/** The secrets facade: a chain of providers plus a cache.
- *
- * Two ways to read. `get` is transparent - it walks the chain and takes
- * the first hit, and the caller never learns which store answered. `getfrom`
- * is directed - it names the store, and only that store is asked. Use the
- * first for ordinary configuration, the second when *which* store holds a
- * secret is part of what you mean. */
 export class Sekreto {
   /** The voxgig/plugin host every spec'd provider is an instance of.
    * Read it for introspection - `host.list()` names each store's ref and
    * status - and nothing on it advances the chain. */
   readonly host: Host
-  /** The definitions this Sekreto can build: the built-ins plus what
-   * `plugins` handed in. */
   readonly catalog: Catalog
 
   private entries: Entry[]
@@ -298,10 +217,6 @@ export class Sekreto {
   constructor(options?: SekretoOptions) {
     const opts = options || {}
 
-    // Built-ins first, then the plugins, into one catalog: a plugin that
-    // names a built-in kind replaces it, which is how a host substitutes
-    // an implementation and never an accident, because the four names
-    // are documented.
     this.catalog = makecatalog(BUILTINS.concat(opts.plugins || []))
     this.host = makehost({ catalog: this.catalog })
 
@@ -318,13 +233,6 @@ export class Sekreto {
     this.seen = []
   }
 
-  /** One chain entry, as a plugin instance.
-   *
-   * The instance is `kind` for a store named after its kind and
-   * `kind$store` otherwise - `hashicorp$prod` - so `host.list()` reads
-   * like the chain. A store name that is already taken gets a numbered
-   * tag from the host instead, because two providers MAY share a store
-   * name (a directed read walks both) and an instance ref may not. */
   private declare(spec: ProviderSpec): Entry {
     const kind = null == spec ? undefined : spec.kind
 
@@ -357,7 +265,6 @@ export class Sekreto {
     return { store, ref, provider: this.host.exports(ref + '/' + PROVIDER_EXPORT) as Provider }
   }
 
-  /** The secret, or a SekretoError if no provider has it. */
   async get(name: Name): Promise<string> {
     const found = await this.try(name)
 
@@ -368,13 +275,10 @@ export class Sekreto {
     return found
   }
 
-  /** The secret, or undefined if no provider has it. */
   async try(name: Name): Promise<string | undefined> {
     return this.resolve('', name, this.entries)
   }
 
-  /** The secret from one named store, or a SekretoError if that store does
-   * not have it. */
   async getfrom(store: string, name: Name): Promise<string> {
     const found = await this.tryfrom(store, name)
 
@@ -385,12 +289,6 @@ export class Sekreto {
     return found
   }
 
-  /** The secret from one named store, or undefined if that store does not
-   * have it.
-   *
-   * Naming a store that is not in the chain is an error, not a miss: `try`
-   * already means "this store may not have it", so it cannot also mean
-   * "this store may not exist" without hiding a typo. */
   async tryfrom(store: string, name: Name): Promise<string | undefined> {
     const matching = this.entries.filter((entry) => entry.store === store)
 
@@ -426,17 +324,14 @@ export class Sekreto {
     return undefined
   }
 
-  /** Does any provider have this secret? */
   async has(name: Name): Promise<boolean> {
     return undefined !== (await this.try(name))
   }
 
-  /** Does this named store have this secret? */
   async hasin(store: string, name: Name): Promise<boolean> {
     return undefined !== (await this.tryfrom(store, name))
   }
 
-  /** Every named secret at once. Missing ones are an error. */
   async all(names: Name[]): Promise<Record<string, string>> {
     const out: Record<string, string> = {}
 
