@voxgig/sdkgen 4.8.2 → 4.9.0

package/project/.sdk/tm/rust/tests/struct_runner/mod.rs

@@ -1,424 +0,0 @@
-// Struct corpus runner — drives the shared JSON test spec
-// (../.sdk/test/test.json, `struct` subtree) against the vendored voxgig
-// struct port. Vendored/adapted from the struct rust port's corpus runner
-// (mirrors tm/go/test/struct_runner_test.go).
-#![allow(dead_code)]
-
-use std::fs;
-use std::path::PathBuf;
-
-use RUSTCRATE::utility::voxgigstruct::ordered_map::OrderedMap;
-
-use RUSTCRATE::utility::voxgigstruct::value::Value;
-use RUSTCRATE::utility::voxgigstruct::*;
-
-pub const NULLMARK: &str = "__NULL__";
-pub const UNDEFMARK: &str = "__UNDEF__";
-pub const EXISTSMARK: &str = "__EXISTS__";
-
-// ---- JSON -> Value -----------------------------------------------------
-// The shared SDK test spec, parsed with the crate's own JSON parser (no
-// external dependency).
-
-pub fn test_json() -> Value {
-    let mut p = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    p.push("..");
-    p.push(".sdk");
-    p.push("test");
-    p.push("test.json");
-    let txt = fs::read_to_string(&p).unwrap_or_else(|e| panic!("read {:?}: {e}", p));
-    RUSTCRATE::utility::jsonparse::json_parse(&txt).expect("parse test.json")
-}
-
-// ---- value helpers -----------------------------------------------------
-
-// Raw field extraction from corpus entries: preserves a stored JSON null so a
-// field declared `null` (e.g. `in: null`, `{val:null}`) reaches the subject as
-// Value::Null and is not silently dropped (Group A null-unification only
-// applies to the public get_prop API under test, not to test-harness plumbing).
-// Mirrors the canonical TS runner reading entry fields by direct property access.
-pub fn vget(v: &Value, key: &str) -> Value {
-    lookup(v, &Value::str(key))
-}
-
-pub fn vget_path(v: &Value, keys: &[&str]) -> Value {
-    let mut cur = v.clone();
-    for k in keys {
-        cur = vget(&cur, k);
-    }
-    cur
-}
-
-pub fn as_i64_opt(v: &Value) -> Option<i64> {
-    match v {
-        Value::Num(n) => Some(*n as i64),
-        _ => None,
-    }
-}
-
-pub fn as_str_opt(v: &Value) -> Option<String> {
-    match v {
-        Value::Str(s) => Some(s.clone()),
-        _ => None,
-    }
-}
-
-// fixJSON: deep-replace JSON null (and undefined) with NULLMARK (when
-// null_flag). Matches `JSON.parse(JSON.stringify(val, replacer))` with the
-// null->NULLMARK replacer used by ts/test/runner.ts.
-pub fn fix_json(v: &Value, null_flag: bool) -> Value {
-    match v {
-        Value::Null | Value::Noval => {
-            if null_flag {
-                Value::str(NULLMARK)
-            } else {
-                v.clone()
-            }
-        }
-        Value::List(l) => Value::list(l.borrow().iter().map(|x| fix_json(x, null_flag)).collect()),
-        Value::Map(m) => {
-            let mut nm = OrderedMap::new();
-            for (k, x) in m.borrow().iter() {
-                nm.insert(k.clone(), fix_json(x, null_flag));
-            }
-            Value::map(nm)
-        }
-        Value::Func(_) => {
-            // JSON.stringify drops functions (object key) / -> null (array elem).
-            // At the comparison boundary, treat as null-ish.
-            if null_flag {
-                Value::str(NULLMARK)
-            } else {
-                Value::Null
-            }
-        }
-        other => other.clone(),
-    }
-}
-
-// match check for the `match` field of a test entry (substring / regex / etc).
