@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/version.clj

@@ -0,0 +1,90 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/version.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin.version
+  "Versions and ranges (section 11.2).
+
+  TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
+  concrete version. A requirement declares `range`. A requirement is
+  satisfied when the names match, the `match` passes, and the provider's
+  `version` falls inside the requirement's `range`.
+
+  That is the whole rule. There is no third field and no second comparison
+  - an earlier draft added a provider-side `compat` range, which left
+  three values and no statement of how they combine, and three defensible
+  readings of one declaration is worse than the ambiguity it was
+  introduced to fix."
+  (:require [voxgig.plugin.types :as t]))
+
+(def ^:private version-re #"\A(\d+)(?:\.(\d+))?(?:\.(\d+))?\z")
+
+(def component-max
+  "A COMPONENT IS BOUNDED, and the bound is the model's, not the host
+  language's. Clojure promotes past a long and javascript stops being
+  exact past 2**53, so `9223372036854775808.0.0` parsed to an exact value
+  here and a rounded one there. 2**31-1 is the smallest bound every target
+  language holds exactly, which makes it the model's."
+  2147483647)
+
+(defn- component [digits whole field]
+  (let [value (bigint digits)]
+    (when (< component-max value)
+      (t/fail "plugin_bad_range"
+              (str "version component out of range in " whole ": " digits)
+              {field whole}))
+    (long value)))
+
+(defn parse-range
+  "Two forms and no more (section 11.2):
+
+    '2.1'    >= 2.1.0 and < 3.0.0
+    '~2.1'   >= 2.1.0 and < 2.2.0"
+  [range]
+  (when-not (and (string? range) (seq range))
+    (t/fail "plugin_bad_range" (str "invalid range: " range) {"range" range}))
+  (let [tilde (.startsWith ^String range "~")
+        body (if tilde (subs range 1) range)
+        m (re-matches version-re body)]
+    (when (nil? m)
+      (t/fail "plugin_bad_range" (str "invalid range: " range) {"range" range}))
+    (let [major (component (m 1) range "range")
+          minor (if (nil? (m 2)) 0 (component (m 2) range "range"))
+          patch (if (nil? (m 3)) 0 (component (m 3) range "range"))]
+      {"lo" [major minor patch]
+       "hi" (if tilde [major (inc minor) 0] [(inc major) 0 0])})))
+
+(defn parse-version [version]
+  (when-not (string? version)
+    (t/fail "plugin_bad_range" (str "invalid version: " version) {"version" version}))
+  (let [m (re-matches version-re version)]
+    (when (nil? m)
+      (t/fail "plugin_bad_range" (str "invalid version: " version) {"version" version}))
+    [(component (m 1) version "version")
+     (if (nil? (m 2)) 0 (component (m 2) version "version"))
+     (if (nil? (m 3)) 0 (component (m 3) version "version"))]))
+
+(defn version-cmp [a b]
+  (or (first (for [i (range 3)
+                   :let [x (or (get a i) 0) y (or (get b i) 0)]
+                   :when (not= x y)]
+               (if (< x y) -1 1)))
+      0))
+
+(defn satisfies-range?
+  "The one satisfaction predicate: lo <= version < hi."
+  [version range]
+  (let [v (parse-version version)
+        r (parse-range range)]
+    (and (>= (version-cmp v (r "lo")) 0) (neg? (version-cmp v (r "hi"))))))
+
+(defn satisfies-q?
+  "`satisfies-range?` for the internal callers that treat an unparseable
+  version or range as \"does not satisfy\" - Capability and Graph, both of
+  which run over data the corpus has already admitted."
+  [version range]
+  (try (satisfies-range? version range) (catch clojure.lang.ExceptionInfo _ false)))
+
+(defn version-parts
+  "The numeric parts of a version, or zeros - a SORT KEY, never a check."
+  [text]
+  (try (parse-version text) (catch clojure.lang.ExceptionInfo _ [0 0 0])))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin.clj

@@ -0,0 +1,40 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin
+  "The canonical surface `make parity` checks (AGENTS.md section 4). Small
+  on purpose (section 19): everything else is functions on the host and
+  instance types, because a library that grows a second public entry point
+  per feature is a library twenty ports pay for twice.
+
+  ELEVEN NAMES, AND THEY ARE ALIASES RATHER THAN DEFINITIONS - a plain
+  `def` of the function value, not a wrapper that forwards. The
+  implementation lives in the namespace named for its design section, so a
+  reader who arrives at `resolve-order` from the corpus lands in
+  `voxgig.plugin.order` where section 7 is quoted. No `potemkin`: section
+  16 permits one runtime dependency, and importing vars prettily is not
+  what it is for."
