@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Gcpsecrets.pm

@@ -0,0 +1,138 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Gcpsecrets.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Gcpsecrets;
+
+# The gcpsecrets plugin: GCP Secret Manager over its REST API.
+#
+# NOT IN THE CORE. A `Sekreto` can build this kind only if the calling
+# project passed this definition in through the `plugins` option; the
+# core loads nothing under `plugins/` (docs/design/plugin-providers.md).
+#
+# A port of typescript/plugins/gcpsecrets.ts, which is canonical.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use Voxgig::Sekreto ();
+use Voxgig::Sekreto::Providers qw(providerplugin);
+use Voxgig::Sekreto::Addr ();
+use Voxgig::Sekreto::Plugins::Httpjson ();
+
+our @EXPORT_OK = qw(gcpsecrets);
+
+# GCP Secret Manager.
+#
+# `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+# Manager ids have no hierarchy and reject dots), latest version. The
+# token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+# GCE/GKE metadata server - so on Google's own platform no credential
+# configuration is needed at all.
+#
+# The metadata call itself is plain http to a link-local host by platform
+# design; no credential rides on it, so `checkaddr` guards the Secret
+# Manager address instead.
+{
+
+    package Voxgig::Sekreto::Plugins::Gcpsecrets::Provider;
+
+    # A configured token is kept forever; a metadata-server token carries
+    # expires_in and is renewed shortly before it runs out.
+    sub new {
+        my ( $class, $opts ) = @_;
+        return bless { opts => $opts || {}, livetoken => undef, renewat => undef }, $class;
+    }
+
+    sub metadataaddr {
+        my ($self) = @_;
+        return $self->{opts}{metadataaddr} if $self->{opts}{metadataaddr};
+        my $host = $ENV{GCE_METADATA_HOST};
+        return $host ? 'http://' . $host : 'http://metadata.google.internal';
+    }
+
+    sub login {
+        my ($self) = @_;
+
+        my $configured = $self->{opts}{token} || $ENV{GOOGLE_OAUTH_ACCESS_TOKEN};
+        return $configured if $configured;
+
+        ( my $base = $self->metadataaddr() ) =~ s{/$}{};
+        my $url = $base . '/computeMetadata/v1/instance/service-accounts/default/token';
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $url,
+            { 'Metadata-Flavor' => 'Google' } );
+
+        my $got = 'HASH' eq ref( $body || '' ) ? $body->{access_token} : undef;
+
+        Voxgig::Sekreto::fail(
+            'sekreto: gcp: no token and metadata server did not answer')
+          if 200 != $status || !$got;
+
+        $self->{renewat} = Voxgig::Sekreto::Plugins::Httpjson::renewafter( $body->{expires_in} );
+
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($got);
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+
+        my $project = $self->{opts}{project} || '';
+        Voxgig::Sekreto::fail('sekreto: gcp: no project') if '' eq $project;
+
+        my $addr = $self->{opts}{addr} || 'https://secretmanager.googleapis.com';
+        Voxgig::Sekreto::Addr::checkaddr($addr);
+
+        $self->{livetoken} = $self->login()
+          if !defined $self->{livetoken}
+          || Voxgig::Sekreto::Plugins::Httpjson::renewdue( $self->{renewat} );
+
+        ( my $base = $addr ) =~ s{/$}{};
+        my $url =
+            $base
+          . '/v1/projects/'
+          . $project
+          . '/secrets/'
+          . Voxgig::Sekreto::flatname( $name, '_' )
+          . '/versions/latest:access';
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $url,
+            { 'authorization' => 'Bearer ' . $self->{livetoken} } );
+
+        return undef if 404 == $status;
+
+        Voxgig::Sekreto::fail( 'sekreto: gcp error: ' . $status . ': ' . $url )
+          if 200 != $status;
+
+        my $data =
+          ( 'HASH' eq ref( $body || '' ) && 'HASH' eq ref( $body->{payload} || '' ) )
+          ? $body->{payload}{data}
+          : undef;
+
+        return undef if !defined $data || ref($data);
+
+        # See the aws provider: an undecodable payload is an error, not a
+        # miss.
