@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/zig/feature/secrets/plugins/boru.zig

@@ -0,0 +1,188 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/boru.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! A boru vault (https://github.com/boru-lang/boru) - a sekreto plugin.
+//!
+//! Spawns the boru CLI, or speaks its wire protocol over HTTPS; either
+//! way it reaches outside the process, which is why it is a plugin.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// A boru vault (https://github.com/boru-lang/boru).
+///
+/// Two ways in, both boru's own.
+///
+/// With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+/// secret on stdout and nothing else. The passphrase is read by boru itself
+/// from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as config and
+/// never puts it on a command line, where it would show up in the process
+/// table.
+///
+/// With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+/// read-only, HashiCorp-shaped provision API, authenticated by a capability
+/// token from `boru vault grant`. A sekreto name is already a valid boru
+/// alias, and boru aliases keep their dots, so `api.token` is the single
+/// path segment `api.token` - not the `api`/`token` split a HashiCorp KV
+/// gets. The value is the `value` field. A 404 is a miss; anything else the
+/// server refuses (a revoked capability, a sealed vault) is an error.
+///
+/// boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+/// credential *broker*, built precisely so the caller never receives the
+/// credential. `vault serve` is the provision endpoint, built to hand the
+/// value back - that is the one sekreto uses.
+pub const BoruProvider = struct {
+    alloc: Allocator,
+    config: sekreto.Config,
+    command: []const u8,
+    namespace: []const u8,
+    home: []const u8,
+    addr: []const u8,
+    token: []const u8,
+    mount: []const u8,
+
+    pub fn lookup(self: *BoruProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        switch (try sekreto.checkname(alloc, name)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        if (0 != self.addr.len) {
+            return self.lookupwire(alloc, name);
+        }
+
+        return self.lookupcli(alloc, name);
+    }
+
+    fn lookupwire(self: *BoruProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        const addr = httpjson.trimslash(self.addr);
+
+        switch (try sekreto.checkaddr(alloc, addr)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        const alias = if (0 != self.namespace.len)
+            try std.fmt.allocPrint(alloc, "{s}/{s}", .{ self.namespace, name })
+        else
+            name;
+
+        const url = try std.fmt.allocPrint(alloc, "{s}/v1/{s}/data/{s}", .{ addr, self.mount, alias });
+
+        const headers = [_]httpjson.Header{.{ .name = "X-Vault-Token", .value = self.token }};
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        if (404 == res.status) {
+            return .{ .ok = null };
+        }
+
+        if (200 != res.status) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: boru serve error: {d}: {s}",
+                .{ res.status, url },
+            ) };
+        }
+
+        const data = httpjson.jget(httpjson.jget(res.body, "data"), "data");
+        return .{ .ok = httpjson.jstr(httpjson.jget(data, "value")) };
+    }
+
+    fn lookupcli(self: *BoruProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        const alias = if (0 != self.namespace.len)
+            try std.fmt.allocPrint(alloc, "{s}:{s}", .{ self.namespace, name })
+        else
+            name;
+
+        // BORU_HOME is added to a copy of the environment, never to the
+        // command line: the passphrase boru reads from the environment must
+        // not end up in the process table beside it.
+        var environ = try self.config.env.clone(alloc);
+        defer environ.deinit();
+
+        if (0 != self.home.len) {
+            try environ.put("BORU_HOME", self.home);
+        }
+
+        const run = std.process.run(alloc, self.config.io, .{
+            .argv = &.{ self.command, "vault", "get", "--reveal", alias },
+            .environ_map = &environ,
+        }) catch |err| {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: cannot run {s}: {s}",
+                .{ self.command, @errorName(err) },
+            ) };
+        };
+
+        const exited = switch (run.term) {
+            .exited => |code| code,
+            else => 1,
+        };
+
+        if (0 == exited) {
+            // boru prints the value and one newline, and nothing else.
+            var value: []const u8 = run.stdout;
+            if (0 != value.len and '\n' == value[value.len - 1]) {
+                value = value[0 .. value.len - 1];
+            }
+            return .{ .ok = value };
+        }
+
+        const why = std.mem.trim(u8, run.stderr, " \t\r\n");
+
+        // "no alias named" is boru saying it does not hold this secret,
+        // which is a miss: the chain carries on to the next provider. A
+        // locked vault or a wrong passphrase is not a miss - treating it as
+        // one would fall through to a weaker store without saying so.
+        if (null != std.mem.indexOf(u8, why, "no alias named")) {
+            return .{ .ok = null };
+        }
+
+        if (0 != why.len) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: boru vault error: {s}", .{why}) };
+        }
+
+        return .{ .err = try sekreto.fail(alloc, "sekreto: boru vault error: exit {d}", .{exited}) };
+    }
+
+    pub fn describe(self: *BoruProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        if (0 != self.addr.len) {
+            return std.fmt.allocPrint(alloc, "boru:{s}", .{httpjson.trimslash(self.addr)});
+        }
+        if (0 != self.namespace.len) {
+            return std.fmt.allocPrint(alloc, "boru:{s}", .{self.namespace});
+        }
+        return alloc.dupe(u8, "boru");
+    }
+
+    pub fn deinit(_: *BoruProvider, _: Allocator) void {}
+};
+
+fn make(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, BoruProvider, .{
+        .alloc = alloc,
+        .config = config,
+        .command = if (0 != spec.command.len) spec.command else "boru",
+        .namespace = spec.namespace,
+        .home = spec.home,
+        .addr = spec.addr,
+        .token = spec.token,
+        .mount = if (0 != spec.mount.len) spec.mount else "secret",
+    }) };
+}
+
+/// The `boru` kind.
+pub const boru: sekreto.Definition = sekreto.providerplugin("boru", make);

