@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/onepassword.php

@@ -0,0 +1,150 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/onepassword.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * 1Password Connect, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it opens a socket.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+
+/**
+ * 1Password, through a Connect server.
+ *
+ * The item titled `api.token` (titles keep their dots), in the named
+ * vault. The value is the field with purpose PASSWORD, or the field
+ * labelled `value`. A vault that cannot be found is an error - config
+ * names it, so its absence is a broken store, not a missing secret.
+ */
+class OnePasswordProvider implements Provider
+{
+    private ?string $vaultid = null;
+
+    /** @param array<string, mixed> $opts */
+    public function __construct(private array $opts = [])
+    {
+    }
+
+    /** @return array<int, string> */
+    private function auth(): array
+    {
+        return ['Authorization: Bearer ' . ($this->opts['token'] ?? '')];
+    }
+
+    private function resolvevault(string $addr): string
+    {
+        $want = $this->opts['vault'] ?? '';
+        if ('' === $want || null === $want) {
+            throw new SekretoError('sekreto: onepassword: no vault');
+        }
+
+        [$status, $body] = fetchjson('GET', $addr . '/v1/vaults', $this->auth());
+
+        if (200 !== $status || !is_array($body)) {
+            throw new SekretoError('sekreto: onepassword error: ' . $status . ': listing vaults');
+        }
+
+        foreach ($body as $entry) {
+            if (is_array($entry)
+                && ($want === ($entry['id'] ?? null) || $want === ($entry['name'] ?? null))
+            ) {
+                return (string) $entry['id'];
+            }
+        }
+
+        throw new SekretoError('sekreto: onepassword: no vault named ' . $want);
+    }
+
+    public function lookup(string $name): ?string
+    {
+        Name::check($name);
+
+        $addr = rtrim($this->opts['addr'] ?? '', '/');
+        if ('' === $addr) {
+            throw new SekretoError('sekreto: onepassword: no addr');
+        }
+        checkaddr($addr);
+
+        if (null === $this->vaultid) {
+            $this->vaultid = $this->resolvevault($addr);
+        }
+
+        $filter = rawurlencode('title eq "' . $name . '"');
+        [$status, $found] = fetchjson(
+            'GET',
+            $addr . '/v1/vaults/' . $this->vaultid . '/items?filter=' . $filter,
+            $this->auth()
+        );
+
+        if (200 !== $status || !is_array($found)) {
+            throw new SekretoError(
+                'sekreto: onepassword error: ' . $status . ': finding ' . $name
+            );
+        }
+
+        if (0 === count($found)) {
+            return null;
+        }
+
+        [$status, $item] = fetchjson(
+            'GET',
+            $addr . '/v1/vaults/' . $this->vaultid . '/items/' . $found[0]['id'],
+            $this->auth()
+        );
+
+        if (200 !== $status) {
+            throw new SekretoError(
+                'sekreto: onepassword error: ' . $status . ': reading ' . $name
+            );
+        }
+
+        $fields = $item['fields'] ?? [];
+
+        foreach ($fields as $field) {
+            if (is_array($field) && 'PASSWORD' === ($field['purpose'] ?? null)) {
+                $value = $field['value'] ?? null;
+                return null === $value ? null : (string) $value;
+            }
+        }
+        foreach ($fields as $field) {
+            if (is_array($field) && 'value' === ($field['label'] ?? null)) {
+                $value = $field['value'] ?? null;
+                return null === $value ? null : (string) $value;
+            }
+        }
+
+        return null;
+    }
+
+    public function describe(): string
+    {
+        return 'onepassword:' . ($this->opts['vault'] ?? '');
+    }
+}
+
+/**
+ * The `onepassword` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function onepassword(): array
+{
+    return providerplugin('onepassword', fn(array $spec) => new OnePasswordProvider($spec));
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/runcmd.php

@@ -0,0 +1,101 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/runcmd.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * The child-process half of the two plugins that shell out - `boru` and
+ * `secretspec` - in one place and OUTSIDE the core: a chain of built-ins
+ * never requires this file, and so never reaches `proc_open`.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Sekreto.php';
+
+use Voxgig\Sekreto\SekretoError;
+
+/**
+ * Run a child to completion and collect both its streams.
