@voxgig/sdkgen 4.30.0 → 4.30.1

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/minivault.ts

@@ -1,33 +1,8 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/minivault.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-// A mini vault: every secret a project owns, encrypted, in ONE FILE.
-//
-// The store to reach for before there is a vault server. There is nothing
-// to run and nothing to reach over a socket - the whole store is a single
-// binary file - and the same chain that reads it in development reads
-// HashiCorp or AWS in production by changing config, which is the reason
-// sekreto exists.
-//
-// It is a plugin rather than a built-in kind because it needs crypto,
-// which is the line the four built-ins stay behind
-// (docs/design/plugin-providers.md).
-//
-// THE KEY DECIDES WHAT THE VAULT HOLDS. A master key reads and writes
-// every name and mints restricted keys. A restricted key reads the names
-// it was granted and CANNOT DERIVE ANY OTHER - the restriction is the
-// cryptography rather than a check this code performs, so a copy of the
-// file plus a restricted passphrase yields exactly what was granted and
-// nothing else. What that does and does not protect is set out in
-// DOCS.md under "What the mini vault protects", because a store
-// described as more than it is gets deployed as more than it is.
-//
-// node:crypto and node:fs are loaded on first use, like every other
-// platform module a plugin needs: a consumer that configured no
-// minivault never evaluates them, and a runtime without them fails at
-// the point of use, naming what it lacks.
 
 import { PluginError } from '../../plugin'
 
@@ -48,53 +23,19 @@ function fs(): Fs {
 }
 
 
-// --- the format ------------------------------------------------------
-//
-//   magic       4   'SKMV'
-//   version     1   FORMAT
-//   kdf         1   1 = PBKDF2-HMAC-SHA256
-//   cipher      1   1 = AES-256-GCM
-//   reserved    1   0
-//   keycount    4   uint32
-//   per key:
-//     id        1 + bytes      the key id, PLAINTEXT
-//     salt      1 + bytes
-//     iters     4              PBKDF2 rounds for this key
-//     ring      1 + iv, 4 + bytes    sealed under the passphrase
-//     meta      1 + iv, 4 + bytes    sealed under the vault's meta key
-//   entrycount  4   uint32
-//   per entry:
-//     id        1 + bytes      the blinded lookup id
-//     name      1 + iv, 4 + bytes    sealed under the vault's name key
-//     value     1 + iv, 4 + bytes    sealed under that secret's own key
-//
-// Integers are big-endian, and every length precedes its bytes, so a
-// port writes the file with the same two primitives it reads it with.
-// A file one port writes is read by every other; `test/fixture` pins
-// that with a committed vault rather than with agreement, because a
-// format two implementations merely agree about is one that drifts.
-//
-// NOTHING OUTSIDE A KEY RECORD IS PLAINTEXT. Secret names are sealed,
-// and an entry is addressed by a blinded id derived from its own key,
-// so a restricted key finds the entries it was granted without the file
-// ever naming the rest. What the file does show anyone is the key ids
-// and how many secrets there are.
 
 const MAGIC = 'SKMV'
 const FORMAT = 1
 const KDF_PBKDF2 = 1
 const CIPHER_AESGCM = 1
 
-/** AES-256-GCM: 32-byte keys, 12-byte nonces, 16-byte tags. */
 const KEYLEN = 32
 const IVLEN = 12
 const TAGLEN = 16
 const SALTLEN = 16
 
-/** PBKDF2-HMAC-SHA256 rounds when a caller names none. */
 export const ITERATIONS = 210000
 
-/** The key id a vault gets when a caller names none. */
 export const MASTERKEY = 'master'
 
 // Additional authenticated data. Every blob is bound to its PLACE in the
@@ -117,13 +58,6 @@ function fail(text: string): never {
   throw new SekretoError('sekreto: minivault: ' + text)
 }
 
