@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/c/feature/secrets/plugin/value.h

@@ -0,0 +1,135 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/value.h)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The dynamic value, and the JSON reader that fills it (§16).
+ *
+ * NO DEPENDENCIES, not even a JSON library: §16 permits exactly one
+ * runtime dependency (voxgig/struct) and C has no port of it, so the
+ * corpus JSON is parsed here. A package graph is also a supply chain.
+ *
+ * ARENA ALLOCATION, and it is the design rather than a shortcut. Every
+ * Value this port makes lives in one arena and the whole arena is freed
+ * at once. The alternative — ownership per value, or refcounting — buys
+ * nothing a test-driven library needs and costs the thing C ports fail
+ * at: a `free` on a path the corpus does not exercise. Nothing here
+ * frees an individual value, so nothing here can double-free one.
+ *
+ * A MAP PRESERVES INSERTION ORDER AND SORTS ON DEMAND. §4 rule 4 makes
+ * order observable in several places (`keys` is sorted, `pos` is the
+ * sorted-ref index), so both orders have to be available and the code
+ * has to say which it means at each use.
+ */
+
+#ifndef VOXGIG_PLUGIN_VALUE_H
+#define VOXGIG_PLUGIN_VALUE_H
+
+#include <stddef.h>
+#include <stdbool.h>
+
+typedef enum {
+  VNULL = 0,
+  VBOOL,
+  VNUM,
+  VSTR,
+  VLIST,
+  VMAP
+} VKind;
+
+typedef struct Value Value;
+
+/* A map entry. Kept as a linked list rather than a hash table: the maps
+ * here hold a handful of keys, insertion order must survive, and a
+ * hashtable would add a growth path with nothing to gain. */
+typedef struct VEntry {
+  const char *key;
+  Value *val;
+  struct VEntry *next;
+} VEntry;
+
+struct Value {
+  VKind kind;
+  bool boolean;
+  double num;
+  const char *str;
+  /* list */
+  Value **items;
+  size_t len;
+  size_t cap;
+  /* map */
+  VEntry *first;
+  VEntry *last;
+};
+
+/* --- arena ---------------------------------------------------------- */
+
+/* Allocate zeroed bytes that live until `arena_reset`. Never returns
+ * NULL: allocation failure is fatal, because a library that limps on
+ * after it cannot be reasoned about and the corpus cannot express it. */
+void *arena_alloc(size_t size);
+char *arena_strdup(const char *s);
+char *arena_strndup(const char *s, size_t n);
+/* Free EVERYTHING. Call between corpus entries, never inside one. */
+void arena_reset(void);
+
+/* --- construction --------------------------------------------------- */
+
+Value *vnull(void);
+Value *vbool(bool b);
+Value *vnum(double n);
+Value *vstr(const char *s);
+Value *vlist(void);
+Value *vmap(void);
+
+/* --- access --------------------------------------------------------- */
+
+bool visnull(const Value *v);
+bool vismap(const Value *v);
+bool vislist(const Value *v);
+bool visstr(const Value *v);
+bool visnum(const Value *v);
+bool visbool(const Value *v);
+
+/* `get` answers NULL for a missing key AND for a key holding JSON null;
+ * `has` distinguishes them, which is what §9.1's "an authored null is
+ * not an absent key" needs. */
+Value *vget(const Value *m, const char *key);
+bool vhas(const Value *m, const char *key);
+void vset(Value *m, const char *key, Value *val);
+void vdel(Value *m, const char *key);
+
+Value *vat(const Value *l, size_t i);
+void vpush(Value *l, Value *item);
+size_t vlen(const Value *v);
+
+const char *vasstr(const Value *v);
+double vasnum(const Value *v);
+bool vasbool(const Value *v);
+
+/* Keys in INSERTION order. */
+size_t vkeys(const Value *m, const char ***out);
+/* Keys SORTED by byte order — §4 rule 4's deterministic walk. */
+size_t vsortedkeys(const Value *m, const char ***out);
+
+/* §4 rule 4: truthiness is JSON's, not C's. */
+bool vtruthy(const Value *v);
+
+/* Deep equality INCLUDING JSON type, which is the half that matters:
+ * half the ports are written in languages whose `==` says `true == 1`,
+ * and `capability/match` exists to catch exactly that. */
+bool vsame(const Value *a, const Value *b);
+
+Value *vclone(const Value *v);
+
+/* --- json ----------------------------------------------------------- */
+
+/* Parse, or NULL with *err set to a message. */
+Value *vparse(const char *text, const char **err);
+/* Canonical JSON, keys in SORTED order so two values that are `vsame`
+ * render identically — the corpus compares rendered forms in places. */
+const char *vjson(const Value *v);
+
+/* Numbers render as integers when they are integral, which is what the
+ * corpus's expected values look like. */
+const char *vnumstr(double n);
+
+#endif

package/project/.sdk/tm/c/feature/secrets/plugin/version.c

@@ -0,0 +1,151 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/version.c)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Versions and ranges (§11.2). */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "version.h"
+
+/* A COMPONENT IS BOUNDED, like a ref is (§4's 1024).