-pub fn matchval(check: &Value, base: &Value) -> bool {
-    if check == base {
-        return true;
-    }
-    if let Value::Str(cs) = check {
-        let bstr = stringify(base, None, false);
-        if let Some(rem) = cs.strip_prefix('/').and_then(|s| s.strip_suffix('/')) {
-            if let Ok(re) = RUSTCRATE::utility::voxgigstruct::re::Regex::new(rem) {
-                return re.is_match(&bstr);
-            }
-        }
-        return bstr
-            .to_lowercase()
-            .contains(&stringify(check, None, false).to_lowercase());
-    }
-    false
-}
-
-// ---- the test loop -----------------------------------------------------
-
-pub struct Run {
-    pub failures: Vec<String>,
-    pub passed: usize,
-}
-
-impl Run {
-    pub fn new() -> Self {
-        Run {
-            failures: Vec::new(),
-            passed: 0,
-        }
-    }
-
-    /// Run a test set: `label` for messages, `null_flag` matches the TS
-    /// `flags.null` (`runset` => true, `runsetflags({null:false})` => false),
-    /// `subject` takes the (cloned) `vin` and returns the result Value.
-    pub fn run_set<F>(&mut self, set: &Value, null_flag: bool, label: &str, mut subject: F)
-    where
-        F: FnMut(Value) -> Value,
-    {
-        if set.is_noval() {
-            // Section absent from this SDK's test.json subset.
-            return;
-        }
-        let fixed = fix_json(set, null_flag);
-        let testset = vget(&fixed, "set");
-        let entries = match testset.as_list() {
-            Some(l) => l.borrow().clone(),
-            None => {
-                self.failures.push(format!("{label}: no `set` array"));
-                return;
-            }
-        };
-        for (i, entry) in entries.iter().enumerate() {
-            // resolveEntry: missing `out` + null_flag => NULLMARK
-            let out0 = vget(entry, "out");
-            let expected = if out0.is_noval() && null_flag {
-                Value::str(NULLMARK)
-            } else {
-                out0
-            };
-            let err_expected = vget(entry, "err");
-            let match_spec = vget(entry, "match");
-
-            // `vin` = clone(entry.in) (deep). The subject gets a shallow
-            // Rc-clone of it, so any in-place mutation it makes (setpath,
-            // setprop, …) is visible through `vin` afterwards.
-            let vin = clone(&vget(entry, "in"));
-            let res = fix_json(&subject(vin.clone()), null_flag);
-
-            if !err_expected.is_noval() {
-                self.failures.push(format!(
-                    "{label}#{i}: expected error [{}] but got {}",
-                    stringify(&err_expected, Some(80), false),
-                    stringify(&res, Some(80), false),
-                ));
-                continue;
-            }
-
-            let mut matched = false;
-            if !match_spec.is_noval() {
-                // base = { in: entry.in (original), args: [vin (post-call)], out: res }
-                let mut base = OrderedMap::new();
-                base.insert("in".to_string(), vget(entry, "in"));
-                base.insert("args".to_string(), Value::list(vec![vin.clone()]));
-                base.insert("out".to_string(), res.clone());
-                let base = Value::map(base);
-                if let Some(why) = match_check(&match_spec, &base) {
-                    self.failures.push(format!(
-                        "{label}#{i}: match failed ({why}); got {}",
-                        stringify(&res, Some(160), false)
-                    ));
-                    continue;
-                }
-                matched = true;
-            }
-
-            if res == expected {
-                self.passed += 1;
-                continue;
-            }
-            if matched
-                && (expected == Value::str(NULLMARK) || expected.is_noval() || expected.is_null())
-            {
-                self.passed += 1;
-                continue;
-            }
-
-            self.failures.push(format!(
-                "{label}#{i}: in={} -> got {}, want {}",
-                stringify(&vget(entry, "in"), Some(120), false),
-                stringify(&res, Some(120), false),
-                stringify(&expected, Some(120), false),
-            ));
-        }
-    }
-}
-
-impl Run {
-    /// Like `run_set`, but the subject may return `Err(message)` — matched
-    /// (substring / regex, case-insensitive) against the entry's `err` field.
-    pub fn run_set_fallible<F>(&mut self, set: &Value, null_flag: bool, label: &str, mut subject: F)
-    where
-        F: FnMut(Value) -> Result<Value, String>,
-    {
-        if set.is_noval() {
-            // Section absent from this SDK's test.json subset.
