@voxgig/sdkgen 4.6.0 → 4.8.0

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/dotenv.ts

@@ -0,0 +1,51 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/dotenv.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, envkey, nodemod, parsedotenv } from './support'
+
+export function dotenvprovider(file: string, prefix?: string): Provider {
+  let values: Record<string, string> | undefined
+
+  const load = () => {
+    if (undefined === values) {
+      try {
+        const { readFileSync } = nodemod<typeof import('node:fs')>('node:fs')
+        values = parsedotenv(readFileSync(file, 'utf8'))
+      } catch (err: any) {
+        // An absent file - or an absent directory - means "no secrets
+        // here", exactly like fileprovider. Anything else (permission
+        // denied, an unreadable mount) is a store that could not answer,
+        // and swallowing it would fall through to a weaker store.
+        if ('ENOENT' === err.code || 'ENOTDIR' === err.code) {
+          values = {}
+        } else {
+          throw new SekretoError(
+            'sekreto: dotenv provider cannot read ' + file + ': ' + err.message,
+          )
+        }
+      }
+    }
+    return values
+  }
+
+  return {
+    lookup: (name: string) => load()[envkey(name, prefix)],
+    describe: () => 'dotenv:' + file,
+  }
+}
+
+/** Literal values, keyed like environment variables. The spec uses this
+ * to test chain behaviour without touching the outside world. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'dotenv',
+  needs: ['fs'],
+  define: (spec: ProviderSpec) => dotenvprovider(spec.file || '.env', spec.prefix),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/env.ts

@@ -0,0 +1,31 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/env.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, envkey } from './support'
+
+export function envprovider(prefix?: string, source?: Record<string, any>): Provider {
+  const env = source || process.env
+
+  return {
+    lookup: (name: string) => {
+      const value = env[envkey(name, prefix)]
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'env' + (prefix ? ':' + prefix : ''),
+  }
+}
+
+/** A `.env` file, read once, keyed exactly like the environment. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'env',
+  needs: [],
+  define: (spec: ProviderSpec) => envprovider(spec.prefix),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/file.ts

@@ -0,0 +1,54 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/file.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import {
+  ProviderSpec, Provider, SekretoError, envkey, flatname, nodemod,
+} from './support'
+
+export function fileprovider(dir: string, prefix?: string): Provider {
+  return {
+    lookup: (name: string) => {
+      const { join } = nodemod<typeof import('node:path')>('node:path')
+      const file = join(dir, envkey(name, prefix))
+
+      let text: string
+      try {
+        const { readFileSync } = nodemod<typeof import('node:fs')>('node:fs')
+        text = readFileSync(file, 'utf8')
+      } catch (err: any) {
+        // An absent file - or an absent directory - means "no secrets
+        // here", exactly like a missing .env. Anything else (permission
+        // denied, an unreadable mount) is a store that could not answer.
+        if ('ENOENT' === err.code || 'ENOTDIR' === err.code) {
+          return undefined
+        }
+        throw new SekretoError('sekreto: file provider cannot read ' + file + ': ' + err.message)
+      }
+
+      return text.replace(/\r?\n$/, '')
+    },
+    describe: () => 'file:' + dir,
+  }
+}
+
+/** Refuse to send a secret-bearing credential in the clear.
+ *
+ * A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+ * convenience. Sending a token over http to anything but the local
+ * machine puts both the token and the secret it fetches on the wire for
+ * anyone on the path, so sekreto will not do it. Loopback stays allowed:
+ * that is `vault server -dev`, `boru vault serve`, and this repo's own
+ * test harness. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'file',
+  needs: ['fs'],
+  define: (spec: ProviderSpec) => fileprovider(spec.dir || '', spec.prefix),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/gcpsecrets.ts

