@voxgig/sdkgen-langpack 0.0.1

package/.sdk/tm/dart/lib/feature/secrets/sekreto/src/spec.dart

@@ -0,0 +1,200 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/src/spec.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The declarative form of a provider, and the credentials it may carry.
+//
+// `ProviderSpec` is what a config file, the shared spec and an app's own
+// chain description all look like: `kind` picks the provider and everything
+// else is that kind's own. A plugin instance reads it back as
+// `inst.options` (see support.dart).
+//
+// IN THE CORE, and not because the core builds every kind - it builds four.
+// A spec is the SHAPE a chain is declared in, so a chain a plugin will
+// build is still described here; the plugin reads it back through the same
+// pair of converters every other kind uses.
+//
+// A port of typescript/src/provider/support.ts, which is canonical.
+
+/// Logging in to a vault instead of being handed a token. `method` is
+/// `kubernetes` or `approle`; `mount` defaults to the method name.
+class AuthSpec {
+  final String method;
+  final String? mount;
+
+  /// kubernetes: the Vault role to log in as.
+  final String? role;
+
+  /// kubernetes: the service-account JWT itself (tests).
+  final String? jwt;
+
+  /// kubernetes: where the JWT lives; the conventional pod path by default.
+  final String? jwtfile;
+
+  /// approle: the role and secret ids.
+  final String? roleid;
+  final String? secretid;
+
+  const AuthSpec({
+    required this.method,
+    this.mount,
+    this.role,
+    this.jwt,
+    this.jwtfile,
+    this.roleid,
+    this.secretid,
+  });
+
+  /// Printed without its credentials.
+  ///
+  /// A printer that walked every field would put the service-account JWT and
+  /// the AppRole secret id into `print('bad chain: $specs')` - which is what
+  /// someone writes when a chain will not build. Fields that hold a
+  /// credential report whether they are set, never what they are.
+  @override
+  String toString() => 'AuthSpec(method: $method, mount: $mount, role: $role, '
+      'jwtfile: $jwtfile, roleid: $roleid, jwt: ${setornot(jwt)}, '
+      'secretid: ${setornot(secretid)})';
+}
+
+/// What a credential field reports about itself.
+String setornot(String? value) =>
+    (null != value && value.isNotEmpty) ? '[set]' : '[unset]';
+
+/// The declarative form of a provider, as used in config and in the shared
+/// spec. `kind` picks the provider; everything else is that kind's own.
+class ProviderSpec {
+  final String kind;
+
+  /// The store name `Sekreto.getfrom` addresses. Defaults to `kind`.
+  final String? name;
+  final String? prefix;
+
+  /// dotenv: the file to read. secretspec: the declaration to read.
+  final String? file;
+
+  /// memory: literal values, keyed like environment variables. Insertion
+  /// ordered, because the spec compares whole maps.
+  final Map<String, String>? values;
+
+  /// file: the directory of one-secret-per-file entries.
+  final String? dir;
+
+  /// hashicorp / boru (wire) / gcp / 1password / doppler / infisical: the
+  /// base URL.
+  final String? addr;
+
+  /// hashicorp / boru (wire) / gcp / azure / 1password / doppler /
+  /// infisical: the token.
+  final String? token;
+
+  /// hashicorp / boru (wire): the KV mount (default `secret`).
+  final String? mount;
+
+  /// hashicorp: KV engine version, 1 or 2 (default 2).
+  final int? kv;
+
+  /// hashicorp: Vault Enterprise namespace (X-Vault-Namespace).
+  final String? vaultnamespace;
+
+  /// hashicorp: log in for a token instead of being handed one.
+  final AuthSpec? auth;
+
+  /// boru / secretspec: the executable to run (default: the kind's name).
+  final String? command;
+
+  /// secretspec: the profile to read (`--profile`).
+  final String? profile;
+
+  /// secretspec: which of ITS backends to read from (`--provider`), e.g.
+  /// `keyring` or `dotenv://.env`. Named `backend` here because `provider`
+  /// already means a sekreto provider.
+  final String? backend;
+
+  /// secretspec: the audit reason recorded for the read (`--reason`).
+  /// SecretSpec refuses to read without one.
+  final String? reason;
+
+  /// boru: the namespace qualifying the alias.
+  final String? namespace;
+
+  /// boru: the vault home, passed as BORU_HOME.
+  final String? home;
+
+  /// aws: region and credentials; the standard AWS_* variables fill the
+  /// rest.
+  final String? region;
+  final String? keyid;
+  final String? secret;
+  final String? session;
+
+  /// gcp / doppler / infisical: the project, however that store names it.
