@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Boru.java

@@ -0,0 +1,161 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Boru.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// A boru vault, as a voxgig/plugin definition.
+//
+// A PLUGIN, NOT PART OF THE CORE: it spawns a process, or opens a
+// socket, and the core reads at most a local file. A chain that does not
+// name this kind must not carry it, so the calling project imports this
+// definition and hands it to Sekreto in the `plugins` option.
+// See docs/design/plugin-providers.md.
+
+package JAVAPACKAGE.feature.secrets.sekreto.plugins;
+
+import static JAVAPACKAGE.feature.secrets.sekreto.Addr.checkaddr;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.dig;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.fetchjson;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.headers;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.trimslash;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Proc.runcmd;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Provider;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import JAVAPACKAGE.feature.secrets.sekreto.Support;
+import JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.Answer;
+import JAVAPACKAGE.feature.secrets.sekreto.plugins.Proc.Ran;
+import java.util.Map;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+
+/**
+ * A boru vault (https://github.com/boru-lang/boru).
+ *
+ * <p>Two ways in, both boru's own.
+ *
+ * <p>With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+ * secret on stdout and nothing else. The passphrase is read by boru itself
+ * from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as config and
+ * never puts it on a command line, where it would show up in the process
+ * table.
+ *
+ * <p>With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+ * read-only, HashiCorp-shaped provision API (boru's
+ * design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+ * from `boru vault grant`. A sekreto name is already a valid boru alias,
+ * and boru aliases keep their dots, so `api.token` is the single path
+ * segment `api.token` - not the `api`/`token` split a HashiCorp KV gets.
+ * The value is the `value` field. A 404 is a miss; anything else the
+ * server refuses (a revoked capability, a sealed vault) is an error.
+ *
+ * <p>boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+ * credential *broker*, built precisely so the caller never receives the
+ * credential. `vault serve` is the provision endpoint, built to hand the
+ * value back - that is the one sekreto uses.
+ */
+public final class Boru implements Provider {
+
+  /** The `boru` kind: what `plugins` hands to Sekreto. */
+  public static final Definition PLUGIN = Support.providerplugin("boru", spec ->
+      new Boru(
+          Support.text(spec.get("command")), Support.text(spec.get("namespace")),
+          Support.text(spec.get("home")), Support.text(spec.get("addr")),
+          Support.text(spec.get("token")), Support.text(spec.get("mount"))));
+  private final String command;
+  private final String namespace;
+  private final String home;
+  private final String addr;
+  private final String token;
+  private final String mount;
+
+  public Boru(String command, String namespace, String home) {
+    this(command, namespace, home, null, null, null);
+  }
+
+  public Boru(String command, String namespace, String home,
+      String addr, String token, String mount) {
+    this.command = null == command || command.isEmpty() ? "boru" : command;
+    this.namespace = namespace;
+    this.home = home;
+    this.addr = null == addr ? "" : trimslash(addr);
+    this.token = null == token ? "" : token;
+    this.mount = null == mount || mount.isEmpty() ? "secret" : mount;
+  }
+
+  @Override
+  public String lookup(String name) {
+    Sekreto.checkname(name);
+
+    if (!addr.isEmpty()) {
+      return wirelookup(name);
+    }
+
+    String alias = null == namespace || namespace.isEmpty() ? name : namespace + ":" + name;
+
+    ProcessBuilder builder =
+        new ProcessBuilder(command, "vault", "get", "--reveal", alias);
+
+    if (null != home && !home.isEmpty()) {
+      builder.environment().put("BORU_HOME", home);
+    }
+
+    Ran ran = runcmd(builder, command);
+    String out = ran.out;
+    String why = ran.why;
+    int status = ran.status;
+
+    if (0 == status) {
+      // boru prints the value and one newline, and nothing else.
+      return out.endsWith("\n") ? out.substring(0, out.length() - 1) : out;
+    }
+
+    // "no alias named" is boru saying it does not hold this secret, which is
+    // a miss: the chain carries on to the next provider. A locked vault or a
+    // wrong passphrase is not a miss - treating it as one would fall through
+    // to a weaker store without saying so.
