@voxgig/sdkgen 4.6.0 → 4.7.0

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/azuresecrets.ts

@@ -0,0 +1,144 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/azuresecrets.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, flatname } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function azuresecretsprovider(options?: {
+  vault?: string
+  token?: string
+  tenant?: string
+  clientid?: string
+  clientsecret?: string
+  loginaddr?: string
+  imdsaddr?: string
+  apiversion?: string
+}): Provider {
+  const opts = options || {}
+  const resource = 'https://vault.azure.net'
+
+  // A configured token is kept forever; logged-in and IMDS tokens carry
+  // expires_in and are renewed shortly before they run out.
+  let livetoken: string | undefined
+  let renewat = Infinity
+
+  const expiry = (expires: any): number => {
+    const seconds = Number(expires)
+    return 0 < seconds ? Date.now() + Math.max(seconds - 60, 1) * 1000 : Infinity
+  }
+
+  const login = async (): Promise<string> => {
+    if (opts.token) {
+      return opts.token
+    }
+
+    if (opts.tenant && opts.clientid && opts.clientsecret) {
+      const loginaddr = opts.loginaddr || 'https://login.microsoftonline.com'
+      checkaddr(loginaddr)
+
+      const url = loginaddr.replace(/\/$/, '') + '/' + opts.tenant + '/oauth2/v2.0/token'
+      const form =
+        'grant_type=client_credentials&client_id=' +
+        encodeURIComponent(opts.clientid) +
+        '&client_secret=' +
+        encodeURIComponent(opts.clientsecret) +
+        '&scope=' +
+        encodeURIComponent(resource + '/.default')
+
+      const res = await fetchjson(
+        'POST',
+        url,
+        { 'content-type': 'application/x-www-form-urlencoded' },
+        form,
+      )
+
+      const got = res.body && res.body.access_token
+      if (200 !== res.status || !got) {
+        throw new SekretoError('sekreto: azure login failed: ' + res.status)
+      }
+
+      renewat = expiry(res.body.expires_in)
+      return String(got)
+    }
+
+    const imds =
+      (opts.imdsaddr || 'http://169.254.169.254').replace(/\/$/, '') +
+      '/metadata/identity/oauth2/token?api-version=2018-02-01&resource=' +
+      encodeURIComponent(resource)
+
+    const res = await fetchjson('GET', imds, { Metadata: 'true' })
+
+    const got = res.body && res.body.access_token
+    if (200 !== res.status || !got) {
+      throw new SekretoError(
+        'sekreto: azure: no token, no client credentials, and IMDS did not answer',
+      )
+    }
+
+    renewat = expiry(res.body.expires_in)
+    return String(got)
+  }
+
+  return {
+    lookup: async (name: string) => {
+      const vault = opts.vault || ''
+      if ('' === vault) {
+        throw new SekretoError('sekreto: azure: no vault')
+      }
+
+      // Only an explicit scheme is a URL; a vault NAMED httpvault must
+      // still become https://httpvault.vault.azure.net.
+      const vaulturl =
+        vault.startsWith('http://') || vault.startsWith('https://')
+          ? vault
+          : 'https://' + vault + '.vault.azure.net'
+      checkaddr(vaulturl)
+
+      if (undefined === livetoken || Date.now() >= renewat) {
+        livetoken = await login()
+      }
+
+      const url =
+        vaulturl.replace(/\/$/, '') +
+        '/secrets/' +
+        flatname(name, '-') +
+        '?api-version=' +
+        (opts.apiversion || '7.4')
+
+      const res = await fetchjson('GET', url, { authorization: 'Bearer ' + livetoken })
+
+      if (404 === res.status) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: azure error: ' + res.status + ': ' + url.split('?')[0])
+      }
+
+      const value = res.body && res.body.value
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'azuresecrets:' + (opts.vault || ''),
+  }
+}
+
+/** 1Password, through a Connect server.
+ *
+ * The item titled `api.token` (titles keep their dots), in the named
+ * vault. The value is the field with purpose PASSWORD, or the field
+ * labelled `value`. A vault that cannot be found is an error - config
+ * names it, so its absence is a broken store, not a missing secret. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'azuresecrets',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => azuresecretsprovider(spec),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/boru.ts

