@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/cpp/feature/secrets/plugins/Boru.cpp

@@ -0,0 +1,117 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Boru.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Boru.hpp"
+
+#include "Httpjson.hpp"
+#include "Proc.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// ------------------------------------------------------------------ boru
+
+/// A boru vault.
+///
+/// Two ways in, both boru's own. With no `addr`, the CLI:
+/// `boru vault get --reveal <alias>` prints the secret on stdout and
+/// nothing else; the passphrase is read by boru itself from
+/// BORU_VAULT_PASSPHRASE, is never accepted as config, and never reaches a
+/// command line where the process table would publish it.
+///
+/// With an `addr`, boru's wire protocol: a read-only, HashiCorp-shaped
+/// provision API. A boru alias KEEPS its dots, so `api.token` is the
+/// single path segment `api.token` - not the `api`/`token` split a
+/// HashiCorp KV gets - and the value is the `value` field.
+class BoruProvider : public Provider {
+ public:
+  BoruProvider(const std::string& command, const std::string& namespace_,
+               const std::string& home, const std::string& addr, const std::string& token,
+               const std::string& mount)
+      : command_(first(command, "boru")),
+        namespace_(namespace_),
+        home_(home),
+        addr_(trimslash(addr)),
+        token_(token),
+        mount_(first(mount, "secret")) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    checkname(name);
+
+    if (!addr_.empty()) return wirelookup(name);
+
+    // The CLI alias is namespace-qualified with a COLON; the wire one with
+    // a slash. Both are boru's own spellings.
+    std::string alias = namespace_.empty() ? name : namespace_ + ":" + name;
+
+    std::vector<std::string> environment = processenv();
+    if (!home_.empty()) setenvvar(environment, "BORU_HOME", home_);
+
+    Ran ran = runcmd({command_, "vault", "get", "--reveal", alias}, environment, command_);
+
+    if (0 == ran.status) {
+      // boru prints the value and one newline, and nothing else.
+      return dropnewline(ran.out);
+    }
+
+    // "no alias named" is boru saying it does not hold this secret, which
+    // is a miss: the chain carries on. A locked vault or a wrong passphrase
+    // is not a miss - treating it as one would fall through to a weaker
+    // store without saying so.
+    if (borumiss(ran.why)) return std::nullopt;
+
+    throw SekretoError("sekreto: boru vault error: " +
+                       (ran.why.empty() ? "exit " + std::to_string(ran.status) : ran.why));
+  }
+
+  std::string describe() const override {
+    if (!addr_.empty()) return "boru:" + addr_;
+    return namespace_.empty() ? "boru" : "boru:" + namespace_;
+  }
+
+ private:
+  std::optional<std::string> wirelookup(const std::string& name) {
+    checkaddr(addr_);
+
+    std::string alias = namespace_.empty() ? name : namespace_ + "/" + name;
+    std::string url = addr_ + "/v1/" + mount_ + "/data/" + alias;
+
+    Ordered headers;
+    headers.set("X-Vault-Token", token_);
+
+    Answer res = fetchjson("GET", url, headers);
+
+    if (404 == res.status) return std::nullopt;
+
+    if (200 != res.status) {
+      throw SekretoError("sekreto: boru serve error: " + std::to_string(res.status) + ": " + url);
+    }
+
+    return textof(res.body.get("data").get("data").get("value"));
+  }
+
+  std::string command_;
+  std::string namespace_;
+  std::string home_;
+  std::string addr_;
+  std::string token_;
+  std::string mount_;
+};
+
+}  // namespace
+
+bool borumiss(const std::string& why) {
+  return std::string::npos != why.find("no alias named");
+}
+
+Definition boru() {
+  return providerplugin("boru", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<BoruProvider>(spec.command, spec.namespace_, spec.home, spec.addr,
+                                          spec.token, spec.mount);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Boru.hpp

@@ -0,0 +1,27 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Boru.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// A boru vault, read through its CLI or over its wire protocol.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_BORU_HPP
+#define SEKRETO_PLUGINS_BORU_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `boru` provider kind, as a voxgig/plugin definition.
+Definition boru();
+
+/// Does this boru failure mean "no such secret" rather than "I could not
+/// answer"?
+bool borumiss(const std::string& why);
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Crypto.cpp

