@voxgig/sdkgen 4.8.2 → 4.9.0

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/gcpsecrets.ts

@@ -1,12 +1,25 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/gcpsecrets.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/gcpsecrets.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, SekretoError, flatname, nodemod } from './support'
-import { checkaddr } from './addr'
-import { fetchjson } from './http'
+import {
+  ProviderSpec, Provider, SekretoError, flatname, providerplugin, unbase64,
+} from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { fetchjson } from './httpjson'
 
+/** GCP Secret Manager.
+ *
+ * `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+ * Manager ids have no hierarchy and reject dots), latest version. The
+ * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+ * GCE/GKE metadata server - so on Google's own platform no credential
+ * configuration is needed at all.
+ *
+ * The metadata call itself is plain http to a link-local host by
+ * platform design; no credential rides on it, so `checkaddr` guards the
+ * Secret Manager address instead. */
 export function gcpsecretsprovider(options?: {
   project?: string
   token?: string
@@ -88,31 +101,18 @@ export function gcpsecretsprovider(options?: {
         return undefined
       }
 
-      return Buffer.from(data, 'base64').toString('utf8')
+      const decoded = unbase64(data)
+      if (undefined === decoded) {
+        throw new SekretoError('sekreto: gcp: undecodable secret')
+      }
+
+      return decoded
     },
     describe: () => 'gcpsecrets:' + (opts.project || ''),
   }
 }
 
-/** Azure Key Vault.
- *
- * `api.token` reads secret `api-token` (dots flattened to `-`; Key
- * Vault names allow nothing else), current version. The token comes
- * from config, then a client-credentials login when tenant/clientid/
- * clientsecret are given, then the IMDS managed-identity endpoint - so
- * on Azure's own platform no credential configuration is needed.
- *
- * As with GCP, the IMDS call is plain http to a link-local host by
- * platform design and carries no credential; the login and vault
- * addresses are `checkaddr`-guarded. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
 
-register({
-  name: 'gcpsecrets',
-  needs: ['fetch'],
-  define: (spec: ProviderSpec) => gcpsecretsprovider(spec),
-})
+/** The plugin. Needs HTTPS. */
+export const gcpsecrets = providerplugin('gcpsecrets', (spec: ProviderSpec) =>
+  gcpsecretsprovider(spec))

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/hashicorp.ts

@@ -1,12 +1,28 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/hashicorp.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/hashicorp.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, SekretoError, checkname, nodemod, vaultref } from './support'
-import { checkaddr } from './addr'
-import { fetchjson } from './http'
+import {
+  ProviderSpec, Provider, SekretoError, nodemod, providerplugin, vaultref,
+} from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { fetchjson } from './httpjson'
 
+/** HashiCorp Vault.
+ *
+ * KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
+ * and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+ * `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
+ * "not here" - a miss - so a vault can sit in a chain with fallbacks.
+ *
+ * A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+ * logins as well as reads.
+ *
+ * Instead of being handed a token, the provider can log in: Kubernetes
+ * auth (the pod's service-account JWT, from its conventional path) or
+ * AppRole. A failed login is an error, never a miss - it means this
+ * store could not answer at all. */
 export function hashicorpprovider(
   addr: string,
   token: string,
@@ -117,43 +133,13 @@ export function hashicorpprovider(
   }
 }
 
-/** A boru vault (https://github.com/boru-lang/boru).
- *
- * Two ways in, both boru's own.
- *
- * With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
- * secret on stdout and nothing else. The passphrase is read by boru
- * itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
- * config and never puts it on a command line, where it would show up in
- * the process table.
- *
- * With an `addr`, boru's wire protocol: `boru vault serve` publishes a
- * read-only, HashiCorp-shaped provision API (boru's
- * design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
- * from `boru vault grant`. A sekreto name is already a valid boru
- * alias, and boru aliases keep their dots, so `api.token` is the single
- * path segment `api.token` - not the `api`/`token` split a HashiCorp KV
- * gets. The value is the `value` field. A 404 is a miss; anything else
- * the server refuses (a revoked capability, a sealed vault) is an
- * error.
- *
- * boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
- * credential *broker*, built precisely so the caller never receives the
- * credential. `vault serve` is the provision endpoint, built to hand
- * the value back - that is the one sekreto uses. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
 
-register({
-  name: 'hashicorp',
-  needs: ['fetch', 'fs'],
-  define: (spec: ProviderSpec) => hashicorpprovider(spec.addr || '', spec.token || '', {
+/** The plugin. Needs HTTPS, and the filesystem for a kubernetes JWT. */
+export const hashicorp = providerplugin('hashicorp', (spec: ProviderSpec) =>
+  hashicorpprovider(spec.addr || '', spec.token || '', {
     mount: spec.mount,
     kv: spec.kv,
     vaultnamespace: spec.vaultnamespace,
     auth: spec.auth,
   }),
-})
+)

