@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/addr.rb

@@ -0,0 +1,111 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/addr.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The plaintext-address guard, in the core because it is pure - a handful
+# of string steps, no socket - and because it is on the spec: every port
+# answers the same for every address in spec/def/store.aon. The plugins
+# that dial an address call `checkaddr` before they do.
+#
+# A port of typescript/src/provider/addr.ts, which is canonical.
+
+require_relative 'sekreto'
+
+module VoxgigSekreto
+  module_function
+
+  # An address with any userinfo replaced by `[redacted]`, for messages.
+  #
+  # Every refusal below names the address it refused, and one of them fires
+  # precisely because the address carries a credential - so printing it
+  # verbatim wrote the password to stderr and into the logs. It cannot be
+  # cleaned up afterwards either: that password was never resolved as a
+  # secret, so redact() has never seen it and never will. The host is what a
+  # reader needs to identify which chain entry is at fault; the userinfo is
+  # not.
+  def safeaddr(addr)
+    mark = addr.index('://')
+    return addr if mark.nil?
+
+    rest = addr[(mark + 3)..]
+    stop = rest.index(%r{[/?#]})
+    authority = stop.nil? ? rest : rest[0...stop]
+
+    at = authority.rindex('@')
+    return addr if at.nil?
+
+    addr[0...(mark + 3)] + '[redacted]' + addr[(mark + 3 + at)..]
+  end
+
+  # Refuse to send a secret-bearing credential in the clear.
+  #
+  # A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+  # convenience. Sending a token over http to anything but the local
+  # machine puts both the token and the secret it fetches on the wire for
+  # anyone on the path, so sekreto will not do it. Loopback stays allowed:
+  # that is `vault server -dev`, `boru vault serve`, and this repo's own
+  # test harness.
+  #
+  # The address is read by hand, in the same handful of steps in every
+  # port, rather than by each platform's URL parser. That is deliberate.
+  # Twelve parsers disagree about malformed input - where userinfo ends,
+  # whether `0177.0.0.1` is loopback, what an unclosed bracket means - and
+  # a check that answers differently in different ports is not a check.
+  #
+  # The rule this parse obeys, and the reason it can be trusted: it is
+  # never more permissive than the HTTP client that will dial the address.
+  # It ends the authority at `/`, `?` or `#` only, so a client that also
+  # breaks on `\` (WHATWG does) can only ever see a SHORTER host than this
+  # does. It refuses userinfo outright rather than locating its end. It
+  # compares the host literally, so a numeric form no parser here agrees
+  # on is refused rather than guessed at.
+  def checkaddr(addr)
+    scheme =
+      if addr.start_with?('https://')
+        'https://'
+      elsif addr.start_with?('http://')
+        'http://'
+      else
+        raise SekretoError, 'sekreto: not an http(s) address: ' + safeaddr(addr)
+      end
+
+    rest = addr[scheme.length..]
+    end_at = rest.index(%r{[/?#]})
+    authority = end_at.nil? ? rest : rest[0...end_at]
+
+    # Userinfo is refused outright rather than parsed around, and on https
+    # as well as http. No store this library speaks authenticates by
+    # userinfo - they take a token or a signature - so an address carrying
+    # one is a mistake at best. At worst it is the attack this whole
+    # method exists to stop: `http://localhost:8200@evil.example.com/` is
+    # a request to evil.example.com that reads, to anything that splits
+    # the authority on ':', as loopback.
+    if authority.include?('@')
+      raise SekretoError, 'sekreto: refusing an address with embedded credentials: ' + safeaddr(addr)
+    end
+
+    # An opening bracket with no closing one is not an address at all.
+    if authority.start_with?('[') && !authority.include?(']')
+      raise SekretoError, 'sekreto: not a valid http(s) address: ' + safeaddr(addr)
+    end
+
+    return if 'https://' == scheme
+
+    # A bracketed IPv6 literal keeps its brackets. Splitting the authority
+    # on the first colon yields '[', so `http://[::1]:8200` could never
+    # match - which made the '[::1]' entry below unreachable, and refused
+    # a legitimate local vault.