+    if (borumiss(why)) {
+      return null;
+    }
+
+    throw new SekretoError(
+        "sekreto: boru vault error: " + (why.isEmpty() ? "exit " + status : why));
+  }
+
+  @SuppressWarnings("unchecked")
+  private String wirelookup(String name) {
+    checkaddr(addr);
+
+    // The dotted name stays one path segment: boru aliases keep their dots.
+    String alias = null == namespace || namespace.isEmpty() ? name : namespace + "/" + name;
+    String url = addr + "/v1/" + mount + "/data/" + alias;
+
+    Answer res = fetchjson("GET", url, headers("X-Vault-Token", token), null);
+
+    if (404 == res.status) {
+      return null;
+    }
+
+    if (200 != res.status) {
+      throw new SekretoError("sekreto: boru serve error: " + res.status + ": " + url);
+    }
+
+    Object data = dig(res.body, "data", "data");
+    Object value = data instanceof Map ? ((Map<String, Object>) data).get("value") : null;
+    return null == value ? null : String.valueOf(value);
+  }
+
+  @Override
+  public String describe() {
+    if (!addr.isEmpty()) {
+      return "boru:" + addr;
+    }
+    return "boru" + (null == namespace || namespace.isEmpty() ? "" : ":" + namespace);
+  }
+
+  /**
+   * Does this boru failure mean "no such secret" rather than "I could not
+   * answer"? Matched on boru's own wording for a missing alias.
+   */
+  static boolean borumiss(String why) {
+    return why.contains("no alias named");
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Doppler.java

@@ -0,0 +1,103 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Doppler.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Doppler, as a voxgig/plugin definition.
+//
+// A PLUGIN, NOT PART OF THE CORE: it opens a socket, and the core reads
+// at most a local file. A chain that does not name this kind must not
+// carry it, so the calling project imports this definition and hands it
+// to Sekreto in the `plugins` option.
+// See docs/design/plugin-providers.md.
+
+package JAVAPACKAGE.feature.secrets.sekreto.plugins;
+
+import static JAVAPACKAGE.feature.secrets.sekreto.Addr.checkaddr;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.fetchjson;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.first;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.headers;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.trimslash;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Provider;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import JAVAPACKAGE.feature.secrets.sekreto.Support;
+import JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.Answer;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+
+/**
+ * Doppler.
+ *
+ * <p>The whole config is downloaded once - Doppler's own bulk endpoint -
+ * and answered from memory, like a remote .env: `api.token` is the
+ * `API_TOKEN` entry. A service token is config-scoped, so project and
+ * config are only needed with broader tokens.
+ */
+public final class Doppler implements Provider {
+
+  /** The `doppler` kind: what `plugins` hands to Sekreto. */
+  public static final Definition PLUGIN = Support.providerplugin("doppler", spec ->
+      new Doppler(
+          Support.text(spec.get("token")), Support.text(spec.get("project")),
+          Support.text(spec.get("config")), Support.text(spec.get("addr"))));
+  private final String token;
+  private final String project;
+  private final String config;
+  private final String addr;
+
+  private Map<String, String> values;
+
+  public Doppler(String token, String project, String config, String addr) {
+    this.token = token;
+    this.project = project;
+    this.config = config;
+    this.addr = addr;
+  }
+
+  @SuppressWarnings("unchecked")
+  private Map<String, String> load() {
+    if (null != values) {
+      return values;
+    }
+
+    String useaddr = trimslash(first(addr, "https://api.doppler.com"));
+    checkaddr(useaddr);
+
+    String url = useaddr + "/v3/configs/config/secrets/download?format=json";
+    if (null != project && !project.isEmpty()) {
+      url += "&project=" + Sigv4.uriescape(project);
+    }
+    if (null != config && !config.isEmpty()) {
+      url += "&config=" + Sigv4.uriescape(config);
+    }
+
+    Answer res = fetchjson(
+        "GET", url, headers("authorization", "Bearer " + (null == token ? "" : token)), null);
+
+    if (200 != res.status || !(res.body instanceof Map)) {
+      throw new SekretoError("sekreto: doppler error: " + res.status);
+    }
+
+    values = new LinkedHashMap<>();
+    for (Map.Entry<String, Object> entry : ((Map<String, Object>) res.body).entrySet()) {
+      if (null != entry.getValue()) {
+        values.put(entry.getKey(), String.valueOf(entry.getValue()));
+      }
+    }
+
+    return values;
+  }
+
+  @Override
+  public String lookup(String name) {
+    return load().get(Sekreto.envkey(name, null));
+  }
+
+  @Override
+  public String describe() {
+    return "doppler"
+        + (null == project || project.isEmpty()
+            ? "" : ":" + project + "/" + (null == config ? "" : config));
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Gcpsecrets.java

@@ -0,0 +1,143 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Gcpsecrets.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// GCP Secret Manager, as a voxgig/plugin definition.