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/httpjson.ts

@@ -0,0 +1,99 @@
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/httpjson.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { SekretoError } from '../provider/support'
+
+/** How long any single vault round-trip may take before it is treated as
+ * unreachable. Ports carry the same bound. */
+const HTTP_TIMEOUT_MS = 10000
+
+/** How much of a response body will be read before the store is treated as
+ * having answered incoherently. Ports carry the same bound.
+ *
+ * Far above anything real. The largest legitimate payload this library
+ * fetches is Doppler's whole-config download, measured in kilobytes; a
+ * megabyte would do. Eight is chosen so that no honest store can meet it
+ * and the check never has to be reasoned about again.
+ *
+ * A bound is needed because the timeout is not one. Ten seconds on a
+ * loopback or datacentre link is gigabytes, and the body is accumulated
+ * in memory before it is parsed — measured at 3.2 GB in one port before
+ * this. Worse where a client advertises gzip and decompresses
+ * transparently, since a few hundred kilobytes of zeros expands to
+ * gigabytes in the client's heap. This is a secrets chain running on an
+ * application's startup path, so the failure is the application never
+ * starting. */
+const HTTP_MAXBODY = 8 * 1024 * 1024
+
+/** One JSON round-trip. Network failure is always an error - an
+ * unreachable store is a store that could not answer.
+ *
+ * Shared by every plugin that speaks HTTP, and by nothing in the core:
+ * a chain of built-ins never reaches this file. */
+export async function fetchjson(
+  method: string,
+  url: string,
+  headers: Record<string, string>,
+  body?: string,
+): Promise<{ status: number; body: any }> {
+  let res: Response
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body,
+      // A vault API never legitimately redirects, and a followed redirect
+      // carries X-Vault-Token to the redirect's host (and can downgrade
+      // https to http), which checkaddr - it only validates the configured
+      // address - cannot see. Refuse to follow one.
+      redirect: 'error',
+      // Bound the wait so an accepted-but-silent endpoint cannot hang the
+      // caller (and the app's startup) forever.
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+    })
+  } catch (err: any) {
+    throw new SekretoError('sekreto: cannot reach ' + url.split('?')[0] + ': ' + err.message)
+  }
+
+  // Read in chunks against HTTP_MAXBODY rather than `res.json()`, which
+  // buffers whatever arrives. Over the bound the request is aborted and
+  // the store has failed: an endless body is a store that could not
+  // answer, and returning a miss there would fall through to a weaker
+  // store on an attacker's cue.
+  let text = ''
+  try {
+    const decoder = new TextDecoder()
+    let size = 0
+
+    for await (const chunk of res.body ?? []) {
+      size += chunk.length
+      if (HTTP_MAXBODY < size) {
+        throw new SekretoError('sekreto: oversized response from ' + url.split('?')[0])
+      }
+      text += decoder.decode(chunk, { stream: true })
+    }
+    text += decoder.decode()
+  } catch (err: any) {
+    if (err instanceof SekretoError) {
+      throw err
+    }
+    throw new SekretoError('sekreto: cannot reach ' + url.split('?')[0] + ': ' + err.message)
+  }
+
+  let parsed: any = undefined
+  try {
+    parsed = JSON.parse(text)
+  } catch (err: any) {
+    // A success status promised JSON; a body that does not parse means
+    // the store could not answer coherently, and treating it as a miss
+    // would fall through to a weaker store. Error statuses may carry
+    // any body - they are decided on status alone.
+    if (200 === res.status) {
+      throw new SekretoError('sekreto: malformed response from ' + url.split('?')[0])
+    }
+  }
+
+  return { status: res.status, body: parsed }
+}

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/infisical.ts

@@ -1,12 +1,18 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/infisical.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/infisical.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
-import { ProviderSpec, Provider, SekretoError, envkey } from './support'
-import { checkaddr } from './addr'
-import { fetchjson } from './http'
+import { ProviderSpec, Provider, SekretoError, envkey, providerplugin } from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { fetchjson } from './httpjson'
 
+/** Infisical.
+ *
+ * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+ * convention is environment-style keys) at a secret path in one
+ * environment of a project. Auth is a token, or a universal-auth
+ * (machine identity) login with clientid/clientsecret. */
 export function infisicalprovider(options?: {
   addr?: string
   token?: string
@@ -93,15 +99,7 @@ export function infisicalprovider(options?: {
   }
 }
 
