@voxgig/sdkgen-langpack 0.0.1

package/.sdk/tm/dart/lib/feature/secrets/sekreto/src/json.dart

@@ -0,0 +1,276 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/src/json.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Minimal JSON support for sekreto.
+//
+// `dart:convert` is part of the SDK, so the scanner itself is not
+// hand-rolled here as it is in the ports whose standard library has none.
+// What is written out is everything around it: a closed value model, a
+// parse that says "this text is not JSON" without saying "this text is the
+// literal null", a depth bound, a rejection of non-finite numbers, and a
+// writer whose output is byte-identical to every other port's.
+//
+// A sealed class rather than plain `dynamic`: a vault answering `null`,
+// `false`, `0` and "no such key" means four different things, and a closed
+// model keeps them apart at compile time rather than by convention.
+//
+// A port of typescript/src/Json.ts, which is canonical.
+
+import 'dart:convert';
+
+/// How deep a response body may nest before it is refused. A body arrives
+/// before any trust check has been made of what sent it, and `[[[[...`
+/// costs nothing to write; the walk below is recursive, so the bound is
+/// what keeps a hostile body from taking the process down with it.
+const int MAXDEPTH = 128;
+
+/// Thrown while converting malformed JSON; never escapes [jsonparse].
+class _JsonError implements Exception {
+  final String message;
+  _JsonError(this.message);
+  @override
+  String toString() => message;
+}
+
+/// A JSON value: exactly six shapes, and no seventh.
+sealed class Json {
+  const Json();
+
+  /// The string, or nothing when this is not a string.
+  String? get asstr => null;
+
+  /// The number, or nothing when this is not a number.
+  double? get asnum => null;
+
+  /// The array, or nothing when this is not an array.
+  List<Json>? get asarr => null;
+
+  /// The object, or nothing when this is not an object.
+  Map<String, Json>? get asobj => null;
+
+  /// This value as the text a caller would print, or nothing when there is
+  /// no value at all. A JSON null is "no value": every provider here treats
+  /// it as a miss rather than as the string "null".
+  String? get text => jsonstringify(this);
+
+  /// Walk nested objects; nothing the moment a step is not there.
+  Json? dig(String key, [String? key2, String? key3]) {
+    Json? at = this;
+
+    for (final step in [key, key2, key3]) {
+      if (null == step) {
+        break;
+      }
+      final fields = at?.asobj;
+      at = null == fields ? null : fields[step];
+    }
+
+    return at;
+  }
+}
+
+class JsonNull extends Json {
+  const JsonNull();
+  @override
+  String? get text => null;
+}
+
+class JsonBool extends Json {
+  final bool value;
+  const JsonBool(this.value);
+  @override
+  String? get text => value ? 'true' : 'false';
+}
+
+class JsonNum extends Json {
+  final double value;
+  const JsonNum(this.value);
+  @override
+  double? get asnum => value;
+  @override
+  String? get text => numstr(value);
+}
+
+class JsonStr extends Json {
+  final String value;
+  const JsonStr(this.value);
+  @override
+  String? get asstr => value;
+  @override
+  String? get text => value;
+}
+
+class JsonArr extends Json {
+  final List<Json> value;
+  const JsonArr(this.value);
+  @override
+  List<Json>? get asarr => value;
+}
+
+class JsonObj extends Json {
+  /// Insertion-ordered: Dart map literals and `jsonDecode` both answer a
+  /// LinkedHashMap, and a payload's field order is signed.
+  final Map<String, Json> value;
+  const JsonObj(this.value);
+  @override
+  Map<String, Json>? get asobj => value;
+}
+
+/// The same reads on a value that may not be there at all - a response body
+/// is `Json?`, because a store may not have answered with JSON - so a
+/// provider can walk it without unwrapping at every step.
+extension JsonMaybe on Json? {
+  Json? dig(String key, [String? key2, String? key3]) =>
+      this?.dig(key, key2, key3);
+  String? get text => this?.text;
+  String? get asstr => this?.asstr;
+  double? get asnum => this?.asnum;
+  List<Json>? get asarr => this?.asarr;
+  Map<String, Json>? get asobj => this?.asobj;
+}
+
+/// Parse JSON text. Nothing for anything unreadable - which the caller must
+/// tell apart from a literal `null` body, since only the first means the
+/// store could not answer coherently.
+///
+/// `jsonDecode` drives its own explicit stack, so a deeply nested body does
+/// not recurse until it arrives here; [_convert] is what bounds it.
