@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/boru.lua

@@ -0,0 +1,124 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/boru.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The boru plugin: a boru vault, through its own CLI or its own wire
+-- protocol. Needs a child process, and HTTPS for the wire path.
+--
+-- A port of typescript/plugins/boru.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+local addr = require('feature.secrets.sekreto.addr')
+local providers = require('feature.secrets.sekreto.providers')
+local json = require('feature.secrets.sekreto.plugins.json')
+local httpjson = require('feature.secrets.sekreto.plugins.httpjson')
+local support = require('feature.secrets.sekreto.plugins.support')
+local net = require('feature.secrets.sekreto.plugins.net')
+
+local fail = err.fail
+local nonempty = providers.nonempty
+local trimslash = providers.trimslash
+local providerplugin = providers.providerplugin
+local stripnewline = support.stripnewline
+local fetchjson = httpjson.fetchjson
+local runcmd = net.runcmd
+
+local M = {}
+
+--- Does this boru failure mean "no such secret" rather than "I could not
+--- answer"? Matched on boru's own wording for a missing alias.
+function M.borumiss(why)
+  return nil ~= why:find('no alias named', 1, true)
+end
+
+--- A boru vault (https://github.com/boru-lang/boru).
+---
+--- Two ways in, both boru's own. With no `addr`, the CLI:
+--- `boru vault get --reveal <alias>` prints the secret on stdout and
+--- nothing else. The passphrase is read by boru itself from
+--- BORU_VAULT_PASSPHRASE; sekreto never accepts it as config and never
+--- puts it on a command line, where the process table would publish it.
+---
+--- With an `addr`, boru's wire protocol: a read-only, HashiCorp-shaped
+--- provision API. A sekreto name is already a valid boru alias, and boru
+--- aliases keep their dots, so `api.token` is the single path segment
+--- `api.token` - not the `api`/`token` split a HashiCorp KV gets.
+local function boru(command, namespace, home, useaddr, token, mount)
+  local usecommand = nonempty(command) and command or 'boru'
+  local address = (nil == useaddr) and '' or trimslash(useaddr)
+  local usetoken = token or ''
+  local usemount = nonempty(mount) and mount or 'secret'
+
+  local function wirelookup(secret)
+    addr.checkaddr(address)
+
+    local alias = nonempty(namespace) and (namespace .. '/' .. secret) or secret
+    local url = address .. '/v1/' .. usemount .. '/data/' .. alias
+
+    local res = fetchjson('GET', url, { { 'X-Vault-Token', usetoken } })
+
+    if 404 == res.status then
+      return nil
+    end
+
+    if 200 ~= res.status then
+      fail('sekreto: boru serve error: ' .. res.status .. ': ' .. url)
+    end
+
+    return json.text(json.dig(res.body, 'data', 'data', 'value'))
+  end
+
+  return {
+    lookup = function(secret)
+      name.checkname(secret)
+
+      if '' ~= address then
+        return wirelookup(secret)
+      end
+
+      local alias = nonempty(namespace) and (namespace .. ':' .. secret) or secret
+
+      -- BORU_HOME is the only variable sekreto sets for the child; the
+      -- passphrase is boru's own to read from BORU_VAULT_PASSPHRASE, and
+      -- is never config here and never on a command line.
+      local overrides = nil
+      if nonempty(home) then
+        overrides = { 'BORU_HOME=' .. home }
+      end
+
+      local out, why, status = runcmd(
+        { usecommand, 'vault', 'get', '--reveal', alias }, overrides, usecommand
+      )
+
+      if 0 == status then
+        -- boru prints the value and one newline, and nothing else.
+        return stripnewline(out)
+      end
+
+      -- "no alias named" is boru saying it does not hold this secret,
+      -- which is a miss. A locked vault or a wrong passphrase is not -
+      -- treating it as one would fall through to a weaker store without
+      -- saying so.
+      if M.borumiss(why) then
+        return nil
+      end
+
+      fail('sekreto: boru vault error: ' ..
+        (('' == why) and ('exit ' .. status) or why))
+    end,
+    describe = function()
+      if '' ~= address then
+        return 'boru:' .. address
+      end
+      return 'boru' .. (nonempty(namespace) and (':' .. namespace) or '')
+    end,
+  }
+end
+
+--- The kind, as a voxgig/plugin definition.
