@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/cpp/feature/secrets/sekreto/Provider.cpp

@@ -0,0 +1,312 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/src/Provider.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Provider.hpp"
+
+#include <map>
+
+#include "../plugin/ref.hpp"
+#include "../plugin/types.hpp"
+
+namespace sekreto {
+
+// ---------------------------------------------------------- the ordered map
+
+bool Ordered::has(const std::string& key) const {
+  for (const auto& entry : pairs) {
+    if (key == entry.first) return true;
+  }
+  return false;
+}
+
+std::optional<std::string> Ordered::get(const std::string& key) const {
+  for (const auto& entry : pairs) {
+    if (key == entry.first) return entry.second;
+  }
+  return std::nullopt;
+}
+
+void Ordered::set(const std::string& key, const std::string& value) {
+  for (auto& entry : pairs) {
+    if (key == entry.first) {
+      entry.second = value;
+      return;
+    }
+  }
+  pairs.emplace_back(key, value);
+}
+
+// ------------------------------------------------------------- the specs
+
+namespace {
+
+/// What a credential field reports about itself.
+std::string setornot(const std::string& value) {
+  return value.empty() ? "[unset]" : "[set]";
+}
+
+}  // namespace
+
+std::string AuthSpec::str() const {
+  return "AuthSpec(method=" + method + ", mount=" + mount + ", role=" + role +
+         ", jwtfile=" + jwtfile + ", roleid=" + roleid + ", jwt=" + setornot(jwt) +
+         ", secretid=" + setornot(secretid) + ")";
+}
+
+std::string ProviderSpec::str() const {
+  return "ProviderSpec(kind=" + kind + ", name=" + name + ", addr=" + addr +
+         ", token=" + setornot(token) + ", secret=" + setornot(secret) +
+         ", clientsecret=" + setornot(clientsecret) +
+         ", auth=" + (auth.has_value() ? auth.value().str() : "none") + ")";
+}
+
+// ------------------------------------------------ the spec as plugin options
+
+namespace {
+
+/// A string field, written only when it is set. "Not configured" and
+/// "configured empty" are the same thing here, so an empty string is an
+/// absent key and the options map reads like the configuration.
+void setstr(const plugin::V& out, const std::string& key, const std::string& text) {
+  if (!text.empty()) plugin::set(out, key, plugin::vstr(text));
+}
+
+std::string strof(const plugin::V& options, const std::string& key) {
+  plugin::V given = plugin::get(options, key);
+  return plugin::isstr(given) ? plugin::asstr(given) : "";
+}
+
+}  // namespace
+
+plugin::V optionsof(const ProviderSpec& spec) {
+  plugin::V out = plugin::vmap();
+
+  setstr(out, "kind", spec.kind);
+  setstr(out, "name", spec.name);
+  setstr(out, "prefix", spec.prefix);
+  setstr(out, "file", spec.file);
+  setstr(out, "dir", spec.dir);
+  setstr(out, "addr", spec.addr);
+  setstr(out, "token", spec.token);
+  setstr(out, "mount", spec.mount);
+  setstr(out, "vaultnamespace", spec.vaultnamespace);
+  setstr(out, "command", spec.command);
+  setstr(out, "profile", spec.profile);
+  setstr(out, "backend", spec.backend);
+  setstr(out, "reason", spec.reason);
+  setstr(out, "namespace", spec.namespace_);
+  setstr(out, "home", spec.home);
+  setstr(out, "region", spec.region);
+  setstr(out, "keyid", spec.keyid);
+  setstr(out, "secret", spec.secret);
+  setstr(out, "session", spec.session);
+  setstr(out, "project", spec.project);
+  setstr(out, "vault", spec.vault);
+  setstr(out, "tenant", spec.tenant);
+  setstr(out, "clientid", spec.clientid);
+  setstr(out, "clientsecret", spec.clientsecret);
+  setstr(out, "loginaddr", spec.loginaddr);
+  setstr(out, "imdsaddr", spec.imdsaddr);
+  setstr(out, "metadataaddr", spec.metadataaddr);
+  setstr(out, "apiversion", spec.apiversion);
+  setstr(out, "config", spec.config);
+  setstr(out, "environment", spec.environment);
+  setstr(out, "path", spec.path);
+
+  if (spec.kv.has_value()) {
+    plugin::set(out, "kv", plugin::vnum(spec.kv.value()));
+  }
+
+  if (!spec.values.empty()) {
+    plugin::V values = plugin::vmap();
+    // A plugin map keeps insertion order, so the literal values arrive in
+    // the order they were written - which the spec compares.