+  (:require [voxgig.plugin.catalog :as catalog]
+            [voxgig.plugin.config :as config]
+            [voxgig.plugin.env :as env]
+            [voxgig.plugin.host :as host]
+            [voxgig.plugin.order :as order]
+            [voxgig.plugin.ref :as ref]
+            [voxgig.plugin.resolve :as resolve]))
+
+;; host construction
+(def make-host host/make-host)
+(def make-catalog catalog/make-catalog)
+
+;; refs - the first thing a new port implements (section 4)
+(def parse-ref ref/parse-ref)
+(def format-ref ref/format-ref)
+(def check-name ref/check-name)
+(def check-tag ref/check-tag)
+
+;; pure functions over documents and definitions
+(def normalize-config config/normalize-config)
+(def resolve-options config/resolve-options)
+(def resolve-order order/resolve-order)
+(def resolve-candidates resolve/resolve-candidates)
+(def apply-env env/apply-env)

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/addr.clj

@@ -0,0 +1,111 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/addr.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; Refusing to send a secret-bearing credential in the clear.
+;;
+;; IN THE CORE, not with the plugins that call it. Every plugin that opens
+;; a socket guards its configured address here, and one rule that answers
+;; the same in every port is worth more than a rule each store's client
+;; carries its own copy of.
+;;
+;; A port of typescript/src/provider/addr.ts, which is canonical.
+
+(ns voxgig.sekreto.addr
+  (:require [clojure.string :as string]
+            [voxgig.sekreto.core :as core])
+  (:import [java.util Locale]))
+
+(defn- authorityend
+  "Where an address's authority ends: the position of the first `/`, `?` or
+  `#`, or nil for none. The EARLIEST of the three - looking for them one
+  after another instead answers with whichever was asked about first, so
+  `http://host?a=/b` would be read as having the authority `host?a=`."
+  [text]
+  (let [marks (keep (fn [ch] (string/index-of text ch)) ["/" "?" "#"])]
+    (when (seq marks) (apply min marks))))
+
+(defn safeaddr
+  "An address with any userinfo replaced by `[redacted]`, for messages.
+
+  Every refusal below names the address it refused, and one of them fires
+  precisely because the address carries a credential - so printing it
+  verbatim wrote the password to stderr and into the logs. It cannot be
+  cleaned up afterwards either: that password was never resolved as a
+  secret, so redaction has never seen it and never will. The host is what a
+  reader needs to identify which chain entry is at fault; the userinfo is
+  not."
+  [addr]
+  (let [mark (string/index-of addr "://")]
+    (if (nil? mark)
+      addr
+      (let [rest (subs addr (+ mark 3))
+            stop (authorityend rest)
+            authority (if (nil? stop) rest (subs rest 0 stop))
+            at (string/last-index-of authority "@")]
+        (if (nil? at)
+          addr
+          (str (subs addr 0 (+ mark 3)) "[redacted]" (subs addr (+ mark 3 at))))))))
+
+(defn checkaddr
+  "Refuse to send a secret-bearing credential in the clear.
+
+  A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+  convenience. Sending a token over http to anything but the local machine
+  puts both the token and the secret it fetches on the wire for anyone on
+  the path, so sekreto will not do it. Loopback stays allowed: that is
+  `vault server -dev`, `boru vault serve`, and this repo's own test harness.
+
+  The address is read by hand, in the same handful of steps in every port,
+  rather than by each platform's URL parser. That is deliberate. A dozen
+  parsers disagree about malformed input - where userinfo ends, whether
+  `0177.0.0.1` is loopback, what an unclosed bracket means - and a check
+  that answers differently in different ports is not a check.
+
+  The rule this parse obeys, and the reason it can be trusted: it is never
+  more permissive than the HTTP client that will dial the address. It ends
+  the authority at `/`, `?` or `#` only, so a client that also breaks on
+  `\\` (WHATWG does) can only ever see a SHORTER host than this does. It
+  refuses userinfo outright rather than locating its end. It compares the
+  host literally, so a numeric form no parser here agrees on is refused
+  rather than guessed at."
