@voxgig/sdkgen 4.8.2 → 4.8.3

package/project/.sdk/tm/go/feature/secrets/plugins/boru/boru.go

@@ -0,0 +1,184 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/boru/boru.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The boru plugin: a boru vault through its CLI, or over `boru vault
+// serve`. Needs a child process, or HTTPS in wire mode. A port of
+// typescript/plugins/boru.ts.
+package boru
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Provider reads a boru vault (https://github.com/boru-lang/boru).
+//
+// Two ways in, both boru's own.
+//
+// With no Addr, the CLI: `boru vault get --reveal <alias>` prints the
+// secret on stdout, and nothing else. The passphrase is read by boru itself
+// from BORU_VAULT_PASSPHRASE; sekreto never accepts it as config and never
+// puts it on a command line, where it would show up in the process table.
+//
+// With an Addr, boru's wire protocol: `boru vault serve` publishes a
+// read-only, HashiCorp-shaped provision API (boru's
+// design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+// from `boru vault grant`. A sekreto name is already a valid boru alias,
+// and boru aliases keep their dots, so api.token is the single path segment
+// api.token - not the api/token split a HashiCorp KV gets. The value is the
+// `value` field. A 404 is a miss; anything else the server refuses (a
+// revoked capability, a sealed vault) is an error.
+//
+// boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+// credential *broker*, built precisely so the caller never receives the
+// credential. `vault serve` is the provision endpoint, built to hand the
+// value back - that is the one sekreto uses.
+type Provider struct {
+	Command   string
+	Namespace string
+	Home      string
+	Addr      string
+	Token     string
+	Mount     string
+}
+
+func (provider *Provider) command() string {
+	if "" == provider.Command {
+		return "boru"
+	}
+	return provider.Command
+}
+
+func (provider *Provider) wireaddr() string {
+	return strings.TrimSuffix(provider.Addr, "/")
+}
+
+func (provider *Provider) wiremount() string {
+	if "" == provider.Mount {
+		return "secret"
+	}
+	return provider.Mount
+}
+
+func (provider *Provider) wirelookup(name string) (string, bool, error) {
+	addr := provider.wireaddr()
+	if err := sekreto.CheckAddr(addr); nil != err {
+		return "", false, err
+	}
+
+	// The dotted name stays one segment: boru aliases keep their dots.
+	alias := name
+	if "" != provider.Namespace {
+		alias = provider.Namespace + "/" + name
+	}
+	target := addr + "/v1/" + provider.wiremount() + "/data/" + alias
+
+	status, body, err := httpjson.Get(target, map[string]string{"X-Vault-Token": provider.Token})
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusNotFound == status {
+		return "", false, nil
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: boru serve error: " + strconv.Itoa(status) + ": " + target)
+	}
+
+	value := httpjson.Dig(body, "data", "data", "value")
+	if nil == value {
+		return "", false, nil
+	}
+
+	return httpjson.ToString(value), true, nil
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	if err := sekreto.CheckName(name); nil != err {
+		return "", false, err
+	}
+
+	if "" != provider.Addr {
+		return provider.wirelookup(name)
+	}
+
+	alias := name
+	if "" != provider.Namespace {
+		alias = provider.Namespace + ":" + name
+	}
+
+	run := exec.Command(provider.command(), "vault", "get", "--reveal", alias)
+
+	if "" != provider.Home {
+		run.Env = append(os.Environ(), "BORU_HOME="+provider.Home)
+	}
+
+	var out, errout bytes.Buffer
+	run.Stdout = &out
+	run.Stderr = &errout
+
+	err := run.Run()
+
+	if nil == err {
+		// boru prints the value and one newline, and nothing else.
+		return strings.TrimSuffix(out.String(), "\n"), true, nil
+	}
+
+	var exiterr *exec.ExitError
+	if !errors.As(err, &exiterr) {
+		return "", false, sekreto.Fail("sekreto: cannot run " + provider.command() + ": " + err.Error())
+	}
+
+	why := strings.TrimSpace(errout.String())
+
+	// "no alias named" is boru saying it does not hold this secret, which is a
+	// miss: the chain carries on to the next provider. A locked vault or a
+	// wrong passphrase is not a miss - treating it as one would fall through
+	// to a weaker store without saying so.
+	if borumiss(why) {
+		return "", false, nil
+	}
+
+	if "" == why {
+		why = "exit " + strconv.Itoa(exiterr.ExitCode())
+	}
+
+	return "", false, sekreto.Fail("sekreto: boru vault error: " + why)
+}
+
+func (provider *Provider) Describe() string {
+	if "" != provider.Addr {
+		return "boru:" + provider.wireaddr()
+	}
+	if "" != provider.Namespace {
+		return "boru:" + provider.Namespace
+	}
+	return "boru"
+}
+
+// borumiss reports whether a boru failure means "no such secret" rather than
+// "I could not answer". Matched on boru's own wording for a missing alias.
+func borumiss(why string) bool {
+	return strings.Contains(why, "no alias named")
+}
+
+// Plugin is the `boru` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("boru", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &Provider{
+		Command:   spec.Command,
+		Namespace: spec.Namespace,
+		Home:      spec.Home,
+		Addr:      spec.Addr,
+		Token:     spec.Token,
+		Mount:     spec.Mount,
+	}, nil
+})