+ *
+ * The grammar admits an unbounded digit sequence, and every language
+ * then disagrees about what happens past its integer range: JavaScript
+ * silently loses precision, Go's Atoi errors (and a port ignoring that
+ * gets 0), C overflows, Python is exact. `satisfies("0",
+ * "9223372036854775808")` was false in the canonical and true in go,
+ * from the same corpus.
+ *
+ * 2^31-1 because every port has a signed 32-bit integer, and no real
+ * version has ever needed more. Stated rather than left to arithmetic
+ * nobody agrees on. Found by review of the go port. */
+#define COMPONENT_MAX 2147483647L
+
+/* `^(\d+)(?:\.(\d+))?(?:\.(\d+))?$`, by hand: three components, digits
+ * only, no leading sign, no empty component. Written out rather than
+ * handed to <regex.h> because the bound below has to be checked per
+ * component anyway, and a regex that matched then needed re-scanning
+ * would be the worse of both. */
+static bool parse3(const char *s, long *out, bool *overflow) {
+  out[0] = out[1] = out[2] = 0;
+  *overflow = false;
+  if (NULL == s || '\0' == s[0]) return false;
+
+  size_t i = 0;
+  for (int part = 0; part < 3; part++) {
+    if ('\0' == s[i]) return 0 < part; /* fewer than three is fine */
+    if (0 < part) {
+      if ('.' != s[i]) return false;
+      i++;
+    }
+    size_t start = i;
+    long acc = 0;
+    while ('0' <= s[i] && '9' >= s[i]) {
+      if (!*overflow) {
+        acc = acc * 10 + (s[i] - '0');
+        if (COMPONENT_MAX < acc) *overflow = true;
+      }
+      i++;
+    }
+    if (start == i) return false; /* an empty component is not a number */
+    out[part] = acc;
+  }
+  return '\0' == s[i];
+}
+
+static Value *triple(const long *n) {
+  Value *out = vlist();
+  for (int i = 0; i < 3; i++) vpush(out, vnum((double)n[i]));
+  return out;
+}
+
+Value *parserange(Value *range) {
+  if (!visstr(range) || '\0' == vasstr(range)[0]) {
+    const char *shown = visstr(range) ? vasstr(range) : "";
+    size_t sz = strlen(shown) + 32;
+    char *text = (char *)arena_alloc(sz);
+    snprintf(text, sz, "invalid range: %s", shown);
+    fail("plugin_bad_range", text,
+         details1("range", visnull(range) ? vnull() : range));
+  }
+
+  const char *s = vasstr(range);
+  /* Two forms and no more (§11.2):
+   *   '2.1'   >= 2.1.0 and < 3.0.0
+   *   '~2.1'  >= 2.1.0 and < 2.2.0 */
+  bool tilde = '~' == s[0];
+  const char *body = tilde ? s + 1 : s;
+
+  long n[3];
+  bool overflow = false;
+  if (!parse3(body, n, &overflow) || overflow) {
+    size_t sz = strlen(s) + 64;
+    char *text = (char *)arena_alloc(sz);
+    if (overflow) snprintf(text, sz, "version component out of range in %s", s);
+    else snprintf(text, sz, "invalid range: %s", s);
+    fail("plugin_bad_range", text, details1("range", range));
+  }
+
+  long lo[3] = { n[0], n[1], n[2] };
+  long hi[3];
+  if (tilde) { hi[0] = n[0]; hi[1] = n[1] + 1; hi[2] = 0; }
+  else { hi[0] = n[0] + 1; hi[1] = 0; hi[2] = 0; }
+
+  Value *out = vmap();
+  vset(out, "lo", triple(lo));
+  vset(out, "hi", triple(hi));
+  return out;
+}
+
+Value *parseversion(Value *version) {
+  if (!visstr(version)) {
+    fail("plugin_bad_range", "invalid version",
+         details1("version", visnull(version) ? vnull() : version));
+  }
+  const char *s = vasstr(version);
+  long n[3];
+  bool overflow = false;
+  if (!parse3(s, n, &overflow) || overflow) {
