@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/onepassword.lua

@@ -0,0 +1,126 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/onepassword.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The onepassword plugin: 1Password through a Connect server, over
+-- HTTPS.
+--
+-- A port of typescript/plugins/onepassword.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+local addr = require('feature.secrets.sekreto.addr')
+local providers = require('feature.secrets.sekreto.providers')
+local json = require('feature.secrets.sekreto.plugins.json')
+local httpjson = require('feature.secrets.sekreto.plugins.httpjson')
+local support = require('feature.secrets.sekreto.plugins.support')
+
+local fail = err.fail
+local trimslash = providers.trimslash
+local providerplugin = providers.providerplugin
+local fetchjson = httpjson.fetchjson
+local uriescape = support.uriescape
+
+local M = {}
+
+--- 1Password, through a Connect server.
+---
+--- The item titled `api.token` (titles keep their dots), in the named
+--- vault. The value is the field with purpose PASSWORD, or the field
+--- labelled `value`. A vault that cannot be found is an error - config
+--- names it, so its absence is a broken store, not a missing secret.
+local function onepassword(useaddr, token, vault)
+  local vaultid = nil
+
+  local function auth()
+    return { { 'authorization', 'Bearer ' .. (token or '') } }
+  end
+
+  local function resolvevault(address)
+    local want = vault or ''
+    if '' == want then
+      fail('sekreto: onepassword: no vault')
+    end
+
+    local res = fetchjson('GET', address .. '/v1/vaults', auth())
+    local list = json.asarr(res.body)
+
+    if 200 ~= res.status or nil == list then
+      fail('sekreto: onepassword error: ' .. res.status .. ': listing vaults')
+    end
+
+    for _, entry in ipairs(list) do
+      local id = json.text(json.dig(entry, 'id'))
+      if want == id or want == json.text(json.dig(entry, 'name')) then
+        return id or ''
+      end
+    end
+
+    fail('sekreto: onepassword: no vault named ' .. want)
+  end
+
+  return {
+    lookup = function(secret)
+      name.checkname(secret)
+
+      local address = trimslash(useaddr or '')
+      if '' == address then
+        fail('sekreto: onepassword: no addr')
+      end
+      addr.checkaddr(address)
+
+      if nil == vaultid then
+        vaultid = resolvevault(address)
+      end
+
+      local filter = uriescape('title eq "' .. secret .. '"')
+      local found = fetchjson(
+        'GET', address .. '/v1/vaults/' .. vaultid .. '/items?filter=' .. filter, auth()
+      )
+
+      local items = json.asarr(found.body)
+      if 200 ~= found.status or nil == items then
+        fail('sekreto: onepassword error: ' .. found.status .. ': finding ' .. secret)
+      end
+
+      if 0 == #items then
+        return nil
+      end
+
+      local item = fetchjson(
+        'GET',
+        address .. '/v1/vaults/' .. vaultid .. '/items/' ..
+          (json.text(json.dig(items[1], 'id')) or ''),
+        auth()
+      )
+
+      if 200 ~= item.status then
+        fail('sekreto: onepassword error: ' .. item.status .. ': reading ' .. secret)
+      end
+
+      local fields = json.asarr(json.dig(item.body, 'fields')) or {}
+
+      for _, entry in ipairs(fields) do
+        if 'PASSWORD' == json.asstr(json.dig(entry, 'purpose')) then
+          return json.text(json.dig(entry, 'value'))
+        end
+      end
+      for _, entry in ipairs(fields) do
+        if 'value' == json.asstr(json.dig(entry, 'label')) then
+          return json.text(json.dig(entry, 'value'))
+        end
+      end
+
+      return nil
+    end,
+    describe = function()
+      return 'onepassword:' .. (vault or '')
+    end,
+  }
+end
+
+--- The kind, as a voxgig/plugin definition.
+M.onepassword = providerplugin('onepassword', function(spec)
+  return onepassword(spec.addr, spec.token, spec.vault)
+end)
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/secretspec.lua

@@ -0,0 +1,93 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/secretspec.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The secretspec plugin: SecretSpec, through its CLI. Needs a child
+-- process, so it is not a built-in kind.