-/** The largest key id the format can record.
- *
- * `small` writes a length in ONE byte. A longer id wrapped that byte and
- * the writer then appended the whole thing, so every field after it
- * shifted: a `grant` with a 300-character id replaced a working vault
- * with an unreadable one, and said nothing. Checked where an id is
- * ACCEPTED, so the refusal names the id rather than the file. */
 const IDMAX = 255
 
 function checkid(id: string, what: string): string {
@@ -137,24 +71,15 @@ function checkid(id: string, what: string): string {
 }
 
 
-// --- keys ------------------------------------------------------------
 
 function hmac(key: Buffer, text: string): Buffer {
   return crypto().createHmac('sha256', key).update(text, 'utf8').digest()
 }
 
-/** The key-encryption key a passphrase unwraps a ring with. */
 function kek(passphrase: string, salt: Buffer, iters: number): Buffer {
   return crypto().pbkdf2Sync(passphrase, salt, iters, KEYLEN, 'sha256')
 }
 
-/** The key one named secret's value is encrypted with.
- *
- * DERIVED, never stored, for a master: it holds the root key and so
- * reaches every name, including ones written after it was made. A
- * restricted key holds the derived keys it was granted and nothing that
- * produces another, so every other name is ciphertext to it in exactly
- * the way it is to a stranger. */
 function secretkey(root: Buffer, name: string): Buffer {
   return hmac(root, AAD_SECRET + name)
 }
@@ -171,7 +96,6 @@ function random(len: number): Buffer {
 }
 
 
-// --- sealing ---------------------------------------------------------
 
 type Sealed = { iv: Buffer, blob: Buffer }
 
@@ -230,14 +154,11 @@ function unb64(text: any, what: string): Buffer {
 }
 
 
-// --- the file --------------------------------------------------------
 
 type KeyRecord = { id: string, salt: Buffer, iters: number, ring: Sealed, meta: Sealed }
 type EntryRecord = { id: Buffer, name: Sealed, value: Sealed }
 type VaultFile = { keys: KeyRecord[], entries: EntryRecord[] }
 
-/** A cursor, so that every length check is in one place: a truncated
- * vault is refused rather than read as a short one. */
 function reader(bytes: Buffer) {
   let at = 0
 
@@ -332,8 +253,6 @@ function writefile(vault: VaultFile): Buffer {
     sealed(key.meta)
   }
 
-  // SORTED BY ID, which is a blinded value: the file therefore records
-  // nothing about the order secrets were written in.
   const entries = [...vault.entries].sort((left, right) => Buffer.compare(left.id, right.id))
 
   u32(entries.length)
@@ -347,7 +266,6 @@ function writefile(vault: VaultFile): Buffer {
 }
 
 
-// --- what a key is ---------------------------------------------------
 
 /** A detached copy, so that what a caller is handed cannot become what
  * this vault believes. */
@@ -360,8 +278,6 @@ function copyinfo(info: VaultKeyInfo): VaultKeyInfo {
   }
 }
 
-/** What a key may do. `grants` is empty for a master key, which reads
- * and writes every name there is. */
 export type VaultKeyInfo = {
   key: string
   master: boolean
@@ -370,7 +286,6 @@ export type VaultKeyInfo = {
 }
 
 export type GrantSpec = {
-  /** The id the new key answers to. */
   key: string
   /** Its passphrase. Nothing else unwraps it, and no master can recover
    * it - a lost restricted passphrase is re-granted, never read back. */
@@ -378,20 +293,14 @@ export type GrantSpec = {
   /** The names it may read. A name that does not exist yet is allowed
    * and means what it says: the key reads it once a master writes it. */
   names: string[]
-  /** May it overwrite the values it can read? Default false. */
   write?: boolean
-  /** PBKDF2 rounds for this key, defaulting to the opening handle's. */
   iterations?: number
 }
 
 export type VaultOptions = {
-  /** The vault file. */
   file: string
-  /** Which key to open with. Default `master`. */
   key?: string
   passphrase: string
-  /** PBKDF2 rounds used when this call CREATES a key. Reading uses what
-   * the file records for the key being opened. */
   iterations?: number
   /** Make the file, with this key as its master, if it is not there.
    *
@@ -401,36 +310,17 @@ export type VaultOptions = {
   create?: boolean
 }
 
