@voxgig/sdkgen 4.6.0 → 4.8.0

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/onepassword.ts

@@ -0,0 +1,120 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/onepassword.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import {
+  ProviderSpec, Provider, SekretoError, checkname, vaultref,
+} from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function onepasswordprovider(options?: {
+  addr?: string
+  token?: string
+  vault?: string
+}): Provider {
+  const opts = options || {}
+
+  let vaultid: string | undefined
+
+  const auth = (): Record<string, string> => ({
+    authorization: 'Bearer ' + (opts.token || ''),
+  })
+
+  const resolvevault = async (addr: string): Promise<string> => {
+    const want = opts.vault || ''
+    if ('' === want) {
+      throw new SekretoError('sekreto: onepassword: no vault')
+    }
+
+    const res = await fetchjson('GET', addr + '/v1/vaults', auth())
+
+    if (200 !== res.status || !Array.isArray(res.body)) {
+      throw new SekretoError('sekreto: onepassword error: ' + res.status + ': listing vaults')
+    }
+
+    for (const entry of res.body) {
+      if (entry && (want === entry.id || want === entry.name)) {
+        return String(entry.id)
+      }
+    }
+
+    throw new SekretoError('sekreto: onepassword: no vault named ' + want)
+  }
+
+  return {
+    lookup: async (name: string) => {
+      checkname(name)
+
+      const addr = (opts.addr || '').replace(/\/$/, '')
+      if ('' === addr) {
+        throw new SekretoError('sekreto: onepassword: no addr')
+      }
+      checkaddr(addr)
+
+      if (undefined === vaultid) {
+        vaultid = await resolvevault(addr)
+      }
+
+      const filter = encodeURIComponent('title eq "' + name + '"')
+      const found = await fetchjson(
+        'GET',
+        addr + '/v1/vaults/' + vaultid + '/items?filter=' + filter,
+        auth(),
+      )
+
+      if (200 !== found.status || !Array.isArray(found.body)) {
+        throw new SekretoError('sekreto: onepassword error: ' + found.status + ': finding ' + name)
+      }
+
+      if (0 === found.body.length) {
+        return undefined
+      }
+
+      const item = await fetchjson(
+        'GET',
+        addr + '/v1/vaults/' + vaultid + '/items/' + found.body[0].id,
+        auth(),
+      )
+
+      if (200 !== item.status) {
+        throw new SekretoError('sekreto: onepassword error: ' + item.status + ': reading ' + name)
+      }
+
+      const fields = (item.body && item.body.fields) || []
+
+      for (const field of fields) {
+        if (field && 'PASSWORD' === field.purpose) {
+          return undefined === field.value || null === field.value ? undefined : String(field.value)
+        }
+      }
+      for (const field of fields) {
+        if (field && 'value' === field.label) {
+          return undefined === field.value || null === field.value ? undefined : String(field.value)
+        }
+      }
+
+      return undefined
+    },
+    describe: () => 'onepassword:' + (opts.vault || ''),
+  }
+}
+
+/** Doppler.
+ *
+ * The whole config is downloaded once - Doppler's own bulk endpoint -
+ * and answered from memory, like a remote .env: `api.token` is the
+ * `API_TOKEN` entry. A service token is config-scoped, so project and
+ * config are only needed with broader tokens. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'onepassword',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => onepasswordprovider(spec),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/support.ts

