@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/json.lua

@@ -0,0 +1,449 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/json.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- sekreto's own JSON, because Lua has none.
+--
+-- Lua 5.4's whole standard library is basic, coroutine, package, string,
+-- utf8, table, math, io, os and debug - so a JSON parser is written here
+-- rather than depended on. Two properties the vendor payloads need and a
+-- naive table would not give: object keys keep their INSERTION ORDER (an
+-- AWS payload's field order is signed, so it cannot be re-ordered by a
+-- hash table), and a parse FAILURE is distinguishable from the literal
+-- `null` (fetchjson must tell "this text is not JSON" from "this text is
+-- the JSON null", and Lua's `nil` cannot say both).
+--
+-- A port of typescript's JSON handling, which is canonical.
+
+local M = {}
+
+-- The JSON null. A Lua nil cannot live in a table and cannot be returned
+-- distinguishably, so null is a sentinel of its own.
+M.NULL = setmetatable({}, { __tostring = function() return 'null' end })
+
+local ARRMT = { __sekretojson = 'arr' }
+local OBJMT = { __sekretojson = 'obj' }
+
+-- The recursion bound. A response body arrives before any trust check has
+-- been made, so `[[[[[...` must fail rather than take the process down.
+local MAXDEPTH = 128
+
+--- A JSON array, from a Lua sequence.
+function M.arr(items)
+  return setmetatable({ items = items or {} }, ARRMT)
+end
+
+--- A JSON object, from a list of {key, value} pairs, in that order.
+function M.obj(pairlist)
+  local keys = {}
+  local vals = {}
+
+  for _, pair in ipairs(pairlist or {}) do
+    if nil == vals[pair[1]] then
+      keys[#keys + 1] = pair[1]
+    end
+    vals[pair[1]] = pair[2]
+  end
+
+  return setmetatable({ keys = keys, vals = vals }, OBJMT)
+end
+
+function M.isarr(val)
+  return 'table' == type(val) and ARRMT == getmetatable(val)
+end
+
+function M.isobj(val)
+  return 'table' == type(val) and OBJMT == getmetatable(val)
+end
+
+function M.isnull(val)
+  return M.NULL == val
+end
+
+--- Set one key on an object, keeping insertion order.
+function M.set(object, key, value)
+  if nil == object.vals[key] then
+    object.keys[#object.keys + 1] = key
+  end
+  object.vals[key] = value
+  return object
+end
+
+--- Walk nested objects, stopping at the first missing step. Returns nil.
+function M.dig(val, ...)
+  local at = val
+
+  for _, key in ipairs({ ... }) do
+    if not M.isobj(at) then
+      return nil
+    end
+    at = at.vals[key]
+    if nil == at then
+      return nil
+    end
+  end
+
+  return at
+end
+
+--- The value as a string, or nil for anything else.
+function M.asstr(val)
+  return 'string' == type(val) and val or nil
+end
+
+--- The value as a number, or nil for anything else.
+function M.asnum(val)
+  return 'number' == type(val) and val or nil
+end
+
+--- The value as an array's item list, or nil.
+function M.asarr(val)
+  return M.isarr(val) and val.items or nil
+end
+
+--- The value as an object, or nil.
+function M.asobj(val)
+  return M.isobj(val) and val or nil
+end
+
+--- Render a number the same way in every port: 5.0 prints as 5.
+function M.numstr(val)
+  if val ~= val or math.huge == val or -math.huge == val then
+    return 'null'
+  end
+
+  if math.type(val) == 'integer' then
+    return string.format('%d', val)
+  end
+
+  if val == math.floor(val) and math.abs(val) < 9007199254740992.0 then
+    return string.format('%d', math.tointeger(val) or val)
+  end
+
+  return (string.format('%.17g', val))
+end
+
+--- Printable text, or nil. A JSON null yields nil, so a null field is a
+--- miss rather than the string "null".
+function M.text(val)
+  if nil == val or M.NULL == val then
+    return nil
+  end
+  if 'string' == type(val) then
+    return val
+  end
+  if 'number' == type(val) then
+    return M.numstr(val)
+  end
+  if 'boolean' == type(val) then
+    return val and 'true' or 'false'
+  end
+  return nil
+end
+
+--- Render a string as a JSON string literal.
+function M.quote(text)
+  local out = { '"' }
+
+  for index = 1, #text do
+    local ch = text:sub(index, index)
+    local byte = ch:byte()
+
+    if '"' == ch then
+      out[#out + 1] = '\\"'
+    elseif '\\' == ch then
+      out[#out + 1] = '\\\\'
+    elseif '\n' == ch then
+      out[#out + 1] = '\\n'
+    elseif '\r' == ch then
+      out[#out + 1] = '\\r'
+    elseif '\t' == ch then
+      out[#out + 1] = '\\t'
+    elseif 0x20 > byte then
+      out[#out + 1] = string.format('\\u%04x', byte)
+    else
+      out[#out + 1] = ch
+    end
+  end
+
+  out[#out + 1] = '"'
+  return table.concat(out)
+end
+
+--- Compact JSON text: no spaces, no newlines, keys in insertion order.