-/** A handle on one vault file, opened as ONE key.
- *
- * Every method answers as that key: `list` shows the names it may read,
- * `get` answers for those and misses on the rest, and the master-only
- * methods refuse for any other key. Nothing is read or derived until the
- * first call that needs the file, so putting a vault in a chain costs no
- * key derivation until a secret is actually wanted. */
 export type MiniVault = {
-  /** The file this handle reads. */
   file: () => string
-  /** The key id this handle opens with. */
   key: () => string
-  /** Derive the key and read the file NOW rather than at first use. */
   open: () => VaultKeyInfo
-  /** Forget the derived keys. The next call opens again. */
   close: () => void
-  /** The names this key can read, sorted. */
   list: () => string[]
   has: (name: string) => boolean
-  /** The value, or undefined when the vault does not hold that name or
-   * this key was not granted it. */
   get: (name: string) => string | undefined
-  /** Write a value. A master writes any name; a restricted key holding
-   * `write` overwrites the names it was granted, and creates none. */
   set: (name: string, value: string) => void
-  /** Drop a name. Master only. */
   remove: (name: string) => void
-  /** Every key in the file, with what it may do. Master only. */
   keys: () => VaultKeyInfo[]
-  /** Mint a restricted key. Master only. */
   grant: (spec: GrantSpec) => void
   /** Drop a key. Master only.
    *
@@ -438,19 +328,11 @@ export type MiniVault = {
    * read, so revoking bars future reads of the LIVE file and `rotate` is
    * what takes a secret back. */
   revoke: (key: string) => void
-  /** A new root key, every value re-encrypted under it, and EVERY OTHER
-   * KEY DROPPED. Master only.
-   *
-   * The other keys go because they must: their rings are sealed under
-   * passphrases this process does not have, so there is no way to hand
-   * them keys they can unwrap. Re-grant afterwards. */
   rotate: () => void
 }
 
 
-// --- creating --------------------------------------------------------
 
-/** A new vault: one master key, no secrets. */
 function newvault(keyid: string, passphrase: string, iterations: number): VaultFile {
   const root = random(KEYLEN)
   const salt = random(SALTLEN)
@@ -472,15 +354,6 @@ function newvault(keyid: string, passphrase: string, iterations: number): VaultF
   }
 }
 
-/** Write a vault file that is not there yet, and REFUSE one that is.
- *
- * Straight to the target under `wx` — `O_CREAT|O_EXCL` — rather than
- * through a temporary and a rename. `rename` REPLACES its destination,
- * so two processes creating the same vault both succeeded and the
- * second discarded the first one's secrets; `existsSync` beforehand
- * only narrows that window. There is nothing to lose by writing the
- * target directly here, because there is no file to damage: either this
- * call creates it or the call fails. */
 function putnew(file: string, vault: VaultFile): void {
   try {
     fs().writeFileSync(file, writefile(vault), { mode: 0o600, flag: 'wx' })
@@ -493,10 +366,7 @@ function putnew(file: string, vault: VaultFile): void {
 }
 
 
-// --- opening ---------------------------------------------------------
 
-/** The ring, as stored: EITHER a root key (master) OR a fixed set of
- * derived per-secret keys (restricted). */
 type Ring = { v: number, write: boolean, root?: string, grants?: Record<string, string> }
 
 /** What a master recorded about a key when it minted it, sealed under
@@ -506,7 +376,6 @@ type Meta = { v: number, master: boolean, write: boolean, grants: string[] }
 
 type Opened = {
   info: VaultKeyInfo
-  /** Present for a master key only. */
   root?: Buffer
   /** The per-name keys this key was granted. Empty for a master, which
    * derives them from the root key instead. */
@@ -518,16 +387,10 @@ type Opened = {
   ring: Sealed
 }
 
