@voxgig/sdkgen-langpack 0.0.1

package/.sdk/tm/dart/lib/feature/secrets/plugin/version.dart

@@ -0,0 +1,116 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (dart/lib/version.dart)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/// Versions and ranges (section 11.2).
+///
+/// TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
+/// concrete version. A requirement declares `range`. A requirement is
+/// satisfied when the names match, the `match` passes, and the provider's
+/// `version` falls inside the requirement's `range`.
+///
+/// That is the whole rule. There is no third field and no second
+/// comparison - an earlier draft added a provider-side `compat` range,
+/// which left three values and no statement of how they combine, and three
+/// defensible readings of one declaration is worse than the ambiguity it
+/// was introduced to fix.
+library;
+
+import 'types.dart' as t;
+
+final _versionRe = RegExp(r'^(\d+)(?:\.(\d+))?(?:\.(\d+))?$');
+
+/// A COMPONENT IS BOUNDED, and the bound is the model's, not the host
+/// language's. A dart `int` is 64-bit and javascript stops being exact past
+/// 2**53, so `9223372036854775808.0.0` parsed to an exact value here and a
+/// rounded one there. 2**31-1 is the smallest bound every target language
+/// holds exactly, which makes it the model's.
+const componentMax = 2147483647;
+
+int _component(String digits, String whole, String field) {
+  // BigInt, not int.parse: a component of forty digits overflows a 64-bit
+  // int silently in a release build, and the check below would then pass
+  // for a value that is plainly out of range.
+  final value = BigInt.parse(digits);
+  if (BigInt.from(componentMax) < value) {
+    t.fail('plugin_bad_range',
+        'version component out of range in $whole: $digits', {field: whole});
+  }
+  return value.toInt();
+}
+
+/// Two forms and no more (section 11.2):
+///
+///   '2.1'    >= 2.1.0 and < 3.0.0
+///   '~2.1'   >= 2.1.0 and < 2.2.0
+Map<String, dynamic> parseRange(dynamic range) {
+  if (range is! String || range.isEmpty) {
+    t.fail('plugin_bad_range', 'invalid range: $range', {'range': range});
+  }
+  final tilde = range.startsWith('~');
+  final body = tilde ? range.substring(1) : range;
+  final m = _versionRe.firstMatch(body);
+  if (m == null) {
+    t.fail('plugin_bad_range', 'invalid range: $range', {'range': range});
+  }
+  final major = _component(m.group(1)!, range, 'range');
+  final minor = m.group(2) == null ? 0 : _component(m.group(2)!, range, 'range');
+  final patch = m.group(3) == null ? 0 : _component(m.group(3)!, range, 'range');
+  return {
+    'lo': [major, minor, patch],
+    'hi': tilde ? [major, minor + 1, 0] : [major + 1, 0, 0],
+  };
+}
+
+List<int> parseVersion(dynamic version) {
+  if (version is! String) {
+    t.fail('plugin_bad_range', 'invalid version: $version',
+        {'version': version});
+  }
+  final m = _versionRe.firstMatch(version);
+  if (m == null) {
+    t.fail('plugin_bad_range', 'invalid version: $version',
+        {'version': version});
+  }
+  return [
+    _component(m.group(1)!, version, 'version'),
+    m.group(2) == null ? 0 : _component(m.group(2)!, version, 'version'),
+    m.group(3) == null ? 0 : _component(m.group(3)!, version, 'version'),
+  ];
+}
+
+int versionCmp(List<dynamic> a, List<dynamic> b) {
+  for (var i = 0; i < 3; i++) {
+    final x = (i < a.length ? a[i] : 0) as int;
+    final y = (i < b.length ? b[i] : 0) as int;
+    if (x != y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+/// The one satisfaction predicate: lo <= version < hi.
+bool satisfies(dynamic version, dynamic range) {
+  final v = parseVersion(version);
+  final r = parseRange(range);
+  return versionCmp(v, r['lo'] as List) >= 0 &&
+      versionCmp(v, r['hi'] as List) < 0;
+}
+
+/// `satisfies` for the internal callers that treat an unparseable version
+/// or range as "does not satisfy" - Capability and Graph, both of which run
+/// over data the corpus has already admitted.