+Json? jsonparse(String? text) {
+  if (null == text || text.isEmpty) {
+    return null;
+  }
+
+  try {
+    return _convert(jsonDecode(text), 0);
+  } catch (_) {
+    // No error escapes: "not JSON" is a value, not an exception.
+    return null;
+  }
+}
+
+Json _convert(Object? value, int depth) {
+  if (MAXDEPTH < depth) {
+    throw _JsonError('sekreto: json: too deeply nested');
+  }
+
+  if (null == value) {
+    return const JsonNull();
+  }
+
+  if (value is bool) {
+    return JsonBool(value);
+  }
+
+  if (value is num) {
+    final asdouble = value.toDouble();
+    // JSON has no infinity, and `1e999` decodes to one. Left alone it
+    // reaches a token-expiry computation as a number that is not a number.
+    if (asdouble.isNaN || asdouble.isInfinite) {
+      throw _JsonError('sekreto: json: number is not finite');
+    }
+    return JsonNum(asdouble);
+  }
+
+  if (value is String) {
+    return JsonStr(value);
+  }
+
+  if (value is List) {
+    return JsonArr(
+      value.map<Json>((entry) => _convert(entry, depth + 1)).toList(),
+    );
+  }
+
+  if (value is Map) {
+    final out = <String, Json>{};
+    value.forEach((key, entry) => out['$key'] = _convert(entry, depth + 1));
+    return JsonObj(out);
+  }
+
+  throw _JsonError('sekreto: json: unreadable value');
+}
+
+/// Render a value as compact JSON: no spaces, no newlines.
+String jsonstringify(Json value) {
+  final out = StringBuffer();
+  _write(value, out);
+  return out.toString();
+}
+
+void _write(Json value, StringBuffer out) {
+  switch (value) {
+    case JsonNull():
+      out.write('null');
+    case JsonBool(value: final entry):
+      out.write(entry ? 'true' : 'false');
+    case JsonNum(value: final entry):
+      out.write(numstr(entry));
+    case JsonStr(value: final entry):
+      out.write(jsonquote(entry));
+    case JsonArr(value: final entries):
+      out.write('[');
+      for (var at = 0; at < entries.length; at++) {
+        if (0 < at) {
+          out.write(',');
+        }
+        _write(entries[at], out);
+      }
+      out.write(']');
+    case JsonObj(value: final entries):
+      out.write('{');
+      var first = true;
+      entries.forEach((key, entry) {
+        if (!first) {
+          out.write(',');
+        }
+        first = false;
+        out.write(jsonquote(key));
+        out.write(':');
+        _write(entry, out);
+      });
+      out.write('}');
+  }
+}
+
+/// Render a string as a JSON string literal, quotes included. Public
+/// because the CLI assembles its one line of output field by field.
+String jsonquote(String text) {
+  final out = StringBuffer('"');
+
+  for (final unit in text.codeUnits) {
+    if (0x22 == unit) {
+      out.write(r'\"');
+    } else if (0x5c == unit) {
+      out.write(r'\\');
+    } else if (0x0a == unit) {
+      out.write(r'\n');
+    } else if (0x0d == unit) {
+      out.write(r'\r');
+    } else if (0x09 == unit) {
+      out.write(r'\t');
+    } else if (0x20 > unit) {
+      out.write('\\u${unit.toRadixString(16).padLeft(4, '0')}');
+    } else {
+      out.writeCharCode(unit);
+    }
+  }
+
+  out.write('"');
+  return out.toString();
+}
+
+/// Render a number the way every other port does: a whole number has no
+/// fractional tail, so a JSON `1` read back and printed stays `1`. Dart
+/// prints an integral double as `1.0`, which would diverge from every other
+/// port's output and from the shared spec.
+String numstr(double value) {
+  if (value.isNaN || value.isInfinite) {
+    return 'null';
+  }
+
+  if (value == value.truncateToDouble() && 9007199254740992.0 > value.abs()) {
+    return value.toInt().toString();
+  }
+
+  return value.toString();
+}

package/.sdk/tm/dart/lib/feature/secrets/sekreto/src/provider.dart

@@ -0,0 +1,31 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/src/provider.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// A source of secrets.
+//
+// A provider answers one question: "do you have this secret?" It returns
+// the value, or null to mean "ask the next one". Nothing else about a
+// provider is visible to the caller - which is the point: an app reads
+// `api.token` and never learns whether it came from the environment, a
+// .env file, HashiCorp Vault or a boru vault.