package/project/.sdk/tm/go/feature/secrets/plugins/doppler/doppler.go

@@ -0,0 +1,114 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/doppler/doppler.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The doppler plugin: Doppler, one bulk download per config. Needs
+// HTTPS. A port of typescript/plugins/doppler.ts.
+package doppler
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Provider reads Doppler.
+//
+// The whole config is downloaded once - Doppler's own bulk endpoint - and
+// answered from memory, like a remote .env: api.token is the API_TOKEN
+// entry. A service token is config-scoped, so project and config are only
+// needed with broader tokens.
+type Provider struct {
+	Token   string
+	Project string
+	Config  string
+	Addr    string
+	// Guards the memoised state below: a Sekreto may resolve from several
+	// goroutines, and a racy map read is either a crash or a zero value - a
+	// MISS where the store does hold the secret, which falls through to a
+	// weaker store.
+	mu     sync.Mutex
+	values map[string]string
+}
+
+func (provider *Provider) load() (map[string]string, error) {
+	provider.mu.Lock()
+	defer provider.mu.Unlock()
+
+	if nil != provider.values {
+		return provider.values, nil
+	}
+
+	addr := provider.Addr
+	if "" == addr {
+		addr = "https://api.doppler.com"
+	}
+	addr = strings.TrimSuffix(addr, "/")
+	if err := sekreto.CheckAddr(addr); nil != err {
+		return nil, err
+	}
+
+	target := addr + "/v3/configs/config/secrets/download?format=json"
+	if "" != provider.Project {
+		target += "&project=" + httpjson.Escape(provider.Project)
+	}
+	if "" != provider.Config {
+		target += "&config=" + httpjson.Escape(provider.Config)
+	}
+
+	status, body, err := httpjson.Get(target,
+		map[string]string{"authorization": "Bearer " + provider.Token})
+	if nil != err {
+		return nil, err
+	}
+
+	object, is := body.(map[string]any)
+	if http.StatusOK != status || !is {
+		return nil, sekreto.Fail("sekreto: doppler error: " + strconv.Itoa(status))
+	}
+
+	values := map[string]string{}
+	for key, value := range object {
+		if nil != value {
+			values[key] = httpjson.ToString(value)
+		}
+	}
+	provider.values = values
+
+	return values, nil
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	key, err := sekreto.EnvKey(name, "")
+	if nil != err {
+		return "", false, err
+	}
+
+	values, err := provider.load()
+	if nil != err {
+		return "", false, err
+	}
+
+	value, has := values[key]
+	return value, has, nil
+}
+
+func (provider *Provider) Describe() string {
+	if "" != provider.Project {
+		return "doppler:" + provider.Project + "/" + provider.Config
+	}
+	return "doppler"
+}
+
+// Plugin is the `doppler` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("doppler", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &Provider{
+		Token:   spec.Token,
+		Project: spec.Project,
+		Config:  spec.Config,
+		Addr:    spec.Addr,
+	}, nil
+})