+bool satisfiesq(dynamic version, dynamic range) {
+  try {
+    return satisfies(version, range);
+  } on t.PluginError {
+    return false;
+  }
+}
+
+/// The numeric parts of a version, or zeros - a SORT KEY, never a check.
+List<int> versionParts(String text) {
+  try {
+    return parseVersion(text);
+  } on t.PluginError {
+    return [0, 0, 0];
+  }
+}

package/.sdk/tm/dart/lib/feature/secrets/sekreto/plugins/aws.dart

@@ -0,0 +1,285 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/plugins/aws.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The two AWS stores, as voxgig/plugin definitions - and `sigv4` with them.
+//
+// PLUGINS, not built-ins, and this is the file the design names: request
+// signing is HMAC-SHA256, and the core of no port imports a hash function.
+// `sigv4.dart` and `crypto.dart` sit beside this file rather than under
+// `src/`, so a chain of the four built-in kinds compiles neither.
+// A `Sekreto` can build `awssecrets` or `awsparams` only if the calling
+// project imported this file and passed them in the `plugins` option
+// (docs/design/plugin-providers.md).
+//
+// A port of typescript/plugins/aws.ts, which is canonical.
+
+import 'dart:async';
+
+import '../src/addr.dart';
+import '../src/json.dart';
+import '../src/provider.dart';
+import '../src/providers.dart';
+import '../src/sekreto.dart';
+import '../src/support.dart';
+
+import 'httpjson.dart';
+import 'sigv4.dart';
+
+/// Now, as the `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants.
+String awsnow() {
+  final now = DateTime.now().toUtc();
+  String two(int value) => value.toString().padLeft(2, '0');
+
+  return '${now.year.toString().padLeft(4, '0')}${two(now.month)}'
+      '${two(now.day)}T${two(now.hour)}${two(now.minute)}'
+      '${two(now.second)}Z';
+}
+
+/// One signed AWS call, prepared without touching the network.
+class _Awscall {
+  final String url;
+  final Map<String, String> headers;
+  final String payload;
+  const _Awscall(this.url, this.headers, this.payload);
+}
+
+/// Region and credentials, from config first and the standard AWS_*
+/// environment variables second - those are AWS's own convention, and a pod
+/// or CI job that has them set should just work. Missing either is an error:
+/// an AWS store with no credentials could not answer.
+///
+/// Resolved, checked and signed synchronously, so a chain with no
+/// credentials fails where it is configured rather than somewhere inside a
+/// network call.
+_Awscall awsprep({
+  String? region,
+  String? keyid,
+  String? secret,
+  String? session,
+  String? addr,
+  required String service,
+  required String target,
+  required String payload,
+}) {
+  final useregion =
+      first([region, getenv('AWS_REGION'), getenv('AWS_DEFAULT_REGION')]);
+  final usekeyid = first([keyid, getenv('AWS_ACCESS_KEY_ID')]);
+  final usesecret = first([secret, getenv('AWS_SECRET_ACCESS_KEY')]);
+  final usesession = first([session, getenv('AWS_SESSION_TOKEN')]);
+
+  if (useregion.isEmpty) {
+    throw SekretoError('sekreto: aws: no region (set region or AWS_REGION)');
+  }
+
+  if (usekeyid.isEmpty || usesecret.isEmpty) {
+    throw SekretoError(
+      'sekreto: aws: no credentials'
+      ' (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)',
+    );
+  }
+
+  // The China partition lives under its own suffix; every other commercial
+  // region is plain amazonaws.com.