+  [addr]
+  (let [scheme (cond
+                 (string/starts-with? addr "https://") "https://"
+                 (string/starts-with? addr "http://") "http://"
+                 :else (throw (core/sekretoerror
+                               (str "sekreto: not an http(s) address: " (safeaddr addr)))))
+        rest (subs addr (count scheme))
+        stop (authorityend rest)
+        authority (if (nil? stop) rest (subs rest 0 stop))]
+
+    ;; Userinfo is refused outright rather than parsed around, and on https
+    ;; as well as http. No store this library speaks authenticates by
+    ;; userinfo - they take a token or a signature - so an address carrying
+    ;; one is a mistake at best. At worst it is the attack this whole
+    ;; function exists to stop: `http://localhost:8200@evil.example.com/` is
+    ;; a request to evil.example.com that reads, to anything that splits the
+    ;; authority on ':', as loopback.
+    (when (string/includes? authority "@")
+      (throw (core/sekretoerror
+              (str "sekreto: refusing an address with embedded credentials: " (safeaddr addr)))))
+
+    ;; An opening bracket with no closing one is not an address at all.
+    (when (and (string/starts-with? authority "[") (not (string/includes? authority "]")))
+      (throw (core/sekretoerror
+              (str "sekreto: not a valid http(s) address: " (safeaddr addr)))))
+
+    (when (not= "https://" scheme)
+      ;; A bracketed IPv6 literal keeps its brackets. Splitting the
+      ;; authority on the first colon yields '[', so `http://[::1]:8200`
+      ;; could never match - which made the '[::1]' entry below unreachable,
+      ;; and refused a legitimate local vault.
+      (let [host (.toLowerCase
+                  ^String (if (string/starts-with? authority "[")
+                            (subs authority 0 (inc (string/index-of authority "]")))
+                            (apply str (take-while (fn [ch] (not= \: ch)) authority)))
+                  Locale/ROOT)]
+        (when-not (contains? #{"localhost" "127.0.0.1" "::1" "[::1]"} host)
+          (throw (core/sekretoerror
+                  (str "sekreto: refusing to send a token in plaintext to "
+                       (safeaddr addr) " (use https)"))))))))
+

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/chain.clj

@@ -0,0 +1,297 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/chain.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; The chain: a Sekreto is an ordered list of providers on a voxgig/plugin
+;; host. `get` asks each in turn and returns the first hit, so an app can be
+;; configured from environment variables in development and a vault in
+;; production without changing a line of its own code.
+;;
+;; THIS NAMESPACE REQUIRES NO PLUGIN, IN ANY FORM. The four built-in kinds
+;; - env, memory, dotenv, file - read at most a local file; every other kind
+;; is a voxgig/plugin definition under `plugins/`, and a chain may name one
+;; only if the calling project handed it in through `:plugins`. That is what
+;; keeps an SDK whose chain is `[dotenv env]` from carrying AWS request
+;; signing and seven HTTP vault clients. See
+;; docs/design/plugin-providers.md.
+;;
+;; What is plugin's and what is sekreto's:
+;;
+;;   plugin owns  the catalog, the instances, name+tag addressing, the
+;;                lifecycle, and the options each instance was declared
+;;                with.
+;;   sekreto owns the walk - reading each instance's exported provider off
+;;                the host and asking them in order.
+;;
+;; A port of typescript/src/Sekreto.ts, which is canonical.
+
+(ns voxgig.sekreto.chain
+  (:refer-clojure :exclude [get])
+  (:require [clojure.string :as string]
+            [voxgig.sekreto.core :as core]
+            [voxgig.sekreto.json :as json]
+            [voxgig.sekreto.provider :as provider]
+            [voxgig.sekreto.providers :as providers]
+            [voxgig.plugin :as plugin]
+            [voxgig.plugin.catalog :as catalog]
+            [voxgig.plugin.host :as host]))
+
+(defn storename
+  "The store name a LIVE provider answers to.
+
+  `describe` opens with the provider's kind - `hashicorp:...`,
+  `dotenv:...`, plain `env` - so the kind is the natural default, and a
+  custom provider gets a sensible name without implementing anything extra.
+  A spec'd provider's store is its `:name` or its `:kind`, decided before
+  the provider exists."
+  [prov]
+  (apply str (take-while (fn [ch] (not= \: ch)) (provider/describe prov))))
+
+(defn- definition
+  "A plugin entry, checked to be a definition before the catalog sees it.
+
+  A definition is a map; a namespace and a symbol naming one are the two
+  ways to hand over the container instead of the thing inside it, and both
+  are refused here rather than deep inside voxgig/plugin with a message
+  about a definition name."