@@ -0,0 +1,176 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/support.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The providers a Sekreto chains together.
+//
+// A provider answers one question: "do you have this secret?" It returns
+// the value, or undefined to mean "ask the next one". Nothing else about
+// a provider is visible to the caller - which is the point: an app reads
+// `api.token` and never learns whether it came from the environment, a
+// .env file, HashiCorp Vault, AWS, GCP, Azure or a boru vault.
+//
+// Two failure shapes, and they are never interchangeable. A store that
+// does not hold the secret is a MISS (undefined) - the chain carries on.
+// A store that could not answer - bad credentials, unreachable host,
+// missing configuration - is an ERROR: falling through there would
+// quietly reach for a weaker store.
+
+import {
+  SekretoError,
+  awsparam,
+  checkname,
+  envkey,
+  flatname,
+  parsedotenv,
+  vaultref,
+} from '../Sekreto'
+
+// NODE BUILTINS, LOADED ON FIRST USE.
+//
+// These were top-level imports, which made them a side effect of importing
+// sekreto AT ALL: `child_process`, `fs` and `path` entered the module graph
+// for a caller who only ever used a `memory` or `env` provider, and any
+// runtime lacking them failed at import time rather than at the point of
+// use. Sekreto.ts imports makeprovider from this module, so the chain
+// reached everything.
+//
+// A plain require(), not `await import()`: dotenvprovider, fileprovider and
+// boruprovider all have SYNCHRONOUS lookups, and making them async to
+// accommodate a dynamic import would change observable behaviour for anyone
+// calling a provider directly. The package is CommonJS ("type":
+// "commonjs"), so require is available and synchronous.
+//
+// What this buys and what it does not: the builtins are no longer evaluated
+// at import time, so importing sekreto is safe in a runtime that lacks them
+// and a bundler can drop an unreachable provider along with its edge. It is
+// NOT by itself a complete browser story — a bundler still resolves a
+// require it can see statically, so a browser build wants conditional
+// exports ("browser" field) as well. That is a packaging change, tracked
+// separately.
+const nodemods: Record<string, any> = {}
+
+function nodemod<T = any>(name: string): T {
+  let mod = nodemods[name]
+
+  if (undefined === mod) {
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      mod = nodemods[name] = require(name)
+    } catch (err: any) {
+      throw new SekretoError(
+        'sekreto: this provider needs ' +
+          name +
+          ', which this runtime does not provide: ' +
+          err.message,
+      )
+    }
+  }
+
+  return mod as T
+}
+
+export type Provider = {
+  /** The value, or undefined if this provider does not have it. */
+  lookup: (name: string) => Promise<string | undefined> | string | undefined
+  /** A short description, shown by `Sekreto.sources()`. */
+  describe: () => string
+}
+
+/** The declarative form of a provider, as used in config and in the
+ * shared spec. */
+export type ProviderSpec = {
+  kind:
+    | 'env'
+    | 'dotenv'
+    | 'memory'
+    | 'file'
+    | 'hashicorp'
+    | 'boru'
+    | 'awssecrets'
+    | 'awsparams'
+    | 'gcpsecrets'
+    | 'azuresecrets'
+    | 'onepassword'
+    | 'doppler'
+    | 'infisical'
+  /** The store name `Sekreto.getfrom` addresses. Defaults to `kind`. */
+  name?: string
+  prefix?: string
+  /** dotenv: the file to read. */
+  file?: string
+  /** memory: literal values, keyed like environment variables. */
+  values?: Record<string, string>
+  /** file: the directory of one-secret-per-file entries. */
+  dir?: string
+  /** hashicorp / boru (wire) / gcp / 1password / doppler / infisical:
+   * the base URL. */
+  addr?: string
+  /** hashicorp / boru (wire) / gcp / azure / 1password / doppler /
+   * infisical: the access token. */
+  token?: string
+  /** hashicorp / boru (wire): the KV mount (default `secret`). */
+  mount?: string
+  /** hashicorp: KV engine version, 1 or 2 (default 2). */
+  kv?: number
+  /** hashicorp: Vault Enterprise namespace (X-Vault-Namespace). */
+  vaultnamespace?: string
+  /** hashicorp: log in for a token instead of being handed one. */
+  auth?: {
+    method: 'kubernetes' | 'approle'
+    /** The auth mount, defaulting to the method name. */
+    mount?: string
+    /** kubernetes: the Vault role to log in as. */
+    role?: string
+    /** kubernetes: the service-account JWT itself (tests). */
+    jwt?: string
+    /** kubernetes: where the JWT lives; the conventional pod path by
+     * default. */
+    jwtfile?: string
+    /** approle: the role and secret ids. */
+    roleid?: string
+    secretid?: string
+  }
+  /** boru: the executable to run (default `boru`). */
+  command?: string
+  /** boru: the namespace qualifying the alias. */
+  namespace?: string
+  /** boru: the vault home, passed as BORU_HOME. */
+  home?: string
+  /** aws: region and credentials; the standard AWS_* environment
+   * variables fill whichever are not given. */
+  region?: string
+  keyid?: string
+  secret?: string
+  session?: string
+  /** gcp / doppler / infisical: the project (GCP project id, Doppler
+   * project slug, Infisical workspace id). */
+  project?: string
+  /** azure: the Key Vault name or full URL. 1password: the vault name
+   * or id. */
+  vault?: string
+  /** azure: client-credential login. infisical: universal-auth login
+   * (tenant is Azure-only). */
+  tenant?: string
+  clientid?: string
+  clientsecret?: string
+  /** azure: where to log in / where IMDS answers. gcp: where the
+   * metadata server answers. Overridable for tests and for clouds with
+   * nonstandard endpoints. */
+  loginaddr?: string
+  imdsaddr?: string
+  metadataaddr?: string
+  /** azure: the Key Vault API version (default 7.4). */
+  apiversion?: string
+  /** doppler: the config slug (with `project`). */
+  config?: string
+  /** infisical: the environment slug and secret path. */
+  environment?: string
+  path?: string
+}
+
+/** Environment variables: `api.token` from `API_TOKEN`. */
+
+export {
+  SekretoError, awsparam, checkname, envkey, flatname, parsedotenv, vaultref,
+}
+export { nodemod }