package/project/.sdk/tm/zig/feature/secrets/plugins/doppler.zig

@@ -0,0 +1,135 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/doppler.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Doppler - a sekreto plugin. Needs HTTPS.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// Doppler.
+///
+/// The whole config is downloaded once - Doppler's own bulk endpoint - and
+/// answered from memory, like a remote .env: `api.token` is the `API_TOKEN`
+/// entry. A service token is config-scoped, so project and config are only
+/// needed with broader tokens.
+pub const DopplerProvider = struct {
+    alloc: Allocator,
+    config: sekreto.Config,
+    token: []const u8,
+    project: []const u8,
+    dopplerconfig: []const u8,
+    addr: []const u8,
+    state: std.heap.ArenaAllocator,
+    values: ?[]const sekreto.KeyValue,
+
+    fn load(self: *DopplerProvider, alloc: Allocator) Allocator.Error!Answer([]const sekreto.KeyValue) {
+        if (self.values) |values| {
+            return .{ .ok = values };
+        }
+
+        const addr = httpjson.trimslash(if (0 != self.addr.len) self.addr else "https://api.doppler.com");
+
+        switch (try sekreto.checkaddr(alloc, addr)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        var url: std.ArrayList(u8) = .empty;
+        try url.appendSlice(alloc, addr);
+        try url.appendSlice(alloc, "/v3/configs/config/secrets/download?format=json");
+
+        if (0 != self.project.len) {
+            try url.appendSlice(alloc, "&project=");
+            try url.appendSlice(alloc, try httpjson.escape(alloc, self.project));
+        }
+        if (0 != self.dopplerconfig.len) {
+            try url.appendSlice(alloc, "&config=");
+            try url.appendSlice(alloc, try httpjson.escape(alloc, self.dopplerconfig));
+        }
+
+        const bearer = try std.fmt.allocPrint(alloc, "Bearer {s}", .{self.token});
+        const headers = [_]httpjson.Header{.{ .name = "authorization", .value = bearer }};
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url.items, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const body = res.body orelse std.json.Value{ .null = {} };
+
+        if (200 != res.status or .object != body) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: doppler error: {d}", .{res.status}) };
+        }
+
+        // Loaded once, so it outlives the lookup's scratch arena.
+        const keep = self.state.allocator();
+        var values: std.ArrayList(sekreto.KeyValue) = .empty;
+
+        var it = body.object.iterator();
+        while (it.next()) |field| {
+            const value = httpjson.jstr(field.value_ptr.*) orelse continue;
+            try values.append(keep, .{
+                .key = try keep.dupe(u8, field.key_ptr.*),
+                .value = try keep.dupe(u8, value),
+            });
+        }
+
+        self.values = values.items;
+        return .{ .ok = values.items };
+    }
+
+    pub fn lookup(self: *DopplerProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        const key = switch (try sekreto.envkey(alloc, name, "")) {
+            .err => |message| return .{ .err = message },
+            .ok => |made| made,
+        };
+
+        const values = switch (try self.load(alloc)) {
+            .err => |message| return .{ .err = message },
+            .ok => |loaded| loaded,
+        };
+
+        for (values) |entry| {
+            if (std.mem.eql(u8, entry.key, key)) {
+                return .{ .ok = entry.value };
+            }
+        }
+
+        return .{ .ok = null };
+    }
+
+    pub fn describe(self: *DopplerProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        if (0 == self.project.len) {
+            return alloc.dupe(u8, "doppler");
+        }
+        return std.fmt.allocPrint(alloc, "doppler:{s}/{s}", .{ self.project, self.dopplerconfig });
+    }
+
+    pub fn deinit(self: *DopplerProvider, _: Allocator) void {
+        self.state.deinit();
+    }
+};
+
+fn make(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, DopplerProvider, .{
+        .alloc = alloc,
+        .config = config,
+        .token = spec.token,
+        .project = spec.project,
+        .dopplerconfig = spec.config,
+        .addr = spec.addr,
+        .state = std.heap.ArenaAllocator.init(alloc),
+        .values = null,
+    }) };
+}
+
+/// The `doppler` kind.
+pub const doppler: sekreto.Definition = sekreto.providerplugin("doppler", make);