+--
+-- A port of typescript/plugins/secretspec.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+local providers = require('feature.secrets.sekreto.providers')
+local support = require('feature.secrets.sekreto.plugins.support')
+local net = require('feature.secrets.sekreto.plugins.net')
+
+local fail = err.fail
+local nonempty = providers.nonempty
+local providerplugin = providers.providerplugin
+local first = support.first
+local stripnewline = support.stripnewline
+local runcmd = net.runcmd
+
+local M = {}
+
+--- Does this SecretSpec failure mean "no such secret" rather than "I
+--- could not answer"?
+---
+--- MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+--- `Provider backend 'keyring' not found`, which is a store that could
+--- not answer at all - and reading that as a miss is the worst failure
+--- this library has, because the chain then falls through to a weaker
+--- store without saying so. The key is required to appear, so the two
+--- cannot be confused.
+function M.secretspecmiss(why, key)
+  return nil ~= why:find("Secret '" .. key .. "' not found", 1, true)
+end
+
+--- SecretSpec (https://secretspec.dev), read through its CLI.
+---
+--- `backend` selects one of SecretSpec's own backends (`--provider`) and
+--- is called `backend` here only because `provider` already means a
+--- sekreto provider. A reason is required, not optional: SecretSpec
+--- records every read in an audit log and refuses to read without one.
+local function secretspec(command, file, profile, backend, reason, prefix)
+  local usecommand = nonempty(command) and command or 'secretspec'
+
+  return {
+    lookup = function(secret)
+      local key = name.envkey(secret, prefix)
+
+      local argv = { usecommand }
+      if nonempty(file) then
+        argv[#argv + 1] = '--file'
+        argv[#argv + 1] = file
+      end
+      argv[#argv + 1] = 'get'
+      argv[#argv + 1] = key
+      if nonempty(backend) then
+        argv[#argv + 1] = '--provider'
+        argv[#argv + 1] = backend
+      end
+      if nonempty(profile) then
+        argv[#argv + 1] = '--profile'
+        argv[#argv + 1] = profile
+      end
+      argv[#argv + 1] = '--reason'
+      argv[#argv + 1] = first(reason, 'sekreto')
+
+      local out, why, status = runcmd(argv, nil, usecommand)
+
+      if 0 == status then
+        return stripnewline(out)
+      end
+
+      if M.secretspecmiss(why, key) then
+        return nil
+      end
+
+      fail('sekreto: secretspec error: ' ..
+        (('' == why) and ('exit ' .. status) or why))
+    end,
+    describe = function()
+      return 'secretspec' .. (nonempty(backend) and (':' .. backend) or '')
+    end,
+  }
+end
+
+--- The kind, as a voxgig/plugin definition.
+M.secretspec = providerplugin('secretspec', function(spec)
+  return secretspec(spec.command, spec.file, spec.profile, spec.backend,
+    spec.reason, spec.prefix)
+end)
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/sigv4.lua

@@ -0,0 +1,269 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/sigv4.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- AWS Signature Version 4, hand-rolled.
+--
+-- The AWS providers need exactly one thing from the AWS SDK - request
+-- signing - and taking the SDK for it would break the no-dependency rule
+-- that keeps every port honest. SigV4 is a stable, published algorithm
+-- built from HMAC-SHA256, which src/sekreto/plugins/crypto.lua carries.
+-- It moved out of the core with the aws plugin: the core of no port
+-- imports a hash function (docs/design/plugin-providers.md).
+--
+-- `sigv4` is pure: the caller passes the timestamp, so the same input
+-- yields the same signature everywhere. That is what lets the shared spec
+-- carry known-answer cases that all ports must reproduce bit for bit, and
+-- lets the integration mock recompute the signature server-side.
+--
+-- `uriescape` and `uridecode` live in support, because four plugins that
+-- sign nothing need them and reaching them through here would put
+-- SHA-256 and HMAC behind all four.
+--
+-- A port of typescript/plugins/sigv4.ts, which is canonical.
