@voxgig/sdkgen 4.6.0 → 4.7.0

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -93,6 +93,38 @@ pub fn is_control_skipped(kind: &str, name: &str, mode: &str) -> (bool, String)
     (false, String::new())
 }
 
+/// Extra SDK options every LIVE client is constructed with, read from
+/// sdk-test-control.json `test.client.options`.
+///
+/// The generated live client knows two things: the base URL (from the spec)
+/// and the credential (from the environment). Everything else about how a
+/// particular API wants to be talked to - which features to switch on, and
+/// with what settings - is a property of THAT API, known to the project and
+/// to nothing in the toolchain.
+///
+/// Merged UNDER the generated fields, so the suite's own base/apikey/server
+/// values win: this ADDS to the live client, it does not redirect it.
+///
+/// Reserved fields are stripped HERE rather than at each merge site: the
+/// generated map only names a field when the model calls for one, so a
+/// "base" in this block would face no competing value and would silently
+/// redirect the whole suite - credential included - to another host.
+pub const LIVE_RESERVED: [&str; 6] =
+    ["base", "prefix", "suffix", "server", "apikey", "secret"];
+
+pub fn live_client_options() -> Value {
+    let ctrl = load_test_control();
+    let out = Value::empty_map();
+    if let Value::Map(m) = get_spec(&ctrl, &["test", "client", "options"]) {
+        for (k, v) in m.borrow().iter() {
+            if !LIVE_RESERVED.contains(&k.as_str()) {
+                setp(&out, k, v.clone());
+            }
+        }
+    }
+    out
+}
+
 /// Configured per-test live delay in ms; default 500.
 pub fn live_delay_ms() -> i64 {
     let ctrl = load_test_control();

package/project/.sdk/tm/rust/utility/make_options.rs

@@ -78,7 +78,7 @@ pub fn make_options_util(ctx: &Rc<Context>) -> Value {
         ("base", Value::str("http://localhost:8000")),
         ("prefix", Value::str("")),
         ("suffix", Value::str("")),
-        ("auth", jo(vec![("prefix", Value::str(""))])),
+        ("auth", jo(vec![("prefix", Value::str("")), ("basic", Value::Bool(false))])),
         ("headers", jo(vec![("`$CHILD`", Value::str("`$STRING`"))])),
         (
             "allow",

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sekreto.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/Sekreto.ts)
-// Source: https://github.com/voxgig/sekreto @ a8c293be1b6c33d65223b2b2275797c241b1a1f1
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //
@@ -11,7 +11,13 @@
 // This file is CANONICAL. Every other port is a translation of it, and
 // spec/sekreto.json is the behavioural contract they all run.
 
-import { Provider, ProviderSpec, makeprovider } from './Providers'
+// The REGISTRY, never './Providers'. Importing the barrel here is what
+// made every provider kind reachable from the core: the chain needs
+// `makeprovider`, and the barrel's edge dragged AWS request signing and
+// seven HTTP clients in behind it. The registry knows only the kinds
+// something actually imported. See docs/design/plugin-providers.md.
+import { Provider, ProviderSpec } from './provider/support'
+import { makeprovider } from './provider/Registry'
 
 /** A secret name: dot-separated lowercase segments, e.g. `api.token`. */
 export type Name = string

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sigv4.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/Sigv4.ts)
-// Source: https://github.com/voxgig/sekreto @ a8c293be1b6c33d65223b2b2275797c241b1a1f1
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //
@@ -14,7 +14,28 @@
 // carry known-answer cases that all ten ports must reproduce bit-for-bit,
 // and lets the integration mock recompute the signature server-side.
 