+    size_t sz = strlen(s) + 64;
+    char *text = (char *)arena_alloc(sz);
+    /* `plugin_bad_range` either way — the same code the rest of the
+     * grammar's failures use, because "this is not a version I can
+     * compare" is one fact however it went wrong. */
+    if (overflow) snprintf(text, sz, "version component out of range in %s", s);
+    else snprintf(text, sz, "invalid version: %s", s);
+    fail("plugin_bad_range", text, details1("version", version));
+  }
+  return triple(n);
+}
+
+int vercmp(Value *a, Value *b) {
+  for (size_t i = 0; i < 3; i++) {
+    double x = visnum(vat(a, i)) ? vasnum(vat(a, i)) : 0.0;
+    double y = visnum(vat(b, i)) ? vasnum(vat(b, i)) : 0.0;
+    if (x != y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+bool satisfies(Value *version, Value *range) {
+  Value *v = parseversion(version);
+  Value *r = parserange(range);
+  return 0 <= vercmp(v, vget(r, "lo")) && 0 > vercmp(v, vget(r, "hi"));
+}
+
+bool satisfiesq(Value *version, Value *range) {
+  /* `satisfies` for the internal callers that treat an unparseable
+   * version or range as "does not satisfy" — Capability and Graph, both
+   * of which run over data the corpus has already admitted. */
+  CatchFrame f;
+  bool out = false;
+  if (0 == PLUGIN_TRY(&f)) {
+    out = satisfies(version, range);
+    PLUGIN_END(&f);
+  }
+  else {
+    out = false;
+  }
+  return out;
+}

package/project/.sdk/tm/c/feature/secrets/plugin/version.h

@@ -0,0 +1,34 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/version.h)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Versions and ranges (§11.2).
+ *
+ * TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
+ * concrete version. A requirement declares `range`. A requirement is
+ * satisfied when the names match, the `match` passes, and the
+ * provider's `version` falls inside the requirement's `range`. That is
+ * the whole rule — there is no third field and no second comparison. */
+
+#ifndef VOXGIG_PLUGIN_VERSION_H
+#define VOXGIG_PLUGIN_VERSION_H
+
+#include <stdbool.h>
+
+#include "types.h"
+#include "value.h"
+
+/* A parsed range is {lo:[3], hi:[3]} — the shape `version/range` asserts
+ * directly, so it is a Value rather than a struct. */
+Value *parserange(Value *range);
+/* [major, minor, patch]. */
+Value *parseversion(Value *version);
+
+/* The one satisfaction predicate: lo <= version < hi. */
+bool satisfies(Value *version, Value *range);
+/* The same, tolerant of a missing version — a bare ref carries none, so
+ * `graph` and `depend` ask this rather than raising. */
+bool satisfiesq(Value *version, Value *range);
+
+int vercmp(Value *a, Value *b);
+
+#endif

package/project/.sdk/tm/c/feature/secrets/plugins/aws.c

@@ -0,0 +1,281 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/aws.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* AWS Secrets Manager and SSM Parameter Store: two kinds, one file.
+ *
+ * They share the credential resolution and the SigV4 signing, which is
+ * the reason they are one translation unit rather than two - splitting
+ * them would put the signer in both links or in neither.
+ *
+ * THE ONLY KINDS IN THE LIBRARY THAT HASH ANYTHING. `sigv4.c` and the
+ * `sha256.c` under it are pulled into a link by this object and by
+ * nothing else; a chain of the other nine plugins carries no digest at
+ * all, and `make check-core` measures that rather than asserting it.