+M.boru = providerplugin('boru', function(spec)
+  return boru(spec.command, spec.namespace, spec.home, spec.addr,
+    spec.token, spec.mount)
+end)
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/crypto.lua

@@ -0,0 +1,212 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/crypto.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- SHA-256, HMAC-SHA256, hex and strict base64 - all hand-rolled.
+--
+-- Lua has no crypto at all. The port links OpenSSL for TLS (see
+-- native/sekretonet.c), and it would be one line to call that library's
+-- EVP_Digest here instead - but the dependency rule covers cryptographic
+-- TRANSPORT and nothing else, so the digests sekreto signs with are its
+-- own. Rust took the same decision with `ring` already in rustls's
+-- closure.
+--
+-- Correctness is not argued from the code: SigV4 is a chain of these
+-- primitives, so the five known-answer vectors in spec/sekreto.json fail
+-- on one wrong bit anywhere below.
+--
+-- Lua 5.4 has 64-bit integers and native bitwise operators, so the
+-- rotations are direct - every addition is masked back to 32 bits.
+
+local M = {}
+
+local MASK = 0xffffffff
+
+local K = {
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
+  0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+  0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+  0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+  0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+  0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
+  0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
+  0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+  0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+}
+
+local function ror(value, count)
+  return ((value >> count) | (value << (32 - count))) & MASK
+end
+
+--- SHA-256 of a byte string, as 32 raw bytes.
+function M.sha256(message)
+  local h0, h1, h2, h3 = 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a
+  local h4, h5, h6, h7 = 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
+
+  -- 0x80, then zeros until the length lands 8 bytes short of a block,
+  -- then the BIT length, big-endian.
+  local bitlen = #message * 8
+  local padded = message .. '\128'
+  local rem = (#padded % 64)
+  local fill = (56 - rem) % 64
+  padded = padded .. string.rep('\0', fill) .. string.pack('>I8', bitlen)
+
+  local w = {}
+
+  for block = 1, #padded, 64 do
+    for index = 0, 15 do
+      w[index + 1] = string.unpack('>I4', padded, block + index * 4)
+    end
+
+    for index = 17, 64 do
+      local a = w[index - 15]
+      local b = w[index - 2]
+      local s0 = ror(a, 7) ~ ror(a, 18) ~ (a >> 3)
+      local s1 = ror(b, 17) ~ ror(b, 19) ~ (b >> 10)
+      w[index] = (w[index - 16] + s0 + w[index - 7] + s1) & MASK
+    end
+
+    local a, b, c, d = h0, h1, h2, h3
+    local e, f, g, h = h4, h5, h6, h7
+
+    for index = 1, 64 do
+      local S1 = ror(e, 6) ~ ror(e, 11) ~ ror(e, 25)
+      local ch = (e & f) ~ ((~e & MASK) & g)
+      local temp1 = (h + S1 + ch + K[index] + w[index]) & MASK
+      local S0 = ror(a, 2) ~ ror(a, 13) ~ ror(a, 22)
+      local maj = (a & b) ~ (a & c) ~ (b & c)
+      local temp2 = (S0 + maj) & MASK
+
+      h = g
+      g = f
+      f = e
+      e = (d + temp1) & MASK
+      d = c
+      c = b
+      b = a
+      a = (temp1 + temp2) & MASK
+    end
+
+    h0 = (h0 + a) & MASK
+    h1 = (h1 + b) & MASK
+    h2 = (h2 + c) & MASK
+    h3 = (h3 + d) & MASK
+    h4 = (h4 + e) & MASK
+    h5 = (h5 + f) & MASK
+    h6 = (h6 + g) & MASK
+    h7 = (h7 + h) & MASK
+  end
+
+  return string.pack('>I4I4I4I4I4I4I4I4', h0, h1, h2, h3, h4, h5, h6, h7)
+end
+
+--- Lowercase hex, two digits per byte.
+function M.hex(bytes)
+  local out = {}
+  for index = 1, #bytes do
+    out[index] = string.format('%02x', bytes:byte(index))
+  end
+  return table.concat(out)
+end
+
+function M.sha256hex(message)
+  return M.hex(M.sha256(message))
+end
+
+local BLOCK = 64
+
+--- HMAC-SHA256, RFC 2104. The argument order is (key, data) in every
+--- port; several standard libraries take (data, key), and that is fixed
+--- at the wrapper rather than at the call sites.