+ *
+ * Given an ARGV ARRAY, not a command string. `proc_open` with a string runs
+ * `/bin/sh -c`, which put every value - the command, the alias, the key -
+ * one escaping function away from being interpreted. `escapeshellarg` was
+ * doing that job correctly, but it made this the only port whose safety
+ * rested on quoting rather than on `execve`, and it broke two things
+ * besides: the "cannot run" branch was unreachable, because `sh` always
+ * starts and absorbs the exec failure into its own message, and the
+ * `BORU_HOME=...` prefix is POSIX-sh syntax that does nothing on Windows,
+ * where `proc_open` goes through `cmd.exe`. The array form (PHP 7.4+) makes
+ * this port behave like the other eleven.
+ *
+ * Both pipes are drained TOGETHER. `stream_get_contents` on stdout to EOF
+ * and only then on stderr deadlocks the moment the child writes more than
+ * one pipe buffer (64 KiB on Linux) to stderr: this process is blocked
+ * waiting for stdout, the child is blocked waiting for room on stderr, and
+ * neither can move. Nothing in this library sets a timeout, so that hang is
+ * permanent. secretspec's diagnostics are box-drawn and reach that size
+ * easily.
+ *
+ * The child's stdin is closed rather than inherited, so a CLI that reads it
+ * - one prompting for a passphrase when its environment variable is absent -
+ * sees EOF and gives up instead of waiting forever.
+ *
+ * @param list<string>          $argv
+ * @param array<string, string> $env  extra variables for the child only
+ *
+ * @return array{0: string, 1: string, 2: int} stdout, trimmed stderr, status
+ */
+function runcmd(array $argv, array $env = []): array
+{
+    $descriptors = [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
+
+    // null inherits the parent environment; a non-empty $env has to be the
+    // whole set, so it is merged rather than replacing it.
+    $childenv = [] === $env ? null : array_merge(getenv(), $env);
+
+    $process = @proc_open($argv, $descriptors, $pipes, null, $childenv);
+
+    if (!is_resource($process)) {
+        throw new SekretoError('sekreto: cannot run ' . $argv[0]);
+    }
+
+    fclose($pipes[0]);
+
+    stream_set_blocking($pipes[1], false);
+    stream_set_blocking($pipes[2], false);
+
+    $text = [1 => '', 2 => ''];
+    $open = [1 => $pipes[1], 2 => $pipes[2]];
+
+    while ([] !== $open) {
+        $read = array_values($open);
+        $write = null;
+        $except = null;
+
+        if (false === @stream_select($read, $write, $except, 30)) {
+            break;
+        }
+
+        foreach ($read as $handle) {
+            $chunk = fread($handle, 65536);
+            $key = $handle === $pipes[1] ? 1 : 2;
+
+            if (false === $chunk || ('' === $chunk && feof($handle))) {
+                unset($open[$key]);
+                continue;
+            }
+
+            $text[$key] .= $chunk;
+        }
+    }
+
+    fclose($pipes[1]);
+    fclose($pipes[2]);
+
+    $status = proc_close($process);
+
+    return [$text[1], trim($text[2]), $status];
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/secretspec.php

@@ -0,0 +1,146 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/secretspec.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * SecretSpec, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it spawns a child process.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/runcmd.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\providerplugin;
+
+/**
+ * SecretSpec (https://secretspec.dev).
+ *
+ * SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+ * project needs - plus a chain of its own backends to satisfy them from.
+ * That makes it the same shape as sekreto one level down, and the reason
+ * to support it is the same reason sekreto exists: a project that has
+ * already declared its secrets there should not have to declare them
+ * again here.
+ *
+ * Read through its CLI, as boru is, because that is the interface it
+ * offers a program in another language: `secretspec get API_TOKEN` prints
+ * the value on stdout and nothing else. A sekreto name maps to a
+ * SecretSpec key exactly as it maps to an environment variable -
+ * `api.token` is `API_TOKEN` - which is the convention SecretSpec's own
+ * examples use.
+ *
+ * `backend` selects one of SecretSpec's backends (`--provider`, e.g.
+ * `keyring` or `dotenv://.env`) and is called `backend` here only because
+ * `provider` already means something else in this library.
+ *
+ * A reason is required, not optional: SecretSpec records every read in an
+ * audit log and refuses to read at all without one. sekreto sends
+ * `sekreto` unless told otherwise, so the audit trail says which tool
+ * asked.