@@ -0,0 +1,118 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/gcpsecrets.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, flatname, nodemod } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function gcpsecretsprovider(options?: {
+  project?: string
+  token?: string
+  addr?: string
+  metadataaddr?: string
+}): Provider {
+  const opts = options || {}
+
+  // A configured token is kept forever; a metadata-server token carries
+  // expires_in and is renewed shortly before it runs out.
+  let livetoken: string | undefined
+  let renewat = Infinity
+
+  const metadataaddr = (): string => {
+    if (opts.metadataaddr) {
+      return opts.metadataaddr
+    }
+    const host = process.env.GCE_METADATA_HOST
+    return host ? 'http://' + host : 'http://metadata.google.internal'
+  }
+
+  const login = async (): Promise<string> => {
+    const configured = opts.token || process.env.GOOGLE_OAUTH_ACCESS_TOKEN
+    if (configured) {
+      return configured
+    }
+
+    const url =
+      metadataaddr().replace(/\/$/, '') +
+      '/computeMetadata/v1/instance/service-accounts/default/token'
+
+    const res = await fetchjson('GET', url, { 'Metadata-Flavor': 'Google' })
+
+    const got = res.body && res.body.access_token
+    if (200 !== res.status || !got) {
+      throw new SekretoError('sekreto: gcp: no token and metadata server did not answer')
+    }
+
+    const expires = Number(res.body.expires_in)
+    renewat = 0 < expires ? Date.now() + Math.max(expires - 60, 1) * 1000 : Infinity
+
+    return String(got)
+  }
+
+  return {
+    lookup: async (name: string) => {
+      const project = opts.project || ''
+      if ('' === project) {
+        throw new SekretoError('sekreto: gcp: no project')
+      }
+
+      const addr = opts.addr || 'https://secretmanager.googleapis.com'
+      checkaddr(addr)
+
+      if (undefined === livetoken || Date.now() >= renewat) {
+        livetoken = await login()
+      }
+
+      const url =
+        addr.replace(/\/$/, '') +
+        '/v1/projects/' +
+        project +
+        '/secrets/' +
+        flatname(name, '_') +
+        '/versions/latest:access'
+
+      const res = await fetchjson('GET', url, { authorization: 'Bearer ' + livetoken })
+
+      if (404 === res.status) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: gcp error: ' + res.status + ': ' + url)
+      }
+
+      const data = res.body && res.body.payload && res.body.payload.data
+      if ('string' !== typeof data) {
+        return undefined
+      }
+
+      return Buffer.from(data, 'base64').toString('utf8')
+    },
+    describe: () => 'gcpsecrets:' + (opts.project || ''),
+  }
+}
+
+/** Azure Key Vault.
+ *
+ * `api.token` reads secret `api-token` (dots flattened to `-`; Key
+ * Vault names allow nothing else), current version. The token comes
+ * from config, then a client-credentials login when tenant/clientid/
+ * clientsecret are given, then the IMDS managed-identity endpoint - so
+ * on Azure's own platform no credential configuration is needed.
+ *
+ * As with GCP, the IMDS call is plain http to a link-local host by
+ * platform design and carries no credential; the login and vault
+ * addresses are `checkaddr`-guarded. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'gcpsecrets',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => gcpsecretsprovider(spec),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/hashicorp.ts