+    host =
+      if authority.start_with?('[')
+        authority[0..authority.index(']')]
+      else
+        authority.split(':')[0].to_s
+      end
+
+    return if ['localhost', '127.0.0.1', '::1', '[::1]'].include?(host.downcase)
+
+    raise SekretoError,
+          'sekreto: refusing to send a token in plaintext to ' + safeaddr(addr) + ' (use https)'
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/aws.rb

@@ -0,0 +1,200 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/aws.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The aws plugin: Secrets Manager and SSM Parameter Store, with requests
+# SigV4-signed in-tree (sigv4.rb, beside this file). Needs HTTPS and
+# HMAC-SHA256 - the one cryptographic dependency in the library, which is
+# why this is a plugin and why the core requires no openssl. A port of
+# typescript/plugins/aws.ts, which is canonical.
+
+require 'json'
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+require_relative 'sigv4'
+
+module VoxgigSekreto
+  module_function
+
+  # The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now.
+  def awsnow
+    Time.now.utc.strftime('%Y%m%dT%H%M%SZ')
+  end
+
+  # Region and credentials, from config first and the standard AWS_*
+  # environment variables second - those are AWS's own convention, and a
+  # pod or CI job that has them set should just work. Missing either is
+  # an error: an AWS store with no credentials could not answer.
+  def awsauth(opts)
+    region = opts['region'] || ENV['AWS_REGION'] || ENV['AWS_DEFAULT_REGION'] || ''
+    keyid = opts['keyid'] || ENV['AWS_ACCESS_KEY_ID'] || ''
+    secret = opts['secret'] || ENV['AWS_SECRET_ACCESS_KEY'] || ''
+    session = opts['session'] || ENV.fetch('AWS_SESSION_TOKEN', nil)
+
+    raise SekretoError, 'sekreto: aws: no region (set region or AWS_REGION)' if '' == region
+
+    if '' == keyid || '' == secret
+      raise SekretoError,
+            'sekreto: aws: no credentials (set keyid/secret or ' \
+            'AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)'
+    end
+
+    { 'region' => region, 'keyid' => keyid, 'secret' => secret, 'session' => session }
+  end
+
+  # One signed call to an AWS JSON-1.1 API.
+  def awscall(opts, service, target, payload)
+    auth = awsauth(opts)
+    # The China partition lives under its own suffix; every other
+    # commercial region is plain amazonaws.com.
+    suffix = auth['region'].start_with?('cn-') ? '.amazonaws.com.cn' : '.amazonaws.com'
+    addr = opts['addr'] || 'https://' + service + '.' + auth['region'] + suffix
+    checkaddr(addr)
+
+    url = addr.sub(%r{/\z}, '') + '/'
+    body = JSON.generate(payload)
+    headers = {
+      'content-type' => 'application/x-amz-json-1.1',
+      'x-amz-target' => target
+    }
+
+    signed = sigv4(
+      'method' => 'POST',
+      'url' => url,
+      'headers' => headers,
+      'body' => body,
+      'service' => service,
+      'region' => auth['region'],
+      'keyid' => auth['keyid'],
+      'secret' => auth['secret'],
+      'session' => auth['session'],
+      'datetime' => awsnow
+    )
+
+    fetchjson('POST', url, headers.merge(signed), body)
+  end
+
+  # Does this AWS error body name one of the not-found types? Those are
+  # a miss; every other failure is a store that could not answer.
+  def awsmiss(body, types)
+    errtype = body.is_a?(Hash) && body['__type'].is_a?(String) ? body['__type'] : ''
+    types.any? { |name| errtype.include?(name) }
+  end
+
+  # AWS Secrets Manager.
+  #
+  # `api.token` reads the secret named `api` (the vaultref path, so
+  # `db.pass.main` reads `db/pass`) and takes the `token` field of its
+  # JSON SecretString - the AWS idiom of one JSON map per secret. A
+  # SecretString that is not JSON is the value itself, under the
+  # conventional field `value`. Requests are SigV4-signed in-tree; see
+  # sigv4.rb.