-/** Build a provider from its declarative form. */
 
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
-
-register({
-  name: 'infisical',
-  needs: ['fetch'],
-  define: (spec: ProviderSpec) => infisicalprovider(spec),
-})
+/** The plugin. Needs HTTPS. */
+export const infisical = providerplugin('infisical', (spec: ProviderSpec) =>
+  infisicalprovider(spec))

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{provider → plugins}/onepassword.ts

@@ -1,14 +1,20 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/onepassword.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/onepassword.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
 import {
-  ProviderSpec, Provider, SekretoError, checkname, vaultref,
-} from './support'
-import { checkaddr } from './addr'
-import { fetchjson } from './http'
+  ProviderSpec, Provider, SekretoError, checkname, providerplugin,
+} from '../provider/support'
+import { checkaddr } from '../provider/addr'
+import { fetchjson } from './httpjson'
 
+/** 1Password, through a Connect server.
+ *
+ * The item titled `api.token` (titles keep their dots), in the named
+ * vault. The value is the field with purpose PASSWORD, or the field
+ * labelled `value`. A vault that cannot be found is an error - config
+ * names it, so its absence is a broken store, not a missing secret. */
 export function onepasswordprovider(options?: {
   addr?: string
   token?: string
@@ -101,20 +107,7 @@ export function onepasswordprovider(options?: {
   }
 }
 
-/** Doppler.
- *
- * The whole config is downloaded once - Doppler's own bulk endpoint -
- * and answered from memory, like a remote .env: `api.token` is the
- * `API_TOKEN` entry. A service token is config-scoped, so project and
- * config are only needed with broader tokens. */
-
-
-// Registering at import is what makes this module's presence the only
-// thing that decides whether the kind exists in a build.
-import { register } from './Registry'
 
-register({
-  name: 'onepassword',
-  needs: ['fetch'],
-  define: (spec: ProviderSpec) => onepasswordprovider(spec),
-})
+/** The plugin. Needs HTTPS. */
+export const onepassword = providerplugin('onepassword', (spec: ProviderSpec) =>
+  onepasswordprovider(spec))

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/secretspec.ts

@@ -0,0 +1,98 @@
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/secretspec.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import {
+  ProviderSpec, Provider, SekretoError, envkey, nodemod, providerplugin,
+} from '../provider/support'
+
+/** SecretSpec — https://secretspec.dev
+ *
+ * A declaration plus a chain of its own backends: the same shape as
+ * sekreto one level down. A project that has declared its secrets there
+ * should not have to declare them again here, so this reads through the
+ * `secretspec` CLI rather than reimplementing its resolution.
+ *
+ * SecretSpec audits every read and refuses without `--reason`; sekreto
+ * sends `sekreto` unless configured otherwise. */
+export function secretspecprovider(options?: {
+  command?: string
+  file?: string
+  profile?: string
+  backend?: string
+  reason?: string
+  prefix?: string
+}): Provider {
+  const opts = options || {}
+  const command = opts.command || 'secretspec'
+
+  return {
+    lookup: (name: string) => {
+      const key = envkey(name, opts.prefix)
+
+      const args: string[] = []
+      if (opts.file) {
+        args.push('--file', opts.file)
+      }
+      args.push('get', key)
+      if (opts.backend) {
+        args.push('--provider', opts.backend)
+      }
+      if (opts.profile) {
+        args.push('--profile', opts.profile)
+      }
+      args.push('--reason', opts.reason || 'sekreto')
+
+      const { spawnSync } = nodemod<typeof import('node:child_process')>('node:child_process')
+      const run = spawnSync(command, args, { encoding: 'utf8' })
+
+      if (run.error) {
+        throw new SekretoError('sekreto: cannot run ' + command + ': ' + run.error.message)
+      }
+
+      if (0 === run.status) {
+        // The value and one newline, and nothing else.
+        return run.stdout.replace(/\n$/, '')
+      }
+
+      const why = (run.stderr || '').trim()
+
+      if (secretspecmiss(why, key)) {
+        return undefined
+      }
+
+      throw new SekretoError('sekreto: secretspec error: ' + (why || 'exit ' + run.status))
+    },
+    describe: () => 'secretspec' + (opts.backend ? ':' + opts.backend : ''),
+  }
+}
+
+/** Does this SecretSpec failure mean "no such secret" rather than "I
+ * could not answer"?
+ *
+ * SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+ * not declare and one declared with no value, and both are misses: this
+ * store does not hold it, so the chain carries on.
+ *
+ * MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+ * `Provider backend 'keyring' not found`, which is a store that could
+ * not answer at all - and reading that as a miss is the worst failure
+ * this library has, because the chain then falls through to a weaker
+ * store without saying so. The key is required to appear, so the two
+ * cannot be confused. */
+function secretspecmiss(why: string, key: string): boolean {
+  return why.includes("Secret '" + key + "' not found")
+}
+
+/** The plugin. Needs a child process. */
+export const secretspec = providerplugin('secretspec', (spec: ProviderSpec) =>
+  secretspecprovider({
+    command: spec.command,
+    file: spec.file,
+    profile: spec.profile,
+    backend: spec.backend,
+    reason: spec.reason,
+    prefix: spec.prefix,
+  }),
+)