-import { createHash, createHmac } from 'node:crypto'
+// node:crypto is loaded ON FIRST USE, not at import time.
+//
+// Providers.ts imports sigv4 for the AWS providers, and Sekreto.ts imports
+// Providers — so a top-level `node:crypto` here put it in the module graph
+// of every sekreto consumer, including one that never signs anything.
+// Deferring keeps this module pure until an AWS provider actually runs.
+//
+// require(), not `await import()`: these helpers are synchronous and are
+// called from synchronous signing code. The package is CommonJS.
+function crypto(): typeof import('node:crypto') {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('node:crypto')
+  } catch (err: any) {
+    throw new Error(
+      'sekreto: AWS request signing needs node:crypto, which this runtime ' +
+        'does not provide: ' +
+        err.message,
+      { cause: err },
+    )
+  }
+}
 
 export type Sigv4Input = {
   method: string
@@ -39,11 +60,11 @@ export type Sigv4Input = {
 export type Sigv4Output = Record<string, string>
 
 function sha256hex(text: string): string {
-  return createHash('sha256').update(text, 'utf8').digest('hex')
+  return crypto().createHash('sha256').update(text, 'utf8').digest('hex')
 }
 
 function hmac(key: Buffer | string, text: string): Buffer {
-  return createHmac('sha256', key).update(text, 'utf8').digest()
+  return crypto().createHmac('sha256', key).update(text, 'utf8').digest()
 }
 
 /** RFC 3986 escaping, which is stricter than encodeURIComponent: AWS
@@ -128,7 +149,10 @@ export function sigv4(input: Sigv4Input): Sigv4Output {
   const kregion = hmac(kdate, input.region)
   const kservice = hmac(kregion, input.service)
   const ksigning = hmac(kservice, 'aws4_request')
-  const signature = createHmac('sha256', ksigning).update(stringtosign, 'utf8').digest('hex')
+  const signature = crypto()
+    .createHmac('sha256', ksigning)
+    .update(stringtosign, 'utf8')
+    .digest('hex')
 
   const out: Sigv4Output = {
     authorization:

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/sekreto @ a8c293be1b6c33d65223b2b2275797c241b1a1f1
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/sekreto - one interface for secrets, wherever they live.
 
@@ -18,25 +18,34 @@ export {
 
 export type { Name, SekretoOptions } from './Sekreto'
 
-export {
-  awsparamsprovider,
-  awssecretsprovider,
-  azuresecretsprovider,
-  boruprovider,
-  checkaddr,
-  dopplerprovider,
-  dotenvprovider,
-  envprovider,
-  fileprovider,
-  gcpsecretsprovider,
-  hashicorpprovider,
-  infisicalprovider,
-  makeprovider,
-  memoryprovider,
-  onepasswordprovider,
-} from './Providers'
+// THE CORE SURFACE. Deliberately does NOT re-export the eleven provider
+// kinds that need something of their runtime: pulling one through this
+// file would make all of them reachable and put AWS request signing in
+// every build, which is the thing the split removes.
+//
+// `env` and `memory` are here because they import nothing at all, and a
+// chain with nowhere to read from is not usable or testable.
+//
+// Everything else registers itself when its module is imported:
+//
+//     import '@voxgig/sekreto/provider/dotenv'
+//
+// or, for the old all-in behaviour, `from '@voxgig/sekreto/Providers'`.
+// See docs/design/plugin-providers.md.
+export { envprovider } from './provider/env'
+export { memoryprovider } from './provider/memory'
+
+// A pure validator, no platform dependency - kept on the core surface
+// because callers validate an address before configuring a provider.
+export { checkaddr } from './provider/addr'
+
+export { makeprovider, register, registered, kinds } from './provider/Registry'
+export type { ProviderDefinition } from './provider/Registry'
 
-export type { Provider, ProviderSpec } from './Providers'
+export type { Provider, ProviderSpec } from './provider/support'
 
-export { sigv4 } from './Sigv4'
-export type { Sigv4Input, Sigv4Output } from './Sigv4'
+// `sigv4` is NOT on the core surface: it is the node:crypto edge, and
+// only the two aws providers use it. Import it from the module that
+// needs it - `@voxgig/sekreto/provider/aws` - or from the full-set
+// barrel. Re-exporting it here would put request signing in every
+// build again, which is the thing the split removes.