package/project/.sdk/tm/go/feature/secrets/plugins/gcpsecrets/gcpsecrets.go

@@ -0,0 +1,156 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/gcpsecrets/gcpsecrets.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The gcpsecrets plugin: GCP Secret Manager. Needs HTTPS. A port of
+// typescript/plugins/gcpsecrets.ts.
+package gcpsecrets
+
+import (
+	"encoding/base64"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Provider reads GCP Secret Manager.
+//
+// api.token reads secret api_token (dots flattened to `_`; Secret Manager
+// ids have no hierarchy and reject dots), latest version. The token comes
+// from config, then GOOGLE_OAUTH_ACCESS_TOKEN, then the GCE/GKE metadata
+// server - so on Google's own platform no credential configuration is
+// needed at all.
+//
+// The metadata call itself is plain http to a link-local host by platform
+// design; no credential rides on it, so checkaddr guards the Secret
+// Manager address instead.
+type Provider struct {
+	Project      string
+	Token        string
+	Addr         string
+	MetadataAddr string
+	// A configured token is kept forever; a metadata-server token carries
+	// expires_in and is renewed shortly before it runs out.
+	livetoken string
+	havetoken bool
+	renewat   time.Time
+	mu        sync.Mutex
+}
+
+func (provider *Provider) metadataaddr() string {
+	if "" != provider.MetadataAddr {
+		return provider.MetadataAddr
+	}
+	if host := os.Getenv("GCE_METADATA_HOST"); "" != host {
+		return "http://" + host
+	}
+	return "http://metadata.google.internal"
+}
+
+func (provider *Provider) login() (string, error) {
+	configured := provider.Token
+	if "" == configured {
+		configured = os.Getenv("GOOGLE_OAUTH_ACCESS_TOKEN")
+	}
+	if "" != configured {
+		return configured, nil
+	}
+
+	target := strings.TrimSuffix(provider.metadataaddr(), "/") +
+		"/computeMetadata/v1/instance/service-accounts/default/token"
+
+	status, body, err := httpjson.Get(target, map[string]string{"Metadata-Flavor": "Google"})
+	if nil != err {
+		return "", err
+	}
+
+	got := httpjson.DigText(body, "access_token")
+	if http.StatusOK != status || "" == got {
+		return "", sekreto.Fail("sekreto: gcp: no token and metadata server did not answer")
+	}
+
+	provider.renewat = httpjson.Expiry(httpjson.Dig(body, "expires_in"))
+
+	return got, nil
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	// Serialize per-provider access: Lookup reads and refreshes the cached
+	// login token, and a secrets client may resolve from several goroutines.
+	provider.mu.Lock()
+	defer provider.mu.Unlock()
+
+	if "" == provider.Project {
+		return "", false, sekreto.Fail("sekreto: gcp: no project")
+	}
+
+	addr := provider.Addr
+	if "" == addr {
+		addr = "https://secretmanager.googleapis.com"
+	}
+	if err := sekreto.CheckAddr(addr); nil != err {
+		return "", false, err
+	}
+
+	if !provider.havetoken || httpjson.Due(provider.renewat) {
+		token, err := provider.login()
+		if nil != err {
+			return "", false, err
+		}
+		provider.livetoken = token
+		provider.havetoken = true
+	}
+
+	flat, err := sekreto.FlatName(name, "_")
+	if nil != err {
+		return "", false, err
+	}
+
+	target := strings.TrimSuffix(addr, "/") + "/v1/projects/" + provider.Project +
+		"/secrets/" + flat + "/versions/latest:access"
+
+	status, body, err := httpjson.Get(target,
+		map[string]string{"authorization": "Bearer " + provider.livetoken})
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusNotFound == status {
+		return "", false, nil
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: gcp error: " + strconv.Itoa(status) + ": " + target)
+	}
+
+	data, is := httpjson.Dig(body, "payload", "data").(string)
+	if !is {
+		return "", false, nil
+	}
+
+	// See the aws provider: an undecodable payload is an error, not a miss.
+	decoded, err := base64.StdEncoding.DecodeString(data)
+	if nil != err {
+		return "", false, sekreto.Fail("sekreto: gcp: undecodable secret")
+	}
+	return string(decoded), true, nil
+}
+
+func (provider *Provider) Describe() string {
+	return "gcpsecrets:" + provider.Project
+}
+
+// Plugin is the `gcpsecrets` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("gcpsecrets", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &Provider{
+		Project:      spec.Project,
+		Token:        spec.Token,
+		Addr:         spec.Addr,
+		MetadataAddr: spec.MetadataAddr,
+	}, nil
+})

