@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/cpp/feature/secrets/plugin/version.cpp

@@ -0,0 +1,143 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/version.cpp)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Versions and ranges (§11.2). */
+
+#include "version.hpp"
+
+namespace plugin {
+
+/* A COMPONENT IS BOUNDED, like a ref is (§4's 1024).
+ *
+ * The grammar admits an unbounded digit sequence, and every language
+ * then disagrees about what happens past its integer range: JavaScript
+ * silently loses precision, Go's Atoi errors (and a port ignoring that
+ * gets 0), C overflows, Python is exact. `satisfies("0",
+ * "9223372036854775808")` was false in the canonical and true in go,
+ * from the same corpus.
+ *
+ * 2^31-1 because every port has a signed 32-bit integer, and no real
+ * version has ever needed more. Stated rather than left to arithmetic
+ * nobody agrees on. Found by review of the go port. */
+static const long COMPONENT_MAX = 2147483647L;
+
+/* `^(\d+)(?:\.(\d+))?(?:\.(\d+))?$`, by hand: three components, digits
+ * only, no leading sign, no empty component. Written out rather than
+ * handed to <regex> because the bound below has to be checked per
+ * component anyway, and a regex that matched then needed re-scanning
+ * would be the worse of both. */
+static bool parse3(const std::string& s, long out[3], bool& overflow) {
+  out[0] = out[1] = out[2] = 0;
+  overflow = false;
+  if (s.empty()) return false;
+
+  size_t i = 0;
+  for (int part = 0; part < 3; part++) {
+    if (i >= s.size()) return 0 < part;   /* fewer than three is fine */
+    if (0 < part) {
+      if ('.' != s[i]) return false;
+      i++;
+    }
+    size_t start = i;
+    long acc = 0;
+    while (i < s.size() && '0' <= s[i] && '9' >= s[i]) {
+      if (!overflow) {
+        acc = acc * 10 + (s[i] - '0');
+        if (COMPONENT_MAX < acc) overflow = true;
+      }
+      i++;
+    }
+    if (start == i) return false;   /* an empty component is not a number */
+    out[part] = acc;
+  }
+  return i == s.size();
+}
+
+static V triple(const long n[3]) {
+  V out = vlist();
+  for (int i = 0; i < 3; i++) push(out, vnum(static_cast<double>(n[i])));
+  return out;
+}
+
+V parserange(const V& range) {
+  if (!isstr(range) || asstr(range).empty()) {
+    std::string shown = isstr(range) ? asstr(range) : "";
+    fail("plugin_bad_range", "invalid range: " + shown,
+         details1("range", isnull(range) ? vnull() : range));
+  }
+
+  const std::string s = asstr(range);
+  /* Two forms and no more (§11.2):
+   *   '2.1'   >= 2.1.0 and < 3.0.0
+   *   '~2.1'  >= 2.1.0 and < 2.2.0 */
+  bool tilde = '~' == s[0];
+  std::string body = tilde ? s.substr(1) : s;
+
+  long n[3];
+  bool overflow = false;
+  if (!parse3(body, n, overflow) || overflow) {
+    fail("plugin_bad_range",
+         overflow ? "version component out of range in " + s
+                  : "invalid range: " + s,
+         details1("range", range));
+  }
+
+  long lo[3] = { n[0], n[1], n[2] };
+  long hi[3];
+  if (tilde) { hi[0] = n[0]; hi[1] = n[1] + 1; hi[2] = 0; }
+  else { hi[0] = n[0] + 1; hi[1] = 0; hi[2] = 0; }
+
+  V out = vmap();
+  set(out, "lo", triple(lo));
+  set(out, "hi", triple(hi));
+  return out;
+}
+
+V parseversion(const V& version) {
+  if (!isstr(version)) {
+    fail("plugin_bad_range", "invalid version",
+         details1("version", isnull(version) ? vnull() : version));
+  }
+  const std::string s = asstr(version);
+  long n[3];
+  bool overflow = false;
+  if (!parse3(s, n, overflow) || overflow) {
+    /* `plugin_bad_range` either way — the same code the rest of the
+     * grammar's failures use, because "this is not a version I can
+     * compare" is one fact however it went wrong. */
+    fail("plugin_bad_range",
+         overflow ? "version component out of range in " + s
+                  : "invalid version: " + s,
+         details1("version", version));
+  }
+  return triple(n);
+}
+
+int vercmp(const V& a, const V& b) {
+  for (size_t i = 0; i < 3; i++) {
+    double x = asnum(at(a, i));
+    double y = asnum(at(b, i));
+    if (x != y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+bool satisfies(const V& version, const V& range) {
+  V v = parseversion(version);
+  V r = parserange(range);
+  return 0 <= vercmp(v, get(r, "lo")) && 0 > vercmp(v, get(r, "hi"));
+}
+
+bool satisfiesq(const V& version, const V& range) {
+  /* `satisfies` for the internal callers that treat an unparseable
+   * version or range as "does not satisfy" — Capability and Graph, both
+   * of which run over data the corpus has already admitted. */
+  try {
+    return satisfies(version, range);
+  }
+  catch (const PluginError&) {
+    return false;
+  }
+}
+
+}  // namespace plugin

package/project/.sdk/tm/cpp/feature/secrets/plugin/version.hpp

@@ -0,0 +1,36 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/version.hpp)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Versions and ranges (§11.2).