+  final suffix =
+      useregion.startsWith('cn-') ? '.amazonaws.com.cn' : '.amazonaws.com';
+  final useaddr = first([addr, 'https://$service.$useregion$suffix']);
+  checkaddr(useaddr);
+
+  final url = '${trimslash(useaddr)}/';
+
+  final extras = <String, String>{
+    'content-type': 'application/x-amz-json-1.1',
+    'x-amz-target': target,
+  };
+
+  final signed = sigv4(Signing(
+    method: 'POST',
+    url: url,
+    service: service,
+    region: useregion,
+    keyid: usekeyid,
+    secret: usesecret,
+    datetime: awsnow(),
+    headers: extras,
+    body: payload,
+    session: usesession.isEmpty ? null : usesession,
+  ));
+
+  final headers = <String, String>{...extras, ...signed};
+
+  return _Awscall(url, headers, payload);
+}
+
+/// Does this AWS error body name one of the not-found types? Those are a
+/// miss; every other failure is a store that could not answer.
+///
+/// A containment test, because AWS sends the type fully qualified:
+/// `com.amazonaws.service#ResourceNotFoundException`.
+bool awsmiss(Json? body, String type) {
+  final errtype = body.dig('__type').asstr;
+  return null != errtype && errtype.contains(type);
+}
+
+/// AWS Secrets Manager.
+///
+/// `api.token` reads the secret named `api` (the vaultref path, so
+/// `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+/// SecretString - the AWS idiom of one JSON map per secret. A SecretString
+/// that is not JSON is the value itself, under the conventional field
+/// `value`. Requests are SigV4-signed in-tree; see sigv4.dart.
+class Awssecrets extends Provider {
+  final String? region;
+  final String? keyid;
+  final String? secret;
+  final String? session;
+  final String? addr;
+
+  Awssecrets({this.region, this.keyid, this.secret, this.session, this.addr});
+
+  @override
+  FutureOr<String?> lookup(String name) {
+    final ref = vaultref(name);
+
+    final call = awsprep(
+      region: region,
+      keyid: keyid,
+      secret: secret,
+      session: session,
+      addr: addr,
+      service: 'secretsmanager',
+      target: 'secretsmanager.GetSecretValue',
+      payload: jsonstringify(JsonObj({'SecretId': JsonStr(ref.path)})),
+    );
+
+    return _read(call, ref);
+  }
+
+  Future<String?> _read(_Awscall call, VaultRef ref) async {
+    final res = await fetchjson('POST', call.url,
+        headers: call.headers, body: call.payload);
+
+    if (400 == res.status && awsmiss(res.body, 'ResourceNotFoundException')) {
+      return null;
+    }
+    if (200 != res.status) {
+      throw SekretoError('sekreto: aws secretsmanager error: ${res.status}');
+    }
+
+    final text = res.body.dig('SecretString').asstr;
+
+    if (null == text) {
+      // A binary secret has no fields to address; only the conventional
+      // `value` field can mean "the bytes themselves".
+      final binary = res.body.dig('SecretBinary').asstr;
+
+      if (null == binary || 'value' != ref.field) {
+        return null;
+      }
+
+      final decoded = unbase64(binary);
+      if (null == decoded) {
+        throw SekretoError('sekreto: aws secretsmanager: undecodable secret');
+      }
+      return decoded;
+    }
+
+    final parsed = jsonparse(text);
+    final fields = parsed.asobj;
+
+    if (null != fields) {
+      return fields[ref.field].text;
+    }
+
+    // A plain-string secret is the whole value; it has no named fields.
+    return 'value' == ref.field ? text : null;
+  }
+
+  // Config only, never the environment: describe() feeds the spec's sources
+  // group, which must answer the same everywhere.
+  @override
+  String describe() => 'awssecrets:${region ?? ''}';
+}
+
+/// AWS SSM Parameter Store.
+///
+/// `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+/// prefix path), decrypted. Parameter Store carries flat strings, so there
+/// is no field indirection.
