@voxgig/sdkgen-langpack 0.0.1

package/.sdk/tm/dart/lib/feature/secrets/sekreto/plugins/onepassword.dart

@@ -0,0 +1,146 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/plugins/onepassword.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// 1Password Connect, as a voxgig/plugin definition.
+//
+// A PLUGIN, not a built-in: it opens a socket. A `Sekreto` can build the
+// `onepassword` kind only if the calling project imported this file and
+// passed `onepassword` in the `plugins` option
+// (docs/design/plugin-providers.md).
+//
+// A port of typescript/plugins/onepassword.ts, which is canonical.
+
+import 'dart:async';
+
+import '../src/addr.dart';
+import '../src/json.dart';
+import '../src/provider.dart';
+import '../src/sekreto.dart';
+import '../src/support.dart';
+
+import 'httpjson.dart';
+
+/// 1Password, through a Connect server.
+///
+/// The item titled `api.token` (titles keep their dots), in the named vault.
+/// The value is the field with purpose PASSWORD, or the field labelled
+/// `value`. A vault that cannot be found is an error - config names it, so
+/// its absence is a broken store, not a missing secret.
+class Onepassword extends Provider {
+  final String? addr;
+  final String? token;
+  final String? vault;
+
+  String? _vaultid;
+
+  Onepassword({this.addr, this.token, this.vault});
+
+  Map<String, String> _auth() => {'authorization': 'Bearer ${token ?? ''}'};
+
+  Future<String> _resolvevault(String useaddr) async {
+    final want = vault ?? '';
+    if (want.isEmpty) {
+      throw SekretoError('sekreto: onepassword: no vault');
+    }
+
+    final res = await fetchjson('GET', '$useaddr/v1/vaults', headers: _auth());
+
+    final list = res.body.asarr;
+    if (200 != res.status || null == list) {
+      throw SekretoError(
+        'sekreto: onepassword error: ${res.status}: listing vaults',
+      );
+    }
+
+    for (final entry in list) {
+      if (want == entry.dig('id').text || want == entry.dig('name').text) {
+        return entry.dig('id').text ?? '';
+      }
+    }
+
+    throw SekretoError('sekreto: onepassword: no vault named $want');
+  }
+
+  @override
+  FutureOr<String?> lookup(String name) {
+    checkname(name);
+
+    final useaddr = trimslash(addr ?? '');
+    if (useaddr.isEmpty) {
+      throw SekretoError('sekreto: onepassword: no addr');
+    }
+    checkaddr(useaddr);
+
+    return _read(useaddr, name);
+  }
+
+  Future<String?> _read(String useaddr, String name) async {
+    var id = _vaultid;
+    if (null == id) {
+      id = await _resolvevault(useaddr);
+      _vaultid = id;
+    }
+
+    final filter = uriescape('title eq "$name"');
+    final found = await fetchjson(
+      'GET',
+      '$useaddr/v1/vaults/$id/items?filter=$filter',
+      headers: _auth(),
+    );
+
+    final items = found.body.asarr;
+    if (200 != found.status || null == items) {
+      throw SekretoError(
+        'sekreto: onepassword error: ${found.status}: finding $name',
+      );
+    }
+
+    // An empty list is a miss: the vault is fine, the item is not there.
+    if (items.isEmpty) {
+      return null;
+    }
+
+    final itemid = items.first.dig('id').text ?? '';
+    final item = await fetchjson(
+      'GET',
+      '$useaddr/v1/vaults/$id/items/$itemid',
+      headers: _auth(),
+    );
+
+    if (200 != item.status) {
+      throw SekretoError(
+        'sekreto: onepassword error: ${item.status}: reading $name',
+      );
+    }
+
+    final fields = item.body.dig('fields').asarr ?? const <Json>[];
+
+    for (final field in fields) {
+      if ('PASSWORD' == field.dig('purpose').asstr) {
+        return field.dig('value').text;
+      }
+    }
+
+    for (final field in fields) {
+      if ('value' == field.dig('label').asstr) {
+        return field.dig('value').text;
+      }
+    }
+
+    return null;
+  }
+
+  @override
+  String describe() => 'onepassword:${vault ?? ''}';
+}
+
+/// The `onepassword` provider kind. Pass it in `plugins` to name it in a
+/// chain.
+final Definition onepassword = providerplugin(
+  'onepassword',
+  (spec) => Onepassword(
+    addr: spec.addr,
+    token: spec.token,
+    vault: spec.vault,
+  ),
+);

package/.sdk/tm/dart/lib/feature/secrets/sekreto/plugins/secretspec.dart

@@ -0,0 +1,116 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/plugins/secretspec.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// SecretSpec, as a voxgig/plugin definition.