+function M.stringify(val)
+  if nil == val or M.NULL == val then
+    return 'null'
+  end
+
+  local kind = type(val)
+
+  if 'boolean' == kind then
+    return val and 'true' or 'false'
+  end
+
+  if 'number' == kind then
+    return M.numstr(val)
+  end
+
+  if 'string' == kind then
+    return M.quote(val)
+  end
+
+  if M.isarr(val) then
+    local parts = {}
+    for index, item in ipairs(val.items) do
+      parts[index] = M.stringify(item)
+    end
+    return '[' .. table.concat(parts, ',') .. ']'
+  end
+
+  if M.isobj(val) then
+    local parts = {}
+    for index, key in ipairs(val.keys) do
+      parts[index] = M.quote(key) .. ':' .. M.stringify(val.vals[key])
+    end
+    return '{' .. table.concat(parts, ',') .. '}'
+  end
+
+  return 'null'
+end
+
+-- ---- the parser ------------------------------------------------------
+--
+-- Every failure below raises inside a pcall that `parse` owns, so no error
+-- ever escapes it: a malformed body is answered with nil, and the caller
+-- decides whether that is a miss or a failure.
+
+local parsevalue
+
+local WS = { [' '] = true, ['\t'] = true, ['\n'] = true, ['\r'] = true }
+
+local function skipws(text, pos)
+  local at = pos
+  while at <= #text and WS[text:sub(at, at)] do
+    at = at + 1
+  end
+  return at
+end
+
+local function bad(why)
+  error({ json = true, why = why }, 0)
+end
+
+local function parseword(text, pos, word, value)
+  if word ~= text:sub(pos, pos + #word - 1) then
+    bad('literal')
+  end
+  return value, pos + #word
+end
+
+local HEX = '0123456789abcdefABCDEF'
+
+local function parsestring(text, pos)
+  if '"' ~= text:sub(pos, pos) then
+    bad('string')
+  end
+
+  local at = pos + 1
+  local out = {}
+
+  while at <= #text do
+    local ch = text:sub(at, at)
+
+    if '"' == ch then
+      return table.concat(out), at + 1
+    end
+
+    if '\\' ~= ch then
+      out[#out + 1] = ch
+      at = at + 1
+    else
+      local escape = text:sub(at + 1, at + 1)
+      at = at + 2
+
+      if '"' == escape then
+        out[#out + 1] = '"'
+      elseif '\\' == escape then
+        out[#out + 1] = '\\'
+      elseif '/' == escape then
+        out[#out + 1] = '/'
+      elseif 'b' == escape then
+        out[#out + 1] = '\b'
+      elseif 'f' == escape then
+        out[#out + 1] = '\f'
+      elseif 'n' == escape then
+        out[#out + 1] = '\n'
+      elseif 'r' == escape then
+        out[#out + 1] = '\r'
+      elseif 't' == escape then
+        out[#out + 1] = '\t'
+      elseif 'u' == escape then
+        local digits = text:sub(at, at + 3)
+        if 4 ~= #digits then
+          bad('escape')
+        end
+        for index = 1, 4 do
+          if nil == HEX:find(digits:sub(index, index), 1, true) then
+            bad('escape')
+          end
+        end
+        -- One UTF-16 code unit, appended as UTF-8. No surrogate-pair
+        -- recombination, in this port or any other.