+  final String? project;
+
+  /// azure: the Key Vault name or full URL. 1password: the vault name or id.
+  final String? vault;
+
+  /// azure: client-credential login. infisical: universal-auth login.
+  final String? tenant;
+  final String? clientid;
+  final String? clientsecret;
+
+  /// azure: where to log in / where IMDS answers. gcp: the metadata server.
+  final String? loginaddr;
+  final String? imdsaddr;
+  final String? metadataaddr;
+
+  /// azure: the Key Vault API version (default 7.4).
+  final String? apiversion;
+
+  /// doppler: the config slug (with `project`).
+  final String? config;
+
+  /// infisical: the environment slug and secret path.
+  final String? environment;
+  final String? path;
+
+  const ProviderSpec({
+    required this.kind,
+    this.name,
+    this.prefix,
+    this.file,
+    this.values,
+    this.dir,
+    this.addr,
+    this.token,
+    this.mount,
+    this.kv,
+    this.vaultnamespace,
+    this.auth,
+    this.command,
+    this.profile,
+    this.backend,
+    this.reason,
+    this.namespace,
+    this.home,
+    this.region,
+    this.keyid,
+    this.secret,
+    this.session,
+    this.project,
+    this.vault,
+    this.tenant,
+    this.clientid,
+    this.clientsecret,
+    this.loginaddr,
+    this.imdsaddr,
+    this.metadataaddr,
+    this.apiversion,
+    this.config,
+    this.environment,
+    this.path,
+  });
+
+  /// Printed without its credentials. See AuthSpec.toString: a printer that
+  /// walked every field would put the Vault token, the AWS secret access key
+  /// and the Azure client secret into whatever formatted it.
+  @override
+  String toString() => 'ProviderSpec(kind: $kind, name: $name, addr: $addr, '
+      'token: ${setornot(token)}, secret: ${setornot(secret)}, '
+      'clientsecret: ${setornot(clientsecret)}, auth: $auth)';
+}

package/.sdk/tm/dart/lib/feature/secrets/sekreto/src/support.dart

@@ -0,0 +1,217 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (dart/src/support.dart)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// How a provider kind becomes a voxgig/plugin definition.
+//
+// This file is the whole bridge between the two libraries. A provider kind
+// is a plugin `Definition` named after the kind; its `define` reads the
+// instance's options as a `ProviderSpec`, builds the provider, and exports
+// it under the key `provider`. `Sekreto` reads it back off the host. One
+// helper makes every one of them, built-in or plugin, shipped or custom:
+//
+//     final mystore = providerplugin('mystore', (spec) => Mystore(spec.addr));
+//
+// A port of typescript/src/provider/support.ts, which is canonical.
+
+import '../../plugin/plugin.dart' as plugin;
+
+import 'provider.dart';
+import 'sekreto.dart';
+import 'spec.dart';
+
+/// A voxgig/plugin definition.
+///
+/// plugin's value model is `dynamic`, and a definition is a map of `name` to
+/// the kind and `define` to the callback - which is what makes a catalog a
+/// data structure a document could produce. The alias exists so that a
+/// `plugins` list reads as what it is rather than as
+/// `List<Map<String, dynamic>>`.
+typedef Definition = Map<String, dynamic>;
+
+/// The export key under which a provider definition publishes the provider
+/// it built. `Sekreto` reads `<ref>/provider` off the host.
+const String PROVIDER_EXPORT = 'provider';
+
+/// The voxgig/plugin error code a SekretoError travels under when it is
+/// raised inside a definition's `define`.
+///
+/// plugin wraps a code-less error raised by a callback as
+/// `plugin_define_failed`, and keeps one that already carries a code. A
+/// provider that refuses its own configuration - `kv: 3`, a missing project
+/// - raises a SekretoError, and the shared spec pins that message byte for
+/// byte, so it must come back out of the host exactly as it went in.
+/// `providerplugin` gives it this code on the way in; `Sekreto` takes it off
+/// on the way out. Nowhere else catches and rewraps.
+const String ERROR_CODE = 'sekreto_error';
+
+/// A provider kind, as a voxgig/plugin definition.
+///
+/// Nothing runs at `activate`: a provider opens nothing until its first
+/// lookup, so there is nothing to capture - a provider that does hold a
+/// resource acquires it there and lets the instance scope unwind it.
+Definition providerplugin(String kind, Provider Function(ProviderSpec) make) =>
+    {
+      'name': kind,
+      // A one-argument closure, so plugin's `_run` sees a Function and calls
+      // it with the instance.