+    for (const auto& entry : spec.values.pairs) {
+      plugin::set(values, entry.first, plugin::vstr(entry.second));
+    }
+    plugin::set(out, "values", values);
+  }
+
+  if (spec.auth.has_value()) {
+    const AuthSpec& auth = spec.auth.value();
+    plugin::V m = plugin::vmap();
+    setstr(m, "method", auth.method);
+    setstr(m, "mount", auth.mount);
+    setstr(m, "role", auth.role);
+    setstr(m, "jwt", auth.jwt);
+    setstr(m, "jwtfile", auth.jwtfile);
+    setstr(m, "roleid", auth.roleid);
+    setstr(m, "secretid", auth.secretid);
+    plugin::set(out, "auth", m);
+  }
+
+  return out;
+}
+
+ProviderSpec specof(const plugin::V& options) {
+  ProviderSpec spec;
+
+  spec.kind = strof(options, "kind");
+  spec.name = strof(options, "name");
+  spec.prefix = strof(options, "prefix");
+  spec.file = strof(options, "file");
+  spec.dir = strof(options, "dir");
+  spec.addr = strof(options, "addr");
+  spec.token = strof(options, "token");
+  spec.mount = strof(options, "mount");
+  spec.vaultnamespace = strof(options, "vaultnamespace");
+  spec.command = strof(options, "command");
+  spec.profile = strof(options, "profile");
+  spec.backend = strof(options, "backend");
+  spec.reason = strof(options, "reason");
+  spec.namespace_ = strof(options, "namespace");
+  spec.home = strof(options, "home");
+  spec.region = strof(options, "region");
+  spec.keyid = strof(options, "keyid");
+  spec.secret = strof(options, "secret");
+  spec.session = strof(options, "session");
+  spec.project = strof(options, "project");
+  spec.vault = strof(options, "vault");
+  spec.tenant = strof(options, "tenant");
+  spec.clientid = strof(options, "clientid");
+  spec.clientsecret = strof(options, "clientsecret");
+  spec.loginaddr = strof(options, "loginaddr");
+  spec.imdsaddr = strof(options, "imdsaddr");
+  spec.metadataaddr = strof(options, "metadataaddr");
+  spec.apiversion = strof(options, "apiversion");
+  spec.config = strof(options, "config");
+  spec.environment = strof(options, "environment");
+  spec.path = strof(options, "path");
+
+  plugin::V kv = plugin::get(options, "kv");
+  if (plugin::isnum(kv)) spec.kv = static_cast<int>(plugin::asnum(kv));
+
+  plugin::V values = plugin::get(options, "values");
+  if (plugin::ismap(values)) {
+    for (const std::string& key : plugin::keys(values)) {
+      spec.values.set(key, plugin::asstr(plugin::get(values, key)));
+    }
+  }
+
+  plugin::V auth = plugin::get(options, "auth");
+  if (plugin::ismap(auth)) {
+    AuthSpec use;
+    use.method = strof(auth, "method");
+    use.mount = strof(auth, "mount");
+    use.role = strof(auth, "role");
+    use.jwt = strof(auth, "jwt");
+    use.jwtfile = strof(auth, "jwtfile");
+    use.roleid = strof(auth, "roleid");
+    use.secretid = strof(auth, "secretid");
+    spec.auth = use;
+  }
+
+  return spec;
+}
+
+// ------------------------------------------------------- the provider slots
+
+namespace {
+
+struct Slots {
+  std::map<double, std::shared_ptr<Provider>> held;
+  double next = 1;
+};
+
+Slots& slots() {
+  // thread_local, NOT a process-global. A provider is parked by `define`
+  // and claimed by `Sekreto::declare` in the same synchronous call on the
+  // same thread, so per-thread is the same table for every purpose this
+  // has - and it removes the sharing entirely. As a process-global it was
+  // shared mutable state on the construction path: four threads building
+  // 500 chains each aborted every run with
+  //
+  //   malloc(): unaligned tcache chunk detected
+  //
+  // three of them inside providerslot -> _Rb_tree_insert_and_rebalance.
+  // The port documents that it claims no thread safety across concurrent
+  // constructions, but heap corruption is not what a disclaimer buys you,
+  // and the pre-refactor port had no shared construction state at all.