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/{Sigv4.ts → plugins/sigv4.ts}

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/Sigv4.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/sigv4.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //
@@ -16,10 +16,11 @@
 
 // node:crypto is loaded ON FIRST USE, not at import time.
 //
-// Providers.ts imports sigv4 for the AWS providers, and Sekreto.ts imports
-// Providers — so a top-level `node:crypto` here put it in the module graph
-// of every sekreto consumer, including one that never signs anything.
-// Deferring keeps this module pure until an AWS provider actually runs.
+// This module lives under plugins/ and is reached only through the aws
+// plugin, so the core never sees it at all; deferring the builtin on top
+// of that keeps importing the plugin free of side effects too, and lets
+// the sigv4 conformance group run on a runtime that has crypto without
+// anything else in the module graph having asked for it.
 //
 // require(), not `await import()`: these helpers are synchronous and are
 // called from synchronous signing code. The package is CommonJS.

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/addr.ts

@@ -1,43 +1,117 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/addr.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/addr.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
 import { SekretoError } from './support'
 
+/** An address with any userinfo replaced by `[redacted]`, for messages.
+ *
+ * Every refusal below names the address it refused, and one of them fires
+ * precisely because the address carries a credential — so printing it
+ * verbatim wrote the password to stderr and into the logs. It cannot be
+ * cleaned up afterwards either: that password was never resolved as a
+ * secret, so `redact()` has never seen it and never will. The host is what
+ * a reader needs to identify which chain entry is at fault; the userinfo
+ * is not. */
+export function safeaddr(addr: string): string {
+  const mark = addr.indexOf('://')
+  if (-1 === mark) {
+    return addr
+  }
+
+  const rest = addr.slice(mark + 3)
+  const end = rest.search(/[/?#]/)
+  const authority = -1 === end ? rest : rest.slice(0, end)
+
+  const at = authority.lastIndexOf('@')
+  if (-1 === at) {
+    return addr
+  }
+
+  return addr.slice(0, mark + 3) + '[redacted]' + addr.slice(mark + 3 + at)
+}
+
+/** Refuse to send a secret-bearing credential in the clear.
+ *
+ * A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+ * convenience. Sending a token over http to anything but the local
+ * machine puts both the token and the secret it fetches on the wire for
+ * anyone on the path, so sekreto will not do it. Loopback stays allowed:
+ * that is `vault server -dev`, `boru vault serve`, and this repo's own
+ * test harness.
+ *
+ * The address is read by hand, in the same handful of steps in every
+ * port, rather than by each platform's URL parser. That is deliberate.
+ * Twelve parsers disagree about malformed input — where userinfo ends,
+ * whether `0177.0.0.1` is loopback, what an unclosed bracket means — and
+ * a check that answers differently in different ports is not a check.
+ *
+ * The rule this parse obeys, and the reason it can be trusted: it is
+ * never more permissive than the HTTP client that will dial the address.
+ * It ends the authority at `/`, `?` or `#` only, so a client that also
+ * breaks on `\` (WHATWG does) can only ever see a SHORTER host than this
+ * does. It refuses userinfo outright rather than locating its end. It
+ * compares the host literally, so a numeric form no parser here agrees on
+ * is refused rather than guessed at. Each of those can refuse an address
+ * that would in fact have been safe; none can allow one that is not. */
 export function checkaddr(addr: string): void {
-  if (addr.startsWith('https://')) {
-    return
+  const scheme = addr.startsWith('https://')
+    ? 'https://'
+    : addr.startsWith('http://')
+      ? 'http://'
+      : ''
+
+  if ('' === scheme) {
+    throw new SekretoError('sekreto: not an http(s) address: ' + safeaddr(addr))
   }
 