-/** Is this the same sealed blob, byte for byte? */
 function sameseal(left: Sealed, right: Sealed): boolean {
   return 0 === Buffer.compare(left.iv, right.iv) && 0 === Buffer.compare(left.blob, right.blob)
 }
 
-/** Open a vault file as one key.
- *
- * The handle is lazy. Nothing is read, and no passphrase is stretched,
- * until a method needs the file - so a chain of ten providers costs ten
- * objects rather than ten PBKDF2 runs. */
 export function openvault(options: VaultOptions): MiniVault {
   const opts = options || ({} as VaultOptions)
   const file = opts.file
@@ -549,11 +412,6 @@ export function openvault(options: VaultOptions): MiniVault {
     try {
       return fs().readFileSync(file)
     } catch (err: any) {
-      // A vault is configured deliberately, with a key. Its absence is a
-      // broken deployment and never "no secrets here": answering a miss
-      // would send the chain on to a weaker store, which is the failure
-      // mode this library most has to avoid. `create` is the caller
-      // saying the opposite, in writing.
       if ('ENOENT' === err.code) {
         if (true !== opts.create) {
           fail('no vault file: ' + file)
@@ -656,16 +514,6 @@ export function openvault(options: VaultOptions): MiniVault {
     }
   }
 
-  /** Read, change, and REPLACE - never edit in place. The rename is what
-   * makes a concurrent reader see either the old file or the new one, so
-   * a write interrupted halfway leaves a vault rather than wreckage.
-   *
-   * THE TEMPORARY IS RANDOM AND EXCLUSIVE. `<vault>.<pid>.tmp` is a name
-   * anyone can predict, so anyone who can write the vault's directory
-   * could put a symlink there and have the next save truncate whatever
-   * it pointed at. `wx` is `O_CREAT|O_EXCL`, which POSIX refuses on a
-   * symlink, and the random suffix stops two writers in one process
-   * colliding on the path. */
   const save = (vault: VaultFile): void => {
     const node = fs()
     const temp = file + '.' + random(8).toString('hex') + '.tmp'
@@ -677,8 +525,6 @@ export function openvault(options: VaultOptions): MiniVault {
       try {
         node.unlinkSync(temp)
       } catch {
-        // The vault is unchanged either way, and the write error is what
-        // the caller needs to be told about.
       }
       fail('cannot write ' + file + ': ' + err.message)
     }
@@ -708,8 +554,6 @@ export function openvault(options: VaultOptions): MiniVault {
           .sort()
       }
 
-      // A restricted key has no name key, so it reports the grants it can
-      // actually find: the vault never tells it what else is in there.
       return open.info.grants
         .filter((name) => undefined !== findentry(vault, open.grants[name]))
         .sort()
@@ -723,11 +567,6 @@ export function openvault(options: VaultOptions): MiniVault {
 
       const key = keyfor(open, name)
       if (undefined === key) {
-        // OUTSIDE THE GRANT IS A MISS, deliberately. The vault answers as
-        // the key that opened it, so a name this key cannot read is a
-        // name this store does not hold for this caller - the same answer
-        // a stranger's vault gives, and the one that makes a restricted
-        // key in front of a broader store a workable chain.
         return undefined
       }
 
@@ -860,8 +699,6 @@ export function openvault(options: VaultOptions): MiniVault {
       const { vault, open } = load()
       rootof(open, 'rotating the vault')
 
-      // Read everything out under the old root before anything changes:
-      // once the root is replaced the old derived keys are unreachable.
       const plain = self.list().map((name) => ({ name, value: self.get(name) as string }))
 
       const root = random(KEYLEN)
@@ -882,9 +719,6 @@ export function openvault(options: VaultOptions): MiniVault {
         { v: FORMAT, write: true, root: b64(root) },
         { v: FORMAT, master: true, write: true, grants: [] })
 