+        out[#out + 1] = utf8.char(tonumber(digits, 16))
+        at = at + 4
+      else
+        bad('escape')
+      end
+    end
+  end
+
+  bad('string')
+end
+
+local function parseobj(text, pos, depth)
+  local at = skipws(text, pos + 1)
+  local object = M.obj({})
+
+  if '}' == text:sub(at, at) then
+    return object, at + 1
+  end
+
+  while true do
+    at = skipws(text, at)
+
+    local key
+    key, at = parsestring(text, at)
+
+    at = skipws(text, at)
+    if ':' ~= text:sub(at, at) then
+      bad('object')
+    end
+
+    local value
+    value, at = parsevalue(text, at + 1, depth + 1)
+
+    M.set(object, key, value)
+
+    at = skipws(text, at)
+    local ch = text:sub(at, at)
+
+    if '}' == ch then
+      return object, at + 1
+    end
+
+    if ',' ~= ch then
+      bad('object')
+    end
+
+    at = at + 1
+  end
+end
+
+local function parsearr(text, pos, depth)
+  local at = skipws(text, pos + 1)
+  local items = {}
+
+  if ']' == text:sub(at, at) then
+    return M.arr(items), at + 1
+  end
+
+  while true do
+    local value
+    value, at = parsevalue(text, at, depth + 1)
+    items[#items + 1] = value
+
+    at = skipws(text, at)
+    local ch = text:sub(at, at)
+
+    if ']' == ch then
+      return M.arr(items), at + 1
+    end
+
+    if ',' ~= ch then
+      bad('array')
+    end
+
+    at = at + 1
+  end
+end
+
+local NUMCHARS = '0123456789+-.eE'
+
+local function parsenumber(text, pos)
+  local at = pos
+
+  while at <= #text and nil ~= NUMCHARS:find(text:sub(at, at), 1, true) do
+    at = at + 1
+  end
+
+  local value = tonumber(text:sub(pos, at - 1))
+
+  -- 1e999 parses to infinity, which JSON has no literal for and which
+  -- would later blow up a token-expiry computation.
+  if nil == value or value ~= value or math.huge == value or -math.huge == value then
+    bad('number')
+  end
+
+  return value, at
+end
+
+parsevalue = function(text, pos, depth)
+  if MAXDEPTH < depth then
+    bad('depth')
+  end
+
+  local at = skipws(text, pos)
+  local ch = text:sub(at, at)
+
+  if '' == ch then
+    bad('eof')
+  end
+
+  if '{' == ch then
+    return parseobj(text, at, depth)
+  end
+
+  if '[' == ch then
+    return parsearr(text, at, depth)
+  end
+
+  if '"' == ch then
+    return parsestring(text, at)
+  end
+
+  if 't' == ch then
+    return parseword(text, at, 'true', true)
+  end
+
+  if 'f' == ch then
+    return parseword(text, at, 'false', false)
+  end
+
+  if 'n' == ch then
+    return parseword(text, at, 'null', M.NULL)
+  end
+
+  return parsenumber(text, at)
+end
+
+--- Parse JSON text. Returns the value, or nil when the text is not JSON.
+--- The literal `null` parses to M.NULL, which is NOT nil - that is the
+--- whole reason the sentinel exists.
+function M.parse(text)
+  if 'string' ~= type(text) or '' == text then
+    return nil
+  end
+
+  local ok, value, at = pcall(parsevalue, text, 1, 1)
+  if not ok then
+    return nil
+  end
+
+  if #text >= skipws(text, at) then
+    return nil
+  end
+
+  return value
+end
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/net.lua

@@ -0,0 +1,198 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/net.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The bridge to the transport helper - a PLUGIN module, never the core.
+--
+-- Everything that opens a socket or starts a child process goes through
+-- this file, so a chain of built-in kinds never requires it and never
+-- needs native/sekretonet.c to have been built at all.
+--
+-- Lua cannot open a socket, and `io.popen` is unidirectional - so a
+-- request cannot be written to a child and its answer read back through
+-- the same handle. The request is therefore handed over in a file and the
+-- answer comes back on the child's stdout.
+--
+-- The file, not the command line, because a vault token rides in the
+-- request headers and the process table is world readable. It is created
+-- by `os.tmpname`, which uses `mkstemp` and so is already 0600, and
+-- native/sekretonet.c unlinks it before reading a byte of it.
+--
+-- Nothing about HTTP is known here. This module moves bytes, exactly as
+-- the helper does - and it runs children, which is the other half of what
+-- the helper is for.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+
+local M = {}
+
+--- Where the helper binary is, worked out from this file's own path
+--- rather than from the working directory: test/checks.sh runs the CLI
+--- from an EMPTY directory with the environment wiped, so nothing in the
+--- process's surroundings can be relied on to find it.
+local function helperpath()
+  local source = debug.getinfo(1, 'S').source
+
+  if '@' == source:sub(1, 1) then
+    local dir = source:sub(2):match('^(.*)/feature/secrets/sekreto/plugins/net%.lua$')
+    if nil ~= dir then
+      return dir .. '/feature/secrets/native/sekreto-net'
+    end
+  end
+
+  return 'feature/secrets/native/sekreto-net'
+end
+
+M.HELPER = helperpath()
+
+--- A shell-safe single-quoted word. `io.popen` goes through `/bin/sh`,
+--- and the only two words this module ever passes it are paths it made
+--- itself - but a path is checked rather than assumed.
+local function quotepath(path)
+  if nil ~= path:find("'", 1, true) or nil ~= path:find('\n', 1, true) then
+    err.fail('sekreto: transport helper path is not usable: ' .. path)
+  end
+  return "'" .. path .. "'"
+end
+
+--- One length-prefixed field.