+//
+// A PLUGIN, NOT PART OF THE CORE: it opens a socket, and the core reads
+// at most a local file. A chain that does not name this kind must not
+// carry it, so the calling project imports this definition and hands it
+// to Sekreto in the `plugins` option.
+// See docs/design/plugin-providers.md.
+
+package JAVAPACKAGE.feature.secrets.sekreto.plugins;
+
+import static JAVAPACKAGE.feature.secrets.sekreto.Addr.checkaddr;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.dig;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.fetchjson;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.first;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.headers;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.renewtime;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.trimslash;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Provider;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import JAVAPACKAGE.feature.secrets.sekreto.Support;
+import JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.Answer;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+
+/**
+ * GCP Secret Manager.
+ *
+ * <p>`api.token` reads secret `api_token` (dots flattened to `_`; Secret
+ * Manager ids have no hierarchy and reject dots), latest version. The
+ * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+ * GCE/GKE metadata server - so on Google's own platform no credential
+ * configuration is needed at all.
+ *
+ * <p>The metadata call itself is plain http to a link-local host by
+ * platform design; no credential rides on it, so `checkaddr` guards the
+ * Secret Manager address instead.
+ */
+public final class Gcpsecrets implements Provider {
+
+  /** The `gcpsecrets` kind: what `plugins` hands to Sekreto. */
+  public static final Definition PLUGIN = Support.providerplugin("gcpsecrets", spec ->
+      new Gcpsecrets(
+          Support.text(spec.get("project")), Support.text(spec.get("token")),
+          Support.text(spec.get("addr")), Support.text(spec.get("metadataaddr"))));
+  private final String project;
+  private final String token;
+  private final String addr;
+  private final String metadataaddr;
+
+  // A configured token is kept forever; a metadata-server token carries
+  // expires_in and is renewed shortly before it runs out.
+  private String livetoken;
+  private long renewat = Long.MAX_VALUE;
+
+  public Gcpsecrets(String project, String token, String addr, String metadataaddr) {
+    this.project = project;
+    this.token = token;
+    this.addr = addr;
+    this.metadataaddr = metadataaddr;
+  }
+
+  private String usemetadataaddr() {
+    if (null != metadataaddr && !metadataaddr.isEmpty()) {
+      return metadataaddr;
+    }
+    String host = System.getenv("GCE_METADATA_HOST");
+    return null == host || host.isEmpty()
+        ? "http://metadata.google.internal" : "http://" + host;
+  }
+
+  private String login() {
+    String configured = first(token, System.getenv("GOOGLE_OAUTH_ACCESS_TOKEN"));
+    if (!configured.isEmpty()) {
+      return configured;
+    }
+
+    String url = trimslash(usemetadataaddr())
+        + "/computeMetadata/v1/instance/service-accounts/default/token";
+
+    Answer res = fetchjson("GET", url, headers("Metadata-Flavor", "Google"), null);
+
+    Object got = dig(res.body, "access_token");
+    if (200 != res.status || null == got || String.valueOf(got).isEmpty()) {
+      throw new SekretoError("sekreto: gcp: no token and metadata server did not answer");
+    }
+
+    renewat = renewtime(dig(res.body, "expires_in"));
+
+    return String.valueOf(got);
+  }
+
+  @Override
+  public String lookup(String name) {
+    String useproject = null == project ? "" : project;
+    if (useproject.isEmpty()) {
+      throw new SekretoError("sekreto: gcp: no project");
+    }
+
+    String useaddr = first(addr, "https://secretmanager.googleapis.com");
+    checkaddr(useaddr);
+
+    if (null == livetoken || System.currentTimeMillis() >= renewat) {
+      livetoken = login();
+    }
+
+    String url = trimslash(useaddr) + "/v1/projects/" + useproject + "/secrets/"
+        + Sekreto.flatname(name, "_") + "/versions/latest:access";
+
+    Answer res = fetchjson("GET", url, headers("authorization", "Bearer " + livetoken), null);
+
+    if (404 == res.status) {
+      return null;
+    }
+
+    if (200 != res.status) {
+      throw new SekretoError("sekreto: gcp error: " + res.status + ": " + url);
+    }
+
+    Object data = dig(res.body, "payload", "data");
+    if (!(data instanceof String)) {
+      return null;
+    }
+
+    // See the aws provider: an undecodable payload is a SekretoError.
