@voxgig/sdkgen 4.8.3 → 4.10.0

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Secretspec.swift

@@ -0,0 +1,111 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Secretspec.swift)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The `secretspec` provider kind: SecretSpec, through its CLI.
+//
+// A plugin, not a built-in: it spawns a child process.
+//
+// A port of typescript/plugins/secretspec.ts, which is canonical.
+
+import Foundation
+
+import Sekreto
+
+// A SCOPED import: plugin exports a `Json` of its own, and the only name
+// this file wants from it is `Definition`.
+import struct VoxgigPlugin.Definition
+
+/// SecretSpec (https://secretspec.dev).
+///
+/// SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+/// project needs - plus a chain of its own backends to satisfy them from.
+/// That makes it the same shape as sekreto one level down, and the reason
+/// to support it is the same reason sekreto exists: a project that has
+/// already declared its secrets there should not have to declare them
+/// again here.
+///
+/// `backend` selects one of SecretSpec's backends (`--provider`) and is
+/// called `backend` here only because `provider` already means something
+/// else in this library.
+///
+/// A reason is required, not optional: SecretSpec records every read in an
+/// audit log and refuses to read at all without one.
+public final class SecretspecProvider: Provider {
+
+  private let command: String
+  private let file: String?
+  private let profile: String?
+  private let backend: String?
+  private let reason: String?
+  private let prefix: String?
+
+  public init(
+    command: String? = nil,
+    file: String? = nil,
+    profile: String? = nil,
+    backend: String? = nil,
+    reason: String? = nil,
+    prefix: String? = nil
+  ) {
+    self.command = first(command, "secretspec")
+    self.file = file
+    self.profile = profile
+    self.backend = backend
+    self.reason = reason
+    self.prefix = prefix
+  }
+
+  public func lookup(_ name: String) throws -> String? {
+    let key = try envkey(name, prefix)
+
+    // `--file` comes BEFORE the subcommand; everything else after it.
+    var argv = [command]
+    if let use = file, !use.isEmpty { argv += ["--file", use] }
+    argv += ["get", key]
+    if let use = backend, !use.isEmpty { argv += ["--provider", use] }
+    if let use = profile, !use.isEmpty { argv += ["--profile", use] }
+    argv += ["--reason", first(reason, "sekreto")]
+
+    let ran = try runcmd(argv, ProcessInfo.processInfo.environment, command)
+
+    if 0 == ran.status {
+      // The value and one newline, and nothing else.
+      return dropsuffix(ran.out, "\n")
+    }
+
+    if secretspecmiss(ran.why, key) { return nil }
+
+    throw SekretoError(
+      "sekreto: secretspec error: " + (ran.why.isEmpty ? "exit \(ran.status)" : ran.why))
+  }
+
+  public func describe() -> String {
+    let use = backend ?? ""
+    return use.isEmpty ? "secretspec" : "secretspec:\(use)"
+  }
+}
+
+/// Does this SecretSpec failure mean "no such secret" rather than "I could
+/// not answer"?
+///
+/// MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+/// `Provider backend 'keyring' not found`, which is a store that could not
+/// answer at all - and reading that as a miss is the worst failure this
+/// library has, because the chain then falls through to a weaker store
+/// without saying so. The key is required to appear, so the two cannot be
+/// confused.
+public func secretspecmiss(_ why: String, _ key: String) -> Bool {
+  return why.contains("Secret '\(key)' not found")
+}
+
+/// The kind, as a voxgig/plugin definition.
+public let secretspec: Definition = providerplugin("secretspec") { spec in
+  SecretspecProvider(
+    command: spec.command,
+    file: spec.file,
+    profile: spec.profile,
+    backend: spec.backend,
+    reason: spec.reason,
+    prefix: spec.prefix
+  )
+}

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Sigv4.swift

@@ -0,0 +1,297 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Sigv4.swift)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// AWS Signature Version 4, hand-rolled.
+//
+// The AWS providers need exactly one thing from the AWS SDK - request
+// signing - and taking the SDK for it would break the no-dependency rule
+// that keeps the ports honest. SigV4 is a stable, published algorithm
+// built from HMAC-SHA256, which Crypto.swift supplies.
+//
+// `sigv4` is pure: the caller passes the timestamp, so the same input
+// yields the same signature everywhere. That is what lets the shared spec
+// carry known-answer cases that all ports must reproduce bit-for-bit, and
+// lets the integration mock recompute the signature server-side.
+//
+// It travels with the aws plugin, not with the core: signing a request is
+// what makes a kind a plugin (docs/design/plugin-providers.md).
+//
+// A port of typescript/src/Sigv4.ts, which is canonical.
+
+import Foundation
+
+import Sekreto
+
+/// One request to sign - the same declarative shape the shared spec uses.
