@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/gcpsecrets.rb

@@ -0,0 +1,107 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/gcpsecrets.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The gcpsecrets plugin: GCP Secret Manager. Needs HTTPS. A port of
+# typescript/plugins/gcpsecrets.ts, which is canonical.
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  # GCP Secret Manager.
+  #
+  # `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+  # Manager ids have no hierarchy and reject dots), latest version. The
+  # token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+  # GCE/GKE metadata server - so on Google's own platform no credential
+  # configuration is needed at all.
+  #
+  # The metadata call itself is plain http to a link-local host by
+  # platform design; no credential rides on it, so `checkaddr` guards the
+  # Secret Manager address instead.
+  class GcpsecretsProvider
+    def initialize(opts = nil)
+      @opts = opts || {}
+
+      # A configured token is kept forever; a metadata-server token carries
+      # expires_in and is renewed shortly before it runs out.
+      @livetoken = nil
+      @renewat = Float::INFINITY
+    end
+
+    def metadataaddr
+      return @opts['metadataaddr'] if VoxgigSekreto.given(@opts['metadataaddr'])
+
+      host = ENV.fetch('GCE_METADATA_HOST', nil)
+      VoxgigSekreto.given(host) ? 'http://' + host : 'http://metadata.google.internal'
+    end
+
+    def login
+      configured = @opts['token'] || ENV.fetch('GOOGLE_OAUTH_ACCESS_TOKEN', nil)
+      return configured if VoxgigSekreto.given(configured)
+
+      url = metadataaddr.sub(%r{/\z}, '') +
+            '/computeMetadata/v1/instance/service-accounts/default/token'
+
+      status, body = VoxgigSekreto.fetchjson('GET', url, { 'Metadata-Flavor' => 'Google' })
+
+      got = body.is_a?(Hash) ? body['access_token'] : nil
+      unless 200 == status && VoxgigSekreto.given(got)
+        raise SekretoError, 'sekreto: gcp: no token and metadata server did not answer'
+      end
+
+      expires = body['expires_in'].to_f
+      @renewat = 0 < expires ? Time.now.to_f + [expires - 60, 1].max : Float::INFINITY
+
+      got.to_s
+    end
+
+    def lookup(name)
+      project = @opts['project'] || ''
+      raise SekretoError, 'sekreto: gcp: no project' if '' == project
+
+      addr = @opts['addr'] || 'https://secretmanager.googleapis.com'
+      VoxgigSekreto.checkaddr(addr)
+
+      @livetoken = login if @livetoken.nil? || Time.now.to_f >= @renewat
+
+      url = addr.sub(%r{/\z}, '') + '/v1/projects/' + project + '/secrets/' +
+            VoxgigSekreto.flatname(name, '_') + '/versions/latest:access'
+
+      status, body = VoxgigSekreto.fetchjson('GET', url,
+                                             { 'authorization' => 'Bearer ' + @livetoken })
+
+      return nil if 404 == status
+
+      raise SekretoError, 'sekreto: gcp error: ' + status.to_s + ': ' + url if 200 != status
+
+      data = body.is_a?(Hash) && body['payload'].is_a?(Hash) ? body['payload']['data'] : nil
+      return nil unless data.is_a?(String)
+
+      # See the aws provider: strict, and an undecodable payload is an
+      # error rather than a miss.
+      decoded = begin
+        data.unpack1('m0')
+      rescue ArgumentError
+        raise SekretoError, 'sekreto: gcp: undecodable secret'
+      end
+
+      decoded.force_encoding('UTF-8')
+    end
+
+    def describe
+      'gcpsecrets:' + (@opts['project'] || '')
+    end
+  end
+
+  module Plugins
+    # The plugin: the `gcpsecrets` provider kind, as a voxgig/plugin
+    # definition.
+    GCPSECRETS = VoxgigSekreto.providerplugin('gcpsecrets', lambda { |spec|
+      GcpsecretsProvider.new(spec.slice('project', 'token', 'addr', 'metadataaddr'))
+    })
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/hashicorp.rb

@@ -0,0 +1,137 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/hashicorp.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The hashicorp plugin: HashiCorp Vault, and OpenBao. Needs HTTPS, and
+# the filesystem for a kubernetes service-account JWT. A port of
+# typescript/plugins/hashicorp.ts, which is canonical.
+
+require 'json'
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  # HashiCorp Vault.