+        my $decoded = Voxgig::Sekreto::Plugins::Httpjson::unbase64($data);
+
+        Voxgig::Sekreto::fail('sekreto: gcp: undecodable secret')
+          if !defined $decoded;
+
+        return $decoded;
+    }
+
+    sub describe {
+        my ($self) = @_;
+        return 'gcpsecrets:' . ( $self->{opts}{project} || '' );
+    }
+}
+
+
+# The plugin: the `gcpsecrets` provider kind, as a voxgig/plugin definition.
+sub gcpsecrets {
+    return providerplugin( 'gcpsecrets',
+        sub { Voxgig::Sekreto::Plugins::Gcpsecrets::Provider->new( $_[0] ) } );
+}
+
+1;

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Hashicorp.pm

@@ -0,0 +1,213 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Hashicorp.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Hashicorp;
+
+# The hashicorp plugin: HashiCorp Vault over its HTTP API.
+#
+# NOT IN THE CORE. A `Sekreto` can build this kind only if the calling
+# project passed this definition in through the `plugins` option; the
+# core loads nothing under `plugins/` (docs/design/plugin-providers.md).
+#
+# A port of typescript/plugins/hashicorp.ts, which is canonical.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use JSON::PP ();
+
+use Voxgig::Sekreto ();
+use Voxgig::Sekreto::Providers qw(providerplugin);
+use Voxgig::Sekreto::Addr ();
+use Voxgig::Sekreto::Plugins::Httpjson ();
+
+our @EXPORT_OK = qw(hashicorp);
+
+# HashiCorp Vault.
+#
+# KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api` and
+# takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+# `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means "not
+# here" - a miss - so a vault can sit in a chain with fallbacks.
+#
+# A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+# logins as well as reads.
+#
+# Instead of being handed a token, the provider can log in: Kubernetes
+# auth (the pod's service-account JWT, from its conventional path) or
+# AppRole. A failed login is an error, never a miss - it means this store
+# could not answer at all.
+{
+
+    package Voxgig::Sekreto::Plugins::Hashicorp::Provider;
+
+    sub new {
+        my ( $class, $addr, $token, $options ) = @_;
+
+        my $opts = $options || {};
+        my $usetoken = defined $token ? $token : '';
+        my $kv = $opts->{kv} || 2;
+
+        # A version typo like kv: 3 must not quietly behave as v2 and turn
+        # its 404s into misses; there is nothing safe to assume it meant.
+        Voxgig::Sekreto::fail(
+            'sekreto: hashicorp: unsupported kv version: ' . $kv )
+          if 1 != $kv && 2 != $kv;
+
+        return bless {
+            addr           => defined $addr ? $addr : '',
+            mount          => $opts->{mount} || 'secret',
+            kv             => $kv,
+            vaultnamespace => $opts->{vaultnamespace},
+            auth           => $opts->{auth},
+
+            # The working token: a configured token is kept forever, a
+            # logged-in token is renewed shortly before its lease runs
+            # out - a long-running process must not keep presenting a
+            # token the vault already expired.