@@ -0,0 +1,113 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/boru.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, checkname, nodemod } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function boruprovider(options?: {
+  command?: string
+  namespace?: string
+  home?: string
+  addr?: string
+  token?: string
+  mount?: string
+}): Provider {
+  const opts = options || {}
+  const command = opts.command || 'boru'
+
+  if (opts.addr) {
+    const addr = opts.addr.replace(/\/$/, '')
+    const mount = opts.mount || 'secret'
+
+    return {
+      lookup: async (name: string) => {
+        checkname(name)
+        checkaddr(addr)
+
+        const alias = opts.namespace ? opts.namespace + '/' + name : name
+        const url = addr + '/v1/' + mount + '/data/' + alias
+
+        const res = await fetchjson('GET', url, { 'X-Vault-Token': opts.token || '' })
+
+        if (404 === res.status) {
+          return undefined
+        }
+
+        if (200 !== res.status) {
+          throw new SekretoError('sekreto: boru serve error: ' + res.status + ': ' + url)
+        }
+
+        const data = res.body && res.body.data && res.body.data.data
+        const value = data ? data['value'] : undefined
+        return undefined === value || null === value ? undefined : String(value)
+      },
+      describe: () => 'boru:' + addr,
+    }
+  }
+
+  return {
+    lookup: (name: string) => {
+      checkname(name)
+
+      const alias = opts.namespace ? opts.namespace + ':' + name : name
+      const env = opts.home ? { ...process.env, BORU_HOME: opts.home } : process.env
+
+      const { spawnSync } = nodemod<typeof import('node:child_process')>('node:child_process')
+      const run = spawnSync(command, ['vault', 'get', '--reveal', alias], {
+        encoding: 'utf8',
+        env,
+      })
+
+      if (run.error) {
+        throw new SekretoError('sekreto: cannot run ' + command + ': ' + run.error.message)
+      }
+
+      if (0 === run.status) {
+        // boru prints the value and one newline, and nothing else.
+        return run.stdout.replace(/\n$/, '')
+      }
+
+      const why = (run.stderr || '').trim()
+
+      // "no alias named" is boru saying it does not hold this secret, which
+      // is a miss: the chain carries on to the next provider. A locked vault
+      // or a wrong passphrase is not a miss - treating it as one would fall
+      // through to a weaker store without saying so.
+      if (borumiss(why)) {
+        return undefined
+      }
+
+      throw new SekretoError('sekreto: boru vault error: ' + (why || 'exit ' + run.status))
+    },
+    describe: () => 'boru' + (opts.namespace ? ':' + opts.namespace : ''),
+  }
+}
+
+/** Does this boru failure mean "no such secret" rather than "I could not
+ * answer"? Matched on boru's own wording for a missing alias. */
+function borumiss(why: string): boolean {
+  return /no alias named/.test(why)
+}
+
+/** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'boru',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => boruprovider({
+    command: spec.command,
+    namespace: spec.namespace,
+    home: spec.home,
+    addr: spec.addr,
+    token: spec.token,
+    mount: spec.mount,
+  }),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/doppler.ts