package/project/.sdk/tm/ts/test/vendor/omni/Runner.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.2 (typescript/src/Runner.ts)
-// Source: https://github.com/voxgig/omni @ bc9535d655564c0833f6eff003b0b13dad8b350f
+// Source: https://github.com/voxgig/omni @ 5956cc4e5ecdaeebd11eab8bb4b9462dfc76e018
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //
@@ -352,20 +352,22 @@ function fixjsonval(val: Json, donull: boolean): Json {
 }
 
 // The JSON form of an error: always at least {name,message}.
-// PATCH (solardemo prototype, pending upstream fix), here and in
-// errmessage below: handle error-shaped MAPS. The shared corpus throws
-// plain objects in some ports (this SDK's makeError rethrows the
-// fixture's ctrl.err verbatim), and the struct repos' original runner
-// matched err.message regardless of the thrown value's class. Upstream
-// collapses any non-Error to String(err) — '[object Object]' — which
-// fails both the err check and every match.err.* leaf.
+//
+// A thrown value need not be an Error. Ports commonly rethrow an
+// error-SHAPED map ({name, message, ...}) - voxgig/sdkgen's generated
+// makeError rethrows the fixture's own error object verbatim - and
+// collapsing that to String(err) yields '[object Object]', which fails both
+// the `err` check and every `match.err.*` leaf. The struct repository's
+// original runner read `.message` regardless of the thrown value's class.
 function errify(err: any): Json {
   if (err instanceof Error) {
     return { ...err, name: err.name, message: err.message }
   }
+
   if (null != err && 'object' === typeof err) {
     return { name: 'Error', ...err }
   }
+
   return { name: 'Error', message: String(err) }
 }
 
@@ -481,11 +483,11 @@ function handleerror(flags: Flags, index: number, entry: Json, err: any) {
 
 // Check that every leaf of `check` is present, and matches, in `base`.
 function match(flags: Flags, index: number, entry: Json, check: Json, base: Json) {
-  // PATCH (solardemo prototype, pending upstream fix): read the base
-  // directly instead of cloning it. The clone gained nothing (the walk
-  // below only READS via getpath) and blew the stack on cyclic bases —
-  // which every corpus ctx entry produces, because a live Context reaches
-  // its client and the client's root context reaches the client again.
+  // Read the base DIRECTLY. The clone bought nothing - the walk below only
+  // reads, via getpath - and it blows the stack on a cyclic base. A port
+  // that drives entries with live objects rather than pure JSON produces
+  // those routinely: voxgig/sdkgen's corpus matches against a live client
+  // context whose root context reaches the client again.
   const cbase = base
 
   const at = (path: Json[]) => (0 === path.length ? '<root>' : pathify(path))

package/project/.sdk/tm/ts/test/vendor/omni/Util.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.2 (typescript/src/Util.ts)
-// Source: https://github.com/voxgig/omni @ bc9535d655564c0833f6eff003b0b13dad8b350f
+// Source: https://github.com/voxgig/omni @ 5956cc4e5ecdaeebd11eab8bb4b9462dfc76e018
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //
@@ -158,12 +158,17 @@ function deepequal(a: Json, b: Json): boolean {
 
