@voxgig/sdkgen 4.8.2 → 4.8.3

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/__init__.py

@@ -0,0 +1,74 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/__init__.py)
+# Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# voxgig_sekreto - one interface for secrets, wherever they live.
+#
+# THE CORE SURFACE: the chain, the four built-in provider kinds, and the
+# means of adding a fifth.
+#
+# The built-ins are the kinds that read at most a local file - env,
+# memory, dotenv, file. Everything that opens a socket, spawns a process
+# or signs a request is a PLUGIN, is not imported by this package, and is
+# handed to `Sekreto` by the calling project:
+#
+#     from voxgig_sekreto import Sekreto
+#     from voxgig_sekreto.plugins.hashicorp import hashicorp
+#
+#     secrets = Sekreto({
+#         'plugins': [hashicorp],
+#         'providers': [{'kind': 'env'}, {'kind': 'hashicorp', 'addr': addr, 'token': token}],
+#     })
+#
+# or, for every kind at once, `ALL` from `voxgig_sekreto.plugins`. See
+# docs/design/plugin-providers.md.
+
+from .addr import checkaddr, safeaddr
+from .providers import (
+    BUILTINS,
+    ERROR_CODE,
+    KINDS,
+    PROVIDER_EXPORT,
+    DotenvProvider,
+    EnvProvider,
+    FileProvider,
+    MemoryProvider,
+    Provider,
+    providerplugin,
+)
+from .sekreto import (
+    Sekreto,
+    SekretoError,
+    awsparam,
+    envkey,
+    flatname,
+    parsedotenv,
+    redact,
+    sekreto,
+    validname,
+    vaultref,
+)
+
+__all__ = [
+    'BUILTINS',
+    'ERROR_CODE',
+    'KINDS',
+    'PROVIDER_EXPORT',
+    'DotenvProvider',
+    'EnvProvider',
+    'FileProvider',
+    'MemoryProvider',
+    'Provider',
+    'Sekreto',
+    'SekretoError',
+    'awsparam',
+    'checkaddr',
+    'envkey',
+    'flatname',
+    'parsedotenv',
+    'providerplugin',
+    'redact',
+    'safeaddr',
+    'sekreto',
+    'validname',
+    'vaultref',
+]

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/addr.py

@@ -0,0 +1,116 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/addr.py)
+# Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The plaintext-address guard, in the core because it is pure - a handful
+# of string steps, no socket - and because it is on the spec: every port
+# answers the same for every address in spec/def/store.aon. The plugins
+# that dial an address call `checkaddr` before they do.
+#
+# A port of typescript/src/provider/addr.ts.
+
+from .sekreto import SekretoError
+
+
+def safeaddr(addr):
+    """An address with any userinfo replaced by `[redacted]`, for messages.
+
+    Every refusal below names the address it refused, and one of them fires
+    precisely because the address carries a credential - so printing it
+    verbatim wrote the password to stderr and into the logs. It cannot be
+    cleaned up afterwards either: that password was never resolved as a
+    secret, so `redact` has never seen it and never will. The host is what a
+    reader needs to identify which chain entry is at fault; the userinfo is
+    not.
+    """
+    mark = addr.find('://')
+    if -1 == mark:
+        return addr
+
+    rest = addr[mark + 3:]
+    end = len(rest)
+    for ch in ('/', '?', '#'):
+        at = rest.find(ch)
+        if -1 != at and at < end:
+            end = at
+    authority = rest[:end]
+
+    at = authority.rfind('@')
+    if -1 == at:
+        return addr
+
+    return addr[:mark + 3] + '[redacted]' + addr[mark + 3 + at:]
+
+
+def checkaddr(addr):
+    """Refuse to send a Vault token in the clear.
+
+    Vault's API is HTTPS in any real deployment; plaintext is a dev-mode
+    convenience. Sending `X-Vault-Token` over http to anything but the local
+    machine puts both the token and the secret it fetches on the wire for
+    anyone on the path, so sekreto will not do it. Loopback stays allowed:
+    that is `vault server -dev` and this repo's own test harness.
+
+    The address is read by hand, in the same handful of steps in every port,
+    rather than by each platform's URL parser. That is deliberate. Twelve
+    parsers disagree about malformed input - where userinfo ends, whether
+    `0177.0.0.1` is loopback, what an unclosed bracket means - and a check
+    that answers differently in different ports is not a check.
+
+    The rule this parse obeys, and the reason it can be trusted: it is never
+    more permissive than the HTTP client that will dial the address. It ends
+    the authority at `/`, `?` or `#` only, so a client that also breaks on
+    `\\` (WHATWG does) can only ever see a SHORTER host than this does. It
+    refuses userinfo outright rather than locating its end. It compares the
+    host literally, so a numeric form no parser here agrees on is refused
+    rather than guessed at.
+    """
+    if addr.startswith('https://'):
+        scheme = 'https://'
+    elif addr.startswith('http://'):
+        scheme = 'http://'
+    else:
+        raise SekretoError('sekreto: not an http(s) address: ' + safeaddr(addr))
+
+    rest = addr[len(scheme):]
+    end = len(rest)
+    for mark in ('/', '?', '#'):
+        at = rest.find(mark)
+        if -1 != at and at < end:
+            end = at
+    authority = rest[:end]
+
+    # Userinfo is refused outright rather than parsed around, and on https as
+    # well as http. No store this library speaks authenticates by userinfo -
+    # they take a token or a signature - so an address carrying one is a
+    # mistake at best. At worst it is the attack this whole function exists
+    # to stop: `http://localhost:8200@evil.example.com/` is a request to
+    # evil.example.com that reads, to anything that splits the authority on
+    # ':', as loopback.
+    if '@' in authority:
+        raise SekretoError(
+            'sekreto: refusing an address with embedded credentials: ' + safeaddr(addr)
+        )
+
+    # An opening bracket with no closing one is not an address at all.
+    if authority.startswith('[') and ']' not in authority:
+        raise SekretoError('sekreto: not a valid http(s) address: ' + safeaddr(addr))
+
+    if 'https://' == scheme:
+        return
+
+    # A bracketed IPv6 literal keeps its brackets. Splitting the authority on
+    # the first colon yields '[', so `http://[::1]:8200` could never match -
+    # which made the '[::1]' entry below unreachable, and refused a
+    # legitimate local vault.
+    if authority.startswith('['):
+        host = authority[:authority.index(']') + 1]
+    else:
+        host = authority.split(':')[0]
+
+    if host.lower() in ('localhost', '127.0.0.1', '::1', '[::1]'):
+        return
+
+    raise SekretoError(
+        'sekreto: refusing to send a token in plaintext to ' + safeaddr(addr)
+        + ' (use https)'
+    )