+function M.hmac(key, data)
+  local usekey = key
+
+  if #usekey > BLOCK then
+    usekey = M.sha256(usekey)
+  end
+  if #usekey < BLOCK then
+    usekey = usekey .. string.rep('\0', BLOCK - #usekey)
+  end
+
+  local ipad = {}
+  local opad = {}
+
+  for index = 1, BLOCK do
+    local byte = usekey:byte(index)
+    ipad[index] = string.char(byte ~ 0x36)
+    opad[index] = string.char(byte ~ 0x5c)
+  end
+
+  local inner = M.sha256(table.concat(ipad) .. data)
+  return M.sha256(table.concat(opad) .. inner)
+end
+
+-- ---- base64 ----------------------------------------------------------
+
+local ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+
+local VALUES = {}
+for index = 1, #ALPHABET do
+  VALUES[ALPHABET:sub(index, index)] = index - 1
+end
+
+--- Decode standard base64, STRICTLY: returns nil for anything that is not
+--- a well-formed payload.
+---
+--- Strictness is the point. A lenient decoder skips bytes outside the
+--- alphabet and hands back plausible-looking bytes for a corrupted
+--- payload - which are then returned to the caller AS THE SECRET. A
+--- rejection here becomes an error, never a miss.
+function M.unbase64(text)
+  if 'string' ~= type(text) then
+    return nil
+  end
+
+  local clean = text:gsub('[ \t\r\n]', '')
+
+  if 0 ~= #clean % 4 then
+    return nil
+  end
+
+  local body = clean
+  local pad = 0
+
+  while 0 < #body and '=' == body:sub(-1) do
+    pad = pad + 1
+    body = body:sub(1, #body - 1)
+  end
+
+  if 2 < pad then
+    return nil
+  end
+
+  for index = 1, #body do
+    if nil == VALUES[body:sub(index, index)] then
+      return nil
+    end
+  end
+
+  local out = {}
+  local acc = 0
+  local bits = 0
+
+  for index = 1, #body do
+    acc = (acc << 6) | VALUES[body:sub(index, index)]
+    bits = bits + 6
+
+    if 8 <= bits then
+      bits = bits - 8
+      out[#out + 1] = string.char((acc >> bits) & 0xff)
+    end
+  end
+
+  return table.concat(out)
+end
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/doppler.lua

@@ -0,0 +1,89 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/doppler.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The doppler plugin: a whole Doppler config downloaded once, over
+-- HTTPS, and answered from memory like a remote .env.
+--
+-- A port of typescript/plugins/doppler.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+local addr = require('feature.secrets.sekreto.addr')
+local providers = require('feature.secrets.sekreto.providers')
+local json = require('feature.secrets.sekreto.plugins.json')
+local httpjson = require('feature.secrets.sekreto.plugins.httpjson')
+local support = require('feature.secrets.sekreto.plugins.support')
+
+local fail = err.fail
+local nonempty = providers.nonempty
+local trimslash = providers.trimslash
+local providerplugin = providers.providerplugin
+local first = support.first
+local fetchjson = httpjson.fetchjson
+local uriescape = support.uriescape
+
+local M = {}
+
+--- Doppler.
+---
+--- The whole config is downloaded once - Doppler's own bulk endpoint -
+--- and answered from memory, like a remote .env: `api.token` is the
+--- `API_TOKEN` entry. A failed load caches nothing, so it retries.
+local function doppler(token, project, config, useaddr)
+  local values = nil
+
+  local function load()
+    if nil ~= values then
+      return values
+    end
+
+    local address = trimslash(first(useaddr, 'https://api.doppler.com'))
+    addr.checkaddr(address)
+
+    local url = address .. '/v3/configs/config/secrets/download?format=json'
+    if nonempty(project) then
+      url = url .. '&project=' .. uriescape(project)
+    end
+    if nonempty(config) then
+      url = url .. '&config=' .. uriescape(config)
+    end
+
+    local res = fetchjson(
+      'GET', url, { { 'authorization', 'Bearer ' .. (token or '') } }
+    )
+
+    local body = json.asobj(res.body)
+    if 200 ~= res.status or nil == body then
+      fail('sekreto: doppler error: ' .. res.status)
+    end
+
+    local loaded = {}
+    for _, key in ipairs(body.keys) do
+      local text = json.text(body.vals[key])
+      if nil ~= text then
+        loaded[key] = text
+      end
+    end
+
+    values = loaded
+    return loaded
+  end
+
+  return {
+    -- The `prefix` option is deliberately not consulted by this kind.
+    lookup = function(secret)
+      return load()[name.envkey(secret)]
+    end,
+    describe = function()
+      return 'doppler' ..