+ */
+class SecretspecProvider implements Provider
+{
+    private string $command;
+
+    public function __construct(
+        ?string $command = null,
+        private ?string $file = null,
+        private ?string $profile = null,
+        private ?string $backend = null,
+        private ?string $reason = null,
+        private ?string $prefix = null
+    ) {
+        $this->command = $command ?? 'secretspec';
+    }
+
+    public function lookup(string $name): ?string
+    {
+        $key = Name::envkey($name, $this->prefix);
+
+        $argv = [$this->command];
+        if ($this->file) {
+            $argv[] = '--file';
+            $argv[] = $this->file;
+        }
+        $argv[] = 'get';
+        $argv[] = $key;
+        if ($this->backend) {
+            $argv[] = '--provider';
+            $argv[] = $this->backend;
+        }
+        if ($this->profile) {
+            $argv[] = '--profile';
+            $argv[] = $this->profile;
+        }
+        $argv[] = '--reason';
+        $argv[] = $this->reason ?: 'sekreto';
+
+        [$out, $why, $status] = runcmd($argv);
+
+        if (0 === $status) {
+            // The value and one newline, and nothing else.
+            return preg_replace('/\n\z/', '', $out, 1);
+        }
+
+        if (secretspecmiss($why, $key)) {
+            return null;
+        }
+
+        throw new SekretoError(
+            'sekreto: secretspec error: ' . ('' === $why ? 'exit ' . $status : $why)
+        );
+    }
+
+    public function describe(): string
+    {
+        return 'secretspec' . ($this->backend ? ':' . $this->backend : '');
+    }
+}
+
+/**
+ * Does this SecretSpec failure mean "no such secret" rather than "I could
+ * not answer"?
+ *
+ * SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+ * not declare and one declared with no value, and both are misses: this
+ * store does not hold it, so the chain carries on.
+ *
+ * MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+ * `Provider backend 'keyring' not found`, which is a store that could not
+ * answer at all - and reading that as a miss is the worst failure this
+ * library has, because the chain then falls through to a weaker store
+ * without saying so. The key is required to appear, so the two cannot be
+ * confused.
+ */
+function secretspecmiss(string $why, string $key): bool
+{
+    return str_contains($why, "Secret '" . $key . "' not found");
+}
+
+/**
+ * The `secretspec` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function secretspec(): array
+{
+    return providerplugin('secretspec', fn(array $spec) => new SecretspecProvider(
+        $spec['command'] ?? null,
+        $spec['file'] ?? null,
+        $spec['profile'] ?? null,
+        $spec['backend'] ?? null,
+        $spec['reason'] ?? null,
+        $spec['prefix'] ?? null
+    ));
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/sigv4.php

@@ -0,0 +1,161 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/sigv4.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * AWS Signature Version 4, hand-rolled.
+ *
+ * The AWS providers need exactly one thing from the AWS SDK - request
+ * signing - and taking the SDK for it would break the no-dependency rule
+ * that keeps ten ports honest. SigV4 is a stable, published algorithm
+ * built from HMAC-SHA256, which PHP's standard hash extension already has.
+ *
+ * `sigv4` is pure: the caller passes the timestamp, so the same input
+ * yields the same signature everywhere. That is what lets the shared spec
+ * carry known-answer cases that all ten ports must reproduce bit-for-bit,
+ * and lets the integration mock recompute the signature server-side.
+ *
+ * IT LIVES WITH THE AWS PLUGIN, not in the core. Signing is the sharpest
+ * instance of the line the split draws: the core of no port imports a hash
+ * function, and only a program that names an AWS kind requires this file.
+ *
+ * A port of typescript/plugins/sigv4.ts, which is canonical.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+/**
+ * RFC 3986 escaping, which is stricter than PHP's urlencode: AWS wants
+ * `!`, `'`, `(`, `)` and `*` escaped too - which is exactly what
+ * rawurlencode does, with the uppercase hex the canonical form requires.
+ */
+function uriescape(string $text): string
+{
+    return rawurlencode($text);
+}
+
+/**
+ * The canonical query string: each pair RFC 3986-escaped, sorted by
+ * escaped key then escaped value.
+ */
+function canonicalquery(string $query): string
+{
+    if ('' === $query) {
+        return '';
+    }
+
+    $pairs = [];
+
+    foreach (explode('&', $query) as $pair) {
+        $eq = strpos($pair, '=');
+        $key = false === $eq ? $pair : substr($pair, 0, $eq);
+        $value = false === $eq ? '' : substr($pair, $eq + 1);
+        $pairs[] = [uriescape(rawurldecode($key)), uriescape(rawurldecode($value))];
+    }
+
+    usort($pairs, function (array $left, array $right) {
+        if ($left[0] !== $right[0]) {
+            return strcmp($left[0], $right[0]);
+        }
+        return strcmp($left[1], $right[1]);
+    });
+
+    return implode('&', array_map(fn(array $pair) => $pair[0] . '=' . $pair[1], $pairs));
+}
+
+/**
+ * Sign one request. Returns the headers to attach: authorization,
+ * x-amz-date, and x-amz-security-token when a session token was given.