@@ -0,0 +1,77 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/doppler.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, envkey } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function dopplerprovider(options?: {
+  token?: string
+  project?: string
+  config?: string
+  addr?: string
+}): Provider {
+  const opts = options || {}
+
+  let values: Record<string, string> | undefined
+
+  const load = async (): Promise<Record<string, string>> => {
+    if (undefined !== values) {
+      return values
+    }
+
+    const addr = (opts.addr || 'https://api.doppler.com').replace(/\/$/, '')
+    checkaddr(addr)
+
+    let url = addr + '/v3/configs/config/secrets/download?format=json'
+    if (opts.project) {
+      url += '&project=' + encodeURIComponent(opts.project)
+    }
+    if (opts.config) {
+      url += '&config=' + encodeURIComponent(opts.config)
+    }
+
+    const res = await fetchjson('GET', url, {
+      authorization: 'Bearer ' + (opts.token || ''),
+    })
+
+    if (200 !== res.status || !res.body || 'object' !== typeof res.body) {
+      throw new SekretoError('sekreto: doppler error: ' + res.status)
+    }
+
+    values = {}
+    for (const [key, value] of Object.entries(res.body)) {
+      if (null !== value && undefined !== value) {
+        values[key] = String(value)
+      }
+    }
+
+    return values
+  }
+
+  return {
+    lookup: async (name: string) => (await load())[envkey(name)],
+    describe: () =>
+      'doppler' + (opts.project ? ':' + opts.project + '/' + (opts.config || '') : ''),
+  }
+}
+
+/** Infisical.
+ *
+ * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+ * convention is environment-style keys) at a secret path in one
+ * environment of a project. Auth is a token, or a universal-auth
+ * (machine identity) login with clientid/clientsecret. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'doppler',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => dopplerprovider(spec),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/dotenv.ts

@@ -0,0 +1,51 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/dotenv.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, envkey, nodemod, parsedotenv } from './support'
+
+export function dotenvprovider(file: string, prefix?: string): Provider {
+  let values: Record<string, string> | undefined
+
+  const load = () => {
+    if (undefined === values) {
+      try {
+        const { readFileSync } = nodemod<typeof import('node:fs')>('node:fs')
+        values = parsedotenv(readFileSync(file, 'utf8'))
+      } catch (err: any) {
+        // An absent file - or an absent directory - means "no secrets
+        // here", exactly like fileprovider. Anything else (permission
+        // denied, an unreadable mount) is a store that could not answer,
+        // and swallowing it would fall through to a weaker store.
+        if ('ENOENT' === err.code || 'ENOTDIR' === err.code) {
+          values = {}
+        } else {
+          throw new SekretoError(
+            'sekreto: dotenv provider cannot read ' + file + ': ' + err.message,
+          )
+        }
+      }
+    }
+    return values
+  }
+
+  return {
+    lookup: (name: string) => load()[envkey(name, prefix)],
+    describe: () => 'dotenv:' + file,
+  }
+}
+
+/** Literal values, keyed like environment variables. The spec uses this
+ * to test chain behaviour without touching the outside world. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'dotenv',
+  needs: ['fs'],
+  define: (spec: ProviderSpec) => dotenvprovider(spec.file || '.env', spec.prefix),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/env.ts

@@ -0,0 +1,31 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/env.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, envkey } from './support'
+
+export function envprovider(prefix?: string, source?: Record<string, any>): Provider {
+  const env = source || process.env
+
+  return {
+    lookup: (name: string) => {
+      const value = env[envkey(name, prefix)]
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'env' + (prefix ? ':' + prefix : ''),
+  }
+}
+
+/** A `.env` file, read once, keyed exactly like the environment. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'env',
+  needs: [],
+  define: (spec: ProviderSpec) => envprovider(spec.prefix),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/file.ts

@@ -0,0 +1,54 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/file.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import {
+  ProviderSpec, Provider, SekretoError, envkey, flatname, nodemod,
+} from './support'
+
+export function fileprovider(dir: string, prefix?: string): Provider {
+  return {
+    lookup: (name: string) => {
+      const { join } = nodemod<typeof import('node:path')>('node:path')
+      const file = join(dir, envkey(name, prefix))
+
+      let text: string
+      try {
+        const { readFileSync } = nodemod<typeof import('node:fs')>('node:fs')
+        text = readFileSync(file, 'utf8')
+      } catch (err: any) {
+        // An absent file - or an absent directory - means "no secrets
+        // here", exactly like a missing .env. Anything else (permission
+        // denied, an unreadable mount) is a store that could not answer.
+        if ('ENOENT' === err.code || 'ENOTDIR' === err.code) {
+          return undefined
+        }
+        throw new SekretoError('sekreto: file provider cannot read ' + file + ': ' + err.message)
+      }
+
+      return text.replace(/\r?\n$/, '')
+    },
+    describe: () => 'file:' + dir,
+  }
+}
+
+/** Refuse to send a secret-bearing credential in the clear.
+ *
+ * A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+ * convenience. Sending a token over http to anything but the local
+ * machine puts both the token and the secret it fetches on the wire for
+ * anyone on the path, so sekreto will not do it. Loopback stays allowed:
+ * that is `vault server -dev`, `boru vault serve`, and this repo's own
+ * test harness. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'file',
+  needs: ['fs'],
+  define: (spec: ProviderSpec) => fileprovider(spec.dir || '', spec.prefix),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/gcpsecrets.ts

