@voxgig/sdkgen 4.8.2 → 4.8.3

package/project/.sdk/tm/ts/src/feature/secrets/plugin/index.ts

@@ -0,0 +1,37 @@
+// VENDORED: @voxgig/plugin 0.1.6 (typescript/src/index.ts)
+// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The canonical surface `make parity` checks (AGENTS.md §4). Small on
+ * purpose (§19): everything else is methods on the host and instance
+ * types, because a library that grows a second public entry point per
+ * feature is a library twenty ports pay for twice. */
+
+export { makehost } from './Host'
+export { makecatalog } from './Catalog'
+export { parseref, formatref, checkname, checktag, canonref, tryref } from './Ref'
+export { normalizeconfig, resolveoptions, checkshape } from './Config'
+export { resolveorder } from './Order'
+export { resolvecandidates, resolvefrom } from './Resolve'
+export { applyenv, encoderef } from './Env'
+export { parserange, parseversion, satisfies } from './Version'
+export { resolvecapability, matches } from './Capability'
+export { resolvegraph } from './Graph'
+export { emit, compose, provider } from './Point'
+export { resolveexport } from './Export'
+export {
+  REQUEST_POINT, SDK_HOOKS, STATION_HOOKS, featuredefinition, featurepoints,
+} from './FeatureHost'
+export type { FeatureClass } from './FeatureHost'
+
+export { PluginError } from './Types'
+export type { Ref, Status, Instance, OrderRef, OrderSpec, OrderBlock, Normalized } from './Types'
+export type { Definition, Catalog } from './Catalog'
+export type { Binding, Pin } from './Order'
+export type { Host, HostOptions, PointSpec } from './Host'
+export type { Source } from './Resolve'
+export type { EnvInput, EnvResult } from './Env'
+export type { Range } from './Version'
+export type { Provided, Required, Candidate } from './Capability'
+export type { Node, Blocked, Why, Resolution } from './Graph'
+export type { Kind, Mode, Spec, Bound } from './Point'
+export type { Exported } from './Export'

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sekreto.ts

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/Sekreto.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/Sekreto.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //
@@ -11,20 +11,31 @@
 // This file is CANONICAL. Every other port is a translation of it, and
 // spec/sekreto.json is the behavioural contract they all run.
 
-// The REGISTRY, never './Providers'. Importing the barrel here is what
-// made every provider kind reachable from the core: the chain needs
-// `makeprovider`, and the barrel's edge dragged AWS request signing and
-// seven HTTP clients in behind it. The registry knows only the kinds
-// something actually imported. See docs/design/plugin-providers.md.
-import { Provider, ProviderSpec } from './provider/support'
-import { makeprovider } from './provider/Registry'
+// THE CORE IMPORTS NO PROVIDER THAT OPENS A SOCKET, SPAWNS A PROCESS OR
+// SIGNS A REQUEST. The four built-in kinds - env, memory, dotenv, file -
+// read at most a local file; every other kind is a voxgig/plugin
+// definition under plugins/, and a chain may name one only if the
+// calling project handed it in through `plugins`. That is what keeps an
+// SDK whose chain is `[dotenv, env]` from carrying AWS request signing
+// and seven HTTP vault clients. See docs/design/plugin-providers.md.
+import { checktag, formatref, makecatalog, makehost } from '../plugin'
+import type { Catalog, Definition, Host } from '../plugin'
+
+import { ERROR_CODE, PROVIDER_EXPORT, Provider, ProviderSpec } from './provider/support'
+import { BUILTINS, KINDS } from './provider/builtin'
 