@@ -447,21 +342,6 @@ export class Sekreto {
     return out
   }
 
-  /** What a Sekreto shows of itself when something prints it.
-   *
-   * `console.log(sekreto)` and `JSON.stringify(sekreto)` both reach
-   * `cache` and `seen`, which between them hold every value this chain
-   * has ever resolved — so one ordinary logging call writes every secret
-   * to the log. `private` is a compile-time fiction: at run time the
-   * fields are ordinary and enumerable.
-   *
-   * `JSON.stringify` is the one that bites hardest, because a structured
-   * logger serialises its whole context object without anyone writing a
-   * line about secrets: `logger.info({ secrets: sekreto }, 'ready')`.
-   *
-   * Both hooks are needed. `toJSON` covers `JSON.stringify` and
-   * everything built on it; the inspect symbol covers `console.log`,
-   * `util.inspect` and the REPL. Neither reaches a value. */
   toJSON(): object {
     return { stores: this.stores() }
   }
@@ -470,13 +350,10 @@ export class Sekreto {
     return 'Sekreto { stores: [ ' + this.stores().join(', ') + ' ] }'
   }
 
-  /** A description of each provider, in resolution order. */
   sources(): string[] {
     return this.entries.map((entry) => entry.provider.describe())
   }
 
-  /** The name of each store that can be named by `getfrom`, in resolution
-   * order and without repeats. */
   stores(): string[] {
     const out: string[] = []
 
@@ -489,15 +366,10 @@ export class Sekreto {
     return out
   }
 
-  /** Replace every value this Sekreto has resolved with `[redacted]`.
-   *
-   * Works whether or not caching is enabled: the redaction list is kept
-   * independently of the read cache. */
   redact(text: string): string {
     return redact(text, this.seen)
   }
 
-  /** Drop cached values, so the next `get` asks the providers again. */
   refresh(): void {
     this.cache = []
   }
@@ -514,7 +386,6 @@ export class Sekreto {
   }
 }
 
-/** Make a Sekreto from options. */
 export function sekreto(options?: SekretoOptions): Sekreto {
   return new Sekreto(options)
 }

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/sekreto - one interface for secrets, wherever they live.
 
@@ -18,26 +18,6 @@ export {
 
 export type { Name, SekretoOptions } from './Sekreto'
 
-// THE CORE SURFACE: the chain, the four built-in provider kinds, and the
-// means of adding a fifth.
-//
-// The built-ins are the kinds that read at most a local file - env,
-// memory, dotenv, file. Everything that opens a socket, spawns a process
-// or signs a request is a PLUGIN, is not reachable from this file, and
-// is handed to `Sekreto` by the calling project:
-//
-//     import { Sekreto } from '@voxgig/sekreto'
-//     import { hashicorp } from '@voxgig/sekreto/plugins/hashicorp'
-//
-//     const secrets = new Sekreto({
-//       plugins: [hashicorp],
-//       providers: [{ kind: 'env' }, { kind: 'hashicorp', addr, token }],
-//     })
-//
-// or, for every kind at once, `allplugins` from '@voxgig/sekreto/plugins'.
-// Re-exporting a plugin here would put AWS request signing in every
-// build again, which is the thing the split removes. See
-// docs/design/plugin-providers.md.
 export { envprovider } from './provider/env'
 export { memoryprovider } from './provider/memory'
 export { dotenvprovider } from './provider/dotenv'

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/aws.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/aws.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -10,7 +10,6 @@ import { checkaddr } from '../provider/addr'
 import { sigv4 } from './sigv4'
 import { fetchjson } from './httpjson'
 
-/** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
 function awsnow(): string {
   return new Date()
     .toISOString()
@@ -56,7 +55,6 @@ function awsauth(opts: Awsopts): {
   return { region, keyid, secret, session }
 }
 
-/** One signed call to an AWS JSON-1.1 API. */
 async function awscall(
   opts: Awsopts,
   service: string,
@@ -100,14 +98,6 @@ function awsmiss(body: any, types: string[]): boolean {
   return types.some((name) => errtype.includes(name))
 }
 
-/** AWS Secrets Manager.
- *
- * `api.token` reads the secret named `api` (the vaultref path, so
- * `db.pass.main` reads `db/pass`) and takes the `token` field of its
- * JSON SecretString - the AWS idiom of one JSON map per secret. A
- * SecretString that is not JSON is the value itself, under the
- * conventional field `value`. Requests are SigV4-signed in-tree; see
- * Sigv4.ts. */
 export function awssecretsprovider(options?: Awsopts): Provider {
   const opts = options || {}
 
@@ -155,7 +145,6 @@ export function awssecretsprovider(options?: Awsopts): Provider {
         return undefined === value || null === value ? undefined : String(value)
       }
 
