@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Doppler.scala

@@ -0,0 +1,68 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Doppler.scala)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Doppler, as a voxgig/plugin definition.
+
+package com.voxgig.sekreto.plugins
+
+import scala.collection.immutable.ListMap
+
+import com.voxgig.sekreto.*
+import com.voxgig.sekreto.Providers.checkaddr
+
+/** Doppler.
+  *
+  * The whole config is downloaded once - Doppler's own bulk endpoint - and
+  * answered from memory, like a remote .env: `api.token` is the
+  * `API_TOKEN` entry. A service token is config-scoped, so project and
+  * config are only needed with broader tokens.
+  */
+class Doppler(
+    token: Option[String] = None,
+    project: Option[String] = None,
+    config: Option[String] = None,
+    addr: Option[String] = None,
+) extends Provider:
+
+  private var values: Option[Map[String, String]] = None
+
+  private def load(): Map[String, String] =
+    values match
+      case Some(loaded) => loaded
+      case None =>
+        val useaddr = trimslash(first(addr, Some("https://api.doppler.com")))
+        checkaddr(useaddr)
+
+        var url = s"$useaddr/v3/configs/config/secrets/download?format=json"
+        project.filter(_.nonEmpty).foreach(value => url += "&project=" + uriescape(value))
+        config.filter(_.nonEmpty).foreach(value => url += "&config=" + uriescape(value))
+
+        val res = fetchjson(
+          "GET",
+          url,
+          Map("authorization" -> s"Bearer ${token.getOrElse("")}"),
+        )
+
+        val body = res.body.asobj
+        if 200 != res.status || body.isEmpty then
+          throw SekretoError(s"sekreto: doppler error: ${res.status}")
+
+        var loaded = ListMap.empty[String, String]
+        for (key, value) <- body.get do value.text.foreach(text => loaded = loaded.updated(key, text))
+
+        values = Some(loaded)
+        loaded
+
+  override def lookup(name: String): Option[String] = load().get(envkey(name))
+
+  override def describe(): String =
+    "doppler" + (
+      if project.exists(_.nonEmpty) then s":${project.get}/${config.getOrElse("")}" else ""
+    )
+
+/** The `doppler` provider kind, as a voxgig/plugin definition. A consumer
+  * imports this and hands it to `Sekreto`; a consumer that does not gets a
+  * `Sekreto` that cannot build a chain entry of that kind.
+  */
+val doppler: Definition = providerplugin("doppler", spec =>
+  Doppler(spec.token, spec.project, spec.config, spec.addr))

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Gcpsecrets.scala

@@ -0,0 +1,97 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Gcpsecrets.scala)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// GCP Secret Manager, as a voxgig/plugin definition.
+
+package com.voxgig.sekreto.plugins
+
+import java.nio.charset.StandardCharsets
+import java.util.Base64
+
+import com.voxgig.sekreto.*
+import com.voxgig.sekreto.Providers.checkaddr
+
+/** GCP Secret Manager.
+  *
+  * `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+  * Manager ids have no hierarchy and reject dots), latest version. The
+  * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+  * GCE/GKE metadata server - so on Google's own platform no credential
+  * configuration is needed at all.
+  *
+  * The metadata call itself is plain http to a link-local host by platform
+  * design; no credential rides on it, so `checkaddr` guards the Secret
+  * Manager address instead.
+  */
+class Gcpsecrets(
+    project: Option[String] = None,
+    token: Option[String] = None,
+    addr: Option[String] = None,
+    metadataaddr: Option[String] = None,
+) extends Provider:
+
+  // A configured token is kept forever; a metadata-server token carries
+  // expires_in and is renewed shortly before it runs out.