@@ -0,0 +1,180 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Crypto.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Crypto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// FIPS 180-4 round constants: the first 32 bits of the fractional parts of
+// the cube roots of the first 64 primes.
+const uint32_t K[64] = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+};
+
+// The eight initial hash words: the first 32 bits of the fractional parts
+// of the square roots of the first 8 primes.
+const uint32_t H0[8] = {
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+};
+
+inline uint32_t ror(uint32_t word, unsigned int bits) {
+  return (word >> bits) | (word << (32 - bits));
+}
+
+const size_t BLOCK = 64;
+
+}  // namespace
+
+Bytes tobytes(const std::string& text) {
+  return Bytes(text.begin(), text.end());
+}
+
+std::string frombytes(const Bytes& data) {
+  return std::string(data.begin(), data.end());
+}
+
+Bytes sha256(const Bytes& data) {
+  Bytes message = data;
+
+  // Padding: one 0x80 byte, zeros up to 56 mod 64, then the message length
+  // in BITS as a big-endian 64-bit integer.
+  uint64_t bitlen = static_cast<uint64_t>(data.size()) * 8;
+
+  message.push_back(0x80);
+  while (56 != message.size() % BLOCK) {
+    message.push_back(0);
+  }
+  for (int shift = 56; 0 <= shift; shift -= 8) {
+    message.push_back(static_cast<uint8_t>((bitlen >> shift) & 0xff));
+  }
+
+  uint32_t hash[8];
+  for (int index = 0; index < 8; index++) {
+    hash[index] = H0[index];
+  }
+
+  for (size_t block = 0; block < message.size(); block += BLOCK) {
+    uint32_t schedule[64];
+
+    for (int index = 0; index < 16; index++) {
+      size_t at = block + static_cast<size_t>(index) * 4;
+      schedule[index] = (static_cast<uint32_t>(message[at]) << 24) |
+                        (static_cast<uint32_t>(message[at + 1]) << 16) |
+                        (static_cast<uint32_t>(message[at + 2]) << 8) |
+                        static_cast<uint32_t>(message[at + 3]);
+    }
+
+    for (int index = 16; index < 64; index++) {
+      uint32_t prev15 = schedule[index - 15];
+      uint32_t prev2 = schedule[index - 2];
+      uint32_t sigma0 = ror(prev15, 7) ^ ror(prev15, 18) ^ (prev15 >> 3);
+      uint32_t sigma1 = ror(prev2, 17) ^ ror(prev2, 19) ^ (prev2 >> 10);
+      schedule[index] = schedule[index - 16] + sigma0 + schedule[index - 7] + sigma1;
+    }
+
+    uint32_t a = hash[0];
+    uint32_t b = hash[1];
+    uint32_t c = hash[2];
+    uint32_t d = hash[3];
+    uint32_t e = hash[4];
+    uint32_t f = hash[5];
+    uint32_t g = hash[6];
+    uint32_t h = hash[7];
+
+    for (int index = 0; index < 64; index++) {
+      uint32_t bigsigma1 = ror(e, 6) ^ ror(e, 11) ^ ror(e, 25);
+      uint32_t choose = (e & f) ^ (~e & g);
+      uint32_t temp1 = h + bigsigma1 + choose + K[index] + schedule[index];
+      uint32_t bigsigma0 = ror(a, 2) ^ ror(a, 13) ^ ror(a, 22);
+      uint32_t major = (a & b) ^ (a & c) ^ (b & c);
+      uint32_t temp2 = bigsigma0 + major;
+
+      h = g;
+      g = f;
+      f = e;
+      e = d + temp1;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2;
+    }
+
+    hash[0] += a;
+    hash[1] += b;
+    hash[2] += c;
+    hash[3] += d;
+    hash[4] += e;
+    hash[5] += f;
+    hash[6] += g;
+    hash[7] += h;
+  }
+
+  Bytes out;
+  out.reserve(32);
+
+  for (int index = 0; index < 8; index++) {
+    out.push_back(static_cast<uint8_t>((hash[index] >> 24) & 0xff));
+    out.push_back(static_cast<uint8_t>((hash[index] >> 16) & 0xff));
+    out.push_back(static_cast<uint8_t>((hash[index] >> 8) & 0xff));
+    out.push_back(static_cast<uint8_t>(hash[index] & 0xff));
+  }
+
+  return out;
+}
+
+Bytes hmacsha256(const Bytes& key, const Bytes& data) {
+  Bytes block = key;
+
+  // A key longer than the block is hashed down; a shorter one is padded up
+  // with zeros.
+  if (BLOCK < block.size()) {
+    block = sha256(block);
+  }
+  block.resize(BLOCK, 0);
+
+  Bytes inner;
+  inner.reserve(BLOCK + data.size());
+  Bytes outer;
+  outer.reserve(BLOCK + 32);
+
+  for (size_t index = 0; index < BLOCK; index++) {
+    inner.push_back(static_cast<uint8_t>(block[index] ^ 0x36));
+    outer.push_back(static_cast<uint8_t>(block[index] ^ 0x5c));
+  }
+
+  inner.insert(inner.end(), data.begin(), data.end());
+
+  Bytes middle = sha256(inner);
+  outer.insert(outer.end(), middle.begin(), middle.end());
+
+  return sha256(outer);
+}
+
+std::string hex(const Bytes& data) {
+  static const char DIGITS[] = "0123456789abcdef";
+
+  std::string out;
+  out.reserve(data.size() * 2);
+
+  for (uint8_t byte : data) {
+    out.push_back(DIGITS[(byte >> 4) & 0x0f]);
+    out.push_back(DIGITS[byte & 0x0f]);
+  }
+
+  return out;
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Crypto.hpp