-      // SAVE FIRST, adopt second. A handle holding the new root over a
-      // file that still holds the old one reads nothing and says the
-      // vault is damaged, which is the wrong story about a failed write.
       save({ keys: [fresh], entries })
 
       opened = {
@@ -915,23 +749,13 @@ export function createvault(options: VaultOptions): MiniVault {
   }
   checkid(opts.key || MASTERKEY, 'a vault needs a key id')
 
-  // No `existsSync` first: the check and the write would be two steps,
-  // and `putnew` refuses an existing file in ONE, which is what makes
-  // two processes racing to create a vault leave one vault.
   putnew(opts.file, newvault(opts.key || MASTERKEY, opts.passphrase, opts.iterations || ITERATIONS))
 
   return openvault(opts)
 }
 
 
-// --- the provider ----------------------------------------------------
 
-/** Read a vault as one store in a chain.
- *
- * The provider is the READ half and nothing more: a chain resolves
- * secrets, and writing one is a deliberate act with an API of its own.
- * That API is the same handle, reached with `vaultof` off a chain or
- * built directly with `openvault`. */
 export function providerof(vault: MiniVault): Provider {
   return {
     lookup: (name: string) => vault.get(name),
@@ -939,12 +763,10 @@ export function providerof(vault: MiniVault): Provider {
   }
 }
 
-/** A vault provider from options, for a chain built by hand. */
 export function minivaultprovider(options: VaultOptions): Provider {
   return providerof(openvault(options))
 }
 
-/** The vault options a provider spec describes. */
 function vaultoptions(spec: ProviderSpec): VaultOptions {
   return {
     file: spec.file || '',
@@ -956,25 +778,9 @@ function vaultoptions(spec: ProviderSpec): VaultOptions {
 }
 
 
-// --- the plugin ------------------------------------------------------
 
-/** The export key the vault API is published under, beside the
- * `provider` key every kind publishes. */
 export const VAULT_EXPORT = 'vault'
 
-/** The `minivault` provider kind.
- *
- * Written out rather than built by `providerplugin`, because this
- * definition publishes TWO exports: `provider`, the read half every kind
- * publishes, and `vault`, the programmatic API. voxgig/plugin's exports
- * are how a definition offers an application more than the host's own
- * vocabulary, and a store that can only be read is half a vault.
- *
- * The SekretoError wrapping is what `providerplugin` would have done:
- * plugin wraps a code-less error raised in `define` as
- * `plugin_define_failed`, and keeps one that already carries a code, so
- * a refusal of this provider's own configuration travels under
- * `sekreto_error` and comes back out of the host as itself. */
 export const minivault: Definition = {
   name: 'minivault',
   define: (inst: any) => {
@@ -998,16 +804,6 @@ export const minivault: Definition = {
   },
 }
 
-/** The vault behind a store in a chain, as its programmatic API.
- *
- * `secrets.host` is the voxgig/plugin host the chain is made of, and a
- * definition's exports are readable off it by ref. This is the one line
- * that turns a store into an API, and it lives here rather than on
- * `Sekreto` because the core knows no plugin.
- *
- * With no store named, the unqualified alias answers: one vault in the
- * chain resolves whatever it is called, and two raise rather than
- * picking one. */
 export function vaultof(secrets: { host: any }, store?: string): MiniVault {
   if (undefined === store) {
     const found = secrets.host.exports('minivault/' + VAULT_EXPORT)
@@ -1017,13 +813,6 @@ export function vaultof(secrets: { host: any }, store?: string): MiniVault {
     return found as MiniVault
   }
 
-  // A NAMED STORE MUST EXIST, and the alias must not stand in for it.
-  // `host.exports` falls back to the alias when the exact ref misses, so
-  // asking for `minivault` in a chain whose only vault is named `app`
-  // used to hand back the `app` vault - and then write to it. Naming a
-  // store that is not there raises, which is the rule the whole library
-  // follows: `try` already means "may not have it", so it cannot also
-  // mean "may not exist".
   const ref = 'minivault' === store ? 'minivault' : 'minivault$' + store
 
   if (undefined === secrets.host.instance(ref)) {

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/onepassword.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/onepassword.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -9,12 +9,6 @@ import {
 import { checkaddr } from '../provider/addr'
 import { fetchjson } from './httpjson'
 