+  static thread_local Slots one;
+  return one;
+}
+
+}  // namespace
+
+double providerslot(const std::shared_ptr<Provider>& provider) {
+  Slots& one = slots();
+  double ticket = one.next;
+  one.next = ticket + 1;
+  one.held[ticket] = provider;
+  return ticket;
+}
+
+std::shared_ptr<Provider> takeprovider(double ticket) {
+  Slots& one = slots();
+  auto at = one.held.find(ticket);
+  if (one.held.end() == at) return nullptr;
+
+  std::shared_ptr<Provider> provider = at->second;
+  one.held.erase(at);
+  return provider;
+}
+
+double providermark() { return slots().next; }
+
+void providerdiscard(double mark) {
+  Slots& one = slots();
+  for (auto at = one.held.begin(); one.held.end() != at;) {
+    at = (mark <= at->first) ? one.held.erase(at) : std::next(at);
+  }
+}
+
+size_t providerslots() { return slots().held.size(); }
+
+// --------------------------------------------------------------- the bridge
+
+const char* const PROVIDER_EXPORT = "provider";
+const char* const ERROR_CODE = "sekreto_error";
+
+Definition providerplugin(const std::string& kind, Make make) {
+  auto def = std::make_shared<plugin::Definition>();
+
+  def->name = kind;
+  def->define = [make](plugin::Inst& inst) {
+    std::shared_ptr<Provider> provider;
+
+    try {
+      provider = make(specof(inst.options()));
+    } catch (const SekretoError& err) {
+      // The spec pins this message byte for byte, so it travels under a
+      // code the host will not rewrite and `Sekreto` takes the code back
+      // off on the far side.
+      plugin::fail(ERROR_CODE, err.what(),
+                   plugin::details2("ref", plugin::vstr(inst.ref()), "cause",
+                                    plugin::vstr(err.what())));
+    } catch (const plugin::PluginError&) {
+      // Already the host's own currency: it names the instance itself.
+      throw;
+    } catch (const std::exception& err) {
+      // ANYTHING ELSE IS THE HOST'S TO REPORT, and it can only report what
+      // reaches it as a PluginError: `Host::run` catches nothing else, so
+      // an escaping std::exception would leave the instance neither
+      // `loaded` nor `failed`. `plugin_bare` is this port's spelling of
+      // "an error with no code", which the host wraps as
+      // `plugin_define_failed` naming the instance and the cause.
+      plugin::fail("plugin_bare", err.what());
+    }
+
+    if (nullptr == provider) {
+      const std::string why = "sekreto: " + inst.name() + " built no provider";
+      plugin::fail(ERROR_CODE, why,
+                   plugin::details2("ref", plugin::vstr(inst.ref()), "cause",
+                                    plugin::vstr(why)));
+    }
+
+    inst.exportvalue(PROVIDER_EXPORT, plugin::vnum(providerslot(provider)));
+  };
+
+  return def;
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/sekreto/Provider.hpp

@@ -0,0 +1,263 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/src/Provider.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// What a provider is, what its declarative form looks like, and how a
+// provider kind becomes a voxgig/plugin definition.
+//
+// A provider answers one question: "do you have this secret?" It returns
+// the value, or nothing to mean "ask the next one". Nothing else about a
+// provider is visible to the caller - which is the point: an app reads
+// `api.token` and never learns whether it came from the environment, a
+// .env file, HashiCorp Vault, AWS, GCP, Azure or a boru vault.
+//
+// A MISS is `std::nullopt` and a FAILURE is a thrown SekretoError. They
+// are never interchangeable: a store that could not answer must not read
+// as a store that does not hold the secret, or the chain falls quietly
+// through to a weaker one.
+//
+// This is the bottom of the core: the error, the ordered map every spec
+// and every signature is written in, the provider interface, the
+// declarative form of a provider, and the bridge to voxgig/plugin. It
+// includes nothing of sekreto's, which is what lets everything else
+// include it.
+//
+// A port of typescript/src/provider/support.ts, which is canonical.
+
+#ifndef SEKRETO_PROVIDER_HPP
+#define SEKRETO_PROVIDER_HPP
+
+#include <functional>
+#include <memory>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+// voxgig/plugin: the catalog a definition is registered in, and the
+// dynamic value an instance carries its options as. AGENTS.md rule 3's
+// one Voxgig dependency, and rule 4 is why the core takes it.
+#include "../plugin/catalog.hpp"
+#include "../plugin/host.hpp"
+#include "../plugin/value.hpp"
+
+namespace sekreto {
+
+/// Anything sekreto refuses to do: a bad name, a missing secret, a
+/// provider that could not be reached.