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/Registry.ts

@@ -0,0 +1,90 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/Registry.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+// THE PROVIDER REGISTRY — the seam that replaced the `makeprovider`
+// switch, and the reason an SDK no longer carries thirteen providers to
+// use two.
+//
+// The switch named every kind in one function, so every kind was
+// statically reachable from `Sekreto` and no bundler could drop one. Its
+// replacement is a map that a provider ADDS ITSELF to. A kind that is
+// never imported is never registered, is never reachable, and is not in
+// the build — which is the whole point.
+//
+// The vocabulary is voxgig/plugin's (docs/design/plugin-providers.md): a
+// provider kind is a plugin `Definition`, a configured provider is an
+// instance addressed by name+tag. What sekreto does NOT route through
+// plugin is the lookup itself: `Provider.lookup` is async, and plugin's
+// dispatch is synchronous by design — twenty ports, many with no
+// async/await. So plugin owns the catalog, the instances and their
+// order; sekreto walks them in each language's own idiom.
+//
+// `define` is the definition's factory: spec in, Provider out. It is
+// separate from the plugin `Definition.define` callback on purpose —
+// this one runs at construction and returns a value, while plugin's runs
+// at load and binds. They are bridged in Catalog.ts.
+
+import { Provider, ProviderSpec, SekretoError } from './support'
+
+export type ProviderDefinition = {
+  /** The `kind` a ProviderSpec names. */
+  name: string
+  /** What this provider needs of its runtime, so a host can refuse or
+   * report before a lookup fails: 'fs', 'fetch', 'crypto', 'process'. */
+  needs?: string[]
+  /** Build the provider from its declarative spec. */
+  define: (spec: ProviderSpec) => Provider
+}
+
+const registry: { [kind: string]: ProviderDefinition } = {}
+
+/** Register a provider kind. Called by each provider module at import,
+ * so importing the module IS installing it. Re-registering the same name
+ * replaces it, which is how a host substitutes an implementation. */
+export function register(def: ProviderDefinition): void {
+  if (null == def || 'string' !== typeof def.name || '' === def.name) {
+    throw new SekretoError('sekreto: invalid provider definition')
+  }
+  registry[def.name] = def
+}
+
+export function registered(kind: string): ProviderDefinition | undefined {
+  return registry[kind]
+}
+
+export function kinds(): string[] {
+  return Object.keys(registry).sort()
+}
+
+/** Build a provider from its spec.
+ *
+ * An UNREGISTERED kind is not the same failure as an unknown one, and the
+ * message says which: a kind sekreto has never heard of is a typo, while
+ * a known kind that was not imported is the leanness mechanism working as
+ * designed and telling you to import it. Collapsing the two was the first
+ * thing that made the split confusing to use. */
+export function makeprovider(spec: ProviderSpec): Provider {
+  const kind = null == spec ? undefined : (spec as any).kind
+  const def = registry[kind as string]
+
+  if (null == def) {
+    throw new SekretoError(
+      'sekreto: unknown provider kind: ' + String(kind) +
+      ' (registered: ' + (kinds().join(', ') || 'none') + ')' +
+      (KNOWN.indexOf(String(kind)) < 0 ? '' :
+        " - that kind exists but its module was not imported; import" +
+        " '@voxgig/sekreto/provider/" + String(kind) + "' to register it"))
+  }
+
+  return def.define(spec)
+}
+
+/** Every kind this library ships, registered or not. Used only to tell a
+ * typo from a module that was not imported. */
+const KNOWN = [
+  'env', 'memory', 'dotenv', 'file', 'hashicorp', 'boru',
+  'awssecrets', 'awsparams', 'gcpsecrets', 'azuresecrets',
+  'onepassword', 'doppler', 'infisical',
+]