+        (nonempty(project) and (':' .. project .. '/' .. (config or '')) or '')
+    end,
+  }
+end
+
+--- The kind, as a voxgig/plugin definition.
+M.doppler = providerplugin('doppler', function(spec)
+  return doppler(spec.token, spec.project, spec.config, spec.addr)
+end)
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/gcpsecrets.lua

@@ -0,0 +1,129 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/gcpsecrets.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The gcpsecrets plugin: GCP Secret Manager, over HTTPS, with the GCE
+-- metadata server as a credential source.
+--
+-- A port of typescript/plugins/gcpsecrets.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+local addr = require('feature.secrets.sekreto.addr')
+local providers = require('feature.secrets.sekreto.providers')
+local json = require('feature.secrets.sekreto.plugins.json')
+local httpjson = require('feature.secrets.sekreto.plugins.httpjson')
+local support = require('feature.secrets.sekreto.plugins.support')
+local crypto = require('feature.secrets.sekreto.plugins.crypto')
+
+local fail = err.fail
+local nonempty = providers.nonempty
+local trimslash = providers.trimslash
+local providerplugin = providers.providerplugin
+local first = support.first
+local nowms = support.nowms
+local renewtime = support.renewtime
+local NEVER = support.NEVER
+local fetchjson = httpjson.fetchjson
+
+local M = {}
+
+--- GCP Secret Manager.
+---
+--- `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+--- Manager ids have no hierarchy and reject dots), latest version. The
+--- token comes from config, then GOOGLE_OAUTH_ACCESS_TOKEN, then the
+--- GCE/GKE metadata server - so on Google's own platform no credential
+--- configuration is needed at all.
+---
+--- The metadata call itself is plain http to a link-local host by
+--- platform design and carries no credential, so `checkaddr` guards the
+--- Secret Manager address instead.
+local function gcpsecrets(project, token, useaddr, metadataaddr)
+  local livetoken = nil
+  local renewat = NEVER
+
+  local function usemetadataaddr()
+    if nonempty(metadataaddr) then
+      return metadataaddr
+    end
+
+    local host = os.getenv('GCE_METADATA_HOST')
+    if nonempty(host) then
+      return 'http://' .. host
+    end
+
+    return 'http://metadata.google.internal'
+  end
+
+  local function login()
+    local configured = first(token, os.getenv('GOOGLE_OAUTH_ACCESS_TOKEN'))
+    if '' ~= configured then
+      return configured
+    end
+
+    local url = trimslash(usemetadataaddr()) ..
+      '/computeMetadata/v1/instance/service-accounts/default/token'
+
+    local res = fetchjson('GET', url, { { 'Metadata-Flavor', 'Google' } })
+    local got = json.text(json.dig(res.body, 'access_token'))
+
+    if 200 ~= res.status or nil == got or '' == got then
+      fail('sekreto: gcp: no token and metadata server did not answer')
+    end
+
+    renewat = renewtime(json.dig(res.body, 'expires_in'))
+
+    return got
+  end
+
+  return {
+    lookup = function(secret)
+      local useproject = project or ''
+      if '' == useproject then
+        fail('sekreto: gcp: no project')
+      end
+
+      local address = first(useaddr, 'https://secretmanager.googleapis.com')
+      addr.checkaddr(address)
+
+      if nil == livetoken or nowms() >= renewat then
+        livetoken = login()
+      end
+
+      local url = trimslash(address) .. '/v1/projects/' .. useproject ..
+        '/secrets/' .. name.flatname(secret, '_') .. '/versions/latest:access'
+
+      local res = fetchjson('GET', url, { { 'authorization', 'Bearer ' .. livetoken } })
+
+      if 404 == res.status then
+        return nil
+      end
+
+      if 200 ~= res.status then
+        fail('sekreto: gcp error: ' .. res.status .. ': ' .. url)
+      end
+
+      local data = json.asstr(json.dig(res.body, 'payload', 'data'))
+      if nil == data then
+        return nil
+      end
+
+      local decoded = crypto.unbase64(data)
+      if nil == decoded then
+        fail('sekreto: gcp: undecodable secret')
+      end
+
+      return decoded
+    end,
+    describe = function()
+      return 'gcpsecrets:' .. (project or '')
+    end,
+  }
+end
+
+--- The kind, as a voxgig/plugin definition.
+M.gcpsecrets = providerplugin('gcpsecrets', function(spec)
+  return gcpsecrets(spec.project, spec.token, spec.addr, spec.metadataaddr)
+end)
+
+return M