+///
+/// The message is the whole contract - no code, no fields, no cause - and
+/// the shared spec pins it byte for byte.
+class SekretoError : public std::runtime_error {
+ public:
+  explicit SekretoError(const std::string& message) : std::runtime_error(message) {}
+};
+
+/// An insertion-ordered string map.
+///
+/// `std::map` orders by key and `std::unordered_map` by nothing at all;
+/// the spec compares whole maps, and a signed AWS payload's field order is
+/// part of what was signed. So this is a vector of pairs.
+class Ordered {
+ public:
+  std::vector<std::pair<std::string, std::string>> pairs;
+
+  bool has(const std::string& key) const;
+  /// The value, or nothing. Absence is nothing; an empty string is a value.
+  std::optional<std::string> get(const std::string& key) const;
+  /// Insert, or overwrite in place so the original position is kept.
+  void set(const std::string& key, const std::string& value);
+  bool empty() const { return pairs.empty(); }
+};
+
+class Provider {
+ public:
+  virtual ~Provider() = default;
+
+  /// The value, or nothing if this provider does not have it. May throw
+  /// SekretoError when the store could not answer at all.
+  virtual std::optional<std::string> lookup(const std::string& name) = 0;
+
+  /// A short description, shown by `Sekreto::sources()`. It must lead with
+  /// the kind: everything before the first `:` is the default store name.
+  virtual std::string describe() const = 0;
+};
+
+/// Logging in to a vault instead of being handed a token. `method` is
+/// `kubernetes` or `approle`; `mount` defaults to the method name.
+struct AuthSpec {
+  std::string method;
+  std::string mount;
+  /// kubernetes: the Vault role to log in as.
+  std::string role;
+  /// kubernetes: the service-account JWT itself (tests).
+  std::string jwt;
+  /// kubernetes: where the JWT lives; the conventional pod path by default.
+  std::string jwtfile;
+  /// approle: the role and secret ids.
+  std::string roleid;
+  std::string secretid;
+
+  /// Printed without its credentials. A derived printer would put the
+  /// service-account JWT and the AppRole secret id into
+  /// `log("bad chain: " + spec)`, which is what someone writes when a
+  /// chain will not build.
+  std::string str() const;
+};
+
+/// The declarative form of a provider, as used in config and in the shared
+/// spec. `kind` names a built-in or a plugin; everything else is that
+/// kind's own, and a plugin reads it back off its instance's options.
+///
+/// String fields default to the empty string rather than to an optional:
+/// "not configured" and "configured empty" mean the same thing everywhere
+/// in this library.
+struct ProviderSpec {
+  std::string kind;
+  /// The store name `Sekreto::getfrom` addresses. Defaults to `kind`.
+  std::string name;
+  std::string prefix;
+  /// dotenv: the file to read. secretspec: the declaration to read.
+  std::string file;
+  /// memory: literal values, keyed like environment variables.
+  Ordered values;
+  /// file: the directory of one-secret-per-file entries.
+  std::string dir;
+  /// hashicorp / boru (wire) / gcp / 1password / doppler / infisical: the base URL.
+  std::string addr;
+  /// hashicorp / boru (wire) / gcp / azure / 1password / doppler / infisical: the token.
+  std::string token;
+  /// hashicorp / boru (wire): the KV mount (default `secret`).
+  std::string mount;
+  /// hashicorp: KV engine version, 1 or 2 (default 2).
+  std::optional<int> kv;
+  /// hashicorp: Vault Enterprise namespace (X-Vault-Namespace).
+  std::string vaultnamespace;
+  /// hashicorp: log in for a token instead of being handed one.
+  std::optional<AuthSpec> auth;
+  /// boru / secretspec: the executable to run.
+  std::string command;
+  /// secretspec: the profile to read (`--profile`).
+  std::string profile;
+  /// secretspec: which of ITS backends to read from (`--provider`). Named
+  /// `backend` here because `provider` already means a sekreto provider.
+  std::string backend;
+  /// secretspec: the audit reason recorded for the read (`--reason`).
+  std::string reason;
+  /// boru: the namespace qualifying the alias.
+  std::string namespace_;
+  /// boru: the vault home, passed as BORU_HOME.
+  std::string home;
+  /// aws: region and credentials; the standard AWS_* variables fill the rest.
+  std::string region;
+  std::string keyid;
+  std::string secret;
+  std::string session;
+  /// gcp / doppler / infisical: the project, however that store names it.
+  std::string project;
+  /// azure: the Key Vault name or full URL. 1password: the vault name or id.
