feat(rust): add lossless encrypted inference transport

[AnthonyRonning]

Summary

• add one first-class send_inference_request API for lossless encrypted inference transport
• let callers own the relative method, route, query, safe headers, exact body bytes, and response parsing
• keep attestation, auth/session management, encryption, session retry, and response decryption inside the SDK
• retain the existing typed models, embeddings, and chat-completion APIs as compatibility wrappers
• bump the Rust SDK to 3.4.0 and update the Rust documentation

Contract and security

The transport does not parse or rewrite request JSON, including stream, stream_options, provider-specific fields, large integers, or whitespace. It preserves the final OpenSecret status, safe headers, decrypted non-streaming bytes, and SSE framing (including [DONE]).

API-key access remains restricted to an exact inference allowlist: models, model catalog, chat completions, embeddings, speech, and transcriptions. Account and conversation routes cannot be reached through this API. Credential, session, representation, integrity, and hop-by-hop headers are removed at the trust boundary.

Compatibility

Existing typed callers keep their current signatures and behavior:

• typed non-streaming chat still forces stream: false
• typed streaming chat still forces stream: true and usage chunks
• typed non-success responses still map to Error::Api
• typed models and embeddings remain supported

Validation

• 41 Rust library tests pass
• exact-byte, query, header-filtering, status/error-body, retry, and arbitrary SSE chunk-boundary coverage
• legacy typed models, embeddings, streaming, and non-streaming regression coverage
• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features
• cargo package --allow-dirty verifies the 3.4.0 package
• live local SDK -> OpenSecret -> Tinfoil smoke tests confirmed Gemma 4 thinking controls survive the transport

Release order

After this merges, publish opensecret 3.4.0. The dependent maple-proxy 0.1.12 and Maple changes are already validated locally against this branch and will follow in dependency order.

Summary by CodeRabbit

• New Features
  • Added a lossless encrypted inference transport via send_inference_request, enabling raw HTTP request/response passthrough.
  • Updated Rust chat-completion calls to use the new inference transport with correct streaming/usage settings.
• Bug Fixes
  • Improved encrypted request/response handling, including allowed-route enforcement, header sanitization, correct SSE framing across arbitrary chunking, and clearer corrupt-ciphertext errors.
• Chores
  • Bumped the Rust crate version to 3.4.0 and refreshed related dependency versions.
• Documentation
  • Updated the Rust README and website Rust docs with the revised inference flow and examples.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 55999592-9a6b-45c7-a71c-00b17c414df4

📥 Commits

Reviewing files that changed from the base of the PR and between b7318b3 and 4a1ecf0.

📒 Files selected for processing (2)

• rust/README.md
• rust/src/client.rs

🚧 Files skipped from review as they are similar to previous changes (2)

• rust/README.md
• rust/src/client.rs

---

📝 Walkthrough

Walkthrough

The Rust SDK adds a lossless encrypted inference transport for raw HTTP requests and responses, including SSE decryption, route and header validation, retry handling, and public request/response types. Typed chat completion helpers now use this transport, and SDK documentation and tests cover the new behavior.

Changes

Lossless encrypted inference transport

Layer / File(s)	Summary
Transport contract and public API rust/Cargo.toml, rust/src/client.rs, rust/src/lib.rs	Adds raw inference HTTP types, decrypted response streams, required dependencies, and public re-exports.
Request validation and response decryption rust/src/client.rs	Validates inference routes, sanitizes headers, encrypts request bodies, handles retries, and decrypts regular and SSE responses while preserving raw bytes and framing.
Typed compatibility wrappers rust/src/client.rs	Routes typed chat completions through the raw transport, forces appropriate streaming options, and parses decrypted SSE data into typed chunks.
Transport verification and examples rust/src/client.rs, rust/README.md, website/docs/maple-ai/index.md	Adds encrypted-body matchers and transport tests, updates streaming expectations, and documents raw inference requests and response iteration.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant OpenSecretClient
  participant InferenceEndpoint
  Caller->>OpenSecretClient: Raw inference request
  OpenSecretClient->>InferenceEndpoint: Encrypted request with sanitized headers
  InferenceEndpoint-->>OpenSecretClient: Encrypted JSON or SSE response
  OpenSecretClient-->>Caller: Decrypted response bytes or typed chunks

Loading

Possibly related PRs

• OpenSecretCloud/OpenSecret-SDK#65: Changes to ChatCompletionChunk parsing are coupled to direct parsing of decrypted SSE data.

Poem

A rabbit sends raw bytes through the night,
Encrypted, then decrypted just right.
SSE lines hop, headers stay neat,
Typed chunks land with carrots to eat.
The SDK streams on in delight.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main Rust change: adding a lossless encrypted inference transport.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex-maple-agent-read-permissions-opensecret-sdk

---

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying opensecret-sdk with    Cloudflare Pages

Latest commit:	4a1ecf0
Status:	✅  Deploy successful!
Preview URL:	https://d6da0fb5.opensecret-sdk.pages.dev
Branch Preview URL:	https://codex-maple-agent-read-permi.opensecret-sdk.pages.dev

View logs

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.