+  #
+  # KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
+  # and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+  # `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
+  # "not here" - a miss - so a vault can sit in a chain with fallbacks.
+  #
+  # A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+  # logins as well as reads.
+  #
+  # Instead of being handed a token, the provider can log in: Kubernetes
+  # auth (the pod's service-account JWT, from its conventional path) or
+  # AppRole. A failed login is an error, never a miss - it means this
+  # store could not answer at all.
+  class HashicorpProvider
+    def initialize(addr, token, options = nil)
+      opts = options || {}
+      @addr = addr
+      @mount = opts['mount'] || 'secret'
+      @kv = opts['kv'] || 2
+      @vaultnamespace = opts['vaultnamespace']
+      @auth = opts['auth']
+
+      # A version typo like kv: 3 must not quietly behave as v2 and turn
+      # its 404s into misses; there is nothing safe to assume it meant.
+      if 1 != @kv && 2 != @kv
+        raise SekretoError, 'sekreto: hashicorp: unsupported kv version: ' + @kv.to_s
+      end
+
+      # The working token: a configured token is kept forever, a logged-in
+      # token is renewed shortly before its lease runs out - a long-running
+      # process must not keep presenting a token the vault already expired.
+      @livetoken = VoxgigSekreto.given(token) ? token : nil
+      @renewat = Float::INFINITY
+    end
+
+    def baseheaders
+      headers = {}
+      headers['X-Vault-Namespace'] = @vaultnamespace if @vaultnamespace
+      headers
+    end
+
+    def login
+      raise SekretoError, 'sekreto: hashicorp: no token and no auth method' if @auth.nil?
+
+      method = @auth['method']
+      mount = @auth['mount'] || method
+      url = @addr.sub(%r{/\z}, '') + '/v1/auth/' + mount.to_s + '/login'
+
+      body = if 'kubernetes' == method
+               jwt = @auth['jwt']
+               if jwt.nil?
+                 file = @auth['jwtfile'] || '/var/run/secrets/kubernetes.io/serviceaccount/token'
+                 jwt = begin
+                   File.read(file).strip
+                 rescue StandardError
+                   raise SekretoError, 'sekreto: hashicorp: cannot read jwt file ' + file
+                 end
+               end
+               { 'role' => @auth['role'] || '', 'jwt' => jwt }
+             elsif 'approle' == method
+               { 'role_id' => @auth['roleid'] || '', 'secret_id' => @auth['secretid'] || '' }
+             else
+               raise SekretoError, 'sekreto: hashicorp: unknown auth method: ' + method.to_s
+             end
+
+      status, resbody = VoxgigSekreto.fetchjson('POST', url, baseheaders, JSON.generate(body))
+
+      got = resbody.is_a?(Hash) && resbody['auth'].is_a?(Hash) ? resbody['auth']['client_token'] : nil
+      unless 200 == status && VoxgigSekreto.given(got)
+        raise SekretoError, 'sekreto: hashicorp login failed: ' + status.to_s + ': ' + url
+      end
+
+      lease = resbody['auth']['lease_duration'].to_f
+      @renewat = 0 < lease ? Time.now.to_f + [lease - 60, 1].max : Float::INFINITY
+
+      got.to_s
+    end
+
+    def lookup(name)
+      VoxgigSekreto.checkaddr(@addr)
+
+      @livetoken = login if @livetoken.nil? || Time.now.to_f >= @renewat
+
+      ref = VoxgigSekreto.vaultref(name)
+      base = @addr.sub(%r{/\z}, '') + '/v1/' + @mount
+      url = 1 == @kv ? base + '/' + ref['path'] : base + '/data/' + ref['path']
+
+      headers = baseheaders
+      headers['X-Vault-Token'] = @livetoken
+
+      status, body = VoxgigSekreto.fetchjson('GET', url, headers)
+
+      return nil if 404 == status
+
+      raise SekretoError, 'sekreto: hashicorp error: ' + status.to_s + ': ' + url if 200 != status
+
+      data = if 1 == @kv
+               body.is_a?(Hash) ? body['data'] : nil
+             else
+               body.is_a?(Hash) && body['data'].is_a?(Hash) ? body['data']['data'] : nil
+             end
+      value = data.is_a?(Hash) ? data[ref['field']] : nil
+
+      value.nil? ? nil : value.to_s
+    end
+
+    def describe
+      'hashicorp:' + @addr + '/' + @mount
+    end
+  end
+
+  module Plugins
+    # The plugin: the `hashicorp` provider kind, as a voxgig/plugin
+    # definition.