@@ -0,0 +1,159 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/hashicorp.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, checkname, nodemod, vaultref } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function hashicorpprovider(
+  addr: string,
+  token: string,
+  options?: {
+    mount?: string
+    kv?: number
+    vaultnamespace?: string
+    auth?: ProviderSpec['auth']
+  },
+): Provider {
+  const opts = options || {}
+  const usemount = opts.mount || 'secret'
+  const kv = opts.kv || 2
+
+  // A version typo like kv: 3 must not quietly behave as v2 and turn
+  // its 404s into misses; there is nothing safe to assume it meant.
+  if (1 !== kv && 2 !== kv) {
+    throw new SekretoError('sekreto: hashicorp: unsupported kv version: ' + String(kv))
+  }
+
+  // The working token: a configured token is kept forever, a logged-in
+  // token is renewed shortly before its lease runs out - a long-running
+  // process must not keep presenting a token the vault already expired.
+  let livetoken: string | undefined = '' === token ? undefined : token
+  let renewat = Infinity
+
+  const baseheaders = (): Record<string, string> => {
+    const headers: Record<string, string> = {}
+    if (opts.vaultnamespace) {
+      headers['X-Vault-Namespace'] = opts.vaultnamespace
+    }
+    return headers
+  }
+
+  const login = async (): Promise<string> => {
+    const auth = opts.auth
+    if (!auth) {
+      throw new SekretoError('sekreto: hashicorp: no token and no auth method')
+    }
+
+    const mount = auth.mount || auth.method
+    const url = addr.replace(/\/$/, '') + '/v1/auth/' + mount + '/login'
+
+    let body: any
+    if ('kubernetes' === auth.method) {
+      let jwt = auth.jwt
+      if (undefined === jwt) {
+        const file = auth.jwtfile || '/var/run/secrets/kubernetes.io/serviceaccount/token'
+        try {
+          const { readFileSync } = nodemod<typeof import('node:fs')>('node:fs')
+          jwt = readFileSync(file, 'utf8').trim()
+        } catch (err: any) {
+          throw new SekretoError('sekreto: hashicorp: cannot read jwt file ' + file)
+        }
+      }
+      body = { role: auth.role || '', jwt }
+    } else if ('approle' === auth.method) {
+      body = { role_id: auth.roleid || '', secret_id: auth.secretid || '' }
+    } else {
+      throw new SekretoError('sekreto: hashicorp: unknown auth method: ' + String(auth.method))
+    }
+
+    const res = await fetchjson('POST', url, baseheaders(), JSON.stringify(body))
+
+    const got = res.body && res.body.auth && res.body.auth.client_token
+    if (200 !== res.status || !got) {
+      throw new SekretoError('sekreto: hashicorp login failed: ' + res.status + ': ' + url)
+    }
+
+    const lease = Number(res.body.auth.lease_duration)
+    renewat = 0 < lease ? Date.now() + Math.max(lease - 60, 1) * 1000 : Infinity
+
+    return String(got)
+  }
+
+  return {
+    lookup: async (name: string) => {
+      checkaddr(addr)
+
+      if (undefined === livetoken || Date.now() >= renewat) {
+        livetoken = await login()
+      }
+
+      const ref = vaultref(name)
+      const base = addr.replace(/\/$/, '') + '/v1/' + usemount
+      const url = 1 === kv ? base + '/' + ref.path : base + '/data/' + ref.path
+
+      const headers = baseheaders()
+      headers['X-Vault-Token'] = livetoken
+
+      const res = await fetchjson('GET', url, headers)
+
+      if (404 === res.status) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: hashicorp error: ' + res.status + ': ' + url)
+      }
+
+      const data =
+        1 === kv ? res.body && res.body.data : res.body && res.body.data && res.body.data.data
+
+      const value = data ? data[ref.field] : undefined
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'hashicorp:' + addr + '/' + usemount,
+  }
+}
+
+/** A boru vault (https://github.com/boru-lang/boru).
+ *
+ * Two ways in, both boru's own.
+ *
+ * With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+ * secret on stdout and nothing else. The passphrase is read by boru
+ * itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
+ * config and never puts it on a command line, where it would show up in
+ * the process table.
+ *
+ * With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+ * read-only, HashiCorp-shaped provision API (boru's
+ * design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+ * from `boru vault grant`. A sekreto name is already a valid boru
+ * alias, and boru aliases keep their dots, so `api.token` is the single
+ * path segment `api.token` - not the `api`/`token` split a HashiCorp KV
+ * gets. The value is the `value` field. A 404 is a miss; anything else
+ * the server refuses (a revoked capability, a sealed vault) is an
+ * error.
+ *
+ * boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+ * credential *broker*, built precisely so the caller never receives the
+ * credential. `vault serve` is the provision endpoint, built to hand
+ * the value back - that is the one sekreto uses. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'hashicorp',
+  needs: ['fetch', 'fs'],
+  define: (spec: ProviderSpec) => hashicorpprovider(spec.addr || '', spec.token || '', {
+    mount: spec.mount,
+    kv: spec.kv,
+    vaultnamespace: spec.vaultnamespace,
+    auth: spec.auth,
+  }),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/http.ts

@@ -0,0 +1,66 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/http.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { SekretoError } from './support'
+import { checkaddr } from './addr'
+
+// Moved here with fetchjson, its only consumer.
+const HTTP_TIMEOUT_MS = 10000
+
+export async function fetchjson(
+  method: string,
+  url: string,
+  headers: Record<string, string>,
+  body?: string,
+): Promise<{ status: number; body: any }> {
+  let res: Response
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body,
+      // A vault API never legitimately redirects, and a followed redirect
+      // carries X-Vault-Token to the redirect's host (and can downgrade
+      // https to http), which checkaddr - it only validates the configured
+      // address - cannot see. Refuse to follow one.
+      redirect: 'error',
+      // Bound the wait so an accepted-but-silent endpoint cannot hang the
+      // caller (and the app's startup) forever.
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+    })
+  } catch (err: any) {
+    throw new SekretoError('sekreto: cannot reach ' + url.split('?')[0] + ': ' + err.message)
+  }
+
+  let parsed: any = undefined
+  try {
+    parsed = await res.json()
+  } catch (err: any) {
+    // A success status promised JSON; a body that does not parse means
+    // the store could not answer coherently, and treating it as a miss
+    // would fall through to a weaker store. Error statuses may carry
+    // any body - they are decided on status alone.
+    if (200 === res.status) {
+      throw new SekretoError('sekreto: malformed response from ' + url.split('?')[0])
+    }
+  }
+
+  return { status: res.status, body: parsed }
+}
+
+/** HashiCorp Vault.
+ *
+ * KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
+ * and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+ * `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
+ * "not here" - a miss - so a vault can sit in a chain with fallbacks.
+ *
+ * A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+ * logins as well as reads.
+ *
+ * Instead of being handed a token, the provider can log in: Kubernetes
+ * auth (the pod's service-account JWT, from its conventional path) or
+ * AppRole. A failed login is an error, never a miss - it means this
+ * store could not answer at all. */