+  class AwssecretsProvider
+    def initialize(opts = nil)
+      @opts = opts || {}
+    end
+
+    def lookup(name)
+      ref = VoxgigSekreto.vaultref(name)
+
+      status, body = VoxgigSekreto.awscall(@opts, 'secretsmanager',
+                                           'secretsmanager.GetSecretValue',
+                                           { 'SecretId' => ref['path'] })
+
+      return nil if 400 == status && VoxgigSekreto.awsmiss(body, ['ResourceNotFoundException'])
+
+      raise SekretoError, 'sekreto: aws secretsmanager error: ' + status.to_s if 200 != status
+
+      text = body.is_a?(Hash) ? body['SecretString'] : nil
+
+      unless text.is_a?(String)
+        # A binary secret has no fields to address; only the conventional
+        # `value` field can mean "the bytes themselves".
+        bin = body.is_a?(Hash) ? body['SecretBinary'] : nil
+        if bin.is_a?(String) && 'value' == ref['field']
+          # 'm' skips characters outside the alphabet, so a corrupted
+          # payload decoded to plausible-looking bytes that were then
+          # returned as the secret. 'm0' is strict. A store that answered
+          # incoherently is an error, never a miss.
+          decoded = begin
+            bin.unpack1('m0')
+          rescue ArgumentError
+            raise SekretoError, 'sekreto: aws secretsmanager: undecodable secret'
+          end
+
+          return decoded.force_encoding('UTF-8')
+        end
+
+        return nil
+      end
+
+      parsed = begin
+        JSON.parse(text)
+      rescue JSON::ParserError
+        nil
+      end
+
+      if parsed.is_a?(Hash)
+        value = parsed[ref['field']]
+        return value.nil? ? nil : value.to_s
+      end
+
+      # A plain-string secret is the whole value; it has no named fields.
+      'value' == ref['field'] ? text : nil
+    end
+
+    # Config only, never the environment: describe feeds the spec's
+    # sources group, which must answer the same everywhere.
+    def describe
+      'awssecrets:' + (@opts['region'] || '')
+    end
+  end
+
+  # AWS SSM Parameter Store.
+  #
+  # `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+  # prefix path), decrypted. Parameter Store carries flat strings, so
+  # there is no field indirection.
+  class AwsparamsProvider
+    def initialize(opts = nil)
+      @opts = opts || {}
+    end
+
+    def lookup(name)
+      status, body = VoxgigSekreto.awscall(@opts, 'ssm', 'AmazonSSM.GetParameter',
+                                           { 'Name' => VoxgigSekreto.awsparam(name, @opts['prefix']),
+                                             'WithDecryption' => true })
+
+      return nil if 400 == status && VoxgigSekreto.awsmiss(body, ['ParameterNotFound'])
+
+      raise SekretoError, 'sekreto: aws ssm error: ' + status.to_s if 200 != status
+
+      value = body.is_a?(Hash) && body['Parameter'].is_a?(Hash) ? body['Parameter']['Value'] : nil
+      value.nil? ? nil : value.to_s
+    end
+
+    def describe
+      'awsparams:' + (@opts['region'] || '') + (@opts['prefix'] || '')
+    end
+  end
+
+  module Plugins
+    # The plugins: the `awssecrets` and `awsparams` provider kinds, as
+    # voxgig/plugin definitions. Two kinds, one module, because they share
+    # the signing and the credential resolution.
+    # A local, not a constant: everything Plugins holds is a definition,
+    # and a stray constant beside them reads like an eleventh plugin.