 /** A secret name: dot-separated lowercase segments, e.g. `api.token`. */
 export type Name = string
 
 export type SekretoOptions = {
-  /** The provider chain, in resolution order. */
+  /** The provider chain, in resolution order. An entry is a live
+   * provider, or the declarative spec of one - `{ kind, ...config }`. */
   providers?: (Provider | ProviderSpec)[]
+  /** The provider kinds beyond the built-ins that `providers` may name,
+   * as voxgig/plugin definitions. Static and explicit: the calling
+   * project imports the plugins it needs and passes them here, and a
+   * kind it did not pass is unknown to this Sekreto. */
+  plugins?: Definition[]
   /** Cache resolved values (default: true). */
   cache?: boolean
 }
@@ -190,39 +201,76 @@ function unescape(text: string): string {
  *
  * Only values of four characters or more are replaced: shorter ones are
  * too likely to appear in ordinary text, and redacting them would make
- * logs unreadable without making them safer. */
+ * logs unreadable without making them safer.
+ *
+ * Longest first, which is not a detail. Replacing in the order the
+ * values arrived meant a shorter secret that prefixes a longer one ate
+ * the prefix and left the rest in the log: with `db.pass` = `abcd` from
+ * the environment and `api.token` = `abcd1234` from the vault, and the
+ * environment resolved first, `token=abcd1234` came out as
+ * `token=[redacted]1234` — four characters of the vault token still
+ * there. Longest first makes the longer secret match before anything can
+ * eat its head. */
 export function redact(text: string, values: string[]): string {
   let out = 'string' === typeof text ? text : ''
 
-  for (const value of values || []) {
-    if ('string' !== typeof value || 4 > value.length) {
-      continue
-    }
+  const usable = (values || []).filter(
+    (value) => 'string' === typeof value && 4 <= value.length,
+  )
+
+  // A copy: `values` belongs to the caller (it is `seen` when called
+  // through Sekreto.redact), and sorting in place would reorder it.
+  for (const value of [...usable].sort((left, right) => right.length - left.length)) {
     out = out.split(value).join('[redacted]')
   }
 
   return out
 }
 
-/** One provider in the chain, under the store name it answers to. */
-type Entry = { store: string; provider: Provider }
+/** One provider in the chain, under the store name it answers to, and
+ * the ref of the plugin instance that built it - '' for a live provider
+ * handed in directly, which no instance backs. */
+type Entry = { store: string; ref: string; provider: Provider }
 
 /** One resolved value. Kept as a list rather than a map so that the store
  * a value came from stays attached, and so redaction order is stable. */
 type Cached = { store: string; name: Name; value: string }
 
-/** The store name a provider answers to when its spec does not say.
+/** The store name a live provider answers to.
  *
- * `describe()` opens with the provider's kind - `vault:...`, `dotenv:...`,
- * plain `env` - so the kind is the natural default, and a custom provider
- * gets a sensible name without having to implement anything extra. */
-function storename(provider: Provider, spec?: ProviderSpec): string {
-  if (spec && spec.name) {
-    return spec.name
-  }
+ * `describe()` opens with the provider's kind - `hashicorp:...`,
+ * `dotenv:...`, plain `env` - so the kind is the natural default, and a
+ * custom provider gets a sensible name without having to implement
+ * anything extra. A spec'd provider's store is its `name` or its `kind`,
+ * decided before the provider exists. */
+function storename(provider: Provider): string {
   return provider.describe().split(':')[0]
 }
 
+/** The message for a kind the catalog does not hold.
+ *
+ * A kind sekreto has never heard of is a typo; a kind that exists as a
+ * plugin but was not passed in is the split working as designed and
+ * telling you what to pass. Collapsing the two was the first thing that
+ * made the split confusing to use. */
+function unknownkind(kind: any, catalog: Catalog): string {
+  const known = -1 !== KINDS.plugin.indexOf(String(kind))
+  return (
+    'sekreto: unknown provider kind: ' + String(kind) +
+    ' (available: ' + catalog.names().join(', ') + ')' +
+    (known ? ' - ' + String(kind) + ' is a sekreto plugin, not built in: pass it in the plugins option' : '')
+  )
+}
+
+/** A SekretoError that crossed the plugin boundary comes back out as
+ * itself, byte for byte. Anything else is not sekreto's to rewrite. */
+function unwrap(err: any): any {
+  if (err && ERROR_CODE === err.code && err.details && 'string' === typeof err.details.cause) {
+    return new SekretoError(err.details.cause)
+  }
+  return err
+}
+
 /** The secrets facade: a chain of providers plus a cache.
  *
  * Two ways to read. `get` is transparent - it walks the chain and takes
@@ -231,6 +279,14 @@ function storename(provider: Provider, spec?: ProviderSpec): string {
  * first for ordinary configuration, the second when *which* store holds a
  * secret is part of what you mean. */
 export class Sekreto {
+  /** The voxgig/plugin host every spec'd provider is an instance of.
+   * Read it for introspection - `host.list()` names each store's ref and
+   * status - and nothing on it advances the chain. */
+  readonly host: Host
+  /** The definitions this Sekreto can build: the built-ins plus what
+   * `plugins` handed in. */
+  readonly catalog: Catalog
+
   private entries: Entry[]
   private docache: boolean
   private cache: Cached[]
@@ -242,15 +298,19 @@ export class Sekreto {
   constructor(options?: SekretoOptions) {
     const opts = options || {}
 