+  [plugin]
+  (cond
+    (map? plugin) plugin
+
+    (or (instance? clojure.lang.Namespace plugin) (symbol? plugin))
+    (let [named (str (if (instance? clojure.lang.Namespace plugin) (ns-name plugin) plugin))]
+      (throw (core/sekretoerror
+              (str "sekreto: not a plugin definition: the namespace " named
+                   " - a plugin is a definition in it, such as "
+                   named "/" (last (string/split named #"\."))
+                   ", or voxgig.sekreto.plugins/ALL for every one"))))
+
+    :else
+    (throw (core/sekretoerror (str "sekreto: not a plugin definition: " (pr-str plugin))))))
+
+(defn- unknownkind
+  "The message for a kind the catalog does not hold.
+
+  A kind sekreto has never heard of is a typo; a kind that exists as a
+  plugin but was not passed in is the split working as designed and telling
+  you what to pass. Collapsing the two was the first thing that made the
+  split confusing to use."
+  [kind cat]
+  (str "sekreto: unknown provider kind: " (str kind)
+       " (available: " (string/join ", " (catalog/definition-names cat)) ")"
+       (when (some (fn [known] (= known kind)) (:plugin providers/KINDS))
+         (str " - " kind " is a sekreto plugin, not built in:"
+              " pass it in the plugins option"))))
+
+(defn- unwrap
+  "A sekreto error that crossed the plugin boundary comes back out as
+  itself, byte for byte. Anything else is not sekreto's to rewrite."
+  [err]
+  (let [data (ex-data err)
+        cause (clojure.core/get (:details data) "cause")]
+    (if (and (= providers/ERROR-CODE (:code data)) (string? cause))
+      (core/sekretoerror cause)
+      err)))
+
+(defrecord Sekreto [host catalog entries docache cache seen])
+
+(defn- declareone
+  "One chain entry, as a plugin instance.
+
+  The instance is `kind` for a store named after its kind and `kind$store`
+  otherwise - `hashicorp$prod` - so `host/list` reads like the chain. A
+  store name that is already taken gets a numbered tag from the host
+  instead, because two providers MAY share a store name (a directed read
+  walks both) and an instance ref may not."
+  [secrets spec]
+  (let [cat (:catalog secrets)
+        h (:host secrets)
+        kind (when (map? spec) (:kind spec))]
+
+    (when (or (nil? kind) (not (catalog/has-definition? cat kind)))
+      (throw (core/sekretoerror (unknownkind kind cat))))
+
+    (let [store (or (core/notempty (:name spec)) kind)]
+
+      (when-not (plugin/check-tag store)
+        (throw (core/sekretoerror (str "sekreto: invalid store name: " store))))
+
+      (let [want (if (= store kind) kind (plugin/format-ref kind store))
+            taken (some? (host/instance h want))
+
+            ref (try
+                  ;; `load` runs the definition's `define`, which builds the
+                  ;; provider from the spec; `activate` takes the instance
+                  ;; live. Nothing is contacted by either: a provider opens
+                  ;; nothing until its first lookup.
+                  (let [entry (if taken
+                                (host/load h kind {"tag" "?" "options" spec})
+                                (host/load h want {"options" spec}))
+                        rf (entry "ref")]
+                    (host/activate h rf)
+                    rf)
+                  (catch Exception err (throw (unwrap err))))
+
+            built (host/exports h (str ref "/" providers/PROVIDER-EXPORT))]
+
+        ;; A definition that exported no provider is not a provider kind.
+        ;; Left alone it would answer every lookup with a nil pointer, one
+        ;; layer further down and with nothing naming the plugin at fault.
+        (when-not (satisfies? provider/Provider built)
+          (throw (core/sekretoerror
+                  (str "sekreto: not a provider plugin: " kind
+                       " - a provider kind is made by providerplugin"))))
+
+        {:store store :ref ref :provider built}))))
+
+(defn make
+  "A Sekreto from a chain of providers.
+
+  Each entry is a declarative spec - a map whose `:kind` picks the provider
+  kind and whose other keys are that kind's own - or a live provider,
+  anything satisfying the `Provider` protocol.
+
+  `:plugins` is the provider kinds beyond the four built-ins that the chain
+  may name, as voxgig/plugin definitions. Static and explicit: the calling
+  project requires the plugins it needs and passes them here, and a kind it
+  did not pass is unknown to this Sekreto. `:cache` turns the read cache
+  off, which the spec's chain groups do so that each entry starts clean."