+
+import 'dart:async';
+
+abstract class Provider {
+  /// The value, or null if this provider does not have it.
+  ///
+  /// `FutureOr` rather than `Future`, and the distinction is load-bearing.
+  /// A provider that reads the environment, a file or a child process
+  /// answers without yielding, and so does the chain that holds it: the
+  /// whole read completes synchronously, which is what lets a caller who
+  /// only ever configures local stores - the conformance suite among them -
+  /// use the result directly. A provider that opens a socket answers with a
+  /// Future, and the chain returns one in turn.
+  ///
+  /// Whichever it is, `await` reads it. A caller writes `await get(...)`
+  /// once and does not care which providers are in the chain.
+  FutureOr<String?> lookup(String name);
+
+  /// A short description, shown by `Sekreto.sources()`.
+  String describe();
+}

package/.sdk/tm/dart/lib/feature/secrets/sekreto/src/providers.dart

@@ -0,0 +1,243 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/src/providers.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// THE BUILT-IN PROVIDER KINDS - the same four in every port.
+//
+// A provider answers one question: "do you have this secret?" It returns
+// the value, or null to mean "ask the next one". Nothing else about a
+// provider is visible to the caller - which is the point: an app reads
+// `api.token` and never learns whether it came from the environment, a
+// .env file or a mounted secret directory.
+//
+// What makes a kind built in is that it reads AT MOST A LOCAL FILE: no
+// socket, no TLS, no crypto, no child process. These four are the floor
+// every chain stands on, and a chain that reads secrets from options, the
+// environment, a plaintext `.env` and a mounted secret directory works with
+// no plugin loaded at all. Everything else - the vault clients, the cloud
+// stores, the two CLIs, and `sigv4` with them - is a voxgig/plugin
+// definition under `plugins/`, and this file is the reason the core imports
+// none of it (docs/design/plugin-providers.md).
+//
+// Two failure shapes, and they are never interchangeable. A store that does
+// not hold the secret is a MISS (null) - the chain carries on. A store that
+// could not answer - bad credentials, unreachable host, missing
+// configuration - is an ERROR: falling through there would quietly reach
+// for a weaker store.
+//
+// A port of typescript/src/provider/, which is canonical.
+
+import 'dart:io';
+
+import 'provider.dart';
+import 'sekreto.dart';
+import 'support.dart';
+
+/// An environment variable, or null.
+String? getenv(String name) => Platform.environment[name];
+
+/// What a failure has to say for itself, never the empty string.
+String why(Object err) {
+  if (err is FileSystemException) {
+    final os = err.osError;
+    return null != os ? os.message : err.message;
+  }
+  if (err is SocketException) {
+    final os = err.osError;
+    return null != os ? os.message : err.message;
+  }
+  final text = '$err';
+  return text.isEmpty ? '$err.runtimeType' : text;
+}
+
+// The two errno values that mean "no secrets here" rather than "I could not
+// answer". A path that is not there, and a path whose parent is a plain
+// file, are both absence; permission denied (EACCES) and "is a directory"
+// (EISDIR) are not, and must raise rather than fall through to a weaker
+// store.
+const int _ENOENT = 2;
+const int _ENOTDIR = 20;
+
+bool absent(FileSystemException err) {
+  final code = err.osError?.errorCode;
+  return _ENOENT == code || _ENOTDIR == code;
+}
+
+/// `<dir>/<name>`, with an empty dir meaning the working directory.
+String joinpath(String dir, String name) {
+  if (dir.isEmpty) {
+    return name;
+  }
+  return dir.endsWith('/') ? '$dir$name' : '$dir/$name';
+}
+
+// ------------------------------------------------------------ the kinds
+
+/// Environment variables: `api.token` from `API_TOKEN`.
+class Env extends Provider {
+  final String? prefix;
+
+  /// An injected environment, for tests. The spec never passes one.
+  final Map<String, String>? source;
+
+  Env({this.prefix, this.source});
+
+  @override
+  String? lookup(String name) {
+    final key = envkey(name, prefix);
+    return null == source ? getenv(key) : source![key];
+  }
+
+  @override
+  String describe() =>
+      'env${(null != prefix && prefix!.isNotEmpty) ? ':$prefix' : ''}';
+}
+
+/// A `.env` file, read once, keyed exactly like the environment.
+class Dotenv extends Provider {
+  final String file;
+  final String? prefix;
+
+  // Read LAZILY, on the first lookup. An eager read would open whatever
+  // `.env` happens to sit in the working directory just because a dotenv
+  // provider is in a chain that is never read from.