@@ -0,0 +1,52 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Crypto.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// SHA-256 and HMAC-SHA256, hand-rolled, plus hex.
+//
+// This port links OpenSSL, so `EVP_Digest` and `HMAC` are a function call
+// away - and calling them here would break the rule that allows the link
+// at all. That exception covers cryptographic TRANSPORT and nothing else:
+// SigV4 is signing, not transport. Rust is the worked precedent, with
+// `ring` already inside rustls's closure and `rust/src/crypto.rs` still
+// carrying both primitives in-tree.
+//
+// Correctness is not asserted here - it is proved by the SigV4
+// known-answer vectors in the shared spec. A signature is a chain of these
+// two functions, so one wrong bit anywhere fails there.
+//
+// A port of rust/src/crypto.rs.
+
+// NOTHING BUT THE SIGNER INCLUDES THIS. Percent-encoding and base64 used
+// to sit here; they moved to Httpjson.hpp, because the plugins that need
+// them - Azure, 1Password, Doppler, Infisical, GCP - sign nothing, and
+// including this file for a query string would put SHA-256 into their link
+// maps.
+
+#ifndef SEKRETO_PLUGINS_CRYPTO_HPP
+#define SEKRETO_PLUGINS_CRYPTO_HPP
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace sekreto {
+
+using Bytes = std::vector<uint8_t>;
+
+Bytes tobytes(const std::string& text);
+std::string frombytes(const Bytes& data);
+
+/// SHA-256 of some bytes, as 32 bytes.
+Bytes sha256(const Bytes& data);
+
+/// HMAC-SHA256, RFC 2104, block size 64. Argument order is (key, data);
+/// PHP's and Perl's stdlib take (data, key), and the wrapper is where that
+/// gets fixed, never at the call sites.
+Bytes hmacsha256(const Bytes& key, const Bytes& data);
+
+/// Lowercase, zero-padded, two digits a byte.
+std::string hex(const Bytes& data);
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Doppler.cpp

@@ -0,0 +1,87 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Doppler.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Doppler.hpp"
+
+#include "Httpjson.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// ---------------------------------------------------------------- doppler
+
+/// Doppler.
+///
+/// The whole config is downloaded once - Doppler's own bulk endpoint - and
+/// answered from memory, like a remote .env: `api.token` is the
+/// `API_TOKEN` entry. A service token is config-scoped, so project and
+/// config are only needed with broader tokens.
+class DopplerProvider : public Provider {
+ public:
+  DopplerProvider(const std::string& token, const std::string& project,
+                  const std::string& config, const std::string& addr)
+      : token_(token), project_(project), config_(config), addr_(addr) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    load();
+    // The `prefix` option is deliberately not consulted by this kind.
+    return values_.get(envkey(name));
+  }
+
+  std::string describe() const override {
+    return project_.empty() ? "doppler" : "doppler:" + project_ + "/" + config_;
+  }
+
+ private:
+  void load() {
+    if (loaded_) return;
+
+    std::string useaddr = trimslash(first(addr_, "https://api.doppler.com"));
+    checkaddr(useaddr);
+
+    std::string url = useaddr + "/v3/configs/config/secrets/download?format=json";
+    if (!project_.empty()) url += "&project=" + uriescape(project_);
+    if (!config_.empty()) url += "&config=" + uriescape(config_);
+
+    Ordered headers;
+    headers.set("authorization", "Bearer " + token_);
+
+    Answer res = fetchjson("GET", url, headers);
+
+    if (200 != res.status || !res.body.isobj()) {
+      throw SekretoError("sekreto: doppler error: " + std::to_string(res.status));
+    }
+
+    Ordered values;
+
+    for (const auto& entry : res.body.objval) {
+      std::optional<std::string> text = textof(entry.second);
+      if (text.has_value()) values.set(entry.first, text.value());
+    }
+
+    // Only a successful load is remembered: a failed one retries.
+    values_ = values;
+    loaded_ = true;
+  }
+
+  std::string token_;
+  std::string project_;
+  std::string config_;
+  std::string addr_;
+
+  Ordered values_;
+  bool loaded_ = false;
+};
+
+}  // namespace
+
+Definition doppler() {
+  return providerplugin("doppler", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<DopplerProvider>(spec.token, spec.project, spec.config, spec.addr);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Doppler.hpp