+//
+// A PLUGIN, not a built-in: it spawns a child process. A `Sekreto` can
+// build the `secretspec` kind only if the calling project imported this
+// file and passed `secretspec` in the `plugins` option
+// (docs/design/plugin-providers.md).
+//
+// A port of typescript/plugins/secretspec.ts, which is canonical.
+
+import '../src/provider.dart';
+import '../src/sekreto.dart';
+import '../src/support.dart';
+
+import 'httpjson.dart';
+
+/// Does this SecretSpec failure mean "no such secret" rather than "I could
+/// not answer"?
+///
+/// SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+/// not declare and one declared with no value, and both are misses: this
+/// store does not hold it, so the chain carries on.
+///
+/// MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+/// `Provider backend 'keyring' not found`, which is a store that could not
+/// answer at all - and reading that as a miss is the worst failure this
+/// library has, because the chain then falls through to a weaker store
+/// without saying so. The key is required to appear, so the two cannot be
+/// confused.
+bool secretspecmiss(String reason, String key) =>
+    reason.contains("Secret '$key' not found");
+
+/// SecretSpec (https://secretspec.dev).
+///
+/// SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+/// project needs - plus a chain of its own backends to satisfy them from.
+/// That makes it the same shape as sekreto one level down, and the reason to
+/// support it is the same reason sekreto exists: a project that has already
+/// declared its secrets there should not have to declare them again here.
+///
+/// A reason is required, not optional: SecretSpec records every read in an
+/// audit log and refuses to read at all without one. sekreto sends `sekreto`
+/// unless told otherwise, so the audit trail says which tool asked.
+class Secretspec extends Provider {
+  final String command;
+  final String? file;
+  final String? profile;
+  final String? backend;
+  final String? reason;
+  final String? prefix;
+
+  Secretspec({
+    String? command,
+    this.file,
+    this.profile,
+    this.backend,
+    this.reason,
+    this.prefix,
+  }) : command = (null == command || command.isEmpty) ? 'secretspec' : command;
+
+  @override
+  String? lookup(String name) {
+    final key = envkey(name, prefix);
+
+    // The order is SecretSpec's: --file belongs to the program, before the
+    // subcommand; everything else belongs to `get`.
+    final argv = <String>[command];
+    if (null != file && file!.isNotEmpty) {
+      argv.addAll(['--file', file!]);
+    }
+    argv.addAll(['get', key]);
+    if (null != backend && backend!.isNotEmpty) {
+      argv.addAll(['--provider', backend!]);
+    }
+    if (null != profile && profile!.isNotEmpty) {
+      argv.addAll(['--profile', profile!]);
+    }
+    argv.addAll(['--reason', first([reason, 'sekreto'])]);
+
+    final ran = runcmd(argv, command);
+
+    if (0 == ran.status) {
+      // The value and one newline, and nothing else.
+      return dropsuffix(ran.out, '\n');
+    }
+
+    if (secretspecmiss(ran.why, key)) {
+      return null;
+    }
+
+    throw SekretoError(
+      'sekreto: secretspec error: '
+      '${ran.why.isEmpty ? 'exit ${ran.status}' : ran.why}',
+    );
+  }
+
+  @override
+  String describe() =>
+      'secretspec${(null != backend && backend!.isNotEmpty) ? ':$backend' : ''}';
+}
+
+/// The `secretspec` provider kind. Pass it in `plugins` to name it in a
+/// chain.
+final Definition secretspec = providerplugin(
+  'secretspec',
+  (spec) => Secretspec(
+    command: spec.command,
+    file: spec.file,
+    profile: spec.profile,
+    backend: spec.backend,
+    reason: spec.reason,
+    prefix: spec.prefix,
+  ),
+);

package/.sdk/tm/dart/lib/feature/secrets/sekreto/plugins/sigv4.dart

@@ -0,0 +1,237 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/plugins/sigv4.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// AWS Signature Version 4, hand-rolled.
+//
+// A PLUGIN FILE, with `crypto.dart` beside it: the core of no port imports
+// a hash function, and this is where sekreto's one use of one lives. Only
+// the aws plugin reaches it, and only a consumer that passed the aws plugin
+// reaches that.