+  std::string vault;
+  /// azure: client-credential login. infisical: universal-auth login.
+  std::string tenant;
+  std::string clientid;
+  std::string clientsecret;
+  /// azure: where to log in / where IMDS answers. gcp: the metadata server.
+  std::string loginaddr;
+  std::string imdsaddr;
+  std::string metadataaddr;
+  /// azure: the Key Vault API version (default 7.4).
+  std::string apiversion;
+  /// doppler: the config slug (with `project`).
+  std::string config;
+  /// infisical: the environment slug and secret path.
+  std::string environment;
+  std::string path;
+
+  /// Printed without its credentials. See AuthSpec::str.
+  std::string str() const;
+};
+
+// --- providers as voxgig/plugin definitions --------------------------
+
+/// A provider kind, as voxgig/plugin holds it. A definition is data with
+/// functions in it, so it is a value a calling project passes in - never
+/// a class to extend and never a registry to fill.
+using Definition = plugin::DefinitionPtr;
+
+/// How a kind builds its provider from the spec its instance was declared
+/// with. A refusal is a thrown SekretoError.
+using Make = std::function<std::shared_ptr<Provider>(const ProviderSpec&)>;
+
+/// The export key under which a provider definition publishes the
+/// provider it built. `Sekreto` reads `<ref>/provider` off the host.
+extern const char* const PROVIDER_EXPORT;
+
+/// The voxgig/plugin error code a SekretoError travels under when it is
+/// thrown inside a definition's `define`.
+///
+/// plugin wraps a code-less error raised by a callback as
+/// `plugin_define_failed`, and keeps an error that already carries a
+/// code. A provider that refuses its own configuration - `kv: 3`, a
+/// missing project - throws a SekretoError, and that message is pinned by
+/// the spec byte for byte, so it must come back out of the host exactly
+/// as it went in. `providerplugin` gives it this code on the way in;
+/// `Sekreto` turns it back into a SekretoError on the way out.
+extern const char* const ERROR_CODE;
+
+/// A provider kind, as a voxgig/plugin definition.
+///
+/// This is the whole bridge between the two libraries. The definition's
+/// `name` is the `kind` a ProviderSpec names; its `define` reads the spec
+/// off the instance's options, builds the provider with `make`, and
+/// exports it. Nothing runs at `activate`: a provider opens nothing until
+/// its first lookup, so there is nothing to capture - a provider that does
+/// hold a resource acquires it there and lets the instance scope unwind
+/// it.
+///
+/// Every built-in and every plugin is made this way, so a custom provider
+/// kind is one call:
+///
+///     Definition mystore = providerplugin(
+///         "mystore", [](const ProviderSpec& spec) {
+///           return std::make_shared<MyStore>(spec.addr);
+///         });
+Definition providerplugin(const std::string& kind, Make make);
+
+/// A spec as the options map a plugin instance carries: one key per field
+/// that is set, named as the field is - the spec's own key names in every
+/// port.
+plugin::V optionsof(const ProviderSpec& spec);
+
+/// The spec a plugin instance's options describe: the inverse of
+/// `optionsof`, and what a definition's `define` hands to its `make`.
+ProviderSpec specof(const plugin::V& options);
+
+// --- the provider slots ----------------------------------------------
+
+// voxgig/plugin's value model carries numbers, strings, lists and maps -
+// not pointers - so a definition's `define` cannot export the provider it
+// built. It leaves the provider HERE and exports the ticket; `Sekreto`
+// reads the ticket back off the host and takes the provider, which empties
+// the slot again. The same shape zig's port uses, for the same reason.
+//
+// A slot is claimed exactly once, so nothing accumulates: between two
+// constructions the table is empty, and `providerslots()` says so. Two
+// threads building chains at once would share it, and this port - like the
+// plugin port under it - does not claim to support that.
+
+/// Park a freshly built provider and answer its ticket.
+double providerslot(const std::shared_ptr<Provider>& provider);
+/// Take the provider a ticket names, emptying the slot. Nothing, if the
+/// ticket names no slot.
+std::shared_ptr<Provider> takeprovider(double ticket);
+/// The next ticket that will be issued: a mark to discard back to when a
+/// declaration fails after its `define` has already built something.
+double providermark();
+/// Drop every slot filled since `mark`.
+void providerdiscard(double mark);
+/// How many slots are filled. Zero everywhere except inside a `define`.
+size_t providerslots();
+
+}  // namespace sekreto
+
+#endif