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/aws.py

@@ -0,0 +1,192 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/aws.py)
+# Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The aws plugin: Secrets Manager and SSM Parameter Store, with requests
+# SigV4-signed in-tree (sigv4.py, beside this file). Needs HTTPS and
+# HMAC-SHA256 - the one cryptographic dependency in the library, which is
+# why this is a plugin and why the core never imports hashlib or hmac. A
+# port of typescript/plugins/aws.ts.
+import base64
+import json
+import os
+import time
+
+from ..addr import checkaddr
+from ..sekreto import SekretoError, awsparam, vaultref
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson
+from .sigv4 import sigv4
+
+
+def awsnow():
+    """The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now."""
+    return time.strftime('%Y%m%dT%H%M%SZ', time.gmtime())
+
+
+def awsauth(opts):
+    """Region and credentials, from config first and the standard AWS_*
+    environment variables second - those are AWS's own convention, and a
+    pod or CI job that has them set should just work. Missing either is
+    an error: an AWS store with no credentials could not answer."""
+    env = os.environ
+
+    region = opts.get('region') or env.get('AWS_REGION') or env.get('AWS_DEFAULT_REGION') or ''
+    keyid = opts.get('keyid') or env.get('AWS_ACCESS_KEY_ID') or ''
+    secret = opts.get('secret') or env.get('AWS_SECRET_ACCESS_KEY') or ''
+    session = opts.get('session') or env.get('AWS_SESSION_TOKEN') or None
+
+    if '' == region:
+        raise SekretoError('sekreto: aws: no region (set region or AWS_REGION)')
+    if '' == keyid or '' == secret:
+        raise SekretoError(
+            'sekreto: aws: no credentials (set keyid/secret or'
+            + ' AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)'
+        )
+
+    return {'region': region, 'keyid': keyid, 'secret': secret, 'session': session}
+
+
+def awscall(opts, service, target, payload):
+    """One signed call to an AWS JSON-1.1 API."""
+    auth = awsauth(opts)
+    # The China partition lives under its own suffix; every other
+    # commercial region is plain amazonaws.com.
+    suffix = '.amazonaws.com.cn' if auth['region'].startswith('cn-') else '.amazonaws.com'
+    addr = opts.get('addr') or 'https://' + service + '.' + auth['region'] + suffix
+    checkaddr(addr)
+
+    url = addr.rstrip('/') + '/'
+    body = json.dumps(payload, separators=(',', ':'))
+    headers = {
+        'content-type': 'application/x-amz-json-1.1',
+        'x-amz-target': target,
+    }
+
+    signed = sigv4({
+        'method': 'POST',
+        'url': url,
+        'headers': headers,
+        'body': body,
+        'service': service,
+        'region': auth['region'],
+        'keyid': auth['keyid'],
+        'secret': auth['secret'],
+        'session': auth['session'],
+        'datetime': awsnow(),
+    })
+
+    allheaders = dict(headers)
+    allheaders.update(signed)
+
+    return fetchjson('POST', url, allheaders, body)
+
+
+def awsmiss(body, types):
+    """Does this AWS error body name one of the not-found types? Those are
+    a miss; every other failure is a store that could not answer."""
+    errtype = body.get('__type') if isinstance(body, dict) else None
+    if not isinstance(errtype, str):
+        errtype = ''
+    return any(name in errtype for name in types)
+
+
+class AwssecretsProvider(Provider):
+    """AWS Secrets Manager.
+
+    `api.token` reads the secret named `api` (the vaultref path, so
+    `db.pass.main` reads `db/pass`) and takes the `token` field of its