+//
+// The AWS providers need exactly one thing from the AWS SDK - request
+// signing - and taking the SDK for it would break the no-dependency rule
+// that keeps the ports honest. SigV4 is a stable, published algorithm built
+// from HMAC-SHA256, which `crypto.dart` supplies.
+//
+// `sigv4` is pure: the caller passes the timestamp, so the same input
+// yields the same signature everywhere. That is what lets the shared spec
+// carry known-answer cases that all ports must reproduce bit-for-bit, and
+// lets the integration mock recompute the signature server-side.
+//
+// A port of typescript/plugins/sigv4.ts, which is canonical.
+
+import 'dart:convert';
+
+import '../src/addr.dart';
+
+import 'crypto.dart';
+// `uriescape` and `uridecode` live with the transport rather than here, so
+// that a plugin which only has to escape a query parameter does not compile
+// a hash function to get one. Canonical keeps them in this file because
+// JavaScript's own `encodeURIComponent` covers the other plugins' needs and
+// dart's `Uri.encodeComponent` does not: it leaves `!*'()` unescaped, which
+// is not RFC 3986 and not what AWS signs.
+import 'httpjson.dart';
+
+/// One request to sign - the same declarative shape the shared spec uses.
+/// `datetime` is `YYYYMMDDTHHMMSSZ`, and it is the caller's, so that signing
+/// is a pure function of its input.
+class Signing {
+  final String method;
+  final String url;
+  final String service;
+  final String region;
+  final String keyid;
+  final String secret;
+  final String datetime;
+  final Map<String, String> headers;
+  final String body;
+  final String? session;
+
+  const Signing({
+    required this.method,
+    required this.url,
+    required this.service,
+    required this.region,
+    required this.keyid,
+    required this.secret,
+    required this.datetime,
+    this.headers = const {},
+    this.body = '',
+    this.session,
+  });
+}
+
+/// The three pieces of a URL that signing needs, split by hand.
+///
+/// Not `Uri.parse`: the `host` header AWS signs is the WHATWG one - the
+/// hostname lowercased, userinfo stripped, and the port present only when
+/// it is not the scheme's default - and no platform URL type answers
+/// exactly that. A signature over a host the service computes differently
+/// is refused with no useful diagnostic.
+class _Parts {
+  final String host;
+  final String path;
+  final String query;
+  const _Parts(this.host, this.path, this.query);
+}
+
+_Parts _split(String url) {
+  final mark = url.indexOf('://');
+  final scheme = -1 == mark ? '' : url.substring(0, mark).toLowerCase();
+  final rest = -1 == mark ? url : url.substring(mark + 3);
+
+  final stop = stopat(rest, '/?#');
+  var authority = -1 == stop ? rest : rest.substring(0, stop);
+  var tail = -1 == stop ? '' : rest.substring(stop);
+
+  // Userinfo is not part of the signed host.
+  final at = authority.lastIndexOf('@');
+  if (-1 != at) {
+    authority = authority.substring(at + 1);
+  }
+
+  String host;
+  var port = '';
+
+  if (authority.startsWith('[')) {
+    // An IPv6 literal keeps its brackets and carries colons of its own.
+    final close = authority.indexOf(']');
+    if (-1 == close) {
+      host = authority;
+    } else {
+      host = authority.substring(0, close + 1);
+      final after = authority.substring(close + 1);
+      if (after.startsWith(':')) {
+        port = after.substring(1);
+      }
+    }
+  } else {
+    final colon = authority.lastIndexOf(':');
+    if (-1 == colon) {
+      host = authority;
+    } else {
+      host = authority.substring(0, colon);
+      port = authority.substring(colon + 1);
+    }
+  }
+
+  host = host.toLowerCase();
+
+  // A default port is implicit, and signing it would not match what the
+  // service reconstructs from the request line.
+  if (port.isNotEmpty &&
+      !('https' == scheme && '443' == port) &&
+      !('http' == scheme && '80' == port)) {
+    host = '$host:$port';
+  }
+
+  final hash = tail.indexOf('#');
+  if (-1 != hash) {
+    tail = tail.substring(0, hash);
+  }
+
+  final mark2 = tail.indexOf('?');
+  final path = -1 == mark2 ? tail : tail.substring(0, mark2);
+  final query = -1 == mark2 ? '' : tail.substring(mark2 + 1);
+
+  return _Parts(host, path.isEmpty ? '/' : path, query);
+}
+
+/// The canonical query string: each pair RFC 3986-escaped, sorted by escaped
+/// key then escaped value.