+  private var livetoken: Option[String] = None
+  private var renewat: Long = Long.MaxValue
+
+  private def usemetadataaddr(): String =
+    metadataaddr.filter(_.nonEmpty) match
+      case Some(value) => value
+      case None =>
+        getenv("GCE_METADATA_HOST").filter(_.nonEmpty) match
+          case Some(host) => s"http://$host"
+          case None       => "http://metadata.google.internal"
+
+  private def login(): String =
+    val configured = first(token, getenv("GOOGLE_OAUTH_ACCESS_TOKEN"))
+    if configured.nonEmpty then configured
+    else
+      val url = trimslash(usemetadataaddr()) +
+        "/computeMetadata/v1/instance/service-accounts/default/token"
+
+      val res = fetchjson("GET", url, Map("Metadata-Flavor" -> "Google"))
+
+      val got = res.body.dig("access_token").text
+      if 200 != res.status || !got.exists(_.nonEmpty) then
+        throw SekretoError("sekreto: gcp: no token and metadata server did not answer")
+
+      renewat = renewtime(res.body.dig("expires_in"))
+
+      got.get
+
+  override def lookup(name: String): Option[String] =
+    val useproject = project.getOrElse("")
+    if useproject.isEmpty then throw SekretoError("sekreto: gcp: no project")
+
+    val useaddr = first(addr, Some("https://secretmanager.googleapis.com"))
+    checkaddr(useaddr)
+
+    if livetoken.isEmpty || System.currentTimeMillis >= renewat then livetoken = Some(login())
+
+    val url = trimslash(useaddr) + "/v1/projects/" + useproject + "/secrets/" +
+      flatname(name, "_") + "/versions/latest:access"
+
+    val res = fetchjson("GET", url, Map("authorization" -> s"Bearer ${livetoken.getOrElse("")}"))
+
+    if 404 == res.status then None
+    else if 200 != res.status then
+      throw SekretoError(s"sekreto: gcp error: ${res.status}: $url")
+    else
+      res.body.dig("payload", "data").asstr match
+        case None => None
+        // See the aws provider: an undecodable payload is a SekretoError.
+        case Some(data) =>
+          try Some(String(Base64.getDecoder.decode(data), StandardCharsets.UTF_8))
+          catch
+            case _: IllegalArgumentException =>
+              throw SekretoError("sekreto: gcp: undecodable secret")
+
+  override def describe(): String = s"gcpsecrets:${project.getOrElse("")}"
+
+/** The `gcpsecrets` provider kind, as a voxgig/plugin definition. A consumer
+  * imports this and hands it to `Sekreto`; a consumer that does not gets a
+  * `Sekreto` that cannot build a chain entry of that kind.
+  */
+val gcpsecrets: Definition = providerplugin("gcpsecrets", spec =>
+  Gcpsecrets(spec.project, spec.token, spec.addr, spec.metadataaddr))

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Hashicorp.scala

@@ -0,0 +1,131 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Hashicorp.scala)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// HashiCorp Vault, as a voxgig/plugin definition.
+
+package com.voxgig.sekreto.plugins
+
+import java.io.IOException
+import java.nio.charset.StandardCharsets
+import java.nio.file.Files
+import java.nio.file.Paths
+import scala.collection.immutable.ListMap
+
+import com.voxgig.sekreto.*
+import com.voxgig.sekreto.Providers.checkaddr
+
+/** HashiCorp Vault.
+  *
+  * KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api` and
+  * takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+  * `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means "not
+  * here" - a miss - so a vault can sit in a chain with fallbacks.
+  *
+  * A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+  * logins as well as reads.
+  *
+  * Instead of being handed a token, the provider can log in: Kubernetes
+  * auth (the pod's service-account JWT, from its conventional path) or
+  * AppRole. A failed login is an error, never a miss - it means this store
+  * could not answer at all.
+  */
+class Hashicorp(
+    addr: String,
+    token: Option[String] = None,
+    mountgiven: Option[String] = None,
+    kvgiven: Option[Int] = None,
+    vaultnamespace: Option[String] = None,
+    auth: Option[AuthSpec] = None,
+) extends Provider:
+
+  private val mount: String = mountgiven.filter(_.nonEmpty).getOrElse("secret")
+  private val kv: Int = kvgiven.getOrElse(2)
+
+  // The working token: a configured token is kept forever, a logged-in
+  // token is renewed shortly before its lease runs out - a long-running
+  // process must not keep presenting a token the vault already expired.