+    JSON SecretString - the AWS idiom of one JSON map per secret. A
+    SecretString that is not JSON is the value itself, under the
+    conventional field `value`. Requests are SigV4-signed in-tree; see
+    sigv4.py.
+    """
+
+    def __init__(self, options=None):
+        self.opts = options or {}
+
+    def lookup(self, name):
+        ref = vaultref(name)
+
+        status, body = awscall(
+            self.opts, 'secretsmanager', 'secretsmanager.GetSecretValue',
+            {'SecretId': ref['path']},
+        )
+
+        if 400 == status and awsmiss(body, ['ResourceNotFoundException']):
+            return None
+
+        if 200 != status:
+            raise SekretoError('sekreto: aws secretsmanager error: ' + str(status))
+
+        text = (body or {}).get('SecretString')
+
+        if not isinstance(text, str):
+            # A binary secret has no fields to address; only the conventional
+            # `value` field can mean "the bytes themselves".
+            binary = (body or {}).get('SecretBinary')
+            if isinstance(binary, str) and 'value' == ref['field']:
+                # validate=True: b64decode silently SKIPS characters
+                # outside the alphabet, so a corrupted payload decoded to
+                # plausible-looking bytes that were then returned as the
+                # secret. A store that answered incoherently is an error,
+                # never a miss.
+                try:
+                    return base64.b64decode(binary, validate=True).decode('utf8')
+                except Exception:
+                    raise SekretoError('sekreto: aws secretsmanager: undecodable secret')
+            return None
+
+        try:
+            parsed = json.loads(text)
+        except ValueError:
+            parsed = None
+
+        if isinstance(parsed, dict):
+            value = parsed.get(ref['field'])
+            return None if value is None else str(value)
+
+        # A plain-string secret is the whole value; it has no named fields.
+        return text if 'value' == ref['field'] else None
+
+    def describe(self):
+        # Config only, never the environment: describe() feeds the spec's
+        # sources group, which must answer the same everywhere.
+        return 'awssecrets:' + (self.opts.get('region') or '')
+
+
+class AwsparamsProvider(Provider):
+    """AWS SSM Parameter Store.
+
+    `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+    prefix path), decrypted. Parameter Store carries flat strings, so
+    there is no field indirection.
+    """
+
+    def __init__(self, options=None):
+        self.opts = options or {}
+
+    def lookup(self, name):
+        status, body = awscall(self.opts, 'ssm', 'AmazonSSM.GetParameter', {
+            'Name': awsparam(name, self.opts.get('prefix')),
+            'WithDecryption': True,
+        })
+
+        if 400 == status and awsmiss(body, ['ParameterNotFound']):
+            return None
+
+        if 200 != status:
+            raise SekretoError('sekreto: aws ssm error: ' + str(status))
+
+        value = ((body or {}).get('Parameter') or {}).get('Value')
+        return None if value is None else str(value)
+
+    def describe(self):
+        return 'awsparams:' + (self.opts.get('region') or '') + (self.opts.get('prefix') or '')
+
+
+# The two plugins: the `awssecrets` and `awsparams` provider kinds, as
+# voxgig/plugin definitions.
+awssecrets = providerplugin('awssecrets', AwssecretsProvider)
+awsparams = providerplugin('awsparams', AwsparamsProvider)
+
+__all__ = ['AwssecretsProvider', 'AwsparamsProvider', 'awssecrets', 'awsparams', 'sigv4']