+    awskeys = %w[region keyid secret session addr].freeze
+
+    AWSSECRETS = VoxgigSekreto.providerplugin('awssecrets', lambda { |spec|
+      AwssecretsProvider.new(spec.slice(*awskeys))
+    })
+
+    AWSPARAMS = VoxgigSekreto.providerplugin('awsparams', lambda { |spec|
+      AwsparamsProvider.new(spec.slice(*awskeys, 'prefix'))
+    })
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/azuresecrets.rb

@@ -0,0 +1,130 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/azuresecrets.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The azuresecrets plugin: Azure Key Vault. Needs HTTPS. A port of
+# typescript/plugins/azuresecrets.ts, which is canonical.
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  # Azure Key Vault.
+  #
+  # `api.token` reads secret `api-token` (dots flattened to `-`; Key
+  # Vault names allow nothing else), current version. The token comes
+  # from config, then a client-credentials login when tenant/clientid/
+  # clientsecret are given, then the IMDS managed-identity endpoint - so
+  # on Azure's own platform no credential configuration is needed.
+  #
+  # As with GCP, the IMDS call is plain http to a link-local host by
+  # platform design and carries no credential; the login and vault
+  # addresses are `checkaddr`-guarded.
+  class AzuresecretsProvider
+    RESOURCE = 'https://vault.azure.net'
+
+    def initialize(opts = nil)
+      @opts = opts || {}
+
+      # A configured token is kept forever; logged-in and IMDS tokens carry
+      # expires_in and are renewed shortly before they run out.
+      @livetoken = nil
+      @renewat = Float::INFINITY
+    end
+
+    def expiry(expires)
+      seconds = expires.to_f
+      0 < seconds ? Time.now.to_f + [seconds - 60, 1].max : Float::INFINITY
+    end
+
+    def login
+      return @opts['token'] if VoxgigSekreto.given(@opts['token'])
+
+      if VoxgigSekreto.given(@opts['tenant']) && VoxgigSekreto.given(@opts['clientid']) &&
+         VoxgigSekreto.given(@opts['clientsecret'])
+        loginaddr = @opts['loginaddr'] || 'https://login.microsoftonline.com'
+        VoxgigSekreto.checkaddr(loginaddr)
+
+        url = loginaddr.sub(%r{/\z}, '') + '/' + @opts['tenant'] + '/oauth2/v2.0/token'
+        form = 'grant_type=client_credentials' \
+               '&client_id=' + VoxgigSekreto.uriescape(@opts['clientid']) +
+               '&client_secret=' + VoxgigSekreto.uriescape(@opts['clientsecret']) +
+               '&scope=' + VoxgigSekreto.uriescape(RESOURCE + '/.default')
+
+        status, body = VoxgigSekreto.fetchjson(
+          'POST', url, { 'content-type' => 'application/x-www-form-urlencoded' }, form
+        )
+
+        got = body.is_a?(Hash) ? body['access_token'] : nil
+        unless 200 == status && VoxgigSekreto.given(got)
+          raise SekretoError, 'sekreto: azure login failed: ' + status.to_s
+        end
+
+        @renewat = expiry(body['expires_in'])
+        return got.to_s
+      end
+
+      imds = (@opts['imdsaddr'] || 'http://169.254.169.254').sub(%r{/\z}, '') +
+             '/metadata/identity/oauth2/token?api-version=2018-02-01&resource=' +
+             VoxgigSekreto.uriescape(RESOURCE)
+
+      status, body = VoxgigSekreto.fetchjson('GET', imds, { 'Metadata' => 'true' })
+
+      got = body.is_a?(Hash) ? body['access_token'] : nil
+      unless 200 == status && VoxgigSekreto.given(got)
+        raise SekretoError,
+              'sekreto: azure: no token, no client credentials, and IMDS did not answer'
+      end
+
+      @renewat = expiry(body['expires_in'])
+      got.to_s
+    end
+
+    def lookup(name)
+      vault = @opts['vault'] || ''
+      raise SekretoError, 'sekreto: azure: no vault' if '' == vault
+
+      # Only an explicit scheme is a URL; a vault NAMED httpvault must
+      # still become https://httpvault.vault.azure.net.