package/project/.sdk/tm/zig/feature/secrets/plugins/gcpsecrets.zig

@@ -0,0 +1,170 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/gcpsecrets.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! GCP Secret Manager - a sekreto plugin. Needs HTTPS.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// GCP Secret Manager.
+///
+/// `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+/// Manager ids have no hierarchy and reject dots), latest version. The token
+/// comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the GCE/GKE
+/// metadata server - so on Google's own platform no credential
+/// configuration is needed at all.
+///
+/// The metadata call itself is plain http to a link-local host by platform
+/// design; no credential rides on it, so `checkaddr` guards the Secret
+/// Manager address instead.
+pub const GcpSecretsProvider = struct {
+    alloc: Allocator,
+    config: sekreto.Config,
+    project: []const u8,
+    token: []const u8,
+    addr: []const u8,
+    metadataaddr: []const u8,
+    livetoken: ?[]const u8,
+    renewat: i64,
+
+    fn metadata(self: *GcpSecretsProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        if (0 != self.metadataaddr.len) {
+            return self.metadataaddr;
+        }
+
+        if (self.config.env.get("GCE_METADATA_HOST")) |host| {
+            if (0 != host.len) {
+                return std.fmt.allocPrint(alloc, "http://{s}", .{host});
+            }
+        }
+
+        return "http://metadata.google.internal";
+    }
+
+    fn login(self: *GcpSecretsProvider, alloc: Allocator) Allocator.Error!Answer([]const u8) {
+        const configured = httpjson.firstof(self.config, self.token, &.{"GOOGLE_OAUTH_ACCESS_TOKEN"});
+        if (0 != configured.len) {
+            return .{ .ok = configured };
+        }
+
+        const url = try std.fmt.allocPrint(
+            alloc,
+            "{s}/computeMetadata/v1/instance/service-accounts/default/token",
+            .{httpjson.trimslash(try self.metadata(alloc))},
+        );
+
+        const headers = [_]httpjson.Header{.{ .name = "Metadata-Flavor", .value = "Google" }};
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const access = httpjson.jstr(httpjson.jget(res.body, "access_token"));
+
+        if (200 != res.status or null == access) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: gcp: no token and metadata server did not answer",
+                .{},
+            ) };
+        }
+
+        self.renewat = httpjson.renewafter(self.config.io, httpjson.jnum(httpjson.jget(res.body, "expires_in")));
+
+        return .{ .ok = access.? };
+    }
+
+    pub fn lookup(self: *GcpSecretsProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        if (0 == self.project.len) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: gcp: no project", .{}) };
+        }
+
+        const addr = if (0 != self.addr.len) self.addr else "https://secretmanager.googleapis.com";
+
+        switch (try sekreto.checkaddr(alloc, addr)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        if (null == self.livetoken or httpjson.nowms(self.config.io) >= self.renewat) {
+            const fresh = switch (try self.login(alloc)) {
+                .err => |message| return .{ .err = message },
+                .ok => |got| got,
+            };
+            if (self.livetoken) |old| {
+                self.alloc.free(old);
+            }
+            self.livetoken = try self.alloc.dupe(u8, fresh);
+        }
+
+        const flat = switch (try sekreto.flatname(alloc, name, "_")) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const url = try std.fmt.allocPrint(
+            alloc,
+            "{s}/v1/projects/{s}/secrets/{s}/versions/latest:access",
+            .{ httpjson.trimslash(addr), self.project, flat },
+        );
+
+        const bearer = try std.fmt.allocPrint(alloc, "Bearer {s}", .{self.livetoken.?});
+        const headers = [_]httpjson.Header{.{ .name = "authorization", .value = bearer }};
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        if (404 == res.status) {
+            return .{ .ok = null };
+        }
+
+        if (200 != res.status) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: gcp error: {d}: {s}", .{ res.status, url }) };
+        }
+
+        const data = httpjson.jstr(httpjson.jget(httpjson.jget(res.body, "payload"), "data")) orelse
+            return .{ .ok = null };
+
+        // See the aws provider: an undecodable payload is an error, not a
+        // miss.
+        return .{ .ok = try sekreto.unbase64(alloc, data) orelse
+            return .{ .err = try sekreto.fail(alloc, "sekreto: gcp: undecodable secret", .{}) } };
+    }
+
+    pub fn describe(self: *GcpSecretsProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        return std.fmt.allocPrint(alloc, "gcpsecrets:{s}", .{self.project});
+    }
+
+    pub fn deinit(self: *GcpSecretsProvider, alloc: Allocator) void {
+        if (self.livetoken) |token| {
+            alloc.free(token);
+        }
+    }
+};
+
+fn make(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, GcpSecretsProvider, .{
+        .alloc = alloc,
+        .config = config,
+        .project = spec.project,
+        .token = spec.token,
+        .addr = spec.addr,
+        .metadataaddr = spec.metadataaddr,
+        .livetoken = null,
+        .renewat = httpjson.NEVER,
+    }) };
+}
+
+/// The `gcpsecrets` kind.
+pub const gcpsecrets: sekreto.Definition = sekreto.providerplugin("gcpsecrets", make);