-  if (!addr.startsWith('http://')) {
-    throw new SekretoError('sekreto: not an http(s) address: ' + addr)
+  const rest = addr.slice(scheme.length)
+  const end = rest.search(/[/?#]/)
+  const authority = -1 === end ? rest : rest.slice(0, end)
+
+  // Userinfo is refused outright rather than parsed around, and on https
+  // as well as http. No store this library speaks authenticates by
+  // userinfo — they take a token or a signature — so an address carrying
+  // one is a mistake at best. At worst it is the attack this whole
+  // function exists to stop: `http://localhost:8200@evil.example.com/` is
+  // a request to evil.example.com that reads, to anything that splits the
+  // authority on ':', as loopback. Refusing the shape is a rule twelve
+  // ports can apply identically; agreeing on where the userinfo ends is
+  // not.
+  if (authority.includes('@')) {
+    throw new SekretoError(
+      'sekreto: refusing an address with embedded credentials: ' + safeaddr(addr),
+    )
   }
 
-  // Parsed, not split on ':'. Splitting the authority on the first colon
-  // yields '[' for a bracketed IPv6 address, so `http://[::1]:8200` could
-  // never match — which made the '::1' and '[::1]' entries below
-  // unreachable, and refused a legitimate local vault.
-  //
-  // The ALLOWLIST is unchanged. URL only fixes what the host IS: it strips
-  // userinfo (so `http://127.0.0.1@evil.com/` reads as evil.com, as
-  // before), lowercases, and normalises numeric forms — `0177.0.0.1` is
-  // 127.0.0.1 and is now recognised as the loopback it actually is.
-  // IPv4-mapped IPv6 (`[::ffff:127.0.0.1]`) is deliberately still refused:
-  // widening the set is a separate decision from parsing it correctly.
-  let host: string
-  try {
-    host = new URL(addr).hostname
-  } catch (err: any) {
-    throw new SekretoError('sekreto: not a valid http(s) address: ' + addr)
+  // An opening bracket with no closing one is not an address at all, and
+  // saying so is more use to whoever wrote the config than refusing it as
+  // though it named a remote host.
+  if (authority.startsWith('[') && !authority.includes(']')) {
+    throw new SekretoError('sekreto: not a valid http(s) address: ' + safeaddr(addr))
   }
 
+  if ('https://' === scheme) {
+    return
+  }
+
+  // A bracketed IPv6 literal keeps its brackets. Splitting the authority
+  // on the first colon yields '[', so `http://[::1]:8200` could never
+  // match — which made the '[::1]' entry below unreachable, and refused a
+  // legitimate local vault.
+  const host = (
+    authority.startsWith('[')
+      ? authority.slice(0, authority.indexOf(']') + 1)
+      : authority.split(':')[0]
+  ).toLowerCase()
+
   if ('localhost' === host || '127.0.0.1' === host || '::1' === host || '[::1]' === host) {
     return
   }
 
   throw new SekretoError(
-    'sekreto: refusing to send a token in plaintext to ' + addr + ' (use https)',
+    'sekreto: refusing to send a token in plaintext to ' + safeaddr(addr) + ' (use https)',
   )
 }
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/builtin.ts

@@ -0,0 +1,37 @@
+// VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/builtin.ts)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+// THE BUILT-IN PROVIDER KINDS - the same four in every port.
+//
+// What makes a kind built in is that it needs nothing of the platform
+// beyond reading a local file: no socket, no TLS, no crypto, no child
+// process. These four are the floor every chain stands on, and a chain
+// that reads secrets from options, the environment, a plaintext `.env`
+// and a mounted secret directory works with no plugin loaded at all.
+// Everything else - the vault clients, the cloud stores, the CLIs - is a
+// plugin, and lives under `plugins/` (docs/design/plugin-providers.md).
+
+import { Definition, ProviderSpec, providerplugin } from './support'
+import { envprovider } from './env'
+import { memoryprovider } from './memory'
+import { dotenvprovider } from './dotenv'
+import { fileprovider } from './file'
+
+export const BUILTINS: Definition[] = [
+  providerplugin('env', (spec: ProviderSpec) => envprovider(spec.prefix)),
+  providerplugin('memory', (spec: ProviderSpec) => memoryprovider(spec.values || {}, spec.prefix)),
+  providerplugin('dotenv', (spec: ProviderSpec) => dotenvprovider(spec.file || '.env', spec.prefix)),
+  providerplugin('file', (spec: ProviderSpec) => fileprovider(spec.dir || '', spec.prefix)),
+]
+
+/** Every kind this library ships, built in or as a plugin, so that an
+ * unknown kind can be told from a plugin that was not loaded. */
+export const KINDS = {
+  builtin: ['env', 'memory', 'dotenv', 'file'],
+  plugin: [
+    'hashicorp', 'boru', 'awssecrets', 'awsparams', 'gcpsecrets',
+    'azuresecrets', 'onepassword', 'doppler', 'infisical', 'secretspec',
+  ],
+}