+String canonicalquery(String query) {
+  if (query.isEmpty) {
+    return '';
+  }
+
+  final pairs = <List<String>>[];
+
+  for (final pair in query.split('&')) {
+    final eq = pair.indexOf('=');
+    final key = -1 == eq ? pair : pair.substring(0, eq);
+    final value = -1 == eq ? '' : pair.substring(eq + 1);
+    pairs.add([uriescape(uridecode(key)), uriescape(uridecode(value))]);
+  }
+
+  pairs.sort((left, right) {
+    final bykey = left[0].compareTo(right[0]);
+    return 0 != bykey ? bykey : left[1].compareTo(right[1]);
+  });
+
+  return pairs.map((pair) => '${pair[0]}=${pair[1]}').join('&');
+}
+
+/// Sign one request. Returns the headers to attach: authorization,
+/// x-amz-date, and x-amz-security-token when a session token was given, in
+/// that order - the spec compares the result as a JSON object, and callers
+/// print it field by field.
+Map<String, String> sigv4(Signing input) {
+  final parts = _split(input.url);
+  final date = input.datetime.substring(0, 8);
+  final session =
+      (null == input.session || input.session!.isEmpty) ? null : input.session;
+
+  // Every header that will be signed: the caller's extras, plus host and
+  // x-amz-date (and the session token when present), lower-cased and
+  // trimmed the way the canonical form requires.
+  //
+  // Canonical header values are trimmed AND internally collapsed - AWS
+  // folds every run of whitespace, tabs included, to one space before
+  // signing, so a header like "a  b" must sign as "a b" or the service
+  // refuses it.
+  final headers = <String, String>{};
+
+  input.headers.forEach((key, value) {
+    headers[key.toLowerCase()] = value.trim().replaceAll(RegExp(r'\s+'), ' ');
+  });
+
+  // Inserted after the caller's, so they win.
+  headers['host'] = parts.host;
+  headers['x-amz-date'] = input.datetime;
+  if (null != session) {
+    headers['x-amz-security-token'] = session;
+  }
+
+  final names = headers.keys.toList()..sort();
+  final canonicalheaders =
+      names.map((name) => '$name:${headers[name]}\n').join();
+  final signedheaders = names.join(';');
+
+  final canonicalrequest = [
+    input.method.toUpperCase(),
+    parts.path,
+    canonicalquery(parts.query),
+    canonicalheaders,
+    signedheaders,
+    sha256hex(input.body),
+  ].join('\n');
+
+  final scope = '$date/${input.region}/${input.service}/aws4_request';
+
+  final stringtosign = [
+    'AWS4-HMAC-SHA256',
+    input.datetime,
+    scope,
+    sha256hex(canonicalrequest),
+  ].join('\n');
+
+  final kdate = hmacsha256(utf8.encode('AWS4${input.secret}'), utf8.encode(date));
+  final kregion = hmacsha256(kdate, utf8.encode(input.region));
+  final kservice = hmacsha256(kregion, utf8.encode(input.service));
+  final ksigning = hmacsha256(kservice, utf8.encode('aws4_request'));
+  final signature = hex(hmacsha256(ksigning, utf8.encode(stringtosign)));
+
+  final out = <String, String>{};
+
+  out['authorization'] = 'AWS4-HMAC-SHA256 Credential=${input.keyid}/$scope'
+      ', SignedHeaders=$signedheaders'
+      ', Signature=$signature';
+  out['x-amz-date'] = input.datetime;
+
+  if (null != session) {
+    out['x-amz-security-token'] = session;
+  }
+
+  return out;
+}

package/.sdk/tm/dart/lib/feature/secrets/sekreto/src/addr.dart

@@ -0,0 +1,138 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/src/addr.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// What sekreto will and will not dial.
+//
+// IN THE CORE, though no built-in kind opens a socket. `checkaddr` is the
+// rule that decides whether a token may be sent to an address at all, and a
+// rule the plugins each carried a copy of would be ten rules. It is pure
+// string work - nothing here connects to anything - so the core keeps it
+// and every plugin that speaks HTTP imports it.
+//
+// A port of typescript/src/provider/addr.ts, which is canonical.
+
+import 'sekreto.dart';
+
+/// The index of the first character of [chars], or -1.
+int stopat(String text, String chars) {
+  for (var at = 0; at < text.length; at++) {
+    if (chars.contains(text[at])) {
+      return at;
+    }
+  }
+  return -1;
+}
+
+/// An address with any userinfo replaced by `[redacted]`, for messages.