+/// `datetime` is `YYYYMMDDTHHMMSSZ`, and it is the caller's, so that
+/// signing is a pure function of its input.
+public struct Signing {
+
+  public var method: String
+  public var url: String
+  public var service: String
+  public var region: String
+  public var keyid: String
+  public var secret: String
+  public var datetime: String
+  public var headers: Ordered<String>
+  public var body: String
+  public var session: String?
+
+  public init(
+    method: String,
+    url: String,
+    service: String,
+    region: String,
+    keyid: String,
+    secret: String,
+    datetime: String,
+    headers: Ordered<String> = Ordered<String>(),
+    body: String = "",
+    session: String? = nil
+  ) {
+    self.method = method
+    self.url = url
+    self.service = service
+    self.region = region
+    self.keyid = keyid
+    self.secret = secret
+    self.datetime = datetime
+    self.headers = headers
+    self.body = body
+    self.session = session
+  }
+}
+
+/// SHA-256 of some text, as lowercase hex.
+public func sha256hex(_ text: String) -> String {
+  return hex(sha256(Array(text.utf8)))
+}
+
+/// HMAC-SHA256 of some text under a key.
+public func hmac(_ key: [UInt8], _ text: String) -> [UInt8] {
+  return hmacsha256(key, Array(text.utf8))
+}
+
+
+/// Percent-decode, and nothing else: `+` stays `+`, as on the wire, and a
+/// malformed escape is kept literal.
+public func uridecode(_ text: String) -> String {
+  let chars = Array(text.utf8)
+  var out: [UInt8] = []
+  var index = 0
+
+  while index < chars.count {
+    var taken = false
+
+    if 0x25 == chars[index], index + 2 < chars.count {  // '%'
+      let digits = String(decoding: chars[(index + 1)...(index + 2)], as: UTF8.self)
+      if let code = UInt8(digits, radix: 16) {
+        out.append(code)
+        index += 3
+        taken = true
+      }
+    }
+
+    if !taken {
+      out.append(chars[index])
+      index += 1
+    }
+  }
+
+  return String(decoding: out, as: UTF8.self)
+}
+
+/// The canonical query string: each pair RFC 3986-escaped, sorted by
+/// escaped key then escaped value.
+public func canonicalquery(_ query: String) -> String {
+  if query.isEmpty { return "" }
+
+  var pairs: [(String, String)] = []
+
+  for pair in query.components(separatedBy: "&") {
+    let split = pair.firstIndex(of: "=")
+    let key = nil == split ? pair : String(pair[pair.startIndex..<split!])
+    let value = nil == split ? "" : String(pair[pair.index(after: split!)...])
+    pairs.append((uriescape(uridecode(key)), uriescape(uridecode(value))))
+  }
+
+  pairs.sort { left, right in
+    if left.0 != right.0 { return left.0 < right.0 }
+    return left.1 < right.1
+  }
+
+  return pairs.map { "\($0.0)=\($0.1)" }.joined(separator: "&")
+}
+
+/// A URL, split by hand.
+///
+/// Not URLComponents: what SigV4 signs must match what the address check
+/// saw and what the client will dial, and a platform URL type is free to
+/// normalise any of the three differently. `host` follows the WHATWG rule
+/// the AWS SDKs use - lowercased, userinfo stripped, the port present only
+/// when it is not the scheme's default.
+struct Urlparts {
+  var scheme: String
+  var host: String
+  var path: String
+  var query: String
+}
+
+func urlparts(_ url: String) -> Urlparts {
+  var scheme = ""
+  var rest = url
+
+  if let mark = url.range(of: "://") {
+    scheme = String(url[url.startIndex..<mark.lowerBound]).lowercased()
+    rest = String(url[mark.upperBound...])
+  }
+
+  var authority = rest
+  var tail = ""
+
+  if let stop = rest.firstIndex(where: { "/" == $0 || "?" == $0 || "#" == $0 }) {
+    authority = String(rest[rest.startIndex..<stop])
+    tail = String(rest[stop...])
+  }
+
+  // Userinfo is not part of the host, and never part of a signature.
+  if let at = authority.lastIndex(of: "@") {
+    authority = String(authority[authority.index(after: at)...])
+  }
+
+  var hostname = authority
+  var port = ""
+
+  if authority.hasPrefix("["), let close = authority.firstIndex(of: "]") {
+    hostname = String(authority[authority.startIndex...close])
+    let after = String(authority[authority.index(after: close)...])
+    if after.hasPrefix(":") { port = String(after.dropFirst()) }
+  } else if let colon = authority.lastIndex(of: ":") {
+    hostname = String(authority[authority.startIndex..<colon])
+    port = String(authority[authority.index(after: colon)...])