+            livetoken => '' eq $usetoken ? undef : $usetoken,
+            renewat   => undef,
+        }, $class;
+    }
+
+    sub baseheaders {
+        my ($self) = @_;
+        my %headers;
+        $headers{'X-Vault-Namespace'} = $self->{vaultnamespace} if $self->{vaultnamespace};
+        return \%headers;
+    }
+
+    sub login {
+        my ($self) = @_;
+
+        my $auth = $self->{auth};
+        Voxgig::Sekreto::fail('sekreto: hashicorp: no token and no auth method')
+          if !$auth;
+
+        my $method = defined $auth->{method} ? $auth->{method} : '';
+        my $mount = $auth->{mount} || $method;
+
+        ( my $addr = $self->{addr} ) =~ s{/$}{};
+        my $url = $addr . '/v1/auth/' . $mount . '/login';
+
+        my $body;
+        if ( 'kubernetes' eq $method ) {
+            my $jwt = $auth->{jwt};
+            if ( !defined $jwt ) {
+                my $file = $auth->{jwtfile}
+                  || '/var/run/secrets/kubernetes.io/serviceaccount/token';
+                my $handle;
+                Voxgig::Sekreto::fail(
+                    'sekreto: hashicorp: cannot read jwt file ' . $file )
+                  if !open( $handle, '<', $file );
+                local $/ = undef;
+                $jwt = <$handle>;
+                close($handle);
+                $jwt = '' if !defined $jwt;
+                $jwt =~ s/^\s+|\s+$//g;
+            }
+            $body = { role => ( defined $auth->{role} ? $auth->{role} : '' ), jwt => $jwt };
+        }
+        elsif ( 'approle' eq $method ) {
+            $body = {
+                role_id   => defined $auth->{roleid}   ? $auth->{roleid}   : '',
+                secret_id => defined $auth->{secretid} ? $auth->{secretid} : '',
+            };
+        }
+        else {
+            Voxgig::Sekreto::fail(
+                'sekreto: hashicorp: unknown auth method: ' . $method );
+        }
+
+        my ( $status, $resbody ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson(
+            'POST', $url,
+            $self->baseheaders(),
+            JSON::PP->new->canonical(1)->encode($body)
+        );
+
+        my $got =
+          ( 'HASH' eq ref( $resbody || '' ) && 'HASH' eq ref( $resbody->{auth} || '' ) )
+          ? $resbody->{auth}{client_token}
+          : undef;
+
+        Voxgig::Sekreto::fail(
+            'sekreto: hashicorp login failed: ' . $status . ': ' . $url )
+          if 200 != $status || !$got;
+
+        $self->{renewat} =
+          Voxgig::Sekreto::Plugins::Httpjson::renewafter( $resbody->{auth}{lease_duration} );
+
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($got);
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+
+        Voxgig::Sekreto::Addr::checkaddr( $self->{addr} );
+
+        $self->{livetoken} = $self->login()
+          if !defined $self->{livetoken}
+          || Voxgig::Sekreto::Plugins::Httpjson::renewdue( $self->{renewat} );
+
+        my $ref = Voxgig::Sekreto::vaultref($name);
+
+        ( my $addr = $self->{addr} ) =~ s{/$}{};
+        my $base = $addr . '/v1/' . $self->{mount};
+        my $url =
+          1 == $self->{kv} ? $base . '/' . $ref->{path} : $base . '/data/' . $ref->{path};
+
+        my $headers = $self->baseheaders();
+        $headers->{'X-Vault-Token'} = $self->{livetoken};
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $url, $headers );
+
+        return undef if 404 == $status;
+
+        Voxgig::Sekreto::fail(
+            'sekreto: hashicorp error: ' . $status . ': ' . $url )
+          if 200 != $status;
+
+        my $data;
+        if ( 1 == $self->{kv} ) {
+            $data = 'HASH' eq ref( $body || '' ) ? $body->{data} : undef;
+        }
+        else {
+            $data =
+              ( 'HASH' eq ref( $body || '' ) && 'HASH' eq ref( $body->{data} || '' ) )
+              ? $body->{data}{data}
+              : undef;
+        }
+
+        my $value = 'HASH' eq ref( $data || '' ) ? $data->{ $ref->{field} } : undef;
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($value);
+    }
+
+    sub describe {
+        my ($self) = @_;
+        return 'hashicorp:' . $self->{addr} . '/' . $self->{mount};
+    }
+}
+
+# The plugin: the `hashicorp` provider kind, as a voxgig/plugin definition.