+class Awsparams extends Provider {
+  final String? region;
+  final String? keyid;
+  final String? secret;
+  final String? session;
+  final String? addr;
+  final String? prefix;
+
+  Awsparams({
+    this.region,
+    this.keyid,
+    this.secret,
+    this.session,
+    this.addr,
+    this.prefix,
+  });
+
+  @override
+  FutureOr<String?> lookup(String name) {
+    final call = awsprep(
+      region: region,
+      keyid: keyid,
+      secret: secret,
+      session: session,
+      addr: addr,
+      service: 'ssm',
+      target: 'AmazonSSM.GetParameter',
+      payload: jsonstringify(JsonObj({
+        'Name': JsonStr(awsparam(name, prefix)),
+        'WithDecryption': const JsonBool(true),
+      })),
+    );
+
+    return _read(call);
+  }
+
+  Future<String?> _read(_Awscall call) async {
+    final res = await fetchjson('POST', call.url,
+        headers: call.headers, body: call.payload);
+
+    if (400 == res.status && awsmiss(res.body, 'ParameterNotFound')) {
+      return null;
+    }
+    if (200 != res.status) {
+      throw SekretoError('sekreto: aws ssm error: ${res.status}');
+    }
+
+    return res.body.dig('Parameter', 'Value').text;
+  }
+
+  @override
+  String describe() => 'awsparams:${region ?? ''}${prefix ?? ''}';
+}
+
+/// The `awssecrets` provider kind - AWS Secrets Manager.
+final Definition awssecrets = providerplugin(
+  'awssecrets',
+  (spec) => Awssecrets(
+    region: spec.region,
+    keyid: spec.keyid,
+    secret: spec.secret,
+    session: spec.session,
+    addr: spec.addr,
+  ),
+);
+
+/// The `awsparams` provider kind - AWS SSM Parameter Store.
+final Definition awsparams = providerplugin(
+  'awsparams',
+  (spec) => Awsparams(
+    region: spec.region,
+    keyid: spec.keyid,
+    secret: spec.secret,
+    session: spec.session,
+    addr: spec.addr,
+    prefix: spec.prefix,
+  ),
+);

package/.sdk/tm/dart/lib/feature/secrets/sekreto/plugins/azuresecrets.dart

@@ -0,0 +1,178 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/plugins/azuresecrets.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Azure Key Vault, as a voxgig/plugin definition.
+//
+// A PLUGIN, not a built-in: it opens a socket. A `Sekreto` can build the
+// `azuresecrets` kind only if the calling project imported this file and
+// passed `azuresecrets` in the `plugins` option
+// (docs/design/plugin-providers.md).
+//
+// A port of typescript/plugins/azuresecrets.ts, which is canonical.
+
+import 'dart:async';
+
+import '../src/addr.dart';
+import '../src/json.dart';
+import '../src/provider.dart';
+import '../src/sekreto.dart';
+import '../src/support.dart';
+
+import 'httpjson.dart';
+
+/// The Key Vault audience an Azure token is minted for.
+const String RESOURCE = 'https://vault.azure.net';
+
+/// Azure Key Vault.
+///
+/// `api.token` reads secret `api-token` (dots flattened to `-`; Key Vault
+/// names allow nothing else), current version. The token comes from config,
+/// then a client-credentials login when tenant/clientid/clientsecret are
+/// given, then the IMDS managed-identity endpoint - so on Azure's own
+/// platform no credential configuration is needed.
+///
+/// As with GCP, the IMDS call is plain http to a link-local host by platform
+/// design and carries no credential; the login and vault addresses are
+/// `checkaddr`-guarded.
+class Azuresecrets extends Provider {
+  final String? vault;
+  final String? token;
+  final String? tenant;
+  final String? clientid;
+  final String? clientsecret;
+  final String? loginaddr;
+  final String? imdsaddr;
+  final String? apiversion;
+
+  // A configured token is kept forever; logged-in and IMDS tokens carry
+  // expires_in and are renewed shortly before they run out.