+  private var livetoken: Option[String] = token.filter(_.nonEmpty)
+  private var renewat: Long = Long.MaxValue
+
+  // A version typo like kv: 3 must not quietly behave as v2 and turn its
+  // 404s into misses; there is nothing safe to assume it meant.
+  if 1 != kv && 2 != kv then
+    throw SekretoError(s"sekreto: hashicorp: unsupported kv version: $kv")
+
+  private def baseheaders(): ListMap[String, String] =
+    vaultnamespace.filter(_.nonEmpty) match
+      case Some(value) => ListMap("X-Vault-Namespace" -> value)
+      case None        => ListMap.empty
+
+  private def login(): String =
+    val use = auth.getOrElse(
+      throw SekretoError("sekreto: hashicorp: no token and no auth method"),
+    )
+
+    val authmount = first(use.mount, Some(use.method))
+    val url = trimslash(addr) + "/v1/auth/" + authmount + "/login"
+
+    val body = use.method match
+      case "kubernetes" =>
+        val jwt = use.jwt.getOrElse:
+          val file = use.jwtfile.getOrElse("/var/run/secrets/kubernetes.io/serviceaccount/token")
+          try String(Files.readAllBytes(Paths.get(file)), StandardCharsets.UTF_8).trim
+          catch
+            case _: IOException =>
+              throw SekretoError(s"sekreto: hashicorp: cannot read jwt file $file")
+
+        Json.obj("role" -> Json.str(use.role.getOrElse("")), "jwt" -> Json.str(jwt))
+
+      case "approle" =>
+        Json.obj(
+          "role_id" -> Json.str(use.roleid.getOrElse("")),
+          "secret_id" -> Json.str(use.secretid.getOrElse("")),
+        )
+
+      case other => throw SekretoError(s"sekreto: hashicorp: unknown auth method: $other")
+
+    val res = fetchjson("POST", url, baseheaders(), Some(Json.stringify(body)))
+
+    val got = res.body.dig("auth", "client_token").text
+    if 200 != res.status || !got.exists(_.nonEmpty) then
+      throw SekretoError(s"sekreto: hashicorp login failed: ${res.status}: $url")
+
+    renewat = renewtime(res.body.dig("auth", "lease_duration"))
+
+    got.get
+
+  override def lookup(name: String): Option[String] =
+    checkaddr(addr)
+
+    if livetoken.isEmpty || System.currentTimeMillis >= renewat then livetoken = Some(login())
+
+    val ref = vaultref(name)
+    val base = trimslash(addr) + "/v1/" + mount
+    val url = if 1 == kv then s"$base/${ref.path}" else s"$base/data/${ref.path}"
+
+    val headers = baseheaders().updated("X-Vault-Token", livetoken.getOrElse(""))
+
+    val res = fetchjson("GET", url, headers)
+
+    if 404 == res.status then None
+    else if 200 != res.status then
+      throw SekretoError(s"sekreto: hashicorp error: ${res.status}: $url")
+    else
+      val data = if 1 == kv then res.body.dig("data") else res.body.dig("data", "data")
+      data.dig(ref.field).text
+
+  override def describe(): String = s"hashicorp:$addr/$mount"
+
+/** The `hashicorp` provider kind, as a voxgig/plugin definition. A consumer
+  * imports this and hands it to `Sekreto`; a consumer that does not gets a
+  * `Sekreto` that cannot build a chain entry of that kind.
+  */
+val hashicorp: Definition = providerplugin("hashicorp", spec =>
+  Hashicorp(
+    spec.addr.getOrElse(""),
+    spec.token,
+    spec.mount,
+    spec.kv,
+    spec.vaultnamespace,
+    spec.auth,
+  ))

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Httpjson.scala

@@ -0,0 +1,209 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Httpjson.scala)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The shared HTTP-JSON transport, and the child-process runner.
+//
+// PLUGIN-ONLY, and that is the point of the file. A socket, a TLS handshake
+// and a forked process are exactly what the core does not have, so the
+// bounded, redirect-refusing, one JSON round-trip helper every vault client
+// here is built on lives under `plugins/` with them. A chain of the four
+// built-in kinds never links it.