-      // A plain-string secret is the whole value; it has no named fields.
       return 'value' === ref.field ? text : undefined
     },
     // Config only, never the environment: describe() feeds the spec's
@@ -195,10 +184,6 @@ export function awsparamsprovider(options?: Awsopts): Provider {
 }
 
 
-/** The two plugins. Both need HTTPS and HMAC-SHA256 - the one crypto
- * dependency in the library, which is why this is a plugin rather than
- * a built-in: `sigv4` is exported from here and from nowhere in the
- * core. */
 export const awssecrets = providerplugin('awssecrets', (spec: ProviderSpec) =>
   awssecretsprovider(spec))
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/azuresecrets.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/azuresecrets.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -7,17 +7,6 @@ import { ProviderSpec, Provider, SekretoError, flatname, providerplugin } from '
 import { checkaddr } from '../provider/addr'
 import { fetchjson } from './httpjson'
 
-/** Azure Key Vault.
- *
- * `api.token` reads secret `api-token` (dots flattened to `-`; Key
- * Vault names allow nothing else), current version. The token comes
- * from config, then a client-credentials login when tenant/clientid/
- * clientsecret are given, then the IMDS managed-identity endpoint - so
- * on Azure's own platform no credential configuration is needed.
- *
- * As with GCP, the IMDS call is plain http to a link-local host by
- * platform design and carries no credential; the login and vault
- * addresses are `checkaddr`-guarded. */
 export function azuresecretsprovider(options?: {
   vault?: string
   token?: string

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/boru.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/boru.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -9,30 +9,6 @@ import {
 import { checkaddr } from '../provider/addr'
 import { fetchjson } from './httpjson'
 
-/** A boru vault (https://github.com/boru-lang/boru).
- *
- * Two ways in, both boru's own.
- *
- * With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
- * secret on stdout and nothing else. The passphrase is read by boru
- * itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
- * config and never puts it on a command line, where it would show up in
- * the process table.
- *
- * With an `addr`, boru's wire protocol: `boru vault serve` publishes a
- * read-only, HashiCorp-shaped provision API (boru's
- * design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
- * from `boru vault grant`. A sekreto name is already a valid boru
- * alias, and boru aliases keep their dots, so `api.token` is the single
- * path segment `api.token` - not the `api`/`token` split a HashiCorp KV
- * gets. The value is the `value` field. A 404 is a miss; anything else
- * the server refuses (a revoked capability, a sealed vault) is an
- * error.
- *
- * boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
- * credential *broker*, built precisely so the caller never receives the
- * credential. `vault serve` is the provision endpoint, built to hand
- * the value back - that is the one sekreto uses. */
 export function boruprovider(options?: {
   command?: string
   namespace?: string
@@ -112,8 +88,6 @@ export function boruprovider(options?: {
   }
 }
 
-/** Does this boru failure mean "no such secret" rather than "I could not
- * answer"? Matched on boru's own wording for a missing alias. */
 function borumiss(why: string): boolean {
   return /no alias named/.test(why)
 }

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/doppler.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/doppler.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -7,12 +7,6 @@ import { ProviderSpec, Provider, SekretoError, envkey, providerplugin } from '..
 import { checkaddr } from '../provider/addr'
 import { fetchjson } from './httpjson'
 
-/** Doppler.
- *
- * The whole config is downloaded once - Doppler's own bulk endpoint -
- * and answered from memory, like a remote .env: `api.token` is the
- * `API_TOKEN` entry. A service token is config-scoped, so project and
- * config are only needed with broader tokens. */
 export function dopplerprovider(options?: {
   token?: string
   project?: string

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/gcpsecrets.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/gcpsecrets.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -9,17 +9,6 @@ import {
 import { checkaddr } from '../provider/addr'
 import { fetchjson } from './httpjson'
 
-/** GCP Secret Manager.
- *
- * `api.token` reads secret `api_token` (dots flattened to `_`; Secret
- * Manager ids have no hierarchy and reject dots), latest version. The
- * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
- * GCE/GKE metadata server - so on Google's own platform no credential
- * configuration is needed at all.
- *
- * The metadata call itself is plain http to a link-local host by
- * platform design; no credential rides on it, so `checkaddr` guards the
- * Secret Manager address instead. */
 export function gcpsecretsprovider(options?: {
   project?: string
   token?: string