+ *
+ * A port of typescript/plugins/aws.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *region;
+  const char *keyid;
+  const char *secret;
+  const char *session;
+  const char *addr;
+  const char *prefix;
+  char *described;
+} awsdata;
+
+/* Region and credentials, from config first and the standard AWS_*
+ * environment variables second - those are AWS's own convention, and a
+ * pod or CI job that has them set should just work. Missing either is an
+ * error: an AWS store with no credentials could not answer. */
+static sek_err awscall(awsdata *data, const char *service, const char *targetname,
+                       const char *payload, sek_answer *out) {
+  sek_pool *pool = data->pool;
+  const char *region = sek_first3(data->region, getenv("AWS_REGION"), getenv("AWS_DEFAULT_REGION"));
+  const char *keyid = sek_first(data->keyid, getenv("AWS_ACCESS_KEY_ID"));
+  const char *secret = sek_first(data->secret, getenv("AWS_SECRET_ACCESS_KEY"));
+  const char *session = sek_first(data->session, getenv("AWS_SESSION_TOKEN"));
+  const char *addr;
+  char *url;
+  sek_map *extras;
+  sek_map *signed_;
+  sek_signing input;
+  sek_err err;
+  size_t index;
+
+  if (sek_empty(region)) {
+    return sek_strdup(pool, "sekreto: aws: no region (set region or AWS_REGION)");
+  }
+  if (sek_empty(keyid) || sek_empty(secret)) {
+    return sek_strdup(pool, "sekreto: aws: no credentials (set keyid/secret or "
+                            "AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)");
+  }
+
+  /* The China partition lives under its own suffix; every other
+   * commercial region is plain amazonaws.com. */
+  addr = sek_first(data->addr, sek_fmt(pool, "https://%s.%s%s", service, region,
+                                       sek_has_prefix(region, "cn-") ? ".amazonaws.com.cn"
+                                                                     : ".amazonaws.com"));
+
+  err = sek_checkaddr(pool, addr);
+  if (NULL != err) {
+    return err;
+  }
+
+  url = sek_fmt(pool, "%s/", sek_trimslash(pool, addr));
+
+  extras = sek_map_new(pool);
+  sek_map_set(extras, "content-type", "application/x-amz-json-1.1");
+  sek_map_set(extras, "x-amz-target", targetname);
+
+  memset(&input, 0, sizeof(input));
+  input.method = "POST";
+  input.url = url;
+  input.service = service;
+  input.region = region;
+  input.keyid = keyid;
+  input.secret = secret;
+  input.datetime = sek_awsnow(pool);
+  input.headers = extras;
+  input.body = payload;
+  input.session = sek_empty(session) ? NULL : session;
+
+  signed_ = sek_sigv4(pool, &input);
+
+  /* The signed headers go on top of the caller's. */
+  for (index = 0; index < signed_->len; index++) {
+    sek_map_set(extras, signed_->keys[index], signed_->vals[index]);
+  }
+
+  return sek_fetchjson(pool, "POST", url, extras, payload, out);
+}
+
+/* Does this AWS error body name the not-found type? AWS sends it fully
+ * qualified - `com.amazonaws...#ResourceNotFoundException` - so this is a
+ * containment test, and it is only ever consulted alongside a 400. */
+static int awsmiss(sek_json *body, const char *type) {
+  const char *errtype = sek_json_asstr(sek_json_dig(body, "__type", NULL));
+
+  return NULL != errtype && sek_contains(errtype, type);
+}
+
+static sek_err awssecrets_lookup(sek_provider *self, const char *name, char **out) {
+  awsdata *data = (awsdata *)self->data;
+  sek_pool *pool = data->pool;
+  sek_vaultref ref;
+  sek_json *payload;
+  sek_answer res;
+  sek_err err;
+  const char *text;
+
+  *out = NULL;
+
+  err = sek_vaultref_of(pool, name, &ref);
+  if (NULL != err) {
+    return err;
+  }
+
+  payload = sek_json_obj(pool);
+  sek_json_set(pool, payload, "SecretId", sek_json_str(pool, ref.path));
+
+  err = awscall(data, "secretsmanager", "secretsmanager.GetSecretValue",
+                sek_json_stringify(pool, payload), &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (400 == res.status && awsmiss(res.body, "ResourceNotFoundException")) {
+    return NULL;
+  }
+
+  if (200 != res.status) {
+    return sek_fmt(pool, "sekreto: aws secretsmanager error: %d", res.status);
+  }
+
+  text = sek_json_asstr(sek_json_dig(res.body, "SecretString", NULL));
+
+  if (NULL == text) {