+    // Built-ins first, then the plugins, into one catalog: a plugin that
+    // names a built-in kind replaces it, which is how a host substitutes
+    // an implementation and never an accident, because the four names
+    // are documented.
+    this.catalog = makecatalog(BUILTINS.concat(opts.plugins || []))
+    this.host = makehost({ catalog: this.catalog })
+
     this.entries = (opts.providers || []).map((entry) => {
       if ('function' === typeof (entry as Provider).lookup) {
         const provider = entry as Provider
-        return { store: storename(provider), provider }
+        return { store: storename(provider), ref: '', provider }
       }
-
-      const spec = entry as ProviderSpec
-      const provider = makeprovider(spec)
-      return { store: storename(provider, spec), provider }
+      return this.declare(entry as ProviderSpec)
     })
 
     this.docache = false === opts.cache ? false : true
@@ -258,6 +318,45 @@ export class Sekreto {
     this.seen = []
   }
 
+  /** One chain entry, as a plugin instance.
+   *
+   * The instance is `kind` for a store named after its kind and
+   * `kind$store` otherwise - `hashicorp$prod` - so `host.list()` reads
+   * like the chain. A store name that is already taken gets a numbered
+   * tag from the host instead, because two providers MAY share a store
+   * name (a directed read walks both) and an instance ref may not. */
+  private declare(spec: ProviderSpec): Entry {
+    const kind = null == spec ? undefined : spec.kind
+
+    if (undefined === kind || !this.catalog.has(kind)) {
+      throw new SekretoError(unknownkind(kind, this.catalog))
+    }
+
+    const store = spec.name || kind
+
+    if (!checktag(store)) {
+      throw new SekretoError('sekreto: invalid store name: ' + store)
+    }
+
+    let ref = store === kind ? kind : formatref(kind, store)
+    if (undefined !== this.host.instance(ref)) {
+      ref = this.host.autotag(kind)
+    }
+
+    try {
+      // `load` runs the definition's `define`, which builds the provider
+      // from the spec; `activate` takes the instance live. Nothing is
+      // contacted by either: a provider opens nothing until its first
+      // lookup.
+      this.host.load(ref, { options: spec })
+      this.host.activate(ref)
+    } catch (err: any) {
+      throw unwrap(err)
+    }
+
+    return { store, ref, provider: this.host.exports(ref + '/' + PROVIDER_EXPORT) as Provider }
+  }
+
   /** The secret, or a SekretoError if no provider has it. */
   async get(name: Name): Promise<string> {
     const found = await this.try(name)
@@ -348,6 +447,29 @@ export class Sekreto {
     return out
   }
 