+///
+/// Every refusal below names the address it refused, and one of them fires
+/// precisely because the address carries a credential - so printing it
+/// verbatim would write the password to stderr and into the logs. It cannot
+/// be cleaned up afterwards either: that password was never resolved as a
+/// secret, so redact() has never seen it and never will. The host is what a
+/// reader needs to identify which chain entry is at fault; the userinfo is
+/// not.
+String safeaddr(String addr) {
+  final mark = addr.indexOf('://');
+  if (-1 == mark) {
+    return addr;
+  }
+
+  final rest = addr.substring(mark + 3);
+  final stop = stopat(rest, '/?#');
+  final authority = -1 == stop ? rest : rest.substring(0, stop);
+
+  final at = authority.lastIndexOf('@');
+  if (-1 == at) {
+    return addr;
+  }
+
+  return '${addr.substring(0, mark + 3)}[redacted]${addr.substring(mark + 3 + at)}';
+}
+
+/// Refuse to send a secret-bearing credential in the clear.
+///
+/// A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+/// convenience. Sending a token over http to anything but the local machine
+/// puts both the token and the secret it fetches on the wire for anyone on
+/// the path, so sekreto will not do it. Loopback stays allowed: that is
+/// `vault server -dev`, `boru vault serve`, and this repo's own test
+/// harness.
+///
+/// The address is read by hand, in the same handful of steps in every port,
+/// rather than by `Uri.parse`. That is deliberate. A dozen parsers disagree
+/// about malformed input - where userinfo ends, whether `0177.0.0.1` is
+/// loopback, what an unclosed bracket means - and a check that answers
+/// differently in different ports is not a check.
+///
+/// The rule this parse obeys, and the reason it can be trusted: it is never
+/// more permissive than the HTTP client that will dial the address. It ends
+/// the authority at `/`, `?` or `#` only, so a client that also breaks on
+/// `\` (WHATWG does) can only ever see a SHORTER host than this does. It
+/// refuses userinfo outright rather than locating its end. It compares the
+/// host literally, so a numeric form no parser here agrees on is refused
+/// rather than guessed at.
+void checkaddr(String addr) {
+  final String scheme;
+
+  if (addr.startsWith('https://')) {
+    scheme = 'https://';
+  } else if (addr.startsWith('http://')) {
+    scheme = 'http://';
+  } else {
+    throw SekretoError('sekreto: not an http(s) address: ${safeaddr(addr)}');
+  }
+
+  final rest = addr.substring(scheme.length);
+  final end = stopat(rest, '/?#');
+  final authority = -1 == end ? rest : rest.substring(0, end);
+
+  // Userinfo is refused outright rather than parsed around, and on https as
+  // well as http. No store this library speaks authenticates by userinfo -
+  // they take a token or a signature - so an address carrying one is a
+  // mistake at best. At worst it is the attack this whole function exists to
+  // stop: `http://localhost:8200@evil.example.com/` is a request to
+  // evil.example.com that reads, to anything that splits the authority on
+  // ':', as loopback.
+  if (authority.contains('@')) {
+    throw SekretoError(
+      'sekreto: refusing an address with embedded credentials: ${safeaddr(addr)}',
+    );
+  }
+
+  // An opening bracket with no closing one is not an address at all.
+  if (authority.startsWith('[') && !authority.contains(']')) {
+    throw SekretoError(
+      'sekreto: not a valid http(s) address: ${safeaddr(addr)}',
+    );
+  }
+
+  if ('https://' == scheme) {
+    return;
+  }
+
+  // A bracketed IPv6 literal keeps its brackets. Splitting the authority on
+  // the first colon yields '[', so `http://[::1]:8200` could never match -
+  // which would make the '[::1]' entry below unreachable, and refuse a
+  // legitimate local vault.
+  final String host;
+  if (authority.startsWith('[')) {
+    host = authority.substring(0, authority.indexOf(']') + 1).toLowerCase();
+  } else {
+    final colon = authority.indexOf(':');
+    host = (-1 == colon ? authority : authority.substring(0, colon))
+        .toLowerCase();
+  }
+
+  // Literal, and exactly four. Nothing is normalised: `0177.0.0.1`,
+  // `2130706433` and `[::ffff:127.0.0.1]` are loopback to some resolvers and
+  // not to others, and a check that has to guess is not a check.
+  if ('localhost' != host &&
+      '127.0.0.1' != host &&
+      '::1' != host &&
+      '[::1]' != host) {
+    throw SekretoError(
+      'sekreto: refusing to send a token in plaintext to ${safeaddr(addr)} (use https)',
+    );
+  }
+}