+    /* A binary secret has no fields to address, so only the conventional
+     * `value` field can mean "the bytes themselves". */
+    const char *bin = sek_json_asstr(sek_json_dig(res.body, "SecretBinary", NULL));
+
+    if (NULL != bin && 0 == strcmp(ref.field, "value")) {
+      size_t len = 0;
+      unsigned char *raw = sek_unbase64(pool, bin, &len);
+
+      if (NULL == raw) {
+        return sek_strdup(pool, "sekreto: aws secretsmanager: undecodable secret");
+      }
+
+      *out = sek_strndup(pool, (const char *)raw, len);
+      return NULL;
+    }
+
+    return NULL;
+  }
+
+  {
+    /* The AWS idiom is one JSON map per secret, so the secret's own value
+     * is parsed and the field taken out of it. */
+    sek_json *parsed = sek_json_parse(pool, text);
+
+    if (NULL != parsed && SEK_JSON_OBJ == parsed->type) {
+      const char *found = sek_json_text(pool, sek_json_dig(parsed, ref.field, NULL));
+      if (NULL != found) {
+        *out = sek_strdup(pool, found);
+      }
+      return NULL;
+    }
+  }
+
+  /* A plain-string secret is the whole value; it has no named fields. */
+  if (0 == strcmp(ref.field, "value")) {
+    *out = sek_strdup(pool, text);
+  }
+
+  return NULL;
+}
+
+static sek_err awsparams_lookup(sek_provider *self, const char *name, char **out) {
+  awsdata *data = (awsdata *)self->data;
+  sek_pool *pool = data->pool;
+  char *param = NULL;
+  sek_json *payload;
+  sek_answer res;
+  sek_err err = sek_awsparam(pool, name, data->prefix, &param);
+  const char *text;
+
+  *out = NULL;
+
+  if (NULL != err) {
+    return err;
+  }
+
+  payload = sek_json_obj(pool);
+  sek_json_set(pool, payload, "Name", sek_json_str(pool, param));
+  sek_json_set(pool, payload, "WithDecryption", sek_json_bool(pool, 1));
+
+  err = awscall(data, "ssm", "AmazonSSM.GetParameter", sek_json_stringify(pool, payload), &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (400 == res.status && awsmiss(res.body, "ParameterNotFound")) {
+    return NULL;
+  }
+
+  if (200 != res.status) {
+    return sek_fmt(pool, "sekreto: aws ssm error: %d", res.status);
+  }
+
+  /* Parameter Store carries flat strings: no field indirection. */
+  text = sek_json_text(pool, sek_json_dig(res.body, "Parameter", "Value", NULL));
+  if (NULL != text) {
+    *out = sek_strdup(pool, text);
+  }
+
+  return NULL;
+}
+
+static const char *aws_describe(sek_provider *self) {
+  return ((awsdata *)self->data)->described;
+}
+
+/* ---- the definitions ----------------------------------------------- */
+
+/* One `make` for both kinds, taking the half that differs as an argument.
+ * They share every field of the spec and every byte of the signing; only
+ * the lookup and the description differ. */
+static sek_err aws_make(sek_pool *pool, const sek_spec *spec, int params, sek_provider **out) {
+  awsdata *data = (awsdata *)sek_alloc(pool, sizeof(awsdata));
+
+  data->pool = pool;
+  data->region = sek_own(pool, spec->region);
+  data->keyid = sek_own(pool, spec->keyid);
+  data->secret = sek_own(pool, spec->secret);
+  data->session = sek_own(pool, spec->session);
+  data->addr = sek_own(pool, spec->addr);
+  data->prefix = sek_own(pool, spec->prefix);
+
+  /* Config only, never the environment: describe() feeds the spec's
+   * sources group, which must answer the same everywhere. */
+  if (params) {
+    data->described =
+        sek_fmt(pool, "awsparams:%s%s", sek_orempty(spec->region), sek_orempty(spec->prefix));
+  } else {
+    data->described = sek_fmt(pool, "awssecrets:%s", sek_orempty(spec->region));
+  }
+
+  *out = sek_provider_new(pool, params ? awsparams_lookup : awssecrets_lookup, aws_describe, data);
+
+  return NULL;
+}
+
+static sek_err awssecrets_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  return aws_make(pool, spec, 0, out);
+}
+
+static sek_err awsparams_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  return aws_make(pool, spec, 1, out);
+}
+
+static sek_providerkind AWSSECRETS_KIND;
+
+Definition *sek_plugin_awssecrets(void) {
+  return sek_providerplugin(&AWSSECRETS_KIND, "awssecrets", awssecrets_make);
+}
+
+static sek_providerkind AWSPARAMS_KIND;
+
+Definition *sek_plugin_awsparams(void) {
+  return sek_providerplugin(&AWSPARAMS_KIND, "awsparams", awsparams_make);
+}