+  /** What a Sekreto shows of itself when something prints it.
+   *
+   * `console.log(sekreto)` and `JSON.stringify(sekreto)` both reach
+   * `cache` and `seen`, which between them hold every value this chain
+   * has ever resolved — so one ordinary logging call writes every secret
+   * to the log. `private` is a compile-time fiction: at run time the
+   * fields are ordinary and enumerable.
+   *
+   * `JSON.stringify` is the one that bites hardest, because a structured
+   * logger serialises its whole context object without anyone writing a
+   * line about secrets: `logger.info({ secrets: sekreto }, 'ready')`.
+   *
+   * Both hooks are needed. `toJSON` covers `JSON.stringify` and
+   * everything built on it; the inspect symbol covers `console.log`,
+   * `util.inspect` and the REPL. Neither reaches a value. */
+  toJSON(): object {
+    return { stores: this.stores() }
+  }
+
+  [Symbol.for('nodejs.util.inspect.custom')](): string {
+    return 'Sekreto { stores: [ ' + this.stores().join(', ') + ' ] }'
+  }
+
   /** A description of each provider, in resolution order. */
   sources(): string[] {
     return this.entries.map((entry) => entry.provider.describe())
@@ -379,6 +501,17 @@ export class Sekreto {
   refresh(): void {
     this.cache = []
   }
+
+  /** Tear the chain down: every plugin instance is deactivated and
+   * unloaded, in reverse, releasing whatever a provider acquired at
+   * activation. Afterwards there is nothing to read from - `get` reports
+   * every secret unknown - and the cache is dropped, though `redact`
+   * still knows every value that was ever resolved. */
+  close(): void {
+    this.host.close()
+    this.entries = []
+    this.cache = []
+  }
 }
 
 /** Make a Sekreto from options. */

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/index.ts

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/index.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/sekreto - one interface for secrets, wherever they live.
 
@@ -18,34 +18,39 @@ export {
 
 export type { Name, SekretoOptions } from './Sekreto'
 
-// THE CORE SURFACE. Deliberately does NOT re-export the eleven provider
-// kinds that need something of their runtime: pulling one through this
-// file would make all of them reachable and put AWS request signing in
-// every build, which is the thing the split removes.
+// THE CORE SURFACE: the chain, the four built-in provider kinds, and the
+// means of adding a fifth.
 //
-// `env` and `memory` are here because they import nothing at all, and a
-// chain with nowhere to read from is not usable or testable.
+// The built-ins are the kinds that read at most a local file - env,
+// memory, dotenv, file. Everything that opens a socket, spawns a process
+// or signs a request is a PLUGIN, is not reachable from this file, and
+// is handed to `Sekreto` by the calling project:
 //
-// Everything else registers itself when its module is imported:
+//     import { Sekreto } from '@voxgig/sekreto'
+//     import { hashicorp } from '@voxgig/sekreto/plugins/hashicorp'
 //
-//     import '@voxgig/sekreto/provider/dotenv'
+//     const secrets = new Sekreto({
+//       plugins: [hashicorp],
+//       providers: [{ kind: 'env' }, { kind: 'hashicorp', addr, token }],
+//     })
 //
-// or, for the old all-in behaviour, `from '@voxgig/sekreto/Providers'`.
-// See docs/design/plugin-providers.md.
+// or, for every kind at once, `allplugins` from '@voxgig/sekreto/plugins'.
+// Re-exporting a plugin here would put AWS request signing in every
+// build again, which is the thing the split removes. See
+// docs/design/plugin-providers.md.
 export { envprovider } from './provider/env'
 export { memoryprovider } from './provider/memory'
+export { dotenvprovider } from './provider/dotenv'
+export { fileprovider } from './provider/file'
+export { BUILTINS, KINDS } from './provider/builtin'
+
+// How a provider kind becomes a plugin definition - the one call a
+// custom kind needs.
+export { providerplugin, PROVIDER_EXPORT, ERROR_CODE } from './provider/support'
 
 // A pure validator, no platform dependency - kept on the core surface
 // because callers validate an address before configuring a provider.
-export { checkaddr } from './provider/addr'
-
-export { makeprovider, register, registered, kinds } from './provider/Registry'
-export type { ProviderDefinition } from './provider/Registry'
+export { checkaddr, safeaddr } from './provider/addr'
 
 export type { Provider, ProviderSpec } from './provider/support'
-
-// `sigv4` is NOT on the core surface: it is the node:crypto edge, and
-// only the two aws providers use it. Import it from the module that
-// needs it - `@voxgig/sekreto/provider/aws` - or from the full-set
-// barrel. Re-exporting it here would put request signing in every
-// build again, which is the thing the split removes.
+export type { Definition } from '../plugin'