+  Map<String, String>? _values;
+
+  Dotenv(this.file, {this.prefix});
+
+  Map<String, String> _load() {
+    final loaded = _values;
+    if (null != loaded) {
+      return loaded;
+    }
+
+    Map<String, String> values;
+
+    try {
+      values = parsedotenv(File(file).readAsStringSync());
+    } on FileSystemException catch (err) {
+      // An absent file - or an absent directory - means "no secrets here",
+      // exactly like the file provider. Anything else (permission denied, an
+      // unreadable mount) is a store that could not answer.
+      if (!absent(err)) {
+        throw SekretoError(
+          'sekreto: dotenv provider cannot read $file: ${why(err)}',
+        );
+      }
+      values = <String, String>{};
+    }
+
+    _values = values;
+    return values;
+  }
+
+  @override
+  String? lookup(String name) => _load()[envkey(name, prefix)];
+
+  @override
+  String describe() => 'dotenv:$file';
+}
+
+/// Literal values, keyed like environment variables. The spec uses this to
+/// test chain behaviour without touching the outside world.
+class Memory extends Provider {
+  final Map<String, String> values;
+  final String? prefix;
+
+  Memory({Map<String, String>? source, this.prefix})
+      : values = source ?? const {};
+
+  @override
+  String? lookup(String name) => values[envkey(name, prefix)];
+
+  @override
+  String describe() =>
+      'memory${(null != prefix && prefix!.isNotEmpty) ? ':$prefix' : ''}';
+}
+
+/// A directory of one-secret-per-file entries, keyed like the environment:
+/// `api.token` reads `<dir>/API_TOKEN`.
+///
+/// This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+/// secret, and a systemd credentials directory, so those all work with no
+/// further configuration. Read on every lookup and never cached: a mounted
+/// secret is rotated underneath a running process.
+///
+/// One trailing newline is stripped - tools that write these files disagree
+/// about it, and a newline is never part of a secret on purpose.
+class SecretFile extends Provider {
+  final String dir;
+  final String? prefix;
+
+  SecretFile(this.dir, {this.prefix});
+
+  @override
+  String? lookup(String name) {
+    final path = joinpath(dir, envkey(name, prefix));
+
+    final String body;
+
+    try {
+      body = File(path).readAsStringSync();
+    } on FileSystemException catch (err) {
+      if (absent(err)) {
+        return null;
+      }
+      throw SekretoError(
+        'sekreto: file provider cannot read $path: ${why(err)}',
+      );
+    }
+
+    if (body.endsWith('\r\n')) {
+      return body.substring(0, body.length - 2);
+    }
+    if (body.endsWith('\n')) {
+      return body.substring(0, body.length - 1);
+    }
+    return body;
+  }
+
+  @override
+  String describe() => 'file:$dir';
+}
+
+// ------------------------------------------------------- the definitions
+
+/// The four built-in kinds, as voxgig/plugin definitions - made by exactly
+/// the same helper as every plugin kind and every custom one.
+///
+/// `Sekreto` puts these into its catalog first, then whatever `plugins`
+/// handed in, so a plugin naming a built-in kind replaces it: a host
+/// substituting an implementation, never an accident, because these four
+/// names are documented.
+final List<Definition> BUILTINS = [
+  providerplugin('env', (spec) => Env(prefix: spec.prefix)),
+  providerplugin(
+      'memory', (spec) => Memory(source: spec.values, prefix: spec.prefix)),
+  providerplugin(
+      'dotenv', (spec) => Dotenv(spec.file ?? '.env', prefix: spec.prefix)),
+  providerplugin(
+      'file', (spec) => SecretFile(spec.dir ?? '', prefix: spec.prefix)),
+];
+
+/// Every kind this library ships, built in or as a plugin, so that a kind
+/// sekreto has never heard of can be told from one that exists as a plugin
+/// and was not passed in.
+///
+/// Ten strings, not ten imports: the core knows the plugin NAMES without
+/// reaching a single plugin file.
+class KINDS {
+  static const List<String> builtin = ['env', 'memory', 'dotenv', 'file'];
+
+  static const List<String> plugin = [
+    'hashicorp',
+    'boru',
+    'awssecrets',
+    'awsparams',
+    'gcpsecrets',
+    'azuresecrets',
+    'onepassword',
+    'doppler',
+    'infisical',
+    'secretspec',
+  ];
+}