@@ -0,0 +1,23 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Doppler.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Doppler.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_DOPPLER_HPP
+#define SEKRETO_PLUGINS_DOPPLER_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `doppler` provider kind, as a voxgig/plugin definition.
+Definition doppler();
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Gcpsecrets.cpp

@@ -0,0 +1,121 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Gcpsecrets.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Gcpsecrets.hpp"
+
+#include "Httpjson.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// -------------------------------------------------------------------- gcp
+
+/// GCP Secret Manager.
+///
+/// `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+/// Manager ids have no hierarchy and reject dots), latest version. The
+/// token comes from config, then GOOGLE_OAUTH_ACCESS_TOKEN, then the
+/// GCE/GKE metadata server - so on Google's own platform no credential
+/// configuration is needed at all.
+///
+/// The metadata call is plain http to a link-local host by platform design
+/// and carries no credential, so `checkaddr` guards the Secret Manager
+/// address instead.
+class GcpsecretsProvider : public Provider {
+ public:
+  GcpsecretsProvider(const std::string& project, const std::string& token,
+                     const std::string& addr, const std::string& metadataaddr)
+      : project_(project), token_(token), addr_(addr), metadataaddr_(metadataaddr) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    if (project_.empty()) throw SekretoError("sekreto: gcp: no project");
+
+    std::string useaddr = first(addr_, "https://secretmanager.googleapis.com");
+    checkaddr(useaddr);
+
+    if (!livetoken_.has_value() || nowms() >= renewat_) {
+      livetoken_ = login();
+    }
+
+    std::string url = trimslash(useaddr) + "/v1/projects/" + project_ + "/secrets/" +
+                      flatname(name, "_") + "/versions/latest:access";
+
+    Ordered headers;
+    headers.set("authorization", "Bearer " + livetoken_.value_or(""));
+
+    Answer res = fetchjson("GET", url, headers);
+
+    if (404 == res.status) return std::nullopt;
+
+    if (200 != res.status) {
+      throw SekretoError("sekreto: gcp error: " + std::to_string(res.status) + ": " + url);
+    }
+
+    std::string data;
+    if (!res.body.get("payload").get("data").asstr(data)) return std::nullopt;
+
+    std::string decoded;
+    if (!unbase64(data, decoded)) {
+      throw SekretoError("sekreto: gcp: undecodable secret");
+    }
+
+    return decoded;
+  }
+
+  std::string describe() const override { return "gcpsecrets:" + project_; }
+
+ private:
+  std::string usemetadataaddr() const {
+    if (!metadataaddr_.empty()) return metadataaddr_;
+
+    std::string host = envvar("GCE_METADATA_HOST");
+    if (!host.empty()) return "http://" + host;
+
+    return "http://metadata.google.internal";
+  }
+
+  std::string login() {
+    std::string configured = first(token_, envvar("GOOGLE_OAUTH_ACCESS_TOKEN"));
+    if (!configured.empty()) return configured;
+
+    std::string url = trimslash(usemetadataaddr()) +
+                      "/computeMetadata/v1/instance/service-accounts/default/token";
+
+    Ordered headers;
+    headers.set("Metadata-Flavor", "Google");
+
+    Answer res = fetchjson("GET", url, headers);
+
+    std::optional<std::string> got = textof(res.body.get("access_token"));
+
+    if (200 != res.status || !got.has_value() || got.value().empty()) {
+      throw SekretoError("sekreto: gcp: no token and metadata server did not answer");
+    }
+
+    renewat_ = renewtime(res.body.get("expires_in"));
+
+    return got.value();
+  }
+
+  std::string project_;
+  std::string token_;
+  std::string addr_;
+  std::string metadataaddr_;
+
+  std::optional<std::string> livetoken_;
+  double renewat_ = NEVER;
+};
+
+}  // namespace
+
+Definition gcpsecrets() {
+  return providerplugin("gcpsecrets", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<GcpsecretsProvider>(spec.project, spec.token, spec.addr,
+                                                 spec.metadataaddr);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Gcpsecrets.hpp

@@ -0,0 +1,23 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Gcpsecrets.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// GCP Secret Manager.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_GCPSECRETS_HPP
+#define SEKRETO_PLUGINS_GCPSECRETS_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `gcpsecrets` provider kind, as a voxgig/plugin definition.
+Definition gcpsecrets();
+
+}  // namespace sekreto
+
+#endif