+ *
+ * TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
+ * concrete version. A requirement declares `range`. A requirement is
+ * satisfied when the names match, the `match` passes, and the
+ * provider's `version` falls inside the requirement's `range`. That is
+ * the whole rule — there is no third field and no second comparison. */
+
+#ifndef VOXGIG_PLUGIN_VERSION_HPP
+#define VOXGIG_PLUGIN_VERSION_HPP
+
+#include "types.hpp"
+#include "value.hpp"
+
+namespace plugin {
+
+/* A parsed range is {lo:[3], hi:[3]} — the shape `version/range` asserts
+ * directly, so it is a Value rather than a struct. */
+V parserange(const V& range);
+/* [major, minor, patch]. */
+V parseversion(const V& version);
+
+/* The one satisfaction predicate: lo <= version < hi. */
+bool satisfies(const V& version, const V& range);
+/* The same, tolerant of a missing version — a bare ref carries none, so
+ * `graph` and `depend` ask this rather than raising. */
+bool satisfiesq(const V& version, const V& range);
+
+int vercmp(const V& a, const V& b);
+
+}  // namespace plugin
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Aws.cpp

@@ -0,0 +1,248 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Aws.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Aws.hpp"
+
+#include <ctime>
+
+#include "Httpjson.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+#include "Sigv4.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// -------------------------------------------------------------------- aws
+
+/// The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. The only place
+/// in this port that samples the clock for a signature - `sigv4` itself is
+/// pure.
+std::string awsnow() {
+  std::time_t stamp = std::time(nullptr);
+  std::tm parts;
+  gmtime_r(&stamp, &parts);
+
+  char buf[32];
+  std::strftime(buf, sizeof(buf), "%Y%m%dT%H%M%SZ", &parts);
+
+  return buf;
+}
+
+/// Region and credentials, resolved for one call.
+struct Awsauth {
+  std::string region;
+  std::string keyid;
+  std::string secret;
+  std::string session;
+};
+
+/// From config first and the standard AWS_* environment variables second -
+/// those are AWS's own convention, and a pod or CI job that has them set
+/// should just work. Missing either is an error: an AWS store with no
+/// credentials could not answer.
+Awsauth awsauth(const std::string& region, const std::string& keyid,
+                const std::string& secret, const std::string& session) {
+  Awsauth out;
+
+  out.region = first(region, envvar("AWS_REGION"), envvar("AWS_DEFAULT_REGION"));
+  out.keyid = first(keyid, envvar("AWS_ACCESS_KEY_ID"));
+  out.secret = first(secret, envvar("AWS_SECRET_ACCESS_KEY"));
+  out.session = first(session, envvar("AWS_SESSION_TOKEN"));
+
+  if (out.region.empty()) {
+    throw SekretoError("sekreto: aws: no region (set region or AWS_REGION)");
+  }
+
+  if (out.keyid.empty() || out.secret.empty()) {
+    throw SekretoError(
+        "sekreto: aws: no credentials"
+        " (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)");
+  }
+
+  return out;
+}
+
+/// One signed call to an AWS JSON-1.1 API.