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/azuresecrets.py

@@ -0,0 +1,120 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/azuresecrets.py)
+# Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The azuresecrets plugin: Azure Key Vault. Needs HTTPS. A port of
+# typescript/plugins/azuresecrets.ts.
+import time
+
+from ..addr import checkaddr
+from ..sekreto import SekretoError, flatname
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson, tonumber, urlpart
+
+
+class AzuresecretsProvider(Provider):
+    """Azure Key Vault.
+
+    `api.token` reads secret `api-token` (dots flattened to `-`; Key
+    Vault names allow nothing else), current version. The token comes
+    from config, then a client-credentials login when tenant/clientid/
+    clientsecret are given, then the IMDS managed-identity endpoint - so
+    on Azure's own platform no credential configuration is needed.
+
+    As with GCP, the IMDS call is plain http to a link-local host by
+    platform design and carries no credential; the login and vault
+    addresses are `checkaddr`-guarded.
+    """
+
+    RESOURCE = 'https://vault.azure.net'
+
+    def __init__(self, options=None):
+        self.opts = options or {}
+
+        # A configured token is kept forever; logged-in and IMDS tokens carry
+        # expires_in and are renewed shortly before they run out.
+        self.livetoken = None
+        self.renewat = float('inf')
+
+    def expiry(self, expires):
+        seconds = tonumber(expires)
+        return time.time() + max(seconds - 60, 1) if 0 < seconds else float('inf')
+
+    def login(self):
+        opts = self.opts
+
+        if opts.get('token'):
+            return opts['token']
+
+        if opts.get('tenant') and opts.get('clientid') and opts.get('clientsecret'):
+            loginaddr = opts.get('loginaddr') or 'https://login.microsoftonline.com'
+            checkaddr(loginaddr)
+
+            url = loginaddr.rstrip('/') + '/' + opts['tenant'] + '/oauth2/v2.0/token'
+            form = ('grant_type=client_credentials&client_id=' + urlpart(opts['clientid'])
+                    + '&client_secret=' + urlpart(opts['clientsecret'])
+                    + '&scope=' + urlpart(self.RESOURCE + '/.default'))
+
+            status, body = fetchjson(
+                'POST', url, {'content-type': 'application/x-www-form-urlencoded'}, form
+            )
+
+            got = (body or {}).get('access_token')
+            if 200 != status or not got:
+                raise SekretoError('sekreto: azure login failed: ' + str(status))
+
+            self.renewat = self.expiry((body or {}).get('expires_in'))
+            return str(got)
+
+        imds = ((opts.get('imdsaddr') or 'http://169.254.169.254').rstrip('/')
+                + '/metadata/identity/oauth2/token?api-version=2018-02-01&resource='
+                + urlpart(self.RESOURCE))
+
+        status, body = fetchjson('GET', imds, {'Metadata': 'true'})
+
+        got = (body or {}).get('access_token')
+        if 200 != status or not got:
+            raise SekretoError(
+                'sekreto: azure: no token, no client credentials, and IMDS did not answer'
+            )
+
+        self.renewat = self.expiry((body or {}).get('expires_in'))
+        return str(got)
+
+    def lookup(self, name):
+        vault = self.opts.get('vault') or ''
+        if '' == vault:
+            raise SekretoError('sekreto: azure: no vault')
+
+        # Only an explicit scheme is a URL; a vault NAMED httpvault must
+        # still become https://httpvault.vault.azure.net.
+        if vault.startswith('http://') or vault.startswith('https://'):
+            vaulturl = vault
+        else:
+            vaulturl = 'https://' + vault + '.vault.azure.net'
+        checkaddr(vaulturl)
+
+        if self.livetoken is None or time.time() >= self.renewat:
+            self.livetoken = self.login()
+
+        url = (vaulturl.rstrip('/') + '/secrets/' + flatname(name, '-')
+               + '?api-version=' + (self.opts.get('apiversion') or '7.4'))
+
+        status, body = fetchjson('GET', url, {'authorization': 'Bearer ' + self.livetoken})
+
+        if 404 == status:
+            return None
+
+        if 200 != status:
+            raise SekretoError(
+                'sekreto: azure error: ' + str(status) + ': ' + url.split('?')[0]
+            )
+
+        value = (body or {}).get('value')
+        return None if value is None else str(value)
+
+    def describe(self):
+        return 'azuresecrets:' + (self.opts.get('vault') or '')
+
+
+# The plugin: the `azuresecrets` provider kind, as a voxgig/plugin definition.
+azuresecrets = providerplugin('azuresecrets', AzuresecretsProvider)