 // Compact JSON text with map keys sorted, so that messages are identical
 // in every port regardless of local map ordering.
-// PATCH (solardemo prototype, pending upstream fix): cycle guard. The
-// corpus drives LIVE Context objects through entries (entry.ctx, and the
-// entry bookkeeping fail() prints with jsonstr), and a live ctx is cyclic
-// (sdk._rootctx.client === sdk). Upstream jsonstr recursed forever; the
-// struct repos' original runner emitted '[Circular]', restored here.
-function jsonstr(val: Json, seen?: WeakSet<object>): string {
+//
+// CYCLE SAFE. Building a FAILURE MESSAGE must never be the thing that
+// crashes: a port driving entries with live objects rather than pure JSON
+// can carry a cyclic value in the entry bookkeeping fail() prints, and this
+// recursed until the stack gave out. A cycle renders as "[Circular]", as
+// the struct repository's original runner did.
+//
+// `seen` tracks the ANCESTORS of the current value, not every value
+// visited: it is removed again on the way out, so the same object appearing
+// twice as siblings - a DAG, not a cycle - still renders in full.
+function jsonstr(val: Json, seen?: Set<any>): string {
   if (undefined === val) {
     return 'undefined'
   }
@@ -184,23 +189,24 @@ function jsonstr(val: Json, seen?: WeakSet<object>): string {
     return val ? 'true' : 'false'
   }
 
-  if (islist(val)) {
-    seen = seen || new WeakSet()
-    if (seen.has(val)) {
-      return '"[Circular]"'
-    }
-    seen.add(val)
-    return '[' + val.map((entry: Json) => jsonstr(entry, seen)).join(',') + ']'
-  }
+  if (islist(val) || ismap(val)) {
+    seen = seen || new Set()
 
-  if (ismap(val)) {
-    seen = seen || new WeakSet()
     if (seen.has(val)) {
       return '"[Circular]"'
     }
+
     seen.add(val)
-    const keys = Object.keys(val).sort()
-    return '{' + keys.map((key) => JSON.stringify(key) + ':' + jsonstr(val[key], seen)).join(',') + '}'
+
+    const out = islist(val)
+      ? '[' + val.map((entry: Json) => jsonstr(entry, seen)).join(',') + ']'
+      : '{' + Object.keys(val).sort()
+        .map((key) => JSON.stringify(key) + ':' + jsonstr((val as any)[key], seen))
+        .join(',') + '}'
+
+    seen.delete(val)
+
+    return out
   }
 
   if ('function' === typeof val) {

package/project/.sdk/tm/ts/test/vendor/omni/compat.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.2 (typescript/compat/struct.ts), import path adapted ('../src' -> './index').
-// Source: https://github.com/voxgig/omni @ bc9535d655564c0833f6eff003b0b13dad8b350f
+// Source: https://github.com/voxgig/omni @ 5956cc4e5ecdaeebd11eab8bb4b9462dfc76e018
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Drop-in replacement for the in-situ test runner in the voxgig/struct
 // repository (`typescript/test/runner.ts`).

package/project/.sdk/tm/ts/test/vendor/omni/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.2 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/omni @ bc9535d655564c0833f6eff003b0b13dad8b350f
+// Source: https://github.com/voxgig/omni @ 5956cc4e5ecdaeebd11eab8bb4b9462dfc76e018
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/omni - shared multi-language test runner.
 