+      vaulturl = if vault.start_with?('http://', 'https://')
+                   vault
+                 else
+                   'https://' + vault + '.vault.azure.net'
+                 end
+      VoxgigSekreto.checkaddr(vaulturl)
+
+      @livetoken = login if @livetoken.nil? || Time.now.to_f >= @renewat
+
+      url = vaulturl.sub(%r{/\z}, '') + '/secrets/' + VoxgigSekreto.flatname(name, '-') +
+            '?api-version=' + (@opts['apiversion'] || '7.4')
+
+      status, body = VoxgigSekreto.fetchjson('GET', url,
+                                             { 'authorization' => 'Bearer ' + @livetoken })
+
+      return nil if 404 == status
+
+      if 200 != status
+        raise SekretoError, 'sekreto: azure error: ' + status.to_s + ': ' + url.split('?')[0]
+      end
+
+      value = body.is_a?(Hash) ? body['value'] : nil
+      value.nil? ? nil : value.to_s
+    end
+
+    def describe
+      'azuresecrets:' + (@opts['vault'] || '')
+    end
+  end
+
+  module Plugins
+    # The plugin: the `azuresecrets` provider kind, as a voxgig/plugin
+    # definition.
+    AZURESECRETS = VoxgigSekreto.providerplugin('azuresecrets', lambda { |spec|
+      AzuresecretsProvider.new(spec.slice('vault', 'token', 'tenant', 'clientid',
+                                          'clientsecret', 'loginaddr', 'imdsaddr',
+                                          'apiversion'))
+    })
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/boru.rb

@@ -0,0 +1,121 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/boru.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The boru plugin: a boru vault, through its own CLI or its own wire
+# protocol. Needs a child process, and HTTPS for the wire path. A port of
+# typescript/plugins/boru.ts, which is canonical.
+
+require 'open3'
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  # A boru vault (https://github.com/boru-lang/boru).
+  #
+  # Two ways in, both boru's own.
+  #
+  # With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+  # secret on stdout and nothing else. The passphrase is read by boru
+  # itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
+  # config and never puts it on a command line, where it would show up in
+  # the process table.
+  #
+  # With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+  # read-only, HashiCorp-shaped provision API (boru's
+  # design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+  # from `boru vault grant`. A sekreto name is already a valid boru
+  # alias, and boru aliases keep their dots, so `api.token` is the single
+  # path segment `api.token` - not the `api`/`token` split a HashiCorp KV
+  # gets. The value is the `value` field. A 404 is a miss; anything else
+  # the server refuses (a revoked capability, a sealed vault) is an
+  # error.
+  #
+  # boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+  # credential *broker*, built precisely so the caller never receives the
+  # credential. `vault serve` is the provision endpoint, built to hand
+  # the value back - that is the one sekreto uses.
+  class BoruProvider
+    def initialize(command = nil, namespace = nil, home = nil, addr = nil, token = nil, mount = nil)
+      @command = command || 'boru'
+      @namespace = namespace
+      @home = home
+      @addr = VoxgigSekreto.given(addr) ? addr.sub(%r{/\z}, '') : nil
+      @token = token
+      @mount = mount || 'secret'
+    end
+
+    def wirelookup(name)
+      VoxgigSekreto.checkname(name)
+      VoxgigSekreto.checkaddr(@addr)
+
+      alias_name = @namespace ? @namespace + '/' + name : name
+      url = @addr + '/v1/' + @mount + '/data/' + alias_name
+
+      status, body = VoxgigSekreto.fetchjson('GET', url, { 'X-Vault-Token' => @token || '' })
+
+      return nil if 404 == status
+
+      raise SekretoError, 'sekreto: boru serve error: ' + status.to_s + ': ' + url if 200 != status
+
+      data = body.is_a?(Hash) && body['data'].is_a?(Hash) ? body['data']['data'] : nil
+      value = data.is_a?(Hash) ? data['value'] : nil
+
+      value.nil? ? nil : value.to_s
+    end
+
+    def lookup(name)
+      return wirelookup(name) if @addr
+
+      VoxgigSekreto.checkname(name)
+
+      alias_name = @namespace ? @namespace + ':' + name : name
+      env = @home ? { 'BORU_HOME' => @home } : {}
+
+      begin
+        out, err, status = Open3.capture3(env, @command, 'vault', 'get', '--reveal', alias_name)
+      rescue SystemCallError => e
+        raise SekretoError, 'sekreto: cannot run ' + @command + ': ' + e.message
+      end
+
+      # boru prints the value and one newline, and nothing else.