-            return;
-        }
-        let fixed = fix_json(set, null_flag);
-        let testset = vget(&fixed, "set");
-        let entries = match testset.as_list() {
-            Some(l) => l.borrow().clone(),
-            None => {
-                self.failures.push(format!("{label}: no `set` array"));
-                return;
-            }
-        };
-        for (i, entry) in entries.iter().enumerate() {
-            let out0 = vget(entry, "out");
-            let expected = if out0.is_noval() && null_flag {
-                Value::str(NULLMARK)
-            } else {
-                out0
-            };
-            let err_expected = vget(entry, "err");
-            let match_spec = vget(entry, "match");
-            let vin = clone(&vget(entry, "in"));
-            let result = subject(vin.clone());
-
-            match result {
-                Err(msg) => {
-                    if err_expected.is_noval() {
-                        self.failures
-                            .push(format!("{label}#{i}: unexpected error: {msg}"));
-                        continue;
-                    }
-                    let want = match &err_expected {
-                        Value::Bool(true) => {
-                            self.passed += 1;
-                            continue;
-                        }
-                        Value::Str(s) => s.clone(),
-                        other => stringify(other, None, false),
-                    };
-                    let ok = if let Some(rem) =
-                        want.strip_prefix('/').and_then(|s| s.strip_suffix('/'))
-                    {
-                        RUSTCRATE::utility::voxgigstruct::re::Regex::new(rem)
-                            .map(|re| re.is_match(&msg))
-                            .unwrap_or(false)
-                    } else {
-                        msg.to_lowercase().contains(&want.to_lowercase())
-                    };
-                    if ok {
-                        self.passed += 1;
-                    } else {
-                        self.failures.push(format!(
-                            "{label}#{i}: error mismatch: got [{}] want [{}]",
-                            msg, want
-                        ));
-                    }
-                }
-                Ok(v) => {
-                    if !err_expected.is_noval() {
-                        self.failures.push(format!(
-                            "{label}#{i}: expected error [{}] but got value {}",
-                            stringify(&err_expected, Some(80), false),
-                            stringify(&fix_json(&v, null_flag), Some(80), false)
-                        ));
-                        continue;
-                    }
-                    let res = fix_json(&v, null_flag);
-                    let mut matched = false;
-                    if !match_spec.is_noval() {
-                        let mut base = OrderedMap::new();
-                        base.insert("in".to_string(), vget(entry, "in"));
-                        base.insert("args".to_string(), Value::list(vec![vin.clone()]));
-                        base.insert("out".to_string(), res.clone());
-                        let base = Value::map(base);
-                        if let Some(why) = match_check(&match_spec, &base) {
-                            self.failures
-                                .push(format!("{label}#{i}: match failed ({why})"));
-                            continue;
-                        }
-                        matched = true;
-                    }
-                    if res == expected
-                        || (matched && (expected == Value::str(NULLMARK) || expected.is_nullish()))
-                    {
-                        self.passed += 1;
-                    } else {
-                        self.failures.push(format!(
-                            "{label}#{i}: in={} -> got {}, want {}",
-                            stringify(&vget(entry, "in"), Some(120), false),
-                            stringify(&res, Some(120), false),
-                            stringify(&expected, Some(120), false),
-                        ));
-                    }
-                }
-            }
-        }
-    }
-}
-
-/// Walk `check`; every leaf must equal/match `getpath(base, path)`. Returns
-/// `Some(reason)` on the first mismatch, `None` if all leaves match.