+
+local crypto = require('feature.secrets.sekreto.plugins.crypto')
+local support = require('feature.secrets.sekreto.plugins.support')
+
+local M = {}
+
+local uriescape = support.uriescape
+local uridecode = support.uridecode
+
+-- ASCII case folding, spelled out. `string.upper` and `string.lower` go
+-- through the C library's toupper/tolower, which follow the machine's
+-- locale - and in a Turkish locale `i` does not fold to `I`.
+local function lowerascii(text)
+  return (text:gsub('[A-Z]', function(ch) return string.char(ch:byte() + 32) end))
+end
+
+local function upperascii(text)
+  return (text:gsub('[a-z]', function(ch) return string.char(ch:byte() - 32) end))
+end
+
+--- The canonical query string: each pair RFC 3986-escaped, sorted by
+--- escaped key then escaped value. `?b=2&a=1` signs as `a=1&b=2`.
+function M.canonicalquery(query)
+  if '' == query then
+    return ''
+  end
+
+  local pairlist = {}
+  local at = 1
+
+  while true do
+    local stop = query:find('&', at, true)
+    local piece = stop and query:sub(at, stop - 1) or query:sub(at)
+
+    local eq = piece:find('=', 1, true)
+    local key = eq and piece:sub(1, eq - 1) or piece
+    local value = eq and piece:sub(eq + 1) or ''
+
+    pairlist[#pairlist + 1] = {
+      uriescape(uridecode(key)),
+      uriescape(uridecode(value)),
+    }
+
+    if not stop then
+      break
+    end
+    at = stop + 1
+  end
+
+  table.sort(pairlist, function(left, right)
+    if left[1] ~= right[1] then
+      return left[1] < right[1]
+    end
+    return left[2] < right[2]
+  end)
+
+  local parts = {}
+  for index, pair in ipairs(pairlist) do
+    parts[index] = pair[1] .. '=' .. pair[2]
+  end
+
+  return table.concat(parts, '&')
+end
+
+--- Split a URL the way the WHATWG `host` property does, by hand.
+---
+--- No platform URL type is trusted here: the signature covers `host`, and
+--- a parser that keeps an explicitly written `:443`, or that leaves
+--- userinfo in, signs something the server will not agree with.
+local function spliturl(url)
+  local mark = url:find('://', 1, true)
+  local scheme = mark and lowerascii(url:sub(1, mark - 1)) or ''
+  local rest = mark and url:sub(mark + 3) or url
+
+  local stop = rest:find('[/?#]')
+  local authority = stop and rest:sub(1, stop - 1) or rest
+  local tail = stop and rest:sub(stop) or ''
+
+  -- Userinfo is stripped: it is never part of the signed host.
+  local at = authority:find('@[^@]*$')
+  if at then
+    authority = authority:sub(at + 1)
+  end
+
+  local host = authority
+  local port = ''
+
+  if '[' == host:sub(1, 1) then
+    local close = host:find(']', 1, true)
+    if close then
+      local after = host:sub(close + 1)
+      host = host:sub(1, close)
+      if ':' == after:sub(1, 1) then
+        port = after:sub(2)
+      end
+    end
+  else
+    local colon = host:find(':', 1, true)
+    if colon then
+      port = host:sub(colon + 1)
+      host = host:sub(1, colon - 1)
+    end
+  end
+
+  host = lowerascii(host)
+
+  -- A default port is not written: `Host: x:443` is not what was signed.
+  if ('https' == scheme and '443' == port) or ('http' == scheme and '80' == port) then
+    port = ''
+  end
+
+  local path = tail
+  local query = ''
+
+  local mark2 = tail:find('?', 1, true)
+  if mark2 then
+    path = tail:sub(1, mark2 - 1)
+    query = tail:sub(mark2 + 1)
+    local hash = query:find('#', 1, true)
+    if hash then
+      query = query:sub(1, hash - 1)
+    end
+  else
+    local hash = tail:find('#', 1, true)
+    if hash then
+      path = tail:sub(1, hash - 1)
+    end
+  end
+
+  if '' == path then
+    path = '/'
+  end
+
+  return {
+    scheme = scheme,
+    host = host,
+    port = port,
+    hostheader = ('' == port) and host or (host .. ':' .. port),
+    path = path,
+    query = query,
+  }
+end
+
+M.spliturl = spliturl
+
+--- Trim, then collapse every internal run of spaces and tabs to one
+--- space: AWS folds sequential whitespace before signing, so a header
+--- value `a  b\tc` must sign as `a b c`.