package/project/.sdk/tm/go/feature/secrets/plugins/hashicorp/hashicorp.go

@@ -0,0 +1,209 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/hashicorp/hashicorp.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The hashicorp plugin: HashiCorp Vault, and OpenBao. Needs HTTPS, and
+// the filesystem for a kubernetes service-account JWT. A port of
+// typescript/plugins/hashicorp.ts.
+package hashicorp
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Provider reads HashiCorp Vault.
+//
+// KV v2 (the default): api.token reads {addr}/v1/{mount}/data/api and takes
+// the `token` field of data.data. KV v1 (KV: 1) reads {addr}/v1/{mount}/api
+// and takes the field of data. A 404 means "not here", which is a miss
+// rather than an error, so a vault can sit in a chain with fallbacks.
+//
+// A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+// logins as well as reads.
+//
+// Instead of being handed a token, the provider can log in: Kubernetes
+// auth (the pod's service-account JWT, from its conventional path) or
+// AppRole. A failed login is an error, never a miss - it means this store
+// could not answer at all.
+type Provider struct {
+	Addr           string
+	Token          string
+	Mount          string
+	KV             int
+	VaultNamespace string
+	Auth           *sekreto.AuthSpec
+	// The working token: a configured token is kept forever, a logged-in
+	// token is renewed shortly before its lease runs out - a long-running
+	// process must not keep presenting a token the vault already expired.
+	livetoken string
+	havetoken bool
+	renewat   time.Time
+	mu        sync.Mutex
+}
+
+func (provider *Provider) mount() string {
+	if "" == provider.Mount {
+		return "secret"
+	}
+	return provider.Mount
+}
+
+func (provider *Provider) baseheaders() map[string]string {
+	headers := map[string]string{}
+	if "" != provider.VaultNamespace {
+		headers["X-Vault-Namespace"] = provider.VaultNamespace
+	}
+	return headers
+}
+
+func (provider *Provider) login() (string, error) {
+	auth := provider.Auth
+	if nil == auth {
+		return "", sekreto.Fail("sekreto: hashicorp: no token and no auth method")
+	}
+
+	mount := auth.Mount
+	if "" == mount {
+		mount = auth.Method
+	}
+	target := strings.TrimSuffix(provider.Addr, "/") + "/v1/auth/" + mount + "/login"
+
+	var payload []byte
+	switch auth.Method {
+	case "kubernetes":
+		jwt := auth.Jwt
+		if "" == jwt {
+			file := auth.JwtFile
+			if "" == file {
+				file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+			}
+			raw, err := os.ReadFile(file)
+			if nil != err {
+				return "", sekreto.Fail("sekreto: hashicorp: cannot read jwt file " + file)
+			}
+			jwt = strings.TrimSpace(string(raw))
+		}
+		payload, _ = json.Marshal(struct {
+			Role string `json:"role"`
+			Jwt  string `json:"jwt"`
+		}{Role: auth.Role, Jwt: jwt})
+	case "approle":
+		payload, _ = json.Marshal(struct {
+			RoleID   string `json:"role_id"`
+			SecretID string `json:"secret_id"`
+		}{RoleID: auth.RoleID, SecretID: auth.SecretID})
+	default:
+		return "", sekreto.Fail("sekreto: hashicorp: unknown auth method: " + auth.Method)
+	}
+
+	status, body, err := httpjson.Call(http.MethodPost, target, provider.baseheaders(), string(payload))
+	if nil != err {
+		return "", err
+	}
+
+	got := httpjson.DigText(body, "auth", "client_token")
+	if http.StatusOK != status || "" == got {
+		return "", sekreto.Fail("sekreto: hashicorp login failed: " + strconv.Itoa(status) + ": " + target)
+	}
+
+	provider.renewat = httpjson.Expiry(httpjson.Dig(body, "auth", "lease_duration"))
+
+	return got, nil
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	// Serialize per-provider access: Lookup reads and refreshes the cached
+	// login token, and a secrets client may resolve from several goroutines.
+	provider.mu.Lock()
+	defer provider.mu.Unlock()
+
+	if err := sekreto.CheckAddr(provider.Addr); nil != err {
+		return "", false, err
+	}
+
+	if !provider.havetoken || httpjson.Due(provider.renewat) {
+		if "" != provider.Token {
+			provider.livetoken = provider.Token
+		} else {
+			token, err := provider.login()
+			if nil != err {
+				return "", false, err
+			}
+			provider.livetoken = token
+		}
+		provider.havetoken = true
+	}
+
+	ref, err := sekreto.NameVaultRef(name)
+	if nil != err {
+		return "", false, err
+	}
+
+	base := strings.TrimSuffix(provider.Addr, "/") + "/v1/" + provider.mount()
+	target := base + "/data/" + ref.Path
+	if 1 == provider.KV {
+		target = base + "/" + ref.Path
+	}
+
+	headers := provider.baseheaders()
+	headers["X-Vault-Token"] = provider.livetoken
+
+	status, body, err := httpjson.Get(target, headers)
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusNotFound == status {
+		return "", false, nil
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: hashicorp error: " + strconv.Itoa(status) + ": " + target)
+	}
+
+	var value any
+	if 1 == provider.KV {
+		value = httpjson.Dig(body, "data", ref.Field)
+	} else {
+		value = httpjson.Dig(body, "data", "data", ref.Field)
+	}
+
+	if nil == value {
+		return "", false, nil
+	}
+
+	return httpjson.ToString(value), true, nil
+}
+
+func (provider *Provider) Describe() string {
+	return "hashicorp:" + provider.Addr + "/" + provider.mount()
+}
+
+// Plugin is the `hashicorp` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("hashicorp", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	kv := spec.KV
+	if 0 == kv {
+		kv = 2
+	}
+	// A version typo like kv: 3 must not quietly behave as v2 and turn
+	// its 404s into misses; there is nothing safe to assume it meant.
+	if 1 != kv && 2 != kv {
+		return nil, sekreto.Fail("sekreto: hashicorp: unsupported kv version: " + strconv.Itoa(kv))
+	}
+	return &Provider{
+		Addr:           spec.Addr,
+		Token:          spec.Token,
+		Mount:          spec.Mount,
+		KV:             spec.KV,
+		VaultNamespace: spec.VaultNamespace,
+		Auth:           spec.Auth,
+	}, nil
+})