+  String? _livetoken;
+  int _renewat = NEVER;
+
+  Azuresecrets({
+    this.vault,
+    this.token,
+    this.tenant,
+    this.clientid,
+    this.clientsecret,
+    this.loginaddr,
+    this.imdsaddr,
+    this.apiversion,
+  });
+
+  bool get _hasclient =>
+      null != tenant &&
+      tenant!.isNotEmpty &&
+      null != clientid &&
+      clientid!.isNotEmpty &&
+      null != clientsecret &&
+      clientsecret!.isNotEmpty;
+
+  Future<String> _login() async {
+    if (null != token && token!.isNotEmpty) {
+      return token!;
+    }
+
+    if (_hasclient) {
+      final useloginaddr =
+          first([loginaddr, 'https://login.microsoftonline.com']);
+      checkaddr(useloginaddr);
+
+      final url = '${trimslash(useloginaddr)}/${tenant!}/oauth2/v2.0/token';
+      final form = 'grant_type=client_credentials'
+          '&client_id=${uriescape(clientid!)}'
+          '&client_secret=${uriescape(clientsecret!)}'
+          '&scope=${uriescape('$RESOURCE/.default')}';
+
+      final res = await fetchjson(
+        'POST',
+        url,
+        headers: {'content-type': 'application/x-www-form-urlencoded'},
+        body: form,
+      );
+
+      final got = res.body.dig('access_token').text;
+      if (200 != res.status || null == got || got.isEmpty) {
+        throw SekretoError('sekreto: azure login failed: ${res.status}');
+      }
+
+      _renewat = renewtime(res.body.dig('expires_in'));
+      return got;
+    }
+
+    final imds = '${trimslash(first([imdsaddr, 'http://169.254.169.254']))}'
+        '/metadata/identity/oauth2/token?api-version=2018-02-01'
+        '&resource=${uriescape(RESOURCE)}';
+
+    final res = await fetchjson('GET', imds, headers: {'Metadata': 'true'});
+
+    final got = res.body.dig('access_token').text;
+    if (200 != res.status || null == got || got.isEmpty) {
+      throw SekretoError(
+        'sekreto: azure: no token, no client credentials, and IMDS did not answer',
+      );
+    }
+
+    // IMDS sends expires_in as a STRING, where everyone else sends a number.
+    _renewat = renewtime(res.body.dig('expires_in'));
+    return got;
+  }
+
+  @override
+  FutureOr<String?> lookup(String name) {
+    final usevault = vault ?? '';
+    if (usevault.isEmpty) {
+      throw SekretoError('sekreto: azure: no vault');
+    }
+
+    // Only an explicit scheme is a URL; a vault NAMED httpvault must still
+    // become https://httpvault.vault.azure.net.
+    final vaulturl =
+        (usevault.startsWith('http://') || usevault.startsWith('https://'))
+            ? usevault
+            : 'https://$usevault.vault.azure.net';
+    checkaddr(vaulturl);
+
+    return _read(vaulturl, name);
+  }
+
+  Future<String?> _read(String vaulturl, String name) async {
+    if (null == _livetoken || DateTime.now().millisecondsSinceEpoch >= _renewat) {
+      _livetoken = await _login();
+    }
+
+    final url = '${trimslash(vaulturl)}/secrets/${flatname(name, '-')}'
+        '?api-version=${first([apiversion, '7.4'])}';
+
+    final res = await fetchjson('GET', url,
+        headers: {'authorization': 'Bearer ${_livetoken ?? ''}'});
+
+    if (404 == res.status) {
+      return null;
+    }
+    if (200 != res.status) {
+      throw SekretoError('sekreto: azure error: ${res.status}: ${bare(url)}');
+    }
+
+    return res.body.dig('value').text;
+  }
+
+  @override
+  String describe() => 'azuresecrets:${vault ?? ''}';
+}
+
+/// The `azuresecrets` provider kind. Pass it in `plugins` to name it in a
+/// chain.
+final Definition azuresecrets = providerplugin(
+  'azuresecrets',
+  (spec) => Azuresecrets(
+    vault: spec.vault,
+    token: spec.token,
+    tenant: spec.tenant,
+    clientid: spec.clientid,
+    clientsecret: spec.clientsecret,
+    loginaddr: spec.loginaddr,
+    imdsaddr: spec.imdsaddr,
+    apiversion: spec.apiversion,
+  ),
+);