+    try {
+      return new String(
+          Base64.getDecoder().decode((String) data), StandardCharsets.UTF_8);
+    } catch (IllegalArgumentException err) {
+      throw new SekretoError("sekreto: gcp: undecodable secret");
+    }
+  }
+
+  @Override
+  public String describe() {
+    return "gcpsecrets:" + (null == project ? "" : project);
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Hashicorp.java

@@ -0,0 +1,186 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Hashicorp.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// HashiCorp Vault, as a voxgig/plugin definition.
+//
+// A PLUGIN, NOT PART OF THE CORE: it opens a socket, and the core reads
+// at most a local file. A chain that does not name this kind must not
+// carry it, so the calling project imports this definition and hands it
+// to Sekreto in the `plugins` option.
+// See docs/design/plugin-providers.md.
+
+package JAVAPACKAGE.feature.secrets.sekreto.plugins;
+
+import static JAVAPACKAGE.feature.secrets.sekreto.Addr.checkaddr;
+import static JAVAPACKAGE.feature.secrets.sekreto.Support.text;
+import static JAVAPACKAGE.feature.secrets.sekreto.Support.textor;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.dig;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.fetchjson;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.first;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.renewtime;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.trimslash;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Json;
+import JAVAPACKAGE.feature.secrets.sekreto.Provider;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import JAVAPACKAGE.feature.secrets.sekreto.Support;
+import JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.Answer;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+
+/**
+ * HashiCorp Vault.
+ *
+ * <p>KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
+ * and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+ * `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means "not
+ * here" - a miss - so a vault can sit in a chain with fallbacks.
+ *
+ * <p>A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+ * logins as well as reads.
+ *
+ * <p>Instead of being handed a token, the provider can log in: Kubernetes
+ * auth (the pod's service-account JWT, from its conventional path) or
+ * AppRole. A failed login is an error, never a miss - it means this store
+ * could not answer at all.
+ */
+public final class Hashicorp implements Provider {
+
+  /** The `hashicorp` kind: what `plugins` hands to Sekreto. */
+  public static final Definition PLUGIN = Support.providerplugin("hashicorp", spec -> {
+    Object kv = spec.get("kv");
+    return new Hashicorp(
+        Support.textor(spec.get("addr"), ""),
+        Support.textor(spec.get("token"), ""),
+        Support.text(spec.get("mount")),
+        kv instanceof Number ? ((Number) kv).intValue() : 0,
+        Support.text(spec.get("vaultnamespace")),
+        Support.map(spec.get("auth")));
+  });
+  private final String addr;
+  private final String mount;
+  private final int kv;
+  private final String vaultnamespace;
+  private final Map<String, Object> auth;
+
+  // The working token: a configured token is kept forever, a logged-in
+  // token is renewed shortly before its lease runs out - a long-running
+  // process must not keep presenting a token the vault already expired.