+local function foldvalue(text)
+  local trimmed = text:gsub('^[ \t\r\n]+', ''):gsub('[ \t\r\n]+$', '')
+  return (trimmed:gsub('[ \t\r\n]+', ' '))
+end
+
+--- Sign one request.
+---
+--- `input` is a table whose field names are the spec's JSON keys verbatim:
+--- method, url, service, region, keyid, secret, datetime, headers, body,
+--- session.
+---
+--- Returns an ORDERED list of {name, value} pairs: authorization,
+--- x-amz-date, and x-amz-security-token only when a session was given.
+--- The order is contract - callers print it field by field.
+function M.sigv4(input)
+  local url = spliturl(input.url or '')
+
+  local datetime = input.datetime or ''
+  local date = datetime:sub(1, 8)
+  local session = input.session
+  if nil ~= session and '' == session then
+    session = nil
+  end
+
+  -- The caller's headers first, then host / x-amz-date / the session
+  -- token AFTER them, so those always win.
+  local headers = {}
+  local names = {}
+
+  local function put(name, value)
+    if nil == headers[name] then
+      names[#names + 1] = name
+    end
+    headers[name] = value
+  end
+
+  for _, pair in ipairs(input.headers or {}) do
+    put(lowerascii(pair[1]), foldvalue(pair[2]))
+  end
+
+  put('host', url.hostheader)
+  put('x-amz-date', datetime)
+  if nil ~= session then
+    put('x-amz-security-token', session)
+  end
+
+  table.sort(names)
+
+  local canonparts = {}
+  for index, name in ipairs(names) do
+    canonparts[index] = name .. ':' .. headers[name] .. '\n'
+  end
+
+  local canonicalheaders = table.concat(canonparts)
+  local signedheaders = table.concat(names, ';')
+
+  local canonicalrequest = table.concat({
+    upperascii(input.method or ''),
+    url.path,
+    M.canonicalquery(url.query),
+    canonicalheaders,
+    signedheaders,
+    crypto.sha256hex(input.body or ''),
+  }, '\n')
+
+  local scope = date .. '/' .. (input.region or '') .. '/' ..
+    (input.service or '') .. '/aws4_request'
+
+  local stringtosign = table.concat({
+    'AWS4-HMAC-SHA256',
+    datetime,
+    scope,
+    crypto.sha256hex(canonicalrequest),
+  }, '\n')
+
+  local kdate = crypto.hmac('AWS4' .. (input.secret or ''), date)
+  local kregion = crypto.hmac(kdate, input.region or '')
+  local kservice = crypto.hmac(kregion, input.service or '')
+  local ksigning = crypto.hmac(kservice, 'aws4_request')
+  local signature = crypto.hex(crypto.hmac(ksigning, stringtosign))
+
+  local out = {
+    {
+      'authorization',
+      'AWS4-HMAC-SHA256 Credential=' .. (input.keyid or '') .. '/' .. scope ..
+        ', SignedHeaders=' .. signedheaders ..
+        ', Signature=' .. signature,
+    },
+    { 'x-amz-date', datetime },
+  }
+
+  if nil ~= session then
+    out[#out + 1] = { 'x-amz-security-token', session }
+  end
+
+  return out
+end
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/support.lua

@@ -0,0 +1,146 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/support.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The pure helpers every store client shares, and nothing else.
+--
+-- This module REQUIRES NOTHING - no socket, no digest, no child process,
+-- not even another sekreto module - so a plugin that needs only these
+-- gets only these. secretspec and the boru CLI path both do: they want
+-- `first` and `stripnewline` and no HTTP at all, and reaching those
+-- through httpjson would put the whole HTTP/1.1 framing behind two kinds
+-- that never open a socket.
+--
+-- It lives under plugins/ rather than in the core because only the ten
+-- plugin kinds use any of it. The core's four built-ins read at most a
+-- local file and need none of it.