+      'define': (plugin.Inst inst) {
+        final Provider provider;
+
+        try {
+          provider = make(specof(inst.options));
+        } on SekretoError catch (err) {
+          throw plugin.PluginError(
+            ERROR_CODE,
+            err.message,
+            {'ref': inst.ref, 'cause': err.message},
+          );
+        }
+
+        inst.export(PROVIDER_EXPORT, provider);
+      },
+    };
+
+// --- the spec across the plugin boundary -----------------------------
+//
+// plugin's options are its own value model - a map of strings to null,
+// bool, num, String, List and Map - and sekreto's spec is a typed class, so
+// the two are written out field by field rather than reflected over.
+// `optionsof` is what `Sekreto.declare` hands to `host.load`; `specof` is
+// what a definition's `define` reads back. They are inverses, and the seam
+// test `a provider spec survives the plugin boundary` is what says so - a
+// field added to one and forgotten in the other would otherwise be lost in
+// silence, and only for the kinds no conformance case exercises.
+
+void _put(Map<String, dynamic> out, String key, Object? value) {
+  if (null != value) {
+    out[key] = value;
+  }
+}
+
+String? _str(Map<String, dynamic> options, String key) {
+  final value = options[key];
+  return value is String ? value : null;
+}
+
+/// A ProviderSpec as plugin instance options.
+Map<String, dynamic> optionsof(ProviderSpec spec) {
+  final out = <String, dynamic>{};
+
+  out['kind'] = spec.kind;
+  _put(out, 'name', spec.name);
+  _put(out, 'prefix', spec.prefix);
+  _put(out, 'file', spec.file);
+  _put(out, 'values',
+      null == spec.values ? null : Map<String, dynamic>.from(spec.values!));
+  _put(out, 'dir', spec.dir);
+  _put(out, 'addr', spec.addr);
+  _put(out, 'token', spec.token);
+  _put(out, 'mount', spec.mount);
+  _put(out, 'kv', spec.kv);
+  _put(out, 'vaultnamespace', spec.vaultnamespace);
+
+  final auth = spec.auth;
+  if (null != auth) {
+    final nested = <String, dynamic>{};
+    nested['method'] = auth.method;
+    _put(nested, 'mount', auth.mount);
+    _put(nested, 'role', auth.role);
+    _put(nested, 'jwt', auth.jwt);
+    _put(nested, 'jwtfile', auth.jwtfile);
+    _put(nested, 'roleid', auth.roleid);
+    _put(nested, 'secretid', auth.secretid);
+    out['auth'] = nested;
+  }
+
+  _put(out, 'command', spec.command);
+  _put(out, 'profile', spec.profile);
+  _put(out, 'backend', spec.backend);
+  _put(out, 'reason', spec.reason);
+  _put(out, 'namespace', spec.namespace);
+  _put(out, 'home', spec.home);
+  _put(out, 'region', spec.region);
+  _put(out, 'keyid', spec.keyid);
+  _put(out, 'secret', spec.secret);
+  _put(out, 'session', spec.session);
+  _put(out, 'project', spec.project);
+  _put(out, 'vault', spec.vault);
+  _put(out, 'tenant', spec.tenant);
+  _put(out, 'clientid', spec.clientid);
+  _put(out, 'clientsecret', spec.clientsecret);
+  _put(out, 'loginaddr', spec.loginaddr);
+  _put(out, 'imdsaddr', spec.imdsaddr);
+  _put(out, 'metadataaddr', spec.metadataaddr);
+  _put(out, 'apiversion', spec.apiversion);
+  _put(out, 'config', spec.config);
+  _put(out, 'environment', spec.environment);
+  _put(out, 'path', spec.path);
+
+  return out;
+}
+
+/// Plugin instance options as a ProviderSpec.