+  private String livetoken;
+  private long renewat = Long.MAX_VALUE;
+
+  public Hashicorp(String addr, String token, String mount) {
+    this(addr, token, mount, 0, null, null);
+  }
+
+  public Hashicorp(String addr, String token, String mount, int kv,
+      String vaultnamespace, Map<String, Object> auth) {
+    this.addr = null == addr ? "" : addr;
+    this.mount = null == mount || mount.isEmpty() ? "secret" : mount;
+    this.kv = 0 == kv ? 2 : kv;
+
+    // A version typo like kv: 3 must not quietly behave as v2 and turn
+    // its 404s into misses; there is nothing safe to assume it meant.
+    if (1 != this.kv && 2 != this.kv) {
+      throw new SekretoError("sekreto: hashicorp: unsupported kv version: " + this.kv);
+    }
+
+    this.vaultnamespace = vaultnamespace;
+    this.auth = auth;
+    this.livetoken = null == token || token.isEmpty() ? null : token;
+  }
+
+  private Map<String, String> baseheaders() {
+    Map<String, String> out = new LinkedHashMap<>();
+    if (null != vaultnamespace && !vaultnamespace.isEmpty()) {
+      out.put("X-Vault-Namespace", vaultnamespace);
+    }
+    return out;
+  }
+
+  private String login() {
+    if (null == auth) {
+      throw new SekretoError("sekreto: hashicorp: no token and no auth method");
+    }
+
+    String method = text(auth.get("method"));
+    String authmount = first(text(auth.get("mount")), null == method ? "" : method);
+    String url = trimslash(addr) + "/v1/auth/" + authmount + "/login";
+
+    Map<String, Object> body = new LinkedHashMap<>();
+    if ("kubernetes".equals(method)) {
+      String jwt = text(auth.get("jwt"));
+      if (null == jwt) {
+        String file = textor(
+            auth.get("jwtfile"), "/var/run/secrets/kubernetes.io/serviceaccount/token");
+        try {
+          jwt = new String(Files.readAllBytes(Paths.get(file)), StandardCharsets.UTF_8).trim();
+        } catch (IOException err) {
+          throw new SekretoError("sekreto: hashicorp: cannot read jwt file " + file);
+        }
+      }
+      body.put("role", textor(auth.get("role"), ""));
+      body.put("jwt", jwt);
+    } else if ("approle".equals(method)) {
+      body.put("role_id", textor(auth.get("roleid"), ""));
+      body.put("secret_id", textor(auth.get("secretid"), ""));
+    } else {
+      throw new SekretoError(
+          "sekreto: hashicorp: unknown auth method: " + (null == method ? "" : method));
+    }
+
+    Answer res = fetchjson("POST", url, baseheaders(), Json.stringify(body));
+
+    Object got = dig(res.body, "auth", "client_token");
+    if (200 != res.status || null == got || String.valueOf(got).isEmpty()) {
+      throw new SekretoError("sekreto: hashicorp login failed: " + res.status + ": " + url);
+    }
+
+    renewat = renewtime(dig(res.body, "auth", "lease_duration"));
+
+    return String.valueOf(got);
+  }
+
+  @Override
+  @SuppressWarnings("unchecked")
+  public String lookup(String name) {
+    checkaddr(addr);
+
+    if (null == livetoken || System.currentTimeMillis() >= renewat) {
+      livetoken = login();
+    }
+
+    Map<String, Object> ref = Sekreto.vaultref(name);
+    String base = trimslash(addr) + "/v1/" + mount;
+    String url = 1 == kv ? base + "/" + ref.get("path") : base + "/data/" + ref.get("path");
+
+    Map<String, String> requestheaders = baseheaders();
+    requestheaders.put("X-Vault-Token", livetoken);
+
+    Answer res = fetchjson("GET", url, requestheaders, null);
+
+    if (404 == res.status) {
+      return null;
+    }
+
+    if (200 != res.status) {
+      throw new SekretoError("sekreto: hashicorp error: " + res.status + ": " + url);
+    }
+
+    Object data = 1 == kv ? dig(res.body, "data") : dig(res.body, "data", "data");
+
+    Object value = data instanceof Map ? ((Map<String, Object>) data).get(ref.get("field")) : null;
+    return null == value ? null : String.valueOf(value);
+  }
+
+  @Override
+  public String describe() {
+    return "hashicorp:" + addr + "/" + mount;
+  }
+}