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/boru.py

@@ -0,0 +1,140 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/boru.py)
+# Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The boru plugin: a boru vault through its CLI, or over `boru vault
+# serve`. Needs a child process, or HTTPS in wire mode. A port of
+# typescript/plugins/boru.ts.
+import os
+import subprocess
+
+from ..addr import checkaddr
+from ..sekreto import SekretoError, checkname
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson
+
+
+class BoruProvider(Provider):
+    """A boru vault (https://github.com/boru-lang/boru).
+
+    Two ways in, both boru's own.
+
+    With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+    secret on stdout and nothing else. The passphrase is read by boru
+    itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
+    config and never puts it on a command line, where it would show up in
+    the process table.
+
+    With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+    read-only, HashiCorp-shaped provision API (boru's
+    design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+    from `boru vault grant`. A sekreto name is already a valid boru
+    alias, and boru aliases keep their dots, so `api.token` is the single
+    path segment `api.token` - not the `api`/`token` split a HashiCorp KV
+    gets. The value is the `value` field. A 404 is a miss; anything else
+    the server refuses (a revoked capability, a sealed vault) is an
+    error.
+
+    boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+    credential *broker*, built precisely so the caller never receives the
+    credential. `vault serve` is the provision endpoint, built to hand
+    the value back - that is the one sekreto uses.
+    """
+
+    def __init__(self, command=None, namespace=None, home=None,
+                 addr=None, token=None, mount=None):
+        self.command = command or 'boru'
+        self.namespace = namespace
+        self.home = home
+        self.addr = addr.rstrip('/') if addr else None
+        self.token = token
+        self.mount = mount or 'secret'
+
+    def lookup(self, name):
+        checkname(name)
+
+        if self.addr:
+            return self.wirelookup(name)
+
+        alias = self.namespace + ':' + name if self.namespace else name
+
+        env = dict(os.environ)
+        if self.home:
+            env['BORU_HOME'] = self.home
+
+        try:
+            run = subprocess.run(
+                [self.command, 'vault', 'get', '--reveal', alias],
+                capture_output=True,
+                text=True,
+                env=env,
+                # Not inherited: a CLI that reads stdin - one prompting for a
+                # passphrase when its environment variable is absent - would
+                # otherwise block on the parent's own stdin forever, and
+                # nothing here sets a timeout. `capture_output` covers only
+                # the other two streams.
+                stdin=subprocess.DEVNULL,
+            )
+        except OSError as err:
+            raise SekretoError('sekreto: cannot run ' + self.command + ': ' + str(err))
+
+        if 0 == run.returncode:
+            # boru prints the value and one newline, and nothing else.
+            return run.stdout[:-1] if run.stdout.endswith('\n') else run.stdout
+
+        why = (run.stderr or '').strip()
+
+        # "no alias named" is boru saying it does not hold this secret, which
+        # is a miss: the chain carries on to the next provider. A locked vault
+        # or a wrong passphrase is not a miss - treating it as one would fall
+        # through to a weaker store without saying so.
+        if borumiss(why):
+            return None
+
+        raise SekretoError(
+            'sekreto: boru vault error: ' + (why or 'exit ' + str(run.returncode))
+        )
+
+    def wirelookup(self, name):
+        checkaddr(self.addr)
+
+        alias = self.namespace + '/' + name if self.namespace else name
+        url = self.addr + '/v1/' + self.mount + '/data/' + alias
+
+        status, body = fetchjson('GET', url, {'X-Vault-Token': self.token or ''})
+
+        if 404 == status:
+            return None
+
+        if 200 != status:
+            raise SekretoError('sekreto: boru serve error: ' + str(status) + ': ' + url)
+
+        data = ((body or {}).get('data') or {}).get('data')
+        value = data.get('value') if isinstance(data, dict) else None
+
+        return None if value is None else str(value)
+
+    def describe(self):
+        if self.addr:
+            return 'boru:' + self.addr
+        return 'boru' + (':' + self.namespace if self.namespace else '')
+
+
+def borumiss(why):
+    """Does this boru failure mean "no such secret" rather than "I could not
+    answer"? Matched on boru's own wording for a missing alias."""
+    return 'no alias named' in why
+
+
+def _make(spec):
+    return BoruProvider(
+        spec.get('command'),
+        spec.get('namespace'),
+        spec.get('home'),
+        spec.get('addr'),
+        spec.get('token'),
+        spec.get('mount'),
+    )
+
+
+# The plugin: the `boru` provider kind, as a voxgig/plugin definition.
+boru = providerplugin('boru', _make)