-/** 1Password, through a Connect server.
- *
- * The item titled `api.token` (titles keep their dots), in the named
- * vault. The value is the field with purpose PASSWORD, or the field
- * labelled `value`. A vault that cannot be found is an error - config
- * names it, so its absence is a broken store, not a missing secret. */
 export function onepasswordprovider(options?: {
   addr?: string
   token?: string

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/secretspec.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/secretspec.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -7,15 +7,6 @@ import {
   ProviderSpec, Provider, SekretoError, envkey, nodemod, providerplugin,
 } from '../provider/support'
 
-/** SecretSpec — https://secretspec.dev
- *
- * A declaration plus a chain of its own backends: the same shape as
- * sekreto one level down. A project that has declared its secrets there
- * should not have to declare them again here, so this reads through the
- * `secretspec` CLI rather than reimplementing its resolution.
- *
- * SecretSpec audits every read and refuses without `--reason`; sekreto
- * sends `sekreto` unless configured otherwise. */
 export function secretspecprovider(options?: {
   command?: string
   file?: string
@@ -68,19 +59,6 @@ export function secretspecprovider(options?: {
   }
 }
 
-/** Does this SecretSpec failure mean "no such secret" rather than "I
- * could not answer"?
- *
- * SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
- * not declare and one declared with no value, and both are misses: this
- * store does not hold it, so the chain carries on.
- *
- * MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
- * `Provider backend 'keyring' not found`, which is a store that could
- * not answer at all - and reading that as a miss is the worst failure
- * this library has, because the chain then falls through to a weaker
- * store without saying so. The key is required to appear, so the two
- * cannot be confused. */
 function secretspecmiss(why: string, key: string): boolean {
   return why.includes("Secret '" + key + "' not found")
 }

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/sigv4.ts

@@ -1,29 +1,7 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/sigv4.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// AWS Signature Version 4, hand-rolled.
-//
-// The AWS providers need exactly one thing from the AWS SDK - request
-// signing - and taking the SDK for it would break the no-dependency rule
-// that keeps ten ports honest. SigV4 is a stable, published algorithm
-// built from HMAC-SHA256, which every port's standard library (or, for
-// Rust, a small in-tree implementation) already has.
-//
-// `sigv4` is pure: the caller passes the timestamp, so the same input
-// yields the same signature everywhere. That is what lets the shared spec
-// carry known-answer cases that all ten ports must reproduce bit-for-bit,
-// and lets the integration mock recompute the signature server-side.
-
-// node:crypto is loaded ON FIRST USE, not at import time.
-//
-// This module lives under plugins/ and is reached only through the aws
-// plugin, so the core never sees it at all; deferring the builtin on top
-// of that keeps importing the plugin free of side effects too, and lets
-// the sigv4 conformance group run on a runtime that has crypto without
-// anything else in the module graph having asked for it.
-//
-// require(), not `await import()`: these helpers are synchronous and are
-// called from synchronous signing code. The package is CommonJS.
+
 function crypto(): typeof import('node:crypto') {
   try {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -51,8 +29,6 @@ export type Sigv4Input = {
   secret: string
   /** STS session token; signed as x-amz-security-token when present. */
   session?: string
-  /** The signing moment, `YYYYMMDDTHHMMSSZ`. Passed in, never sampled,
-   * so the function stays pure. */
   datetime: string
 }
 
@@ -108,12 +84,6 @@ export function sigv4(input: Sigv4Input): Sigv4Output {
   const date = input.datetime.slice(0, 8)
   const body = input.body || ''
 