+      return out.sub(/\n\z/, '') if status.success?
+
+      why = err.to_s.strip
+
+      # "no alias named" is boru saying it does not hold this secret, which is
+      # a miss: the chain carries on to the next provider. A locked vault or a
+      # wrong passphrase is not a miss - treating it as one would fall through
+      # to a weaker store without saying so.
+      return nil if VoxgigSekreto.borumiss(why)
+
+      raise SekretoError,
+            'sekreto: boru vault error: ' + (why.empty? ? 'exit ' + status.exitstatus.to_s : why)
+    end
+
+    def describe
+      return 'boru:' + @addr if @addr
+
+      'boru' + (@namespace ? ':' + @namespace : '')
+    end
+  end
+
+  module_function
+
+  # Does this boru failure mean "no such secret" rather than "I could not
+  # answer"? Matched on boru's own wording for a missing alias.
+  def borumiss(why)
+    why.include?('no alias named')
+  end
+
+  module Plugins
+    # The plugin: the `boru` provider kind, as a voxgig/plugin definition.
+    BORU = VoxgigSekreto.providerplugin('boru', lambda { |spec|
+      BoruProvider.new(spec['command'], spec['namespace'], spec['home'],
+                       spec['addr'], spec['token'], spec['mount'])
+    })
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/doppler.rb

@@ -0,0 +1,66 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/doppler.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The doppler plugin: Doppler. Needs HTTPS. A port of
+# typescript/plugins/doppler.ts, which is canonical.
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  # Doppler.
+  #
+  # The whole config is downloaded once - Doppler's own bulk endpoint -
+  # and answered from memory, like a remote .env: `api.token` is the
+  # `API_TOKEN` entry. A service token is config-scoped, so project and
+  # config are only needed with broader tokens.
+  class DopplerProvider
+    def initialize(opts = nil)
+      @opts = opts || {}
+      @values = nil
+    end
+
+    def load
+      return @values unless @values.nil?
+
+      addr = (@opts['addr'] || 'https://api.doppler.com').sub(%r{/\z}, '')
+      VoxgigSekreto.checkaddr(addr)
+
+      url = addr + '/v3/configs/config/secrets/download?format=json'
+      url += '&project=' + VoxgigSekreto.uriescape(@opts['project']) if VoxgigSekreto.given(@opts['project'])
+      url += '&config=' + VoxgigSekreto.uriescape(@opts['config']) if VoxgigSekreto.given(@opts['config'])
+
+      status, body = VoxgigSekreto.fetchjson(
+        'GET', url, { 'authorization' => 'Bearer ' + (@opts['token'] || '') }
+      )
+
+      raise SekretoError, 'sekreto: doppler error: ' + status.to_s if 200 != status || !body.is_a?(Hash)
+
+      @values = {}
+      body.each { |key, value| @values[key] = value.to_s unless value.nil? }
+
+      @values
+    end
+
+    def lookup(name)
+      load[VoxgigSekreto.envkey(name)]
+    end
+
+    def describe
+      return 'doppler' unless VoxgigSekreto.given(@opts['project'])
+
+      'doppler:' + @opts['project'] + '/' + (@opts['config'] || '')
+    end
+  end
+
+  module Plugins
+    # The plugin: the `doppler` provider kind, as a voxgig/plugin
+    # definition.
+    DOPPLER = VoxgigSekreto.providerplugin('doppler', lambda { |spec|
+      DopplerProvider.new(spec.slice('token', 'project', 'config', 'addr'))
+    })
+  end
+end