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/addr.ts

@@ -0,0 +1,48 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/addr.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { SekretoError } from './support'
+
+export function checkaddr(addr: string): void {
+  if (addr.startsWith('https://')) {
+    return
+  }
+
+  if (!addr.startsWith('http://')) {
+    throw new SekretoError('sekreto: not an http(s) address: ' + addr)
+  }
+
+  // Parsed, not split on ':'. Splitting the authority on the first colon
+  // yields '[' for a bracketed IPv6 address, so `http://[::1]:8200` could
+  // never match — which made the '::1' and '[::1]' entries below
+  // unreachable, and refused a legitimate local vault.
+  //
+  // The ALLOWLIST is unchanged. URL only fixes what the host IS: it strips
+  // userinfo (so `http://127.0.0.1@evil.com/` reads as evil.com, as
+  // before), lowercases, and normalises numeric forms — `0177.0.0.1` is
+  // 127.0.0.1 and is now recognised as the loopback it actually is.
+  // IPv4-mapped IPv6 (`[::ffff:127.0.0.1]`) is deliberately still refused:
+  // widening the set is a separate decision from parsing it correctly.
+  let host: string
+  try {
+    host = new URL(addr).hostname
+  } catch (err: any) {
+    throw new SekretoError('sekreto: not a valid http(s) address: ' + addr)
+  }
+
+  if ('localhost' === host || '127.0.0.1' === host || '::1' === host || '[::1]' === host) {
+    return
+  }
+
+  throw new SekretoError(
+    'sekreto: refusing to send a token in plaintext to ' + addr + ' (use https)',
+  )
+}
+
+/** How long any single vault round-trip may take before it is treated as
+ * unreachable. Ports carry the same bound. */
+
+/** One JSON round-trip. Network failure is always an error - an
+ * unreachable store is a store that could not answer. */