-pub fn match_check(check: &Value, base: &Value) -> Option<String> {
-    fn rec(check: &Value, base: &Value, path: &mut Vec<String>) -> Option<String> {
-        match check {
-            Value::Map(cm) => {
-                for (k, cv) in cm.borrow().iter() {
-                    path.push(k.clone());
-                    let r = rec(cv, base, path);
-                    path.pop();
-                    if r.is_some() {
-                        return r;
-                    }
-                }
-                None
-            }
-            Value::List(cl) => {
-                for (i, cv) in cl.borrow().iter().enumerate() {
-                    path.push(i.to_string());
-                    let r = rec(cv, base, path);
-                    path.pop();
-                    if r.is_some() {
-                        return r;
-                    }
-                }
-                None
-            }
-            leaf => {
-                let bv = get_path(
-                    base,
-                    &Value::list(path.iter().cloned().map(Value::Str).collect()),
-                    None,
-                );
-                if leaf == &bv {
-                    return None;
-                }
-                if let Value::Str(s) = leaf {
-                    if s == UNDEFMARK && bv.is_noval() {
-                        return None;
-                    }
-                    if s == EXISTSMARK && !bv.is_nullish() {
-                        return None;
-                    }
-                }
-                if matchval(leaf, &bv) {
-                    return None;
-                }
-                Some(format!(
-                    "{}: {} <=> {}",
-                    path.join("."),
-                    stringify(leaf, Some(40), false),
-                    stringify(&bv, Some(40), false)
-                ))
-            }
-        }
-    }
-    let mut path = Vec::new();
-    rec(check, base, &mut path)
-}
-
-// ---- adapters helpers --------------------------------------------------
-
-pub fn b(v: bool) -> Value {
-    Value::Bool(v)
-}
-
-pub fn inject_def_from_value(v: &Value) -> InjectDef {
-    let mut d = InjectDef::default();
-    if let Value::Map(_) = v {
-        let key = vget(v, "key");
-        if !key.is_noval() {
-            d.key = Some(key);
-        }
-        let meta = vget(v, "meta");
-        if !meta.is_noval() {
-            d.meta = Some(meta);
-        }
-        let base = vget(v, "base");
-        if let Value::Str(s) = base {
-            d.base = Some(s);
-        }
-        let dparent = vget(v, "dparent");
-        if !dparent.is_noval() {
-            d.dparent = Some(dparent);
-        }
-        let dpath = vget(v, "dpath");
-        if let Value::Str(s) = dpath {
-            d.dpath = Some(s.split('.').map(|x| x.to_string()).collect());
-        } else if let Value::List(l) = &dpath {
-            d.dpath = Some(
-                l.borrow()
-                    .iter()
-                    .map(|x| as_str_opt(x).unwrap_or_default())
-                    .collect(),
-            );
-        }
-    }
-    d
-}
-

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/Registry.ts

@@ -1,90 +0,0 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/Registry.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
-// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Copyright (c) 2025 Voxgig Ltd, MIT License */
-
-// THE PROVIDER REGISTRY — the seam that replaced the `makeprovider`
-// switch, and the reason an SDK no longer carries thirteen providers to
-// use two.
-//
-// The switch named every kind in one function, so every kind was
-// statically reachable from `Sekreto` and no bundler could drop one. Its
-// replacement is a map that a provider ADDS ITSELF to. A kind that is
-// never imported is never registered, is never reachable, and is not in
-// the build — which is the whole point.
-//
-// The vocabulary is voxgig/plugin's (docs/design/plugin-providers.md): a
-// provider kind is a plugin `Definition`, a configured provider is an
-// instance addressed by name+tag. What sekreto does NOT route through
-// plugin is the lookup itself: `Provider.lookup` is async, and plugin's
-// dispatch is synchronous by design — twenty ports, many with no
-// async/await. So plugin owns the catalog, the instances and their
-// order; sekreto walks them in each language's own idiom.
-//
-// `define` is the definition's factory: spec in, Provider out. It is
-// separate from the plugin `Definition.define` callback on purpose —
-// this one runs at construction and returns a value, while plugin's runs
-// at load and binds. They are bridged in Catalog.ts.