+  }
+
+  hostname = asciilower(hostname)
+
+  // A default port is implicit: `Host: example.com:443` is not what an AWS
+  // SDK signs, and a signature over the wrong host is refused.
+  if ("https" == scheme && "443" == port) || ("http" == scheme && "80" == port) {
+    port = ""
+  }
+
+  var path = "/"
+  var query = ""
+
+  if !tail.isEmpty {
+    var pathpart = tail
+
+    if let hash = tail.firstIndex(of: "#") {
+      pathpart = String(tail[tail.startIndex..<hash])
+    }
+
+    if let mark = pathpart.firstIndex(of: "?") {
+      query = String(pathpart[pathpart.index(after: mark)...])
+      pathpart = String(pathpart[pathpart.startIndex..<mark])
+    }
+
+    if !pathpart.isEmpty { path = pathpart }
+  }
+
+  return Urlparts(
+    scheme: scheme,
+    host: port.isEmpty ? hostname : hostname + ":" + port,
+    path: path,
+    query: query
+  )
+}
+
+/// Trim, and collapse every internal run of spaces and tabs to one space.
+///
+/// AWS folds sequential whitespace before signing, so a header value like
+/// `a  b\tc` must sign as `a b c` or the service refuses the request.
+func foldspace(_ text: String) -> String {
+  var out = ""
+  var pending = false
+  var started = false
+
+  for ch in text {
+    if " " == ch || "\t" == ch || "\n" == ch || "\r" == ch {
+      if started { pending = true }
+      continue
+    }
+    if pending {
+      out.append(" ")
+      pending = false
+    }
+    out.append(ch)
+    started = true
+  }
+
+  return out
+}
+
+/// Sign one request. Returns the headers to attach: authorization,
+/// x-amz-date, and x-amz-security-token when a session token was given, in
+/// that order - the spec compares the result as a JSON object, and callers
+/// print it field by field.
+public func sigv4(_ input: Signing) -> Ordered<String> {
+  let parts = urlparts(input.url)
+
+  let date = String(input.datetime.prefix(8))
+  let session = (input.session?.isEmpty ?? true) ? nil : input.session
+
+  // Every header that will be signed: the caller's extras, plus host and
+  // x-amz-date (and the session token when present). The built-in three go
+  // in AFTER the caller's, so they win over anything passed in.
+  var headers = Ordered<String>()
+
+  for (key, value) in input.headers.pairs {
+    headers[asciilower(key)] = foldspace(value)
+  }
+
+  headers["host"] = parts.host
+  headers["x-amz-date"] = input.datetime
+  if let token = session { headers["x-amz-security-token"] = token }
+
+  let sorted = headers.pairs.sorted { $0.0 < $1.0 }
+
+  let canonicalheaders = sorted.map { "\($0.0):\($0.1)\n" }.joined()
+  let signedheaders = sorted.map { $0.0 }.joined(separator: ";")
+
+  let canonicalrequest = [
+    asciiupper(input.method),
+    parts.path,
+    canonicalquery(parts.query),
+    canonicalheaders,
+    signedheaders,
+    sha256hex(input.body),
+  ].joined(separator: "\n")
+
+  let scope = "\(date)/\(input.region)/\(input.service)/aws4_request"
+
+  let stringtosign = [
+    "AWS4-HMAC-SHA256",
+    input.datetime,
+    scope,
+    sha256hex(canonicalrequest),
+  ].joined(separator: "\n")
+
+  let kdate = hmac(Array(("AWS4" + input.secret).utf8), date)
+  let kregion = hmac(kdate, input.region)
+  let kservice = hmac(kregion, input.service)
+  let ksigning = hmac(kservice, "aws4_request")
+  let signature = hex(hmac(ksigning, stringtosign))
+
+  var out = Ordered<String>()
+
+  out["authorization"] =
+    "AWS4-HMAC-SHA256 Credential=\(input.keyid)/\(scope)"
+    + ", SignedHeaders=\(signedheaders)"
+    + ", Signature=\(signature)"
+  out["x-amz-date"] = input.datetime
+
+  if let token = session { out["x-amz-security-token"] = token }
+
+  return out
+}

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Addr.swift

@@ -0,0 +1,120 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Addr.swift)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Refusing to send a secret-bearing credential in the clear.
+//
+// This is CORE, not plugin, even though only the plugins ever dial an
+// address. The rule is sekreto's rather than any one store's, the shared
+// spec pins its three messages byte for byte, and a check that ten
+// plugins each carried their own copy of would drift between them - which
+// is precisely how a check stops being one.
+//
+// A port of typescript/src/provider/addr.ts, which is canonical.
+
+import Foundation
+
+/// An address with any userinfo replaced by `[redacted]`, for messages.