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/aws.ts

@@ -0,0 +1,219 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/aws.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import {
+  ProviderSpec, Provider, SekretoError, awsparam, flatname, vaultref,
+} from './support'
+import { checkaddr } from './addr'
+import { sigv4 } from '../Sigv4'
+import { fetchjson } from './http'
+
+function awsnow(): string {
+  return new Date()
+    .toISOString()
+    .replace(/[-:]/g, '')
+    .replace(/\.\d+Z$/, 'Z')
+}
+
+type Awsopts = {
+  region?: string
+  keyid?: string
+  secret?: string
+  session?: string
+  addr?: string
+  prefix?: string
+}
+
+/** Region and credentials, from config first and the standard AWS_*
+ * environment variables second - those are AWS's own convention, and a
+ * pod or CI job that has them set should just work. Missing either is
+ * an error: an AWS store with no credentials could not answer. */
+function awsauth(opts: Awsopts): {
+  region: string
+  keyid: string
+  secret: string
+  session?: string
+} {
+  const env = process.env
+
+  const region = opts.region || env.AWS_REGION || env.AWS_DEFAULT_REGION || ''
+  const keyid = opts.keyid || env.AWS_ACCESS_KEY_ID || ''
+  const secret = opts.secret || env.AWS_SECRET_ACCESS_KEY || ''
+  const session = opts.session || env.AWS_SESSION_TOKEN || undefined
+
+  if ('' === region) {
+    throw new SekretoError('sekreto: aws: no region (set region or AWS_REGION)')
+  }
+  if ('' === keyid || '' === secret) {
+    throw new SekretoError(
+      'sekreto: aws: no credentials (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)',
+    )
+  }
+
+  return { region, keyid, secret, session }
+}
+
+/** One signed call to an AWS JSON-1.1 API. */
+async function awscall(
+  opts: Awsopts,
+  service: string,
+  target: string,
+  payload: any,
+): Promise<{ status: number; body: any }> {
+  const auth = awsauth(opts)
+  // The China partition lives under its own suffix; every other
+  // commercial region is plain amazonaws.com.
+  const suffix = auth.region.startsWith('cn-') ? '.amazonaws.com.cn' : '.amazonaws.com'
+  const addr = opts.addr || 'https://' + service + '.' + auth.region + suffix
+  checkaddr(addr)
+
+  const url = addr.replace(/\/$/, '') + '/'
+  const body = JSON.stringify(payload)
+  const headers: Record<string, string> = {
+    'content-type': 'application/x-amz-json-1.1',
+    'x-amz-target': target,
+  }
+
+  const signed = sigv4({
+    method: 'POST',
+    url,
+    headers,
+    body,
+    service,
+    region: auth.region,
+    keyid: auth.keyid,
+    secret: auth.secret,
+    session: auth.session,
+    datetime: awsnow(),
+  })
+
+  return fetchjson('POST', url, { ...headers, ...signed }, body)
+}
+
+/** Does this AWS error body name one of the not-found types? Those are
+ * a miss; every other failure is a store that could not answer. */
+function awsmiss(body: any, types: string[]): boolean {
+  const errtype = body && 'string' === typeof body.__type ? body.__type : ''
+  return types.some((name) => errtype.includes(name))
+}
+
+/** AWS Secrets Manager.
+ *
+ * `api.token` reads the secret named `api` (the vaultref path, so
+ * `db.pass.main` reads `db/pass`) and takes the `token` field of its
+ * JSON SecretString - the AWS idiom of one JSON map per secret. A
+ * SecretString that is not JSON is the value itself, under the
+ * conventional field `value`. Requests are SigV4-signed in-tree; see
+ * Sigv4.ts. */
+export function awssecretsprovider(options?: Awsopts): Provider {
+  const opts = options || {}
+
+  return {
+    lookup: async (name: string) => {
+      const ref = vaultref(name)
+
+      const res = await awscall(opts, 'secretsmanager', 'secretsmanager.GetSecretValue', {
+        SecretId: ref.path,
+      })
+
+      if (400 === res.status && awsmiss(res.body, ['ResourceNotFoundException'])) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: aws secretsmanager error: ' + res.status)
+      }
+
+      const text = res.body && res.body.SecretString
+
+      if ('string' !== typeof text) {
+        // A binary secret has no fields to address; only the conventional
+        // `value` field can mean "the bytes themselves".
+        const bin = res.body && res.body.SecretBinary
+        if ('string' === typeof bin && 'value' === ref.field) {
+          return Buffer.from(bin, 'base64').toString('utf8')
+        }
+        return undefined
+      }
+
+      let parsed: any
+      try {
+        parsed = JSON.parse(text)
+      } catch (err: any) {
+        parsed = undefined
+      }
+
+      if (parsed && 'object' === typeof parsed && !Array.isArray(parsed)) {
+        const value = parsed[ref.field]
+        return undefined === value || null === value ? undefined : String(value)
+      }
+
+      // A plain-string secret is the whole value; it has no named fields.
+      return 'value' === ref.field ? text : undefined
+    },
+    // Config only, never the environment: describe() feeds the spec's
+    // sources group, which must answer the same everywhere.
+    describe: () => 'awssecrets:' + (opts.region || ''),
+  }
+}
+
+/** AWS SSM Parameter Store.
+ *
+ * `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+ * prefix path), decrypted. Parameter Store carries flat strings, so
+ * there is no field indirection. */
+export function awsparamsprovider(options?: Awsopts): Provider {
+  const opts = options || {}
+
+  return {
+    lookup: async (name: string) => {
+      const res = await awscall(opts, 'ssm', 'AmazonSSM.GetParameter', {
+        Name: awsparam(name, opts.prefix),
+        WithDecryption: true,
+      })
+
+      if (400 === res.status && awsmiss(res.body, ['ParameterNotFound'])) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: aws ssm error: ' + res.status)
+      }
+
+      const value = res.body && res.body.Parameter && res.body.Parameter.Value
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'awsparams:' + (opts.region || '') + (opts.prefix || ''),
+  }
+}
+
+/** GCP Secret Manager.
+ *
+ * `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+ * Manager ids have no hierarchy and reject dots), latest version. The
+ * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+ * GCE/GKE metadata server - so on Google's own platform no credential
+ * configuration is needed at all.
+ *
+ * The metadata call itself is plain http to a link-local host by
+ * platform design; no credential rides on it, so `checkaddr` guards the
+ * Secret Manager address instead. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'awssecrets',
+  needs: ['fetch', 'crypto'],
+  define: (spec: ProviderSpec) => awssecretsprovider(spec),
+})
+
+register({
+  name: 'awsparams',
+  needs: ['fetch', 'crypto'],
+  define: (spec: ProviderSpec) => awsparamsprovider(spec),
+})