+--
+-- The equivalents in the canonical port are spread across
+-- typescript/plugins/httpjson.ts and typescript/plugins/support.ts; the
+-- split into a separate module here is lua's, for the reason above.
+
+local M = {}
+
+--- The first candidate that is set and non-empty, or empty.
+---
+--- Walked with `select`, never with `ipairs` over a packed table: a nil
+--- argument leaves a hole, and `ipairs` stops dead at the first one - so
+--- `first(nil, os.getenv('AWS_ACCESS_KEY_ID'))` would answer empty with
+--- the variable plainly set.
+function M.first(...)
+  local count = select('#', ...)
+
+  for index = 1, count do
+    local candidate = select(index, ...)
+    if nil ~= candidate and '' ~= candidate then
+      return candidate
+    end
+  end
+
+  return ''
+end
+
+--- One trailing newline removed. A CLI prints the secret and a newline;
+--- the newline is never part of the secret on purpose.
+function M.stripnewline(text)
+  if '\n' == text:sub(-1) then
+    return text:sub(1, #text - 1)
+  end
+  return text
+end
+
+--- Never renewed: a configured token does not expire.
+M.NEVER = math.maxinteger
+
+--- Milliseconds since the epoch, near enough for token renewal.
+function M.nowms()
+  return os.time() * 1000
+end
+
+--- When a logged-in token must be renewed, from its expiry in seconds (a
+--- JSON number, or a string as Azure IMDS sends it): now + max(seconds -
+--- 60, 1). A missing or zero expiry means never renew.
+function M.renewtime(expires)
+  local seconds = 0
+
+  if 'number' == type(expires) then
+    seconds = expires
+  elseif 'string' == type(expires) then
+    seconds = tonumber(expires) or 0
+  end
+
+  if seconds ~= seconds or 0 >= seconds then
+    return M.NEVER
+  end
+
+  return M.nowms() + math.floor(math.max(seconds - 60, 1) * 1000)
+end
+
+--- The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now.
+function M.awsnow()
+  return os.date('!%Y%m%dT%H%M%SZ')
+end
+
+-- --------------------------------------------- percent-encoding
+--
+-- Here rather than with sigv4 because four plugins that sign nothing need
+-- `uriescape` - azure, 1password, doppler and infisical - and reaching it
+-- through sigv4 would put SHA-256 and HMAC behind all four. Moved
+-- verbatim from what was src/sekreto/sigv4.lua: the sigv4 corpus group
+-- is a known-answer test, so the bytes these two produce are pinned.
+
+--- RFC 3986 escaping, which is stricter than the usual URL encoder: AWS
+--- wants everything but the unreserved set escaped, with uppercase hex.
+--- `!'()*` are escaped here and are not by JavaScript's own encoder.
+function M.uriescape(text)
+  local out = {}
+
+  for index = 1, #text do
+    local byte = text:byte(index)
+    local ch = text:sub(index, index)
+
+    if (65 <= byte and 90 >= byte) or
+      (97 <= byte and 122 >= byte) or
+      (48 <= byte and 57 >= byte) or
+      45 == byte or 95 == byte or 46 == byte or 126 == byte
+    then
+      out[#out + 1] = ch
+    else
+      out[#out + 1] = string.format('%%%02X', byte)
+    end
+  end
+
+  return table.concat(out)
+end
+
+local HEX = '0123456789abcdefABCDEF'
+
+--- Percent-decode, and nothing else: `+` stays `+`, as on the wire, and a
+--- malformed escape is kept literal.
+function M.uridecode(text)
+  local out = {}
+  local index = 1
+
+  while index <= #text do
+    local ch = text:sub(index, index)
+
+    if '%' == ch and index + 2 <= #text then
+      local digits = text:sub(index + 1, index + 2)
+      if nil ~= HEX:find(digits:sub(1, 1), 1, true) and
+        nil ~= HEX:find(digits:sub(2, 2), 1, true)
+      then
+        out[#out + 1] = string.char(tonumber(digits, 16))
+        index = index + 3
+        goto continue
+      end
+    end
+
+    out[#out + 1] = ch
+    index = index + 1
+
+    ::continue::
+  end
+
+  return table.concat(out)
+end
+
+return M