+    HASHICORP = VoxgigSekreto.providerplugin('hashicorp', lambda { |spec|
+      HashicorpProvider.new(spec['addr'] || '', spec['token'] || '',
+                            spec.slice('mount', 'kv', 'vaultnamespace', 'auth'))
+    })
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/httpjson.rb

@@ -0,0 +1,136 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/httpjson.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The HTTP half of every plugin that speaks to a store over the wire, in
+# one place and OUTSIDE the core: a chain of built-ins never requires this
+# file. One JSON round-trip, bounded in time and in size, refusing
+# redirects and ignoring proxies; and the small helpers every store client
+# needs.
+#
+# `uriescape` lives here rather than with sigv4 because four plugins that
+# never sign anything need it - azure, 1password, doppler, infisical - and
+# reaching it through sigv4 would make each of them require openssl. It is
+# RFC 3986 escaping, which is stricter than Ruby's own encoders: AWS wants
+# `!`, `'`, `(`, `)` and `*` escaped too, and CGI.escape writes a space as
+# `+`.
+#
+# A port of typescript/plugins/httpjson.ts, which is canonical.
+
+require 'json'
+require 'net/http'
+require 'uri'
+
+require_relative '../../voxgig_sekreto'
+
+module VoxgigSekreto
+  # How long any single vault round-trip may take before it is treated
+  # as unreachable. Ports carry the same bound.
+  HTTP_TIMEOUT = 10
+
+  # How much of a response body will be read before the store is treated as
+  # having answered incoherently. Ports carry the same bound.
+  #
+  # Far above anything real - the largest legitimate payload this library
+  # fetches is Doppler's whole-config download, measured in kilobytes. A
+  # bound is needed because the TIMEOUT is not one: ten seconds on a
+  # loopback or datacentre link is gigabytes, and the body is accumulated in
+  # memory before it is parsed. This runs on an application's startup path,
+  # so the failure is the application never starting.
+  HTTP_MAXBODY = 8 * 1024 * 1024
+
+  module_function
+
+  # One JSON round-trip, returning [status, parsed-json-or-nil]. A 404 is
+  # a normal answer here, not an exception: callers decide on status
+  # first. Network failure is always an error - an unreachable store is a
+  # store that could not answer.
+  def fetchjson(method, url, headers, body = nil)
+    uri = URI.parse(url)
+
+    request = 'POST' == method ? Net::HTTP::Post.new(uri) : Net::HTTP::Get.new(uri)
+    headers.each { |key, value| request[key] = value }
+    request.body = body unless body.nil?
+
+    # Declared out here: the streaming block below fills it, and a variable
+    # first assigned inside the block would not survive it.
+    text = +''
+
+    response = begin
+      # The two nils are the proxy address and port: a secrets client dials
+      # the address it was configured with and nowhere else. Left off, this
+      # defaults to :ENV and reads http_proxy. Ruby's resolver does exempt
+      # loopback, so the local dev vault was never exposed - but the GCP and
+      # Azure metadata endpoints are not loopback, and the tokens they return
+      # would have gone through the proxy.
+      #
+      # The timeouts are the canonical port's 10s bound. Left off, Net::HTTP
+      # defaults to 60 - six times that - so a vault that accepted the
+      # connection and then said nothing held an application's startup for a
+      # minute per request. Measured before this: still blocked at 35s where
+      # every other port had given up at 10.
+      # max_retries: 0 because Net::HTTP retries an idempotent request once
+      # by default, which quietly doubled the bound above - measured at 20s
+      # against a silent server, not the 10 the constant says. A vault read
+      # is not something to repeat on its own initiative either: the caller
+      # decides whether a store that could not answer is worth asking again.
+      Net::HTTP.start(uri.hostname, uri.port, nil, nil,
+                      use_ssl: 'https' == uri.scheme,
+                      open_timeout: HTTP_TIMEOUT,
+                      read_timeout: HTTP_TIMEOUT,
+                      write_timeout: HTTP_TIMEOUT,
+                      max_retries: 0) do |http|
+        # Streamed against HTTP_MAXBODY rather than taking response.body,
+        # which buffers whatever arrives. An endless body would otherwise be
+        # accumulated in memory until the deadline, which on a loopback or
+        # datacentre link is gigabytes.