+ *
+ * Input keys: method, url, headers?, body?, service, region, keyid,
+ * secret, session?, datetime (YYYYMMDDTHHMMSSZ).
+ *
+ * @param array<string, mixed> $input
+ * @return array<string, string>
+ */
+function sigv4(array $input): array
+{
+    $url = parse_url((string) $input['url']) ?: [];
+
+    $date = substr((string) $input['datetime'], 0, 8);
+    $body = (string) ($input['body'] ?? '');
+
+    // The host as a URL object reports it: including the port only when it
+    // is not the scheme's default.
+    $scheme = strtolower((string) ($url['scheme'] ?? ''));
+    $host = (string) ($url['host'] ?? '');
+    $port = $url['port'] ?? null;
+    if (
+        null !== $port &&
+        !('https' === $scheme && 443 === $port) &&
+        !('http' === $scheme && 80 === $port)
+    ) {
+        $host .= ':' . $port;
+    }
+
+    // Every header that will be signed: the caller's extras, plus host and
+    // x-amz-date (and the session token when present), lower-cased and
+    // trimmed the way the canonical form requires.
+    // Canonical header values are trimmed AND internally collapsed -
+    // AWS folds sequential whitespace to one space before signing, so a
+    // header like "a  b" must sign as "a b" or the service refuses it.
+    $headers = [];
+    foreach ($input['headers'] ?? [] as $key => $value) {
+        $headers[strtolower((string) $key)] = preg_replace('/\s+/', ' ', trim((string) $value));
+    }
+    $headers['host'] = $host;
+    $headers['x-amz-date'] = (string) $input['datetime'];
+    if (!empty($input['session'])) {
+        $headers['x-amz-security-token'] = (string) $input['session'];
+    }
+
+    $names = array_keys($headers);
+    sort($names);
+    $canonicalheaders = implode(
+        '',
+        array_map(fn(string $name) => $name . ':' . $headers[$name] . "\n", $names)
+    );
+    $signedheaders = implode(';', $names);
+
+    $path = (string) ($url['path'] ?? '');
+
+    $canonicalrequest = implode("\n", [
+        strtoupper((string) $input['method']),
+        '' === $path ? '/' : $path,
+        canonicalquery((string) ($url['query'] ?? '')),
+        $canonicalheaders,
+        $signedheaders,
+        hash('sha256', $body),
+    ]);
+
+    $scope = $date . '/' . $input['region'] . '/' . $input['service'] . '/aws4_request';
+
+    $stringtosign = implode("\n", [
+        'AWS4-HMAC-SHA256',
+        $input['datetime'],
+        $scope,
+        hash('sha256', $canonicalrequest),
+    ]);
+
+    $kdate = hash_hmac('sha256', $date, 'AWS4' . $input['secret'], true);
+    $kregion = hash_hmac('sha256', (string) $input['region'], $kdate, true);
+    $kservice = hash_hmac('sha256', (string) $input['service'], $kregion, true);
+    $ksigning = hash_hmac('sha256', 'aws4_request', $kservice, true);
+    $signature = hash_hmac('sha256', $stringtosign, $ksigning);
+
+    $out = [
+        'authorization' => 'AWS4-HMAC-SHA256 Credential=' . $input['keyid'] . '/' . $scope
+            . ', SignedHeaders=' . $signedheaders
+            . ', Signature=' . $signature,
+        'x-amz-date' => (string) $input['datetime'],
+    ];
+
+    if (!empty($input['session'])) {
+        $out['x-amz-security-token'] = (string) $input['session'];
+    }
+
+    return $out;
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/src/Addr.php

@@ -0,0 +1,129 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/src/Addr.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * Reading a store address safely: the two pure functions every plugin that
+ * dials a host runs first.
+ *
+ * They stay in the CORE even though only plugins call them. They are
+ * string work - no socket, no resolver, no platform - and the rule they
+ * enforce is a property of sekreto rather than of any one store, so a
+ * custom provider kind written outside this repository gets it for free.