+Answer awscall(const std::string& region, const std::string& keyid,
+               const std::string& secret, const std::string& session,
+               const std::string& addr, const std::string& service,
+               const std::string& target, const std::string& payload) {
+  Awsauth auth = awsauth(region, keyid, secret, session);
+
+  // The China partition lives under its own suffix; every other commercial
+  // region is plain amazonaws.com.
+  bool china = 0 == auth.region.compare(0, 3, "cn-");
+  std::string suffix = china ? ".amazonaws.com.cn" : ".amazonaws.com";
+  std::string useaddr = first(addr, "https://" + service + "." + auth.region + suffix);
+
+  checkaddr(useaddr);
+
+  std::string url = trimslash(useaddr) + "/";
+
+  Ordered extras;
+  extras.set("content-type", "application/x-amz-json-1.1");
+  extras.set("x-amz-target", target);
+
+  Signing input;
+  input.method = "POST";
+  input.url = url;
+  input.service = service;
+  input.region = auth.region;
+  input.keyid = auth.keyid;
+  input.secret = auth.secret;
+  input.datetime = awsnow();
+  input.headers = extras;
+  input.body = payload;
+  input.session = auth.session;
+
+  Ordered headers = extras;
+  for (const auto& entry : sigv4(input).pairs) {
+    headers.set(entry.first, entry.second);
+  }
+
+  return fetchjson("POST", url, headers, payload);
+}
+
+/// Does this AWS error body name one of the not-found types? Those are a
+/// miss; every other failure is a store that could not answer. AWS sends
+/// `com.amazonaws...#ResourceNotFoundException`, so this is a CONTAINS.
+bool awsmiss(const Json& body, const std::string& want) {
+  std::string errtype;
+  if (!body.get("__type").asstr(errtype)) return false;
+
+  return std::string::npos != errtype.find(want);
+}
+
+/// AWS Secrets Manager.
+///
+/// `api.token` reads the secret named `api` (the vaultref path, so
+/// `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+/// SecretString - the AWS idiom of one JSON map per secret. A SecretString
+/// that is not JSON is the value itself, under the conventional field
+/// `value`. Requests are SigV4-signed in-tree.
+class AwssecretsProvider : public Provider {
+ public:
+  AwssecretsProvider(const std::string& region, const std::string& keyid,
+                     const std::string& secret, const std::string& session,
+                     const std::string& addr)
+      : region_(region), keyid_(keyid), secret_(secret), session_(session), addr_(addr) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    VaultRef ref = vaultref(name);
+
+    Answer res = awscall(region_, keyid_, secret_, session_, addr_, "secretsmanager",
+                         "secretsmanager.GetSecretValue",
+                         Json::stringify(Json::obj({{"SecretId", Json::str(ref.path)}})));
+
+    if (400 == res.status && awsmiss(res.body, "ResourceNotFoundException")) {
+      return std::nullopt;
+    }
+
+    if (200 != res.status) {
+      throw SekretoError("sekreto: aws secretsmanager error: " + std::to_string(res.status));
+    }
+
+    std::string text;
+
+    if (!res.body.get("SecretString").asstr(text)) {
+      // A binary secret has no fields to address; only the conventional
+      // `value` field can mean "the bytes themselves".
+      std::string binary;
+      if (!res.body.get("SecretBinary").asstr(binary) || "value" != ref.field) {
+        return std::nullopt;
+      }
+
+      std::string decoded;
+      if (!unbase64(binary, decoded)) {
+        throw SekretoError("sekreto: aws secretsmanager: undecodable secret");
+      }
+
+      return decoded;
+    }
+
+    Json parsed;
+    if (Json::parse(text, parsed) && parsed.isobj()) {
+      return textof(parsed.get(ref.field));
+    }
+
+    // A plain-string secret is the whole value; it has no named fields.
+    if ("value" == ref.field) return text;
+
+    return std::nullopt;
+  }
+
+  // Config only, never the environment: describe() feeds the spec's
+  // sources group, which must answer the same everywhere.