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/hashicorp.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/hashicorp.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -9,20 +9,6 @@ import {
 import { checkaddr } from '../provider/addr'
 import { fetchjson } from './httpjson'
 
-/** HashiCorp Vault.
- *
- * KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
- * and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
- * `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
- * "not here" - a miss - so a vault can sit in a chain with fallbacks.
- *
- * A Vault Enterprise namespace rides the X-Vault-Namespace header, on
- * logins as well as reads.
- *
- * Instead of being handed a token, the provider can log in: Kubernetes
- * auth (the pod's service-account JWT, from its conventional path) or
- * AppRole. A failed login is an error, never a miss - it means this
- * store could not answer at all. */
 export function hashicorpprovider(
   addr: string,
   token: string,

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/httpjson.ts

@@ -1,37 +1,14 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/httpjson.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
 import { SekretoError } from '../provider/support'
 
-/** How long any single vault round-trip may take before it is treated as
- * unreachable. Ports carry the same bound. */
 const HTTP_TIMEOUT_MS = 10000
 
-/** How much of a response body will be read before the store is treated as
- * having answered incoherently. Ports carry the same bound.
- *
- * Far above anything real. The largest legitimate payload this library
- * fetches is Doppler's whole-config download, measured in kilobytes; a
- * megabyte would do. Eight is chosen so that no honest store can meet it
- * and the check never has to be reasoned about again.
- *
- * A bound is needed because the timeout is not one. Ten seconds on a
- * loopback or datacentre link is gigabytes, and the body is accumulated
- * in memory before it is parsed — measured at 3.2 GB in one port before
- * this. Worse where a client advertises gzip and decompresses
- * transparently, since a few hundred kilobytes of zeros expands to
- * gigabytes in the client's heap. This is a secrets chain running on an
- * application's startup path, so the failure is the application never
- * starting. */
 const HTTP_MAXBODY = 8 * 1024 * 1024
 
-/** One JSON round-trip. Network failure is always an error - an
- * unreachable store is a store that could not answer.
- *
- * Shared by every plugin that speaks HTTP, and by nothing in the core:
- * a chain of built-ins never reaches this file. */
 export async function fetchjson(
   method: string,
   url: string,
@@ -49,19 +26,12 @@ export async function fetchjson(
       // https to http), which checkaddr - it only validates the configured
       // address - cannot see. Refuse to follow one.
       redirect: 'error',
-      // Bound the wait so an accepted-but-silent endpoint cannot hang the
-      // caller (and the app's startup) forever.
       signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
     })
   } catch (err: any) {
     throw new SekretoError('sekreto: cannot reach ' + url.split('?')[0] + ': ' + err.message)
   }
 
-  // Read in chunks against HTTP_MAXBODY rather than `res.json()`, which
-  // buffers whatever arrives. Over the bound the request is aborted and
-  // the store has failed: an endless body is a store that could not
-  // answer, and returning a miss there would fall through to a weaker
-  // store on an attacker's cue.
   let text = ''
   try {
     const decoder = new TextDecoder()
@@ -86,10 +56,6 @@ export async function fetchjson(
   try {
     parsed = JSON.parse(text)
   } catch (err: any) {
-    // A success status promised JSON; a body that does not parse means
-    // the store could not answer coherently, and treating it as a miss
-    // would fall through to a weaker store. Error statuses may carry
-    // any body - they are decided on status alone.
     if (200 === res.status) {
       throw new SekretoError('sekreto: malformed response from ' + url.split('?')[0])
     }

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/infisical.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/infisical.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -7,12 +7,6 @@ import { ProviderSpec, Provider, SekretoError, envkey, providerplugin } from '..
 import { checkaddr } from '../provider/addr'
 import { fetchjson } from './httpjson'
 
-/** Infisical.
- *
- * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
- * convention is environment-style keys) at a secret path in one
- * environment of a project. Auth is a token, or a universal-auth
- * (machine identity) login with clientid/clientsecret. */
 export function infisicalprovider(options?: {
   addr?: string
   token?: string