@@ -0,0 +1,118 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/gcpsecrets.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, flatname, nodemod } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function gcpsecretsprovider(options?: {
+  project?: string
+  token?: string
+  addr?: string
+  metadataaddr?: string
+}): Provider {
+  const opts = options || {}
+
+  // A configured token is kept forever; a metadata-server token carries
+  // expires_in and is renewed shortly before it runs out.
+  let livetoken: string | undefined
+  let renewat = Infinity
+
+  const metadataaddr = (): string => {
+    if (opts.metadataaddr) {
+      return opts.metadataaddr
+    }
+    const host = process.env.GCE_METADATA_HOST
+    return host ? 'http://' + host : 'http://metadata.google.internal'
+  }
+
+  const login = async (): Promise<string> => {
+    const configured = opts.token || process.env.GOOGLE_OAUTH_ACCESS_TOKEN
+    if (configured) {
+      return configured
+    }
+
+    const url =
+      metadataaddr().replace(/\/$/, '') +
+      '/computeMetadata/v1/instance/service-accounts/default/token'
+
+    const res = await fetchjson('GET', url, { 'Metadata-Flavor': 'Google' })
+
+    const got = res.body && res.body.access_token
+    if (200 !== res.status || !got) {
+      throw new SekretoError('sekreto: gcp: no token and metadata server did not answer')
+    }
+
+    const expires = Number(res.body.expires_in)
+    renewat = 0 < expires ? Date.now() + Math.max(expires - 60, 1) * 1000 : Infinity
+
+    return String(got)
+  }
+
+  return {
+    lookup: async (name: string) => {
+      const project = opts.project || ''
+      if ('' === project) {
+        throw new SekretoError('sekreto: gcp: no project')
+      }
+
+      const addr = opts.addr || 'https://secretmanager.googleapis.com'
+      checkaddr(addr)
+
+      if (undefined === livetoken || Date.now() >= renewat) {
+        livetoken = await login()
+      }
+
+      const url =
+        addr.replace(/\/$/, '') +
+        '/v1/projects/' +
+        project +
+        '/secrets/' +
+        flatname(name, '_') +
+        '/versions/latest:access'
+
+      const res = await fetchjson('GET', url, { authorization: 'Bearer ' + livetoken })
+
+      if (404 === res.status) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: gcp error: ' + res.status + ': ' + url)
+      }
+
+      const data = res.body && res.body.payload && res.body.payload.data
+      if ('string' !== typeof data) {
+        return undefined
+      }
+
+      return Buffer.from(data, 'base64').toString('utf8')
+    },
+    describe: () => 'gcpsecrets:' + (opts.project || ''),
+  }
+}
+
+/** Azure Key Vault.
+ *
+ * `api.token` reads secret `api-token` (dots flattened to `-`; Key
+ * Vault names allow nothing else), current version. The token comes
+ * from config, then a client-credentials login when tenant/clientid/
+ * clientsecret are given, then the IMDS managed-identity endpoint - so
+ * on Azure's own platform no credential configuration is needed.
+ *
+ * As with GCP, the IMDS call is plain http to a link-local host by
+ * platform design and carries no credential; the login and vault
+ * addresses are `checkaddr`-guarded. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'gcpsecrets',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => gcpsecretsprovider(spec),
+})