+ProviderSpec specof(Map<String, dynamic> options) {
+  final rawvalues = options['values'];
+  final values = rawvalues is Map
+      ? <String, String>{
+          for (final entry in rawvalues.entries)
+            '${entry.key}': '${entry.value}',
+        }
+      : null;
+
+  final rawauth = options['auth'];
+  final auth = rawauth is Map
+      ? AuthSpec(
+          method: rawauth['method'] is String ? rawauth['method'] as String : '',
+          mount: rawauth['mount'] is String ? rawauth['mount'] as String : null,
+          role: rawauth['role'] is String ? rawauth['role'] as String : null,
+          jwt: rawauth['jwt'] is String ? rawauth['jwt'] as String : null,
+          jwtfile:
+              rawauth['jwtfile'] is String ? rawauth['jwtfile'] as String : null,
+          roleid:
+              rawauth['roleid'] is String ? rawauth['roleid'] as String : null,
+          secretid: rawauth['secretid'] is String
+              ? rawauth['secretid'] as String
+              : null,
+        )
+      : null;
+
+  final kv = options['kv'];
+
+  return ProviderSpec(
+    kind: _str(options, 'kind') ?? '',
+    name: _str(options, 'name'),
+    prefix: _str(options, 'prefix'),
+    file: _str(options, 'file'),
+    values: values,
+    dir: _str(options, 'dir'),
+    addr: _str(options, 'addr'),
+    token: _str(options, 'token'),
+    mount: _str(options, 'mount'),
+    kv: kv is num ? kv.toInt() : null,
+    vaultnamespace: _str(options, 'vaultnamespace'),
+    auth: auth,
+    command: _str(options, 'command'),
+    profile: _str(options, 'profile'),
+    backend: _str(options, 'backend'),
+    reason: _str(options, 'reason'),
+    namespace: _str(options, 'namespace'),
+    home: _str(options, 'home'),
+    region: _str(options, 'region'),
+    keyid: _str(options, 'keyid'),
+    secret: _str(options, 'secret'),
+    session: _str(options, 'session'),
+    project: _str(options, 'project'),
+    vault: _str(options, 'vault'),
+    tenant: _str(options, 'tenant'),
+    clientid: _str(options, 'clientid'),
+    clientsecret: _str(options, 'clientsecret'),
+    loginaddr: _str(options, 'loginaddr'),
+    imdsaddr: _str(options, 'imdsaddr'),
+    metadataaddr: _str(options, 'metadataaddr'),
+    apiversion: _str(options, 'apiversion'),
+    config: _str(options, 'config'),
+    environment: _str(options, 'environment'),
+    path: _str(options, 'path'),
+  );
+}

package/.sdk/tm/dart/lib/feature/streaming/StreamingFeature.dart

@@ -0,0 +1,97 @@
+// ignore_for_file: non_constant_identifier_names
+
+import 'dart:async';
+
+import '../base/BaseFeature.dart';
+
+// Streaming result support. For list-style operations it attaches a
+// `result.stream()` Stream factory so callers can consume items
+// incrementally with `await for (final item in result.stream())` instead of
+// materialising the whole list. The stream reads the result's data lazily,
+// so it reflects the parsed entities. A `chunkDelay` (ms) simulates
+// paced/chunked delivery for offline tests via the injectable `sleep`; a
+// `chunkSize` groups items into batches when set.
+class StreamingFeature extends BaseFeature {
+  dynamic _client;
+
+  StreamingFeature() {
+    version = '0.0.1';
+    name = 'streaming';
+    active = true;
+  }
+
+  @override
+  dynamic init(dynamic ctx, dynamic opts) {
+    _client = ctx.client;
+    options = opts is Map ? Map<String, dynamic>.from(opts) : {};
+    active = true == options['active'];
+    return null;
+  }
+
+  @override
+  dynamic PreResult(dynamic ctx) {
+    if (!_streamable(ctx)) {
+      return null;
+    }
+    final result = ctx.result;
+    if (null == result) {
+      return null;
+    }
+
+    final self = this;
+    result.streaming = true;
+
+    result.stream = () {
+      return self._iterate(result);
+    };
+
+    final track = _client.track;
+    if (null == track['streaming']) {
+      track['streaming'] = {'opened': 0};
+    }
+    track['streaming']['opened']++;
+    return null;
+  }
+
+  Stream<dynamic> _iterate(dynamic result) async* {
+    final chunkDelay = (options['chunkDelay'] ?? 0) as num;
+    final chunkSize = (options['chunkSize'] ?? 0) as num;
+
+    // Read lazily so downstream result processing is reflected.
+    final items = result.resdata is List ? result.resdata as List : [];
+
+    if (0 < chunkSize) {
+      for (var i = 0; i < items.length; i += chunkSize.toInt()) {
+        if (0 < chunkDelay) {
+          await _sleep(chunkDelay.toInt());
+        }
+        final end = i + chunkSize.toInt();
+        yield items.sublist(i, end > items.length ? items.length : end);
+      }
+      return;
+    }
+
+    for (final item in items) {
+      if (0 < chunkDelay) {
+        await _sleep(chunkDelay.toInt());
+      }
+      yield item;
+    }
+  }
+
+  bool _streamable(dynamic ctx) {
+    final ops = options['ops'] ?? ['list'];
+    return (ops as List).contains(null == ctx.op ? null : ctx.op.name);
+  }
+
+  Future<void> _sleep(int ms) {
+    if (0 >= ms) {
+      return Future.value();
+    }
+    final sleeper = options['sleep'];
+    if (sleeper is Function) {
+      return Future.value(sleeper(ms)).then((_x) {});
+    }
+    return Future.delayed(Duration(milliseconds: ms));
+  }
+}

package/.sdk/tm/dart/lib/feature/telemetry/TelemetryFeature.dart

@@ -0,0 +1,136 @@
+// ignore_for_file: non_constant_identifier_names
+
+import '../base/BaseFeature.dart';
+
+// Distributed-tracing telemetry. Opens a span per operation (PrePoint),
+// propagates trace context to the server as W3C `traceparent` plus
+// `X-Trace-Id` / `X-Span-Id` headers (PreRequest), and closes the span on
+// completion (PreDone) or failure (PreUnexpected). Finished spans are kept
+// on the client track (`telemetry.spans`); an `exporter` callback, when
+// provided, is invoked with each finished span. Trace/span id generation
+// and the clock are injectable for deterministic tests.