+sub hashicorp {
+    return providerplugin(
+        'hashicorp',
+        sub {
+            my ($spec) = @_;
+            return Voxgig::Sekreto::Plugins::Hashicorp::Provider->new(
+                $spec->{addr}  || '',
+                $spec->{token} || '',
+                {
+                    mount          => $spec->{mount},
+                    kv             => $spec->{kv},
+                    vaultnamespace => $spec->{vaultnamespace},
+                    auth           => $spec->{auth},
+                }
+            );
+        }
+    );
+}
+
+1;

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Httpjson.pm

@@ -0,0 +1,173 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Httpjson.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Httpjson;
+
+# The HTTP half of every plugin that speaks to a store over the wire, in
+# one place and OUTSIDE the core: a chain of built-ins never loads this
+# module. One JSON round-trip, bounded in time and in size, refusing
+# redirects and ignoring proxies; and the small helpers every store client
+# needs.
+#
+# A port of typescript/plugins/httpjson.ts, which is canonical.
+#
+# HTTP::Tiny, JSON::PP and MIME::Base64 are all core Perl, so this port
+# stays free of third-party dependencies. HTTPS additionally wants
+# IO::Socket::SSL, which HTTP::Tiny picks up when it is present: the TLS
+# exception AGENTS.md rule 3 records, and the reason a machine without it
+# has a Perl port that cannot reach a real vault.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use HTTP::Tiny   ();
+use JSON::PP     ();
+use MIME::Base64 ();
+
+our @EXPORT_OK = qw(fetchjson renewafter renewdue stringof unbase64 urlenc);
+
+# Voxgig::Sekreto is loaded by every consumer of this module, and the
+# failure path is called by name rather than imported so that nothing here
+# has to care which of the two was loaded first.
+sub fail { return Voxgig::Sekreto::fail(@_) }
+
+# The string a JSON value reads as, the way the canonical port's String()
+# spells it: booleans as words, numbers as themselves, undef stays undef.
+sub stringof {
+    my ($value) = @_;
+    return undef if !defined $value;
+    return ( $value ? 'true' : 'false' ) if JSON::PP::is_bool($value);
+    return "$value";
+}
+
+
+# RFC 3986 escaping for the URL parts these clients build - a vault name, a
+# project, an OAuth form field.
+#
+# ITS OWN COPY, not the SigV4 canonical form's `uriescape`, though the two
+# bodies are the same. They are two contracts: this one escapes a component
+# of an address, and that one is part of a signature the spec pins byte for
+# byte. Sharing them made every store client - Doppler, Infisical, 1Password
+# - load AWS request signing and a hash function to escape a URL, which is a
+# small echo of exactly what the core/plugin split was for.
+sub urlenc {
+    my ($text) = @_;
+    utf8::encode($text) if utf8::is_utf8($text);
+    $text =~ s/([^A-Za-z0-9\-._~])/sprintf( '%%%02X', ord($1) )/ge;
+    return $text;
+}
+
+
+# Decode standard base64, or undef when the text is not base64.
+#
+# MIME::Base64::decode_base64 SKIPS characters outside the alphabet, so a
+# corrupted payload decoded to plausible-looking bytes that the caller then
+# returned AS THE SECRET. The alphabet is checked first, so a store that
+# answered incoherently can be told apart from one that answered.
+sub unbase64 {
+    my ($text) = @_;
+
+    ( my $trimmed = $text ) =~ s/\s+//g;
+
+    return undef if $trimmed !~ m{\A[A-Za-z0-9+/]*={0,2}\z};
+    return undef if 0 != length($trimmed) % 4;
+
+    return MIME::Base64::decode_base64($trimmed);
+}
+
+
+# One JSON round-trip, returning (status, decoded-json-or-undef). A 404 is
+# a normal answer here, not a failure: it means the store has no such
+# secret. Network failure is always an error - an unreachable store is a
+# store that could not answer.