+//
+// A port of typescript/plugins/httpjson.ts, which is canonical.
+
+package com.voxgig.sekreto.plugins
+
+import java.io.ByteArrayOutputStream
+import java.io.IOException
+import java.io.InputStream
+import java.net.URI
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.nio.charset.StandardCharsets
+import java.time.Duration
+
+import com.voxgig.sekreto.*
+
+/** How long any single vault round-trip may take before it is treated as
+  * unreachable. Ports carry the same bound.
+  */
+private val TIMEOUT: Duration = Duration.ofSeconds(10)
+
+/** How much of a response body will be read before the store is treated as
+  * having answered incoherently. Ports carry the same bound.
+  *
+  * Far above anything real - the largest legitimate payload this library
+  * fetches is Doppler's whole-config download, measured in kilobytes. A
+  * bound is needed because the TIMEOUT is not one: ten seconds on a loopback
+  * or datacentre link is gigabytes, and the body is accumulated in memory
+  * before it is parsed. This runs on an application's startup path, so the
+  * failure is the application never starting.
+  */
+private val MAXBODY: Int = 8 * 1024 * 1024
+
+/** An environment variable, or None. */
+private[plugins] def getenv(name: String): Option[String] = Option(System.getenv(name))
+
+/** What a finished child process left behind. */
+private[plugins] case class Ran(out: String, why: String, status: Int)
+
+/** Run a child to completion and collect both its streams.
+  *
+  * The two streams are drained CONCURRENTLY. Reading stdout to EOF and only
+  * then reading stderr deadlocks the moment the child writes more than one
+  * pipe buffer (64 KiB on Linux) to stderr: the parent is blocked waiting
+  * for stdout, the child is blocked waiting for room on stderr, and neither
+  * can move. Nothing in this library sets a timeout, so that hang is
+  * permanent - `get()` simply never returns. secretspec's diagnostics are
+  * box-drawn and reach that size easily.
+  *
+  * The child's stdin is closed rather than left open on a pipe nobody writes
+  * to, so a CLI that reads it - one prompting for a passphrase when its
+  * environment variable is absent - sees EOF and gives up instead of waiting
+  * forever.
+  */
+private[plugins] def runcmd(builder: ProcessBuilder, command: String): Ran =
+  try
+    val process = builder.start()
+
+    process.getOutputStream.close()
+
+    val errbuf = ByteArrayOutputStream()
+
+    val pump: Runnable = () =>
+      try process.getErrorStream.transferTo(errbuf)
+      catch
+        // The child went away mid-write; waitFor reports how.
+        case _: IOException => ()
+
+    val drain = Thread(pump)
+    drain.setDaemon(true)
+    drain.start()
+
+    val out = String(process.getInputStream.readAllBytes, StandardCharsets.UTF_8)
+    val status = process.waitFor()
+    drain.join()
+
+    Ran(out, String(errbuf.toByteArray, StandardCharsets.UTF_8).trim, status)
+  catch
+    case err: IOException =>
+      throw SekretoError(s"sekreto: cannot run $command: ${err.getMessage}")
+    case err: InterruptedException =>
+      Thread.currentThread.interrupt()
+      throw SekretoError(s"sekreto: interrupted running $command")
+
+// HTTP/1.1, explicitly.
+//
+// java.net.http defaults to HTTP_2, and over cleartext that means an h2c
+// upgrade: the first request goes out with `Upgrade: h2c`, the declared
+// Content-Length, and NO BODY, and the body follows only after the server
+// declines. A server that checks the two against each other - Fastify does,
+// and Infisical is Fastify - rejects that request outright with "Request
+// body size did not match Content-Length", so every POST this port makes to
+// such a server fails before it is even read.
+//
+// The mocks in test/ are Node's own http module, which does not object,
+// which is why this survived until the same code met a real Infisical. No
+// vault API this library speaks needs HTTP/2.