-  // Every header that will be signed: the caller's extras, plus host and
-  // x-amz-date (and the session token when present), lower-cased and
-  // trimmed the way the canonical form requires.
-  // Canonical header values are trimmed AND internally collapsed -
-  // AWS folds sequential whitespace to one space before signing, so a
-  // header like "a  b" must sign as "a b" or the service refuses it.
   const headers: Record<string, string> = {}
   for (const [key, value] of Object.entries(input.headers || {})) {
     headers[key.toLowerCase()] = String(value).trim().replace(/\s+/g, ' ')

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/addr.ts

@@ -1,19 +1,10 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/addr.ts)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
 import { SekretoError } from './support'
 
-/** An address with any userinfo replaced by `[redacted]`, for messages.
- *
- * Every refusal below names the address it refused, and one of them fires
- * precisely because the address carries a credential — so printing it
- * verbatim wrote the password to stderr and into the logs. It cannot be
- * cleaned up afterwards either: that password was never resolved as a
- * secret, so `redact()` has never seen it and never will. The host is what
- * a reader needs to identify which chain entry is at fault; the userinfo
- * is not. */
 export function safeaddr(addr: string): string {
   const mark = addr.indexOf('://')
   if (-1 === mark) {
@@ -32,29 +23,6 @@ export function safeaddr(addr: string): string {
   return addr.slice(0, mark + 3) + '[redacted]' + addr.slice(mark + 3 + at)
 }
 
-/** Refuse to send a secret-bearing credential in the clear.
- *
- * A vault API is HTTPS in any real deployment; plaintext is a dev-mode
- * convenience. Sending a token over http to anything but the local
- * machine puts both the token and the secret it fetches on the wire for
- * anyone on the path, so sekreto will not do it. Loopback stays allowed:
- * that is `vault server -dev`, `boru vault serve`, and this repo's own
- * test harness.
- *
- * The address is read by hand, in the same handful of steps in every
- * port, rather than by each platform's URL parser. That is deliberate.
- * Twelve parsers disagree about malformed input — where userinfo ends,
- * whether `0177.0.0.1` is loopback, what an unclosed bracket means — and
- * a check that answers differently in different ports is not a check.
- *
- * The rule this parse obeys, and the reason it can be trusted: it is
- * never more permissive than the HTTP client that will dial the address.
- * It ends the authority at `/`, `?` or `#` only, so a client that also
- * breaks on `\` (WHATWG does) can only ever see a SHORTER host than this
- * does. It refuses userinfo outright rather than locating its end. It
- * compares the host literally, so a numeric form no parser here agrees on
- * is refused rather than guessed at. Each of those can refuse an address
- * that would in fact have been safe; none can allow one that is not. */
 export function checkaddr(addr: string): void {
   const scheme = addr.startsWith('https://')
     ? 'https://'
@@ -70,24 +38,12 @@ export function checkaddr(addr: string): void {
   const end = rest.search(/[/?#]/)
   const authority = -1 === end ? rest : rest.slice(0, end)
 
-  // Userinfo is refused outright rather than parsed around, and on https
-  // as well as http. No store this library speaks authenticates by
-  // userinfo — they take a token or a signature — so an address carrying
-  // one is a mistake at best. At worst it is the attack this whole
-  // function exists to stop: `http://localhost:8200@evil.example.com/` is
-  // a request to evil.example.com that reads, to anything that splits the
-  // authority on ':', as loopback. Refusing the shape is a rule twelve
-  // ports can apply identically; agreeing on where the userinfo ends is
-  // not.
   if (authority.includes('@')) {
     throw new SekretoError(
       'sekreto: refusing an address with embedded credentials: ' + safeaddr(addr),
     )
   }
 
-  // An opening bracket with no closing one is not an address at all, and
-  // saying so is more use to whoever wrote the config than refusing it as
-  // though it named a remote host.
   if (authority.startsWith('[') && !authority.includes(']')) {
     throw new SekretoError('sekreto: not a valid http(s) address: ' + safeaddr(addr))
   }