+ *
+ * A port of typescript/src/addr.ts, which is canonical.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto;
+
+require_once __DIR__ . '/Sekreto.php';
+
+/**
+ * An address with any userinfo replaced by `[redacted]`, for messages.
+ *
+ * Every refusal below names the address it refused, and one of them fires
+ * precisely because the address carries a credential - so printing it
+ * verbatim wrote the password to stderr and into the logs. It cannot be
+ * cleaned up afterwards either: that password was never resolved as a
+ * secret, so redact() has never seen it and never will. The host is what a
+ * reader needs to identify which chain entry is at fault; the userinfo is
+ * not.
+ */
+function safeaddr(string $addr): string
+{
+    $mark = strpos($addr, '://');
+    if (false === $mark) {
+        return $addr;
+    }
+
+    $rest = substr($addr, $mark + 3);
+    $authority = substr($rest, 0, strcspn($rest, '/?#'));
+
+    $at = strrpos($authority, '@');
+    if (false === $at) {
+        return $addr;
+    }
+
+    return substr($addr, 0, $mark + 3) . '[redacted]' . substr($addr, $mark + 3 + $at);
+}
+
+/**
+ * Refuse to send a Vault token in the clear.
+ *
+ * Vault's API is HTTPS in any real deployment; plaintext is a dev-mode
+ * convenience. Sending `X-Vault-Token` over http to anything but the local
+ * machine puts both the token and the secret it fetches on the wire for
+ * anyone on the path, so sekreto will not do it. Loopback stays allowed:
+ * that is `vault server -dev` and this repo's own test harness.
+ *
+ * The address is read by hand, in the same handful of steps in every port,
+ * rather than by each platform's URL parser. That is deliberate. Twelve
+ * parsers disagree about malformed input - where userinfo ends, whether
+ * `0177.0.0.1` is loopback, what an unclosed bracket means - and a check
+ * that answers differently in different ports is not a check.
+ *
+ * The rule this parse obeys, and the reason it can be trusted: it is never
+ * more permissive than the HTTP client that will dial the address. It ends
+ * the authority at `/`, `?` or `#` only, so a client that also breaks on
+ * `\` (WHATWG does) can only ever see a SHORTER host than this does. It
+ * refuses userinfo outright rather than locating its end. It compares the
+ * host literally, so a numeric form no parser here agrees on is refused
+ * rather than guessed at.
+ */
+function checkaddr(string $addr): void
+{
+    if (str_starts_with($addr, 'https://')) {
+        $scheme = 'https://';
+    } elseif (str_starts_with($addr, 'http://')) {
+        $scheme = 'http://';
+    } else {
+        throw new SekretoError('sekreto: not an http(s) address: ' . safeaddr($addr));
+    }
+
+    $rest = substr($addr, strlen($scheme));
+    $end = strcspn($rest, '/?#');
+    $authority = substr($rest, 0, $end);
+
+    // Userinfo is refused outright rather than parsed around, and on https as
+    // well as http. No store this library speaks authenticates by userinfo -
+    // they take a token or a signature - so an address carrying one is a
+    // mistake at best. At worst it is the attack this whole function exists
+    // to stop: `http://localhost:8200@evil.example.com/` is a request to
+    // evil.example.com that reads, to anything that splits the authority on
+    // ':', as loopback.
+    if (str_contains($authority, '@')) {
+        throw new SekretoError(
+            'sekreto: refusing an address with embedded credentials: ' . safeaddr($addr)
+        );
+    }
+
+    // An opening bracket with no closing one is not an address at all.
+    if (str_starts_with($authority, '[') && !str_contains($authority, ']')) {
+        throw new SekretoError('sekreto: not a valid http(s) address: ' . safeaddr($addr));
+    }
+
+    if ('https://' === $scheme) {
+        return;
+    }
+
+    // A bracketed IPv6 literal keeps its brackets. Splitting the authority on
+    // the first colon yields '[', so `http://[::1]:8200` could never match -
+    // which made the '[::1]' entry below unreachable, and refused a
+    // legitimate local vault.
+    if (str_starts_with($authority, '[')) {
+        $host = substr($authority, 0, strpos($authority, ']') + 1);
+    } else {
+        $host = explode(':', $authority)[0];
+    }
+
+    if (in_array(strtolower($host), ['localhost', '127.0.0.1', '::1', '[::1]'], true)) {
+        return;
+    }
+
+    throw new SekretoError(
+        'sekreto: refusing to send a token in plaintext to ' . safeaddr($addr) . ' (use https)'
+    );
+}