+sub fetchjson {
+    my ( $method, $url, $headers, $body ) = @_;
+
+    my $options = { headers => $headers || {} };
+    $options->{content} = $body if defined $body;
+
+    # A secrets client dials the address it was configured with and nowhere
+    # else. HTTP::Tiny's constructor calls _set_proxies, which reads
+    # http_proxy WITHOUT exempting loopback - so with that variable set,
+    # `X-Vault-Token` for a local dev vault went, in the clear, to whatever
+    # it named. checkaddr permits plaintext to loopback precisely because
+    # nothing leaves the machine; an environment variable it cannot see must
+    # not be able to make that false. All three keys are needed: an explicit
+    # undef is what suppresses the lookup.
+    # max_size is the response-body bound every port carries. HTTP::Tiny
+    # accepts it and this port was not passing it, so an endless body was
+    # accumulated in memory until the deadline - which on a loopback or
+    # datacentre link is gigabytes. Far above anything real: the largest
+    # legitimate payload here is Doppler's whole-config download, measured
+    # in kilobytes.
+    my $response = HTTP::Tiny->new(
+        timeout      => 10,
+        verify_SSL   => 1,
+        max_redirect => 0,
+        max_size     => 8 * 1024 * 1024,
+        proxy        => undef,
+        http_proxy   => undef,
+        https_proxy  => undef,
+    )->request( $method, $url, $options );
+
+    # HTTP::Tiny reports an over-size body as a 599 with this text. An
+    # endless body is a store that could not answer, so it must raise
+    # rather than become a miss - the latter would fall through to a
+    # weaker store on an attacker's cue.
+    if ( 599 == $response->{status}
+        && -1 != index( $response->{content} || '', 'Size of response body exceeds' ) )
+    {
+        ( my $plain = $url ) =~ s/\?.*//s;
+        fail( 'sekreto: oversized response from ' . $plain );
+    }
+
+    # HTTP::Tiny reports transport failures as a synthetic 599.
+    if ( 599 == $response->{status} ) {
+        ( my $plain = $url ) =~ s/\?.*//s;
+        fail( 'sekreto: cannot reach ' . $plain . ': ' . ( $response->{content} || '' ) );
+    }
+
+    my $parsed = eval { JSON::PP->new->decode( $response->{content} ) };
+
+    # A success status promised JSON; a body that does not parse means
+    # the store could not answer coherently, and treating it as a miss
+    # would fall through to a weaker store. Error statuses may carry
+    # any body - they are decided on status alone.
+    if ( $@ && 200 == $response->{status} ) {
+        ( my $plain = $url ) =~ s/\?.*//s;
+        fail( 'sekreto: malformed response from ' . $plain );
+    }
+
+    return ( $response->{status}, $parsed );
+}
+
+
+
+# When a logged-in token must be renewed: shortly before its lease runs
+# out, now + max(seconds - 60, 1). A missing or non-positive expiry means
+# "never renew" - undef here, the canonical port's Infinity.
+sub renewafter {
+    my ($seconds) = @_;
+
+    no warnings 'numeric';
+    my $lease = ( defined $seconds && !ref($seconds) ) ? 0 + $seconds : 0;
+
+    return undef if !( 0 < $lease );
+
+    my $delta = $lease - 60;
+    $delta = 1 if 1 > $delta;
+
+    return time() + $delta;
+}
+
+
+# Is this token due for renewal? A configured token (renewat undef) never
+# is.
+sub renewdue {
+    my ($renewat) = @_;
+    return defined $renewat && time() >= $renewat ? 1 : 0;
+}
+
+1;

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Infisical.pm

@@ -0,0 +1,132 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Infisical.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Infisical;
+
+# The infisical plugin: Infisical over its REST API.
+#
+# NOT IN THE CORE. A `Sekreto` can build this kind only if the calling
+# project passed this definition in through the `plugins` option; the
+# core loads nothing under `plugins/` (docs/design/plugin-providers.md).