-
-import { Provider, ProviderSpec, SekretoError } from './support'
-
-export type ProviderDefinition = {
-  /** The `kind` a ProviderSpec names. */
-  name: string
-  /** What this provider needs of its runtime, so a host can refuse or
-   * report before a lookup fails: 'fs', 'fetch', 'crypto', 'process'. */
-  needs?: string[]
-  /** Build the provider from its declarative spec. */
-  define: (spec: ProviderSpec) => Provider
-}
-
-const registry: { [kind: string]: ProviderDefinition } = {}
-
-/** Register a provider kind. Called by each provider module at import,
- * so importing the module IS installing it. Re-registering the same name
- * replaces it, which is how a host substitutes an implementation. */
-export function register(def: ProviderDefinition): void {
-  if (null == def || 'string' !== typeof def.name || '' === def.name) {
-    throw new SekretoError('sekreto: invalid provider definition')
-  }
-  registry[def.name] = def
-}
-
-export function registered(kind: string): ProviderDefinition | undefined {
-  return registry[kind]
-}
-
-export function kinds(): string[] {
-  return Object.keys(registry).sort()
-}
-
-/** Build a provider from its spec.
- *
- * An UNREGISTERED kind is not the same failure as an unknown one, and the
- * message says which: a kind sekreto has never heard of is a typo, while
- * a known kind that was not imported is the leanness mechanism working as
- * designed and telling you to import it. Collapsing the two was the first
- * thing that made the split confusing to use. */
-export function makeprovider(spec: ProviderSpec): Provider {
-  const kind = null == spec ? undefined : (spec as any).kind
-  const def = registry[kind as string]
-
-  if (null == def) {
-    throw new SekretoError(
-      'sekreto: unknown provider kind: ' + String(kind) +
-      ' (registered: ' + (kinds().join(', ') || 'none') + ')' +
-      (KNOWN.indexOf(String(kind)) < 0 ? '' :
-        " - that kind exists but its module was not imported; import" +
-        " '@voxgig/sekreto/provider/" + String(kind) + "' to register it"))
-  }
-
-  return def.define(spec)
-}
-
-/** Every kind this library ships, registered or not. Used only to tell a
- * typo from a module that was not imported. */
-const KNOWN = [
-  'env', 'memory', 'dotenv', 'file', 'hashicorp', 'boru',
-  'awssecrets', 'awsparams', 'gcpsecrets', 'azuresecrets',
-  'onepassword', 'doppler', 'infisical',
-]

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/http.ts

@@ -1,66 +0,0 @@
-// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/http.ts)
-// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
-// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Copyright (c) 2025 Voxgig Ltd, MIT License */
-
-import { SekretoError } from './support'
-import { checkaddr } from './addr'
-
-// Moved here with fetchjson, its only consumer.
-const HTTP_TIMEOUT_MS = 10000
-
-export async function fetchjson(
-  method: string,
-  url: string,
-  headers: Record<string, string>,
-  body?: string,
-): Promise<{ status: number; body: any }> {
-  let res: Response
-  try {
-    res = await fetch(url, {
-      method,
-      headers,
-      body,
-      // A vault API never legitimately redirects, and a followed redirect
-      // carries X-Vault-Token to the redirect's host (and can downgrade
-      // https to http), which checkaddr - it only validates the configured
-      // address - cannot see. Refuse to follow one.
-      redirect: 'error',
-      // Bound the wait so an accepted-but-silent endpoint cannot hang the
-      // caller (and the app's startup) forever.
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
-    })
-  } catch (err: any) {
-    throw new SekretoError('sekreto: cannot reach ' + url.split('?')[0] + ': ' + err.message)
-  }
-
-  let parsed: any = undefined
-  try {
-    parsed = await res.json()
-  } catch (err: any) {
-    // A success status promised JSON; a body that does not parse means
-    // the store could not answer coherently, and treating it as a miss
-    // would fall through to a weaker store. Error statuses may carry
-    // any body - they are decided on status alone.
-    if (200 === res.status) {
-      throw new SekretoError('sekreto: malformed response from ' + url.split('?')[0])
-    }
-  }
-
-  return { status: res.status, body: parsed }
-}
-
-/** HashiCorp Vault.
- *
- * KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
- * and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
- * `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
- * "not here" - a miss - so a vault can sit in a chain with fallbacks.
- *
- * A Vault Enterprise namespace rides the X-Vault-Namespace header, on
- * logins as well as reads.
- *
- * Instead of being handed a token, the provider can log in: Kubernetes
- * auth (the pod's service-account JWT, from its conventional path) or
- * AppRole. A failed login is an error, never a miss - it means this
- * store could not answer at all. */