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/aws.ts

@@ -1,15 +1,16 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/aws.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/aws.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
 import {
-  ProviderSpec, Provider, SekretoError, awsparam, flatname, vaultref,
-} from './support'
-import { checkaddr } from './addr'
-import { sigv4 } from '../Sigv4'
-import { fetchjson } from './http'
+  ProviderSpec, Provider, SekretoError, awsparam, providerplugin, vaultref, unbase64,
+} from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { sigv4 } from './sigv4'
+import { fetchjson } from './httpjson'
 
+/** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
 function awsnow(): string {
   return new Date()
     .toISOString()
@@ -133,7 +134,11 @@ export function awssecretsprovider(options?: Awsopts): Provider {
         // `value` field can mean "the bytes themselves".
         const bin = res.body && res.body.SecretBinary
         if ('string' === typeof bin && 'value' === ref.field) {
-          return Buffer.from(bin, 'base64').toString('utf8')
+          const decoded = unbase64(bin)
+          if (undefined === decoded) {
+            throw new SekretoError('sekreto: aws secretsmanager: undecodable secret')
+          }
+          return decoded
         }
         return undefined
       }
@@ -189,31 +194,16 @@ export function awsparamsprovider(options?: Awsopts): Provider {
   }
 }
 
-/** GCP Secret Manager.
- *
- * `api.token` reads secret `api_token` (dots flattened to `_`; Secret
- * Manager ids have no hierarchy and reject dots), latest version. The
- * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
- * GCE/GKE metadata server - so on Google's own platform no credential
- * configuration is needed at all.
- *
- * The metadata call itself is plain http to a link-local host by
- * platform design; no credential rides on it, so `checkaddr` guards the
- * Secret Manager address instead. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
-
-register({
-  name: 'awssecrets',
-  needs: ['fetch', 'crypto'],
-  define: (spec: ProviderSpec) => awssecretsprovider(spec),
-})
-
-register({
-  name: 'awsparams',
-  needs: ['fetch', 'crypto'],
-  define: (spec: ProviderSpec) => awsparamsprovider(spec),
-})
+
+/** The two plugins. Both need HTTPS and HMAC-SHA256 - the one crypto
+ * dependency in the library, which is why this is a plugin rather than
+ * a built-in: `sigv4` is exported from here and from nowhere in the
+ * core. */
+export const awssecrets = providerplugin('awssecrets', (spec: ProviderSpec) =>
+  awssecretsprovider(spec))
+
+export const awsparams = providerplugin('awsparams', (spec: ProviderSpec) =>
+  awsparamsprovider(spec))
+
+export { sigv4 }
+export type { Sigv4Input, Sigv4Output } from './sigv4'

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/azuresecrets.ts

@@ -1,12 +1,23 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/azuresecrets.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/azuresecrets.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, SekretoError, flatname } from './support'
-import { checkaddr } from './addr'
-import { fetchjson } from './http'
+import { ProviderSpec, Provider, SekretoError, flatname, providerplugin } from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { fetchjson } from './httpjson'
 
+/** Azure Key Vault.
+ *
+ * `api.token` reads secret `api-token` (dots flattened to `-`; Key
+ * Vault names allow nothing else), current version. The token comes
+ * from config, then a client-credentials login when tenant/clientid/
+ * clientsecret are given, then the IMDS managed-identity endpoint - so
+ * on Azure's own platform no credential configuration is needed.
+ *
+ * As with GCP, the IMDS call is plain http to a link-local host by
+ * platform design and carries no credential; the login and vault
+ * addresses are `checkaddr`-guarded. */
 export function azuresecretsprovider(options?: {
   vault?: string
   token?: string
@@ -125,20 +136,7 @@ export function azuresecretsprovider(options?: {
   }
 }
 