+local function field(name, value)
+  return name .. ' ' .. #value .. '\n' .. value .. '\n'
+end
+
+--- Run the helper over one request. Returns the answer verb and payload.
+local function call(fields)
+  local path = os.tmpname()
+
+  local handle = io.open(path, 'wb')
+  if nil == handle then
+    os.remove(path)
+    err.fail('sekreto: cannot write a transport request')
+  end
+
+  handle:write(table.concat(fields))
+  handle:close()
+
+  local pipe = io.popen(quotepath(M.HELPER) .. ' ' .. quotepath(path) .. ' 2>/dev/null', 'r')
+  if nil == pipe then
+    os.remove(path)
+    return 'ERR', 'cannot start the transport helper'
+  end
+
+  local answer = pipe:read('a') or ''
+  pipe:close()
+
+  -- The helper unlinks it; this is the backstop for the case where the
+  -- helper never ran at all.
+  os.remove(path)
+
+  local stop = answer:find('\n', 1, true)
+  if nil == stop then
+    return 'ERR',
+      'the transport helper did not answer (is ' .. M.HELPER .. ' built?)'
+  end
+
+  local head = answer:sub(1, stop - 1)
+  local rest = answer:sub(stop + 1)
+
+  local verb = head:match('^(%u+)')
+
+  if 'ERR' == verb then
+    return 'ERR', rest
+  end
+
+  if 'OK' == verb then
+    return 'OK', rest
+  end
+
+  if 'EXEC' == verb then
+    local code, outlen, errlen = head:match('^EXEC (%-?%d+) (%d+) (%d+)$')
+    if nil == code then
+      return 'ERR', 'the transport helper answered incoherently'
+    end
+    outlen = tonumber(outlen)
+    errlen = tonumber(errlen)
+    return 'EXEC', {
+      status = tonumber(code),
+      out = rest:sub(1, outlen),
+      why = rest:sub(outlen + 1, outlen + errlen),
+    }
+  end
+
+  return 'ERR', 'the transport helper answered incoherently'
+end
+
+--- Connect, send `payload`, read the answer to end of stream.
+---
+--- Returns the response bytes, or nil plus a reason. A reason is always a
+--- failure - never a miss.
+function M.fetch(host, port, usetls, payload, timeoutms, maxbody)
+  local verb, got = call({
+    field('mode', 'fetch'),
+    field('host', host),
+    field('port', tostring(port)),
+    field('tls', usetls and '1' or '0'),
+    field('timeout', tostring(timeoutms)),
+    field('maxbody', tostring(maxbody)),
+    field('data', payload),
+  })
+
+  if 'OK' ~= verb then
+    return nil, ('table' == type(got)) and 'transport failure' or got
+  end
+
+  return got
+end
+
+--- Run a child to completion and collect both its streams separately.
+---
+--- `argv` is an array and never a shell string. `overrides` is a list of
+--- `NAME=value` entries applied ON TOP of the inherited environment: Lua
+--- cannot enumerate its own environment (`os.getenv` reads one name), so
+--- building a complete one here would silently drop every variable this
+--- port did not think to name, and boru reads several of its own.
+---
+--- Returns {status, out, why}, or nil plus a reason when the child could
+--- not be started at all.
+function M.exec(argv, overrides)
+  local fields = { field('mode', 'exec') }
+
+  for _, arg in ipairs(argv) do
+    fields[#fields + 1] = field('arg', arg)
+  end
+  for _, entry in ipairs(overrides or {}) do
+    fields[#fields + 1] = field('setenv', entry)
+  end
+
+  local verb, got = call(fields)
+
+  if 'EXEC' ~= verb then
+    -- The helper reports a failed exec through a close-on-exec status
+    -- pipe, so "could not be started" is never guessed from an exit code
+    -- a real child is equally free to produce. It becomes
+    -- `sekreto: cannot run <command>: <err>`, which is a failure and
+    -- never a miss.
+    local reason = ('table' == type(got)) and 'transport failure' or got
+    return nil, (reason:match('^EXECFAIL (.*)$') or reason)
+  end
+
+  return got
+end
+
+--- What a finished child process left behind, with a failure to start it
+--- raised rather than returned.
+---
+--- Both streams are drained concurrently and stdin is closed; see
+--- native/sekretonet.c, which does the draining. Argv is an array and
+--- never a shell string, and no secret is ever put on a command line.
+function M.runcmd(argv, overrides, command)
+  local ran, why = M.exec(argv, overrides)
+
+  if nil == ran then
+    err.fail('sekreto: cannot run ' .. command .. ': ' .. why)
+  end
+
+  return ran.out, name.trim(ran.why), ran.status
+end
+
+return M