+        http.request(request) do |res|
+          res.read_body do |chunk|
+            text << chunk
+            if HTTP_MAXBODY < text.bytesize
+              raise SekretoError,
+                    'sekreto: oversized response from ' + url.split('?')[0]
+            end
+          end
+          res
+        end
+      end
+    rescue SekretoError
+      # An endless body is a store that could not answer, so this propagates
+      # rather than becoming a miss - the latter would fall through to a
+      # weaker store on an attacker's cue.
+      raise
+    rescue StandardError => e
+      raise SekretoError, 'sekreto: cannot reach ' + url.split('?')[0] + ': ' + e.message
+    end
+
+    parsed = begin
+      JSON.parse(text)
+    rescue JSON::ParserError, TypeError
+      # A success status promised JSON; a body that does not parse means
+      # the store could not answer coherently, and treating it as a miss
+      # would fall through to a weaker store. Error statuses may carry
+      # any body - they are decided on status alone.
+      if 200 == response.code.to_i
+        raise SekretoError, 'sekreto: malformed response from ' + url.split('?')[0]
+      end
+
+      nil
+    end
+
+    [response.code.to_i, parsed]
+  end
+
+  # RFC 3986 escaping, which is stricter than most library encoders: AWS
+  # wants `!`, `'`, `(`, `)` and `*` escaped too.
+  def uriescape(text)
+    text.to_s.gsub(/[^A-Za-z0-9\-_.~]/) do |ch|
+      ch.bytes.map { |byte| format('%%%02X', byte) }.join
+    end
+  end
+
+  def uridecode(text)
+    text.gsub(/%([0-9A-Fa-f]{2})/) { [Regexp.last_match(1)].pack('H2') }
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/infisical.rb

@@ -0,0 +1,97 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/infisical.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The infisical plugin: Infisical. Needs HTTPS. A port of
+# typescript/plugins/infisical.ts, which is canonical.
+
+require 'json'
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  # Infisical.
+  #
+  # `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+  # convention is environment-style keys) at a secret path in one
+  # environment of a project. Auth is a token, or a universal-auth
+  # (machine identity) login with clientid/clientsecret.
+  class InfisicalProvider
+    def initialize(opts = nil)
+      @opts = opts || {}
+
+      # A configured token is kept forever; a universal-auth token carries
+      # expiresIn and is renewed shortly before it runs out.
+      @livetoken = nil
+      @renewat = Float::INFINITY
+    end
+
+    def login(addr)
+      return @opts['token'] if VoxgigSekreto.given(@opts['token'])
+
+      unless VoxgigSekreto.given(@opts['clientid']) && VoxgigSekreto.given(@opts['clientsecret'])
+        raise SekretoError, 'sekreto: infisical: no token and no client credentials'
+      end
+
+      status, body = VoxgigSekreto.fetchjson(
+        'POST', addr + '/api/v1/auth/universal-auth/login',
+        { 'content-type' => 'application/json' },
+        JSON.generate('clientId' => @opts['clientid'], 'clientSecret' => @opts['clientsecret'])
+      )
+
+      got = body.is_a?(Hash) ? body['accessToken'] : nil
+      unless 200 == status && VoxgigSekreto.given(got)
+        raise SekretoError, 'sekreto: infisical login failed: ' + status.to_s
+      end
+
+      expires = body['expiresIn'].to_f
+      @renewat = 0 < expires ? Time.now.to_f + [expires - 60, 1].max : Float::INFINITY
+
+      got.to_s
+    end
+
+    def lookup(name)
+      addr = (@opts['addr'] || 'https://app.infisical.com').sub(%r{/\z}, '')
+      VoxgigSekreto.checkaddr(addr)
+
+      project = @opts['project'] || ''
+      environment = @opts['environment'] || ''
+      if '' == project || '' == environment
+        raise SekretoError, 'sekreto: infisical: no project/environment'
+      end
+
+      @livetoken = login(addr) if @livetoken.nil? || Time.now.to_f >= @renewat
+
+      url = addr + '/api/v3/secrets/raw/' + VoxgigSekreto.envkey(name) +
+            '?workspaceId=' + VoxgigSekreto.uriescape(project) +
+            '&environment=' + VoxgigSekreto.uriescape(environment) +
+            '&secretPath=' + VoxgigSekreto.uriescape(@opts['path'] || '/')
+
+      status, body = VoxgigSekreto.fetchjson('GET', url,
+                                             { 'authorization' => 'Bearer ' + @livetoken })
+
+      return nil if 404 == status
+
+      raise SekretoError, 'sekreto: infisical error: ' + status.to_s if 200 != status
+
+      value = body.is_a?(Hash) && body['secret'].is_a?(Hash) ? body['secret']['secretValue'] : nil
+      value.nil? ? nil : value.to_s
+    end
+
+    def describe
+      'infisical:' + (@opts['project'] || '') + '/' + (@opts['environment'] || '')
+    end
+  end
+
+  module Plugins
+    # The plugin: the `infisical` provider kind, as a voxgig/plugin
+    # definition.