-/** 1Password, through a Connect server.
- *
- * The item titled `api.token` (titles keep their dots), in the named
- * vault. The value is the field with purpose PASSWORD, or the field
- * labelled `value`. A vault that cannot be found is an error - config
- * names it, so its absence is a broken store, not a missing secret. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
 
-register({
-  name: 'azuresecrets',
-  needs: ['fetch'],
-  define: (spec: ProviderSpec) => azuresecretsprovider(spec),
-})
+/** The plugin. Needs HTTPS. */
+export const azuresecrets = providerplugin('azuresecrets', (spec: ProviderSpec) =>
+  azuresecretsprovider(spec))

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/boru.ts

@@ -1,12 +1,38 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/boru.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/boru.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, SekretoError, checkname, nodemod } from './support'
-import { checkaddr } from './addr'
-import { fetchjson } from './http'
-
+import {
+  ProviderSpec, Provider, SekretoError, checkname, nodemod, providerplugin,
+} from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { fetchjson } from './httpjson'
+
+/** A boru vault (https://github.com/boru-lang/boru).
+ *
+ * Two ways in, both boru's own.
+ *
+ * With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+ * secret on stdout and nothing else. The passphrase is read by boru
+ * itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
+ * config and never puts it on a command line, where it would show up in
+ * the process table.
+ *
+ * With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+ * read-only, HashiCorp-shaped provision API (boru's
+ * design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+ * from `boru vault grant`. A sekreto name is already a valid boru
+ * alias, and boru aliases keep their dots, so `api.token` is the single
+ * path segment `api.token` - not the `api`/`token` split a HashiCorp KV
+ * gets. The value is the `value` field. A 404 is a miss; anything else
+ * the server refuses (a revoked capability, a sealed vault) is an
+ * error.
+ *
+ * boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+ * credential *broker*, built precisely so the caller never receives the
+ * credential. `vault serve` is the provision endpoint, built to hand
+ * the value back - that is the one sekreto uses. */
 export function boruprovider(options?: {
   command?: string
   namespace?: string
@@ -92,17 +118,10 @@ function borumiss(why: string): boolean {
   return /no alias named/.test(why)
 }
 
-/** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
 
-register({
-  name: 'boru',
-  needs: ['fetch'],
-  define: (spec: ProviderSpec) => boruprovider({
+/** The plugin. Needs a child process (CLI mode) or HTTPS (wire mode). */
+export const boru = providerplugin('boru', (spec: ProviderSpec) =>
+  boruprovider({
     command: spec.command,
     namespace: spec.namespace,
     home: spec.home,
@@ -110,4 +129,4 @@ register({
     token: spec.token,
     mount: spec.mount,
   }),
-})
+)

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/doppler.ts

@@ -1,12 +1,18 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/doppler.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/doppler.ts)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, SekretoError, envkey } from './support'
-import { checkaddr } from './addr'
-import { fetchjson } from './http'
+import { ProviderSpec, Provider, SekretoError, envkey, providerplugin } from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { fetchjson } from './httpjson'
 
+/** Doppler.
+ *
+ * The whole config is downloaded once - Doppler's own bulk endpoint -
+ * and answered from memory, like a remote .env: `api.token` is the
+ * `API_TOKEN` entry. A service token is config-scoped, so project and
+ * config are only needed with broader tokens. */
 export function dopplerprovider(options?: {
   token?: string
   project?: string
@@ -58,20 +64,7 @@ export function dopplerprovider(options?: {
   }
 }
 
-/** Infisical.
- *
- * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
- * convention is environment-style keys) at a secret path in one
- * environment of a project. Auth is a token, or a universal-auth
- * (machine identity) login with clientid/clientsecret. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
 
-register({
-  name: 'doppler',
-  needs: ['fetch'],
-  define: (spec: ProviderSpec) => dopplerprovider(spec),
-})
+/** The plugin. Needs HTTPS. */
+export const doppler = providerplugin('doppler', (spec: ProviderSpec) =>
+  dopplerprovider(spec))