+//
+// Redirects are never followed: a vault API does not legitimately redirect,
+// and a followed redirect would carry X-Vault-Token to the redirect's host
+// (and could downgrade https to http), which checkaddr - it only validates
+// the configured address - cannot see.
+private val CLIENT: HttpClient = HttpClient
+  .newBuilder()
+  .version(HttpClient.Version.HTTP_1_1)
+  .followRedirects(HttpClient.Redirect.NEVER)
+  .connectTimeout(TIMEOUT)
+  .build()
+
+/** One JSON round-trip's result: the status, and the parsed body. */
+private[plugins] case class Answer(status: Int, body: Option[Json])
+
+/** One JSON round-trip. Network failure is always an error - an unreachable
+  * store is a store that could not answer.
+  */
+private[plugins] def fetchjson(
+    method: String,
+    url: String,
+    headers: Map[String, String] = Map.empty,
+    body: Option[String] = None,
+): Answer =
+  val builder = HttpRequest
+    .newBuilder()
+    .uri(URI.create(url))
+    .timeout(TIMEOUT)
+    .method(
+      method,
+      body match
+        case None       => HttpRequest.BodyPublishers.noBody()
+        case Some(text) => HttpRequest.BodyPublishers.ofString(text, StandardCharsets.UTF_8),
+    )
+
+  for (key, value) <- headers do builder.header(key, value)
+
+  // ofInputStream, not ofString: ofString buffers whatever arrives, so an
+  // endless body would be accumulated in memory until the deadline - which
+  // on a loopback or datacentre link is gigabytes.
+  val response: HttpResponse[InputStream] =
+    try CLIENT.send(builder.build(), HttpResponse.BodyHandlers.ofInputStream())
+    catch
+      // A refused connection arrives with a null message, so the class name
+      // stands in - "cannot reach ...: null" says nothing at all.
+      case err: IOException =>
+        throw SekretoError(s"sekreto: cannot reach ${bare(url)}: ${why(err)}")
+      case err: InterruptedException =>
+        Thread.currentThread.interrupt()
+        throw SekretoError(s"sekreto: cannot reach ${bare(url)}: interrupted")
+
+  // A success status promised JSON; a body that does not parse means the
+  // store could not answer coherently, and treating it as a miss would fall
+  // through to a weaker store. Error statuses may carry any body - they are
+  // decided on status alone.
+  // One byte over the bound is enough to know it was exceeded. An endless
+  // body is a store that could not answer, so this raises rather than
+  // returning a miss - the latter would fall through to a weaker store on an
+  // attacker's cue.
+  val stream = response.body()
+  val text =
+    try
+      val raw = stream.readNBytes(MAXBODY + 1)
+      if MAXBODY < raw.length then
+        throw SekretoError(s"sekreto: oversized response from ${bare(url)}")
+      String(raw, StandardCharsets.UTF_8)
+    catch
+      case err: IOException =>
+        throw SekretoError(s"sekreto: cannot reach ${bare(url)}: ${why(err)}")
+    finally stream.close()
+
+  val parsed = Json.parse(text)
+  if 200 == response.statusCode() && parsed.isEmpty then
+    throw SekretoError(s"sekreto: malformed response from ${bare(url)}")
+
+  Answer(response.statusCode(), parsed)
+
+/** What an exception has to say for itself, never the empty string. */
+private def why(err: Throwable): String = Option(err.getMessage).getOrElse(err.toString)
+
+/** A URL without its query string, for a message that must not leak one. */
+private[plugins] def bare(url: String): String = url.takeWhile(_ != '?')
+
+/** The first candidate that is set and non-empty, or empty. */
+private[plugins] def first(candidates: Option[String]*): String =
+  candidates.iterator.flatten.find(_.nonEmpty).getOrElse("")
+
+private[plugins] def trimslash(text: String): String = dropsuffix(text, "/")
+
+/** When a logged-in token must be renewed, from its expiry in seconds (a
+  * JSON number, or a string as Azure IMDS sends it): now + max(seconds - 60,
+  * 1). A missing or zero expiry means never renew.