+///
+/// Every refusal below names the address it refused, and one of them fires
+/// precisely because the address carries a credential - so printing it
+/// verbatim would write the password to stderr and into the logs. It
+/// cannot be cleaned up afterwards either: that password was never
+/// resolved as a secret, so redact() has never seen it and never will. The
+/// host is what a reader needs to identify which chain entry is at fault;
+/// the userinfo is not.
+public func safeaddr(_ addr: String) -> String {
+  guard let mark = addr.range(of: "://") else { return addr }
+
+  let rest = String(addr[mark.upperBound...])
+  let stop = rest.firstIndex { "/" == $0 || "?" == $0 || "#" == $0 }
+  let authority = nil == stop ? rest : String(rest[rest.startIndex..<stop!])
+
+  guard let at = authority.lastIndex(of: "@") else { return addr }
+
+  let cut = authority.distance(from: authority.startIndex, to: at)
+  let head = String(addr[addr.startIndex..<mark.upperBound])
+  let tail = String(rest[rest.index(rest.startIndex, offsetBy: cut)...])
+
+  return head + "[redacted]" + tail
+}
+
+/// Refuse to send a secret-bearing credential in the clear.
+///
+/// A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+/// convenience. Sending a token over http to anything but the local
+/// machine puts both the token and the secret it fetches on the wire for
+/// anyone on the path, so sekreto will not do it. Loopback stays allowed:
+/// that is `vault server -dev`, `boru vault serve`, and this repo's own
+/// test harness.
+///
+/// The address is read by hand, in the same handful of steps in every
+/// port, rather than by each platform's URL parser. That is deliberate. A
+/// dozen parsers disagree about malformed input - where userinfo ends,
+/// whether `0177.0.0.1` is loopback, what an unclosed bracket means - and
+/// a check that answers differently in different ports is not a check.
+///
+/// The rule this parse obeys, and the reason it can be trusted: it is
+/// never more permissive than the HTTP client that will dial the address.
+/// It ends the authority at `/`, `?` or `#` only, so a client that also
+/// breaks on `\` (WHATWG does) can only ever see a SHORTER host than this
+/// does. It refuses userinfo outright rather than locating its end. It
+/// compares the host literally, so a numeric form no parser here agrees on
+/// is refused rather than guessed at.
+public func checkaddr(_ addr: String) throws {
+  var scheme = ""
+
+  // Literal and case-sensitive: `HTTP://localhost` is refused rather than
+  // normalised, because normalising is where parsers start to disagree.
+  if addr.hasPrefix("https://") {
+    scheme = "https://"
+  } else if addr.hasPrefix("http://") {
+    scheme = "http://"
+  } else {
+    throw SekretoError("sekreto: not an http(s) address: \(safeaddr(addr))")
+  }
+
+  let rest = String(addr.dropFirst(scheme.count))
+  let end = rest.firstIndex { "/" == $0 || "?" == $0 || "#" == $0 }
+  let authority = nil == end ? rest : String(rest[rest.startIndex..<end!])
+
+  // Userinfo is refused outright rather than parsed around, and on https
+  // as well as http. No store this library speaks authenticates by
+  // userinfo - they take a token or a signature - so an address carrying
+  // one is a mistake at best. At worst it is the attack this whole
+  // function exists to stop: `http://localhost:8200@evil.example.com/` is
+  // a request to evil.example.com that reads, to anything that splits the
+  // authority on ':', as loopback.
+  if authority.contains("@") {
+    throw SekretoError(
+      "sekreto: refusing an address with embedded credentials: \(safeaddr(addr))")
+  }
+
+  // An opening bracket with no closing one is not an address at all.
+  if authority.hasPrefix("[") && !authority.contains("]") {
+    throw SekretoError("sekreto: not a valid http(s) address: \(safeaddr(addr))")
+  }
+
+  if "https://" == scheme { return }
+
+  // A bracketed IPv6 literal keeps its brackets. Splitting the authority
+  // on the first colon yields '[', so `http://[::1]:8200` could never
+  // match - which made the '[::1]' entry below unreachable, and refused a
+  // legitimate local vault.
+  var host = authority
+
+  if authority.hasPrefix("["), let close = authority.firstIndex(of: "]") {
+    host = String(authority[authority.startIndex...close])
+  } else if let colon = authority.firstIndex(of: ":") {
+    host = String(authority[authority.startIndex..<colon])
+  }
+
+  host = asciilower(host)
+
+  // Literal, and exactly these four. Nothing is normalised: `0177.0.0.1`,
+  // `2130706433` and `[::ffff:127.0.0.1]` are all refused, because no two
+  // URL parsers agree on what they mean.
+  if "localhost" != host && "127.0.0.1" != host && "::1" != host && "[::1]" != host {
+    throw SekretoError(
+      "sekreto: refusing to send a token in plaintext to \(safeaddr(addr)) (use https)")
+  }
+}