Rust

Westyx Nexus Rust SDK

The official Rust SDK for Westyx Nexus.

No async runtime required - synchronous blocking API, compatible with tokio, async-std, or pure sync applications
Thread-safe TTL cache - in-memory Mutex-guarded snapshot, stale-while-revalidate with background refresh
SSE live updates - run_stream() triggers immediate re-sync on any config/secret/flag change
Public vs secret key access - public keys are restricted to configs and flags; NexusError::PublicKeyRestricted returned immediately
ETag caching - 304 Not Modified skips JSON decode and resets TTL with no data transfer
Billing protection - 402 Payment Required halts background sync but keeps serving cached values
Quarantine circuit breaker - 429 quarantined stops retries until expires_at; NexusError::Quarantined { reason, expires_at }
Workload Identity Federation - OIDC token exchange for Kubernetes, AWS IRSA, GCP, and Azure; AWS IAM (aws_iam) for ECS/Fargate/Lambda/plain-EC2 (v0.9.0-beta.1, behind the aws-iam cargo feature); no static API key needed
Write API - set_secret, delete_secret, delete_secret_version
AB Testing - evaluate_ab for rollout and targeting rules (add-on required)
File-type secrets - written to OS temp dir on sync; path returned via get_secret_file_path; cleaned up on drop
Service kind awareness - kind=frontend services cannot hold secrets; enforced locally

Latest release: v0.10.1-beta.1

Change	Details
Public-key error message	Drops the retired `pk_` prefix; the public-key secret-restriction error now reads "cannot read or write secrets with a public key" (completes the R12 rebrand)

Change	Details
`aws_iam` WIF provider	AWS IAM Caller Identity for non-EKS AWS compute (ECS/Fargate, Lambda, plain EC2) with IAM credentials but no OIDC token. SigV4-signs an STS `GetCallerIdentity` request (never sent to AWS) and posts it to `/v1/auth/token-exchange`; Nexus replays it to prove your IAM role. The signed `X-Nexus-Server-ID` is your service's own base-URL host, so a captured request is valid for that one service only. Behind the optional `aws-iam` cargo feature (`aws-config` + `aws-sigv4`), off by default
Azure IMDS path added	The `azure` provider prefers `$AZURE_FEDERATED_TOKEN_FILE` (AKS) and otherwise fetches an IMDS managed-identity token, requiring an explicit `api://<client-id>` audience (the generic default is refused)
https enforcement	`NexusClient` rejects plain-http endpoints (loopback excepted) so credentials never travel in cleartext
Fail-closed refresh	A failed WIF refresh now surfaces `SessionExpired`/the exchange error instead of silently sending a stale token; concurrent refreshes are de-duplicated; reads refresh too
Distinct exchange errors	Token-exchange 400/403 now map to `BadRequest`/`Forbidden` (previously only 401 was mapped); the slug `Host` header is sent on the exchange request
Bounded reads + expires_in guard	Metadata reads capped at 64 KiB, exchange/response at 1 MiB; a non-positive/overflowing `expires_in` is clamped

Change	Details
WIF GCP fix	The `gcp` provider now fetches a Google-signed OIDC identity token from the GCE metadata server; it previously read `GOOGLE_APPLICATION_CREDENTIALS` (a key file, not a JWT) which the token exchange rejected
WIF auto-detect aligned	Detection now checks `AWS_WEB_IDENTITY_TOKEN_FILE`, probes the GCE metadata server for `gcp`, and checks `AZURE_FEDERATED_TOKEN_FILE` - matching the actual token sources

Change	Details
Security improvements	Response bodies no longer in error messages; WIF token whitespace stripped; file paths are opaque hashes; `SecretNotFound` key truncated to 128 chars
`flag.toggled` SSE event	Flag toggle events now trigger a re-sync
SSE quarantine detection	Stream 429 with quarantine body pauses reconnects until `expires_at`
Drop cleanup fix	`Weak<Inner>` in background threads - file-type secrets reliably removed on Drop
CI hardened	Trigger regex, MR trigger, publish ancestry check

Change	Details
Initial release	First Rust SDK for Westyx Nexus
Write API	`set_secret`, `delete_secret`, `delete_secret_version`
`NexusError::RateLimited`	New error for 429 on write endpoints
WIF support	Kubernetes, AWS, GCP, Azure providers
SSE streaming	`run_stream()` with exponential backoff
File-type secrets	`get_secret_file_path`, Drop cleanup

Getting started

Reference

Operations