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/infisical.ts

@@ -0,0 +1,107 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/infisical.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, envkey } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function infisicalprovider(options?: {
+  addr?: string
+  token?: string
+  clientid?: string
+  clientsecret?: string
+  project?: string
+  environment?: string
+  path?: string
+}): Provider {
+  const opts = options || {}
+
+  // A configured token is kept forever; a universal-auth token carries
+  // expiresIn and is renewed shortly before it runs out.
+  let livetoken: string | undefined
+  let renewat = Infinity
+
+  const login = async (addr: string): Promise<string> => {
+    if (opts.token) {
+      return opts.token
+    }
+
+    if (!opts.clientid || !opts.clientsecret) {
+      throw new SekretoError('sekreto: infisical: no token and no client credentials')
+    }
+
+    const res = await fetchjson(
+      'POST',
+      addr + '/api/v1/auth/universal-auth/login',
+      { 'content-type': 'application/json' },
+      JSON.stringify({ clientId: opts.clientid, clientSecret: opts.clientsecret }),
+    )
+
+    const got = res.body && res.body.accessToken
+    if (200 !== res.status || !got) {
+      throw new SekretoError('sekreto: infisical login failed: ' + res.status)
+    }
+
+    const expires = Number(res.body.expiresIn)
+    renewat = 0 < expires ? Date.now() + Math.max(expires - 60, 1) * 1000 : Infinity
+
+    return String(got)
+  }
+
+  return {
+    lookup: async (name: string) => {
+      const addr = (opts.addr || 'https://app.infisical.com').replace(/\/$/, '')
+      checkaddr(addr)
+
+      const project = opts.project || ''
+      const environment = opts.environment || ''
+      if ('' === project || '' === environment) {
+        throw new SekretoError('sekreto: infisical: no project/environment')
+      }
+
+      if (undefined === livetoken || Date.now() >= renewat) {
+        livetoken = await login(addr)
+      }
+
+      const url =
+        addr +
+        '/api/v3/secrets/raw/' +
+        envkey(name) +
+        '?workspaceId=' +
+        encodeURIComponent(project) +
+        '&environment=' +
+        encodeURIComponent(environment) +
+        '&secretPath=' +
+        encodeURIComponent(opts.path || '/')
+
+      const res = await fetchjson('GET', url, { authorization: 'Bearer ' + livetoken })
+
+      if (404 === res.status) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: infisical error: ' + res.status)
+      }
+
+      const value = res.body && res.body.secret && res.body.secret.secretValue
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'infisical:' + (opts.project || '') + '/' + (opts.environment || ''),
+  }
+}
+
+/** Build a provider from its declarative form. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'infisical',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => infisicalprovider(spec),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/memory.ts

@@ -0,0 +1,33 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/memory.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, envkey } from './support'
+
+export function memoryprovider(values: Record<string, string>, prefix?: string): Provider {
+  return {
+    lookup: (name: string) => values[envkey(name, prefix)],
+    describe: () => 'memory' + (prefix ? ':' + prefix : ''),
+  }
+}
+
+/** A directory of one-secret-per-file entries, keyed like the
+ * environment: `api.token` reads `<dir>/API_TOKEN`.
+ *
+ * This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+ * secret, and a systemd credentials directory, so those all work with no
+ * further configuration. One trailing newline is stripped - tools that
+ * write these files disagree about it, and a newline is never part of a
+ * secret on purpose. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'memory',
+  needs: [],
+  define: (spec: ProviderSpec) => memoryprovider(spec.values || {}, spec.prefix),
+})