+  */
+private[plugins] def renewtime(expires: Option[Json]): Long =
+  val seconds = expires match
+    case Some(Json.Num(value)) => value
+    case Some(Json.Str(value)) => value.toDoubleOption.getOrElse(0.0)
+    case _                     => 0.0
+
+  if seconds.isNaN || 0 >= seconds then Long.MaxValue
+  else System.currentTimeMillis + (math.max(seconds - 60, 1.0) * 1000).toLong

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Infisical.scala

@@ -0,0 +1,98 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Infisical.scala)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Infisical, as a voxgig/plugin definition.
+
+package com.voxgig.sekreto.plugins
+
+import com.voxgig.sekreto.*
+import com.voxgig.sekreto.Providers.checkaddr
+
+/** Infisical.
+  *
+  * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+  * convention is environment-style keys) at a secret path in one
+  * environment of a project. Auth is a token, or a universal-auth (machine
+  * identity) login with clientid/clientsecret.
+  */
+class Infisical(
+    addr: Option[String] = None,
+    token: Option[String] = None,
+    clientid: Option[String] = None,
+    clientsecret: Option[String] = None,
+    project: Option[String] = None,
+    environment: Option[String] = None,
+    path: Option[String] = None,
+) extends Provider:
+
+  // A configured token is kept forever; a universal-auth token carries
+  // expiresIn and is renewed shortly before it runs out.
+  private var livetoken: Option[String] = None
+  private var renewat: Long = Long.MaxValue
+
+  private def login(useaddr: String): String =
+    if token.exists(_.nonEmpty) then token.get
+    else
+      if !clientid.exists(_.nonEmpty) || !clientsecret.exists(_.nonEmpty) then
+        throw SekretoError("sekreto: infisical: no token and no client credentials")
+
+      val body = Json.obj(
+        "clientId" -> Json.str(clientid.get),
+        "clientSecret" -> Json.str(clientsecret.get),
+      )
+
+      val res = fetchjson(
+        "POST",
+        s"$useaddr/api/v1/auth/universal-auth/login",
+        Map("content-type" -> "application/json"),
+        Some(Json.stringify(body)),
+      )
+
+      val got = res.body.dig("accessToken").text
+      if 200 != res.status || !got.exists(_.nonEmpty) then
+        throw SekretoError(s"sekreto: infisical login failed: ${res.status}")
+
+      renewat = renewtime(res.body.dig("expiresIn"))
+
+      got.get
+
+  override def lookup(name: String): Option[String] =
+    val useaddr = trimslash(first(addr, Some("https://app.infisical.com")))
+    checkaddr(useaddr)
+
+    val useproject = project.getOrElse("")
+    val useenvironment = environment.getOrElse("")
+    if useproject.isEmpty || useenvironment.isEmpty then
+      throw SekretoError("sekreto: infisical: no project/environment")
+
+    if livetoken.isEmpty || System.currentTimeMillis >= renewat then
+      livetoken = Some(login(useaddr))
+
+    val url = s"$useaddr/api/v3/secrets/raw/" + envkey(name) +
+      "?workspaceId=" + uriescape(useproject) +
+      "&environment=" + uriescape(useenvironment) +
+      "&secretPath=" + uriescape(first(path, Some("/")))
+
+    val res = fetchjson("GET", url, Map("authorization" -> s"Bearer ${livetoken.getOrElse("")}"))
+
+    if 404 == res.status then None
+    else if 200 != res.status then throw SekretoError(s"sekreto: infisical error: ${res.status}")
+    else res.body.dig("secret", "secretValue").text
+
+  override def describe(): String =
+    s"infisical:${project.getOrElse("")}/${environment.getOrElse("")}"
+
+/** The `infisical` provider kind, as a voxgig/plugin definition. A consumer
+  * imports this and hands it to `Sekreto`; a consumer that does not gets a
+  * `Sekreto` that cannot build a chain entry of that kind.
+  */
+val infisical: Definition = providerplugin("infisical", spec =>
+  Infisical(
+    spec.addr,
+    spec.token,
+    spec.clientid,
+    spec.clientsecret,
+    spec.project,
+    spec.environment,
+    spec.path,
+  ))