feat(sdk): advertise partial_decrypt and http_range_source features

[sujankota]

Stacked on #4229 (otdfctl --offset/--length + URL input), which is stacked on #4221 (LoadTDFFromURL). Will retarget to main once those merge — the strings should only ship in a build that actually has both.

Proposed Changes

Part of DSPX-4886. Adds two entries to sdk.SupportedFeatures(), surfaced by otdfctl --version --json as supported_features, so xtest's go cli.sh supports can gate the DSPX-5117 partial-decrypt tests:

• partial_decrypt — otdfctl decrypt --offset/--length (feat(otdfctl): support decrypt --offset/--length and HTTP(S) URLs #4229)
• http_range_source — an http(s):// decrypt input loaded with HTTP range requests (feat(sdk): load TDFs from HTTP(S) URLs using range requests #4221, feat(otdfctl): support decrypt --offset/--length and HTTP(S) URLs #4229)

Names are taken from DSPX-5117.

@dmihalcik-virtru, a few questions before this merges:

1. Are partial_decrypt / http_range_source final? Per the SupportedFeatures doc comment, renaming later has to be coordinated with opentdf/tests, since an unknown string silently skips.
2. For go, should cli.sh check these via supported_features (like dpop), or would you rather probe partial_decrypt with help decrypt | grep -- --offset (like kasallowlist)? http_range_source has no CLI surface (it's a positional argument), so it needs the feature string either way. If you'd prefer the grep for partial_decrypt, I'll drop it from this list.
3. Both strings live in the SDK but describe otdfctl behaviour. That's fine as long as this merges after feat(otdfctl): support decrypt --offset/--length and HTTP(S) URLs #4229 (otdfctl builds against the workspace SDK), which is why it's stacked.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

cd otdfctl && go build . && ./otdfctl --version --json | jq -c .supported_features
# ["dpop","dpop_nonce_challenge","connectrpc","partial_decrypt","http_range_source"]

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: fbe3ff3a-ada2-4ee5-8a67-550bb5f0aacf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: fbe3ff3a-ada2-4ee5-8a67-550bb5f0aacf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	415.094567ms
Throughput	240.91 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.662693518s
Average Latency	445.707695ms
Throughput	111.95 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ js@main-main
✅ go@main-main
✅ js@main-v0.9.0
authorization-scale-report
✅ go@pull-4234-v0.9.0
✅ go@main-pull-4234
govulncheck-failure-0
bats-test-results
✅ go@pull-4234-main
✅ go@pull-4234-pull-4234
✅ go@main-v0.9.0
govulncheck-failure-4
✅ java@main-pull-4234
✅ java@main-main
cukes-report
govulncheck-failure-7
govulncheck-failure-2
opentdfplatformZHMODP.dockerbuild
✅ java@main-v0.9.0
govulncheck-failure-1
✅ js@main-pull-4234