+  std::string describe() const override { return "awssecrets:" + region_; }
+
+ private:
+  std::string region_;
+  std::string keyid_;
+  std::string secret_;
+  std::string session_;
+  std::string addr_;
+};
+
+/// AWS SSM Parameter Store.
+///
+/// `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+/// prefix path), decrypted. Parameter Store carries flat strings, so there
+/// is no field indirection.
+class AwsparamsProvider : public Provider {
+ public:
+  AwsparamsProvider(const std::string& region, const std::string& keyid,
+                    const std::string& secret, const std::string& session,
+                    const std::string& addr, const std::string& prefix)
+      : region_(region),
+        keyid_(keyid),
+        secret_(secret),
+        session_(session),
+        addr_(addr),
+        prefix_(prefix) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    Json payload = Json::obj({{"Name", Json::str(awsparam(name, prefix_))},
+                              {"WithDecryption", Json::boolean(true)}});
+
+    Answer res = awscall(region_, keyid_, secret_, session_, addr_, "ssm",
+                         "AmazonSSM.GetParameter", Json::stringify(payload));
+
+    if (400 == res.status && awsmiss(res.body, "ParameterNotFound")) return std::nullopt;
+
+    if (200 != res.status) {
+      throw SekretoError("sekreto: aws ssm error: " + std::to_string(res.status));
+    }
+
+    return textof(res.body.get("Parameter").get("Value"));
+  }
+
+  std::string describe() const override { return "awsparams:" + region_ + prefix_; }
+
+ private:
+  std::string region_;
+  std::string keyid_;
+  std::string secret_;
+  std::string session_;
+  std::string addr_;
+  std::string prefix_;
+};
+
+}  // namespace
+
+Definition awssecrets() {
+  return providerplugin("awssecrets", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<AwssecretsProvider>(spec.region, spec.keyid, spec.secret,
+                                                spec.session, spec.addr);
+  });
+}
+
+Definition awsparams() {
+  return providerplugin("awsparams", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<AwsparamsProvider>(spec.region, spec.keyid, spec.secret,
+                                               spec.session, spec.addr, spec.prefix);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Aws.hpp

@@ -0,0 +1,30 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Aws.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// AWS Secrets Manager and SSM Parameter Store.
+//
+// SIGV4 TRAVELS WITH THIS PLUGIN, and it is the sharpest instance of the
+// whole split: the core of no port includes a hash function, and this is
+// the only kind that needs one.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_AWS_HPP
+#define SEKRETO_PLUGINS_AWS_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `awssecrets` provider kind, as a voxgig/plugin definition.
+Definition awssecrets();
+
+/// The `awsparams` provider kind, as a voxgig/plugin definition.
+Definition awsparams();
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Azuresecrets.cpp

@@ -0,0 +1,149 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Azuresecrets.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Azuresecrets.hpp"
+
+#include "Httpjson.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// ------------------------------------------------------------------ azure
+
+/// The Key Vault audience an Azure token is minted for.
+const char* const AZURERESOURCE = "https://vault.azure.net";
+
+/// Azure Key Vault.
+///
+/// `api.token` reads secret `api-token` (dots flattened to `-`; Key Vault
+/// names allow nothing else), current version. The token comes from
+/// config, then a client-credentials login when tenant/clientid/
+/// clientsecret are given, then the IMDS managed-identity endpoint.
+class AzuresecretsProvider : public Provider {
+ public:
+  AzuresecretsProvider(const std::string& vault, const std::string& token,
+                       const std::string& tenant, const std::string& clientid,
+                       const std::string& clientsecret, const std::string& loginaddr,
+                       const std::string& imdsaddr, const std::string& apiversion)
+      : vault_(vault),
+        token_(token),
+        tenant_(tenant),
+        clientid_(clientid),
+        clientsecret_(clientsecret),
+        loginaddr_(loginaddr),
+        imdsaddr_(imdsaddr),
+        apiversion_(apiversion) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    if (vault_.empty()) throw SekretoError("sekreto: azure: no vault");
+
+    // Only an explicit scheme is a URL; a vault NAMED httpvault must still
+    // become https://httpvault.vault.azure.net.