+#
+# A port of typescript/plugins/infisical.ts, which is canonical.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use JSON::PP ();
+
+use Voxgig::Sekreto ();
+use Voxgig::Sekreto::Providers qw(providerplugin);
+use Voxgig::Sekreto::Addr ();
+use Voxgig::Sekreto::Plugins::Httpjson ();
+
+our @EXPORT_OK = qw(infisical);
+
+# Infisical.
+#
+# `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+# convention is environment-style keys) at a secret path in one
+# environment of a project. Auth is a token, or a universal-auth (machine
+# identity) login with clientid/clientsecret.
+{
+
+    package Voxgig::Sekreto::Plugins::Infisical::Provider;
+
+    # A configured token is kept forever; a universal-auth token carries
+    # expiresIn and is renewed shortly before it runs out.
+    sub new {
+        my ( $class, $opts ) = @_;
+        return bless { opts => $opts || {}, livetoken => undef, renewat => undef }, $class;
+    }
+
+    sub login {
+        my ( $self, $addr ) = @_;
+        my $opts = $self->{opts};
+
+        return $opts->{token} if $opts->{token};
+
+        Voxgig::Sekreto::fail(
+            'sekreto: infisical: no token and no client credentials')
+          if !$opts->{clientid} || !$opts->{clientsecret};
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson(
+            'POST',
+            $addr . '/api/v1/auth/universal-auth/login',
+            { 'content-type' => 'application/json' },
+            JSON::PP->new->canonical(1)->encode(
+                { clientId => $opts->{clientid}, clientSecret => $opts->{clientsecret} }
+            )
+        );
+
+        my $got = 'HASH' eq ref( $body || '' ) ? $body->{accessToken} : undef;
+
+        Voxgig::Sekreto::fail( 'sekreto: infisical login failed: ' . $status )
+          if 200 != $status || !$got;
+
+        $self->{renewat} = Voxgig::Sekreto::Plugins::Httpjson::renewafter( $body->{expiresIn} );
+
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($got);
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+        my $opts = $self->{opts};
+
+        ( my $addr = $opts->{addr} || 'https://app.infisical.com' ) =~ s{/$}{};
+        Voxgig::Sekreto::Addr::checkaddr($addr);
+
+        my $project     = $opts->{project}     || '';
+        my $environment = $opts->{environment} || '';
+        Voxgig::Sekreto::fail('sekreto: infisical: no project/environment')
+          if '' eq $project || '' eq $environment;
+
+        $self->{livetoken} = $self->login($addr)
+          if !defined $self->{livetoken}
+          || Voxgig::Sekreto::Plugins::Httpjson::renewdue( $self->{renewat} );
+
+        my $url =
+            $addr
+          . '/api/v3/secrets/raw/'
+          . Voxgig::Sekreto::envkey($name)
+          . '?workspaceId='
+          . Voxgig::Sekreto::Plugins::Httpjson::urlenc($project)
+          . '&environment='
+          . Voxgig::Sekreto::Plugins::Httpjson::urlenc($environment)
+          . '&secretPath='
+          . Voxgig::Sekreto::Plugins::Httpjson::urlenc( $opts->{path} || '/' );
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $url,
+            { 'authorization' => 'Bearer ' . $self->{livetoken} } );
+
+        return undef if 404 == $status;
+
+        Voxgig::Sekreto::fail( 'sekreto: infisical error: ' . $status )
+          if 200 != $status;
+
+        my $value =
+          ( 'HASH' eq ref( $body || '' ) && 'HASH' eq ref( $body->{secret} || '' ) )
+          ? $body->{secret}{secretValue}
+          : undef;
+
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($value);
+    }
+
+    sub describe {
+        my ($self) = @_;
+        return 'infisical:'
+          . ( $self->{opts}{project} || '' ) . '/'
+          . ( $self->{opts}{environment} || '' );
+    }
+}
+
+
+# The plugin: the `infisical` provider kind, as a voxgig/plugin definition.
+sub infisical {
+    return providerplugin( 'infisical',
+        sub { Voxgig::Sekreto::Plugins::Infisical::Provider->new( $_[0] ) } );
+}
+
+1;