+class TelemetryFeature extends BaseFeature {
+  dynamic _client;
+  final Map<dynamic, dynamic> _spans = {};
+  int _seq = 0;
+
+  TelemetryFeature() {
+    version = '0.0.1';
+    name = 'telemetry';
+    active = true;
+  }
+
+  @override
+  dynamic init(dynamic ctx, dynamic opts) {
+    _client = ctx.client;
+    options = opts is Map ? Map<String, dynamic>.from(opts) : {};
+    active = true == options['active'];
+    _spans.clear();
+    _seq = 0;
+
+    final track = _client.track;
+    if (null == track['telemetry']) {
+      track['telemetry'] = <String, dynamic>{'spans': <dynamic>[], 'active': 0};
+    }
+    return null;
+  }
+
+  @override
+  dynamic PrePoint(dynamic ctx) {
+    final span = <String, dynamic>{
+      'traceId': _id('trace'),
+      'spanId': _id('span'),
+      'name': (null == ctx.op ? '_' : (ctx.op.entity ?? '_')).toString() +
+          '.' +
+          (null == ctx.op ? '_' : (ctx.op.name ?? '_')).toString(),
+      'start': _now(),
+      'end': null,
+      'durationMs': null,
+      'ok': null,
+    };
+    _spans[ctx] = span;
+    _client.track['telemetry']['active']++;
+    return null;
+  }
+
+  @override
+  dynamic PreRequest(dynamic ctx) {
+    final span = _spans[ctx];
+    final spec = ctx.spec;
+    if (null == span || null == spec) {
+      return null;
+    }
+    spec.headers ??= {};
+    final h = options['headers'] ?? {};
+    spec.headers[h['trace'] ?? 'X-Trace-Id'] = span['traceId'];
+    spec.headers[h['span'] ?? 'X-Span-Id'] = span['spanId'];
+    spec.headers[h['parent'] ?? 'traceparent'] = '00-' +
+        span['traceId'].toString() +
+        '-' +
+        span['spanId'].toString() +
+        '-01';
+    return null;
+  }
+
+  @override
+  dynamic PreDone(dynamic ctx) {
+    _close(
+        ctx,
+        null != ctx.result &&
+            false != ctx.result.ok &&
+            null == ctx.result.err);
+    return null;
+  }
+
+  @override
+  dynamic PreUnexpected(dynamic ctx) {
+    _close(ctx, false);
+    return null;
+  }
+
+  void _close(dynamic ctx, bool ok) {
+    // Close once per operation; a PreDone followed by a pipeline throw
+    // (non-2xx) fires PreUnexpected too, which then finds no open span.
+    final span = _spans[ctx];
+    if (null == span) {
+      return;
+    }
+    _spans.remove(ctx);
+    span['end'] = _now();
+    final dur = span['end'] - span['start'];
+    span['durationMs'] = dur < 0 ? 0 : dur;
+    span['ok'] = ok;
+
+    final telemetry = _client.track['telemetry'];
+    telemetry['active']--;
+    telemetry['spans'].add(span);
+
+    final exporter = options['exporter'];
+    if (exporter is Function) {
+      try {
+        exporter(span);
+      } catch (_e) {
+        // Exporter failures are swallowed.
+      }
+    }
+  }
+
+  String _id(String kind) {
+    final idgen = options['idgen'];
+    if (idgen is Function) {
+      return idgen(kind).toString();
+    }
+    // Deterministic-ish sequential id; unique within a client instance.
+    _seq++;
+    final n = _seq.toRadixString(16).padLeft(4, '0');
+    return ('trace' == kind ? 't' : 's') + n.padRight(16, '0');
+  }
+
+  num _now() {
+    final now = options['now'];
+    if (now is Function) {
+      return now();
+    }
+    return DateTime.now().millisecondsSinceEpoch;
+  }
+}