+    bool isurl = 0 == vault_.compare(0, 7, "http://") || 0 == vault_.compare(0, 8, "https://");
+    std::string vaulturl = isurl ? vault_ : "https://" + vault_ + ".vault.azure.net";
+
+    checkaddr(vaulturl);
+
+    if (!livetoken_.has_value() || nowms() >= renewat_) {
+      livetoken_ = login();
+    }
+
+    std::string url = trimslash(vaulturl) + "/secrets/" + flatname(name, "-") +
+                      "?api-version=" + first(apiversion_, "7.4");
+
+    Ordered headers;
+    headers.set("authorization", "Bearer " + livetoken_.value_or(""));
+
+    Answer res = fetchjson("GET", url, headers);
+
+    if (404 == res.status) return std::nullopt;
+
+    if (200 != res.status) {
+      throw SekretoError("sekreto: azure error: " + std::to_string(res.status) + ": " +
+                         bareurl(url));
+    }
+
+    return textof(res.body.get("value"));
+  }
+
+  std::string describe() const override { return "azuresecrets:" + vault_; }
+
+ private:
+  std::string login() {
+    if (!token_.empty()) return token_;
+
+    if (!tenant_.empty() && !clientid_.empty() && !clientsecret_.empty()) {
+      std::string useloginaddr = first(loginaddr_, "https://login.microsoftonline.com");
+      checkaddr(useloginaddr);
+
+      std::string url = trimslash(useloginaddr) + "/" + tenant_ + "/oauth2/v2.0/token";
+      std::string form = "grant_type=client_credentials&client_id=" + uriescape(clientid_) +
+                         "&client_secret=" + uriescape(clientsecret_) +
+                         "&scope=" + uriescape(std::string(AZURERESOURCE) + "/.default");
+
+      Ordered headers;
+      headers.set("content-type", "application/x-www-form-urlencoded");
+
+      Answer res = fetchjson("POST", url, headers, form);
+
+      std::optional<std::string> got = textof(res.body.get("access_token"));
+
+      if (200 != res.status || !got.has_value() || got.value().empty()) {
+        throw SekretoError("sekreto: azure login failed: " + std::to_string(res.status));
+      }
+
+      renewat_ = renewtime(res.body.get("expires_in"));
+
+      return got.value();
+    }
+
+    std::string imds = trimslash(first(imdsaddr_, "http://169.254.169.254")) +
+                       "/metadata/identity/oauth2/token?api-version=2018-02-01&resource=" +
+                       uriescape(AZURERESOURCE);
+
+    Ordered headers;
+    headers.set("Metadata", "true");
+
+    Answer res = fetchjson("GET", imds, headers);
+
+    std::optional<std::string> got = textof(res.body.get("access_token"));
+
+    if (200 != res.status || !got.has_value() || got.value().empty()) {
+      throw SekretoError(
+          "sekreto: azure: no token, no client credentials, and IMDS did not answer");
+    }
+
+    // IMDS sends expires_in as a STRING, unlike everybody else.
+    renewat_ = renewtime(res.body.get("expires_in"));
+
+    return got.value();
+  }
+
+  std::string vault_;
+  std::string token_;
+  std::string tenant_;
+  std::string clientid_;
+  std::string clientsecret_;
+  std::string loginaddr_;
+  std::string imdsaddr_;
+  std::string apiversion_;
+
+  std::optional<std::string> livetoken_;
+  double renewat_ = NEVER;
+};
+
+}  // namespace
+
+Definition azuresecrets() {
+  return providerplugin("azuresecrets", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<AzuresecretsProvider>(spec.vault, spec.token, spec.tenant,
+                                                   spec.clientid, spec.clientsecret,
+                                                   spec.loginaddr, spec.imdsaddr,
+                                                   spec.apiversion);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Azuresecrets.hpp

@@ -0,0 +1,23 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Azuresecrets.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Azure Key Vault.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_AZURESECRETS_HPP
+#define SEKRETO_PLUGINS_AZURESECRETS_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `azuresecrets` provider kind, as a voxgig/plugin definition.
+Definition azuresecrets();
+
+}  // namespace sekreto
+
+#endif