package/project/.sdk/tm/zig/core/utility.zig

@@ -372,7 +372,7 @@ pub fn make_options_util(ctx: *Context) Value {
         .{ "base", h.vstr("http://localhost:8000") },
         .{ "prefix", h.vstr("") },
         .{ "suffix", h.vstr("") },
-        .{ "auth", h.jo(&.{.{ "prefix", h.vstr("") }}) },
+        .{ "auth", h.jo(&.{ .{ "prefix", h.vstr("") }, .{ "basic", h.vbool(false) } }) },
         .{ "headers", h.jo(&.{.{ "`$CHILD`", h.vstr("`$STRING`") }}) },
         .{ "allow", h.jo(&.{
             .{ "method", h.vstr("GET,PUT,POST,PATCH,DELETE,OPTIONS") },

package/project/sdkgen-package.json

@@ -3,7 +3,7 @@
     "package": 1
   },
   "name": "@voxgig/sdkgen",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "provides": {
     "target": [
       "c",

package/src/cmp/Feature.ts

@@ -3,6 +3,7 @@ import { cmp, Copy, Folder } from 'jostraca'
 
 import { ensureStdrep } from '../helpers/stdrep'
 import { featureApplies, featureTags } from '../helpers/applicability'
+import { pluginExcludesFor } from '../helpers/featureSource'
 
 const Feature = cmp(function Feature(props: any) {
   const { target, feature, ctx$ } = props
@@ -31,6 +32,10 @@ const Feature = cmp(function Feature(props: any) {
       // TODO: Copy should just warn if from not found
       Copy({
         from: 'tm/' + target.name + '/src/feature/' + feature.name,
+        // An ACTIVE feature's INACTIVE plugins do not come with it. This
+        // is the copy that decides it: Main's exclude never sees these
+        // files, because this Copy has already written them.
+        exclude: pluginExcludesFor(ctx$.model, feature.name),
         replace: {
           // Feature templates reference the SDK class by placeholder — e.g.
           // tm/ts/.../TestFeature.ts imports `ProjectNameSDK`. Without the

package/src/cmp/TestControl.ts

@@ -0,0 +1,64 @@
+import Path from 'node:path'
+
+import {
+  cmp,
+  File,
+  Fragment,
+} from 'jostraca'
+
+
+const TEST_CONTROL_FILE = 'sdk-test-control.json'
+
+
+// Keep the blanket per-target `Copy({ from: 'tm/<lang>' })` from restoring the
+// template default over a project's edited control file. One regex for every
+// target: the file sits under `test/`, `t/`, `tests/` or `sdktest/` depending
+// on the language, and the name is what identifies it either way.
+const TEST_CONTROL_EXCLUDE = new RegExp('(^|/)' + TEST_CONTROL_FILE + '$')
+
+
+// `sdk-test-control.json` is the ONE generated file a project is meant to edit
+// by hand: it names the tests to skip, the live pacing, and the extra client
+// options a live run needs (`test.client.options`).
+//
+// It shipped as part of each target's blanket `Copy({ from: 'tm/<lang>' })`,
+// and a Copy has no per-file "leave it alone if it already exists" — so every
+// `npm run generate` overwrote whatever the project had put there. The
+// documented workaround, editing the template master under `.sdk/tm/`, is
+// worse: `doctor` reports it as drift and the next `target add <lang>` reverts
+// it.
+//
+// So it is emitted HERE instead, write-once: `File({ exclude: true })` returns
+// early when the file already exists (FileOp), which is exactly the semantics
+// the file is documented to have. A project without one yet gets the
+// template's default; a project that has edited one keeps its edits across
+// both `generate` and `target add`.
+//
+// The content still comes from the target's own template, so there remains
+// exactly one copy of the default on disk.
+//
+// The template is addressed the SAME way the Copy this replaces addressed it:
+// `tm/<lang>/...` relative to the working directory, which is the project's
+// `.sdk`. Resolved to absolute here because Fragment resolves a RELATIVE
+// `from` against the OUTPUT folder instead — a different base, and the one
+// place these two could silently disagree.
+const TestControl = cmp(function TestControl(props: {
+  target: { name: string }
+  dir: string
+  ctx$?: any
+}) {
+  const { target, dir } = props
+
+  File({ name: TEST_CONTROL_FILE, exclude: true }, () => {
+    Fragment({
+      from: Path.resolve('tm', target.name, dir, TEST_CONTROL_FILE)
+    })
+  })
+})
+
+
+export {
+  TestControl,
+  TEST_CONTROL_FILE,
+  TEST_CONTROL_EXCLUDE,
+}