+    INFISICAL = VoxgigSekreto.providerplugin('infisical', lambda { |spec|
+      InfisicalProvider.new(spec.slice('addr', 'token', 'clientid', 'clientsecret',
+                                       'project', 'environment', 'path'))
+    })
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/onepassword.rb

@@ -0,0 +1,104 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/onepassword.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The onepassword plugin: 1Password, through a Connect server. Needs
+# HTTPS. A port of typescript/plugins/onepassword.ts, which is canonical.
+
+require_relative '../../voxgig_sekreto'
+require_relative '../addr'
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  # 1Password, through a Connect server.
+  #
+  # The item titled `api.token` (titles keep their dots), in the named
+  # vault. The value is the field with purpose PASSWORD, or the field
+  # labelled `value`. A vault that cannot be found is an error - config
+  # names it, so its absence is a broken store, not a missing secret.
+  class OnepasswordProvider
+    def initialize(opts = nil)
+      @opts = opts || {}
+      @vaultid = nil
+    end
+
+    def auth
+      { 'authorization' => 'Bearer ' + (@opts['token'] || '') }
+    end
+
+    def resolvevault(addr)
+      want = @opts['vault'] || ''
+      raise SekretoError, 'sekreto: onepassword: no vault' if '' == want
+
+      status, body = VoxgigSekreto.fetchjson('GET', addr + '/v1/vaults', auth)
+
+      unless 200 == status && body.is_a?(Array)
+        raise SekretoError, 'sekreto: onepassword error: ' + status.to_s + ': listing vaults'
+      end
+
+      body.each do |entry|
+        return entry['id'].to_s if entry.is_a?(Hash) && (want == entry['id'] || want == entry['name'])
+      end
+
+      raise SekretoError, 'sekreto: onepassword: no vault named ' + want
+    end
+
+    def lookup(name)
+      VoxgigSekreto.checkname(name)
+
+      addr = (@opts['addr'] || '').sub(%r{/\z}, '')
+      raise SekretoError, 'sekreto: onepassword: no addr' if '' == addr
+
+      VoxgigSekreto.checkaddr(addr)
+
+      @vaultid = resolvevault(addr) if @vaultid.nil?
+
+      filter = VoxgigSekreto.uriescape('title eq "' + name + '"')
+      status, found = VoxgigSekreto.fetchjson(
+        'GET', addr + '/v1/vaults/' + @vaultid + '/items?filter=' + filter, auth
+      )
+
+      unless 200 == status && found.is_a?(Array)
+        raise SekretoError, 'sekreto: onepassword error: ' + status.to_s + ': finding ' + name
+      end
+
+      return nil if found.empty?
+
+      status, item = VoxgigSekreto.fetchjson(
+        'GET', addr + '/v1/vaults/' + @vaultid + '/items/' + found[0]['id'].to_s, auth
+      )
+
+      if 200 != status
+        raise SekretoError, 'sekreto: onepassword error: ' + status.to_s + ': reading ' + name
+      end
+
+      fields = item.is_a?(Hash) && item['fields'].is_a?(Array) ? item['fields'] : []
+
+      fields.each do |field|
+        next unless field.is_a?(Hash) && 'PASSWORD' == field['purpose']
+
+        return field['value'].nil? ? nil : field['value'].to_s
+      end
+      fields.each do |field|
+        next unless field.is_a?(Hash) && 'value' == field['label']
+
+        return field['value'].nil? ? nil : field['value'].to_s
+      end
+
+      nil
+    end
+
+    def describe
+      'onepassword:' + (@opts['vault'] || '')
+    end
+  end
+
+  module Plugins
+    # The plugin: the `onepassword` provider kind, as a voxgig/plugin
+    # definition.
+    ONEPASSWORD = VoxgigSekreto.providerplugin('onepassword', lambda { |spec|
+      OnepasswordProvider.new(spec.slice('addr', 'token', 'vault'))
+    })
+  end
+end