+  ([entries] (make entries nil))
+  ([entries {:keys [plugins cache] :or {cache true}}]
+   ;; Built-ins first, then the plugins, into one catalog: a plugin that
+   ;; names a built-in kind replaces it, which is how a host substitutes an
+   ;; implementation and never an accident, because the four names are
+   ;; documented.
+   (let [cat (plugin/make-catalog (into (vec providers/BUILTINS)
+                                        (map definition (or plugins []))))
+         secrets (->Sekreto
+                  (plugin/make-host {"catalog" cat})
+                  cat
+                  (atom [])
+                  (not (false? cache))
+                  ;; A vector, not a map: the store a value came from stays
+                  ;; attached, and redaction order does not vary between
+                  ;; runs.
+                  (atom [])
+                  ;; Every value ever resolved, for `redactall`. Kept
+                  ;; independently of the read cache so that redaction still
+                  ;; works when the cache is off - otherwise an uncached
+                  ;; Sekreto would silently disable redaction and leak
+                  ;; secrets to logs.
+                  (atom []))]
+
+     (reset! (:entries secrets)
+             (mapv (fn [entry]
+                     ;; A live provider is backed by no instance; a spec'd
+                     ;; one is an instance of its kind on the host.
+                     (if (satisfies? provider/Provider entry)
+                       {:store (storename entry) :ref "" :provider entry}
+                       (declareone secrets entry)))
+                   (or entries [])))
+
+     secrets)))
+
+(defn- resolvechain [secrets store name entries]
+  (core/checkname name)
+
+  (let [hit (when (:docache secrets)
+              (some (fn [entry] (when (and (= store (:store entry)) (= name (:name entry))) entry))
+                    @(:cache secrets)))]
+    (if (some? hit)
+      (:value hit)
+      (let [found (some (fn [entry] (provider/lookup (:provider entry) name)) entries)]
+        (when (some? found)
+          (when (:docache secrets)
+            (swap! (:cache secrets) conj {:store store :name name :value found}))
+          (swap! (:seen secrets) conj found))
+        found))))
+
+(defn tryget
+  "The secret, or nil if no provider has it. Named `tryget` because `try`
+  is a Clojure special form."
+  [secrets name]
+  (resolvechain secrets "" name @(:entries secrets)))
+
+(defn get
+  "The secret, or a sekreto error if no provider has it."
+  [secrets name]
+  (let [found (tryget secrets name)]
+    (when (nil? found)
+      (throw (core/sekretoerror (str "sekreto: unknown secret: " name))))
+    found))
+
+(defn tryfrom
+  "The secret from one named store, or nil if that store does not have it.
+
+  Naming a store that is not in the chain is an error, not a miss: `tryget`
+  already means \"this store may not have it\", so it cannot also mean
+  \"this store may not exist\" without hiding a typo."
+  [secrets store name]
+  (let [matching (filterv (fn [entry] (= store (:store entry))) @(:entries secrets))]
+    (when (empty? matching)
+      (throw (core/sekretoerror (str "sekreto: unknown store: " store))))
+    (resolvechain secrets store name matching)))
+
+(defn getfrom
+  "The secret from one named store, or a sekreto error if that store does
+  not have it."
+  [secrets store name]
+  (let [found (tryfrom secrets store name)]
+    (when (nil? found)
+      (throw (core/sekretoerror (str "sekreto: unknown secret: " store ":" name))))
+    found))
+
+(defn has
+  "Does any provider have this secret?"
+  [secrets name]
+  (some? (tryget secrets name)))
+
+(defn hasin
+  "Does this named store have this secret?"
+  [secrets store name]
+  (some? (tryfrom secrets store name)))
+
+(defn all
+  "Every named secret at once, in the order asked. Missing ones are an error."
+  [secrets names]
+  (json/omap (map (fn [name] [name (get secrets name)]) names)))
+
+(defn sources
+  "A description of each provider, in resolution order."
+  [secrets]
+  (mapv (fn [entry] (provider/describe (:provider entry))) @(:entries secrets)))
+
+(defn stores
+  "The name of each store that can be named by `getfrom`, in resolution
+  order and without repeats."
+  [secrets]
+  (vec (distinct (map :store @(:entries secrets)))))
+
+(defn redactall
+  "Replace every value THIS Sekreto has resolved with `[redacted]`.
+
+  Named `redactall` - as in the Perl port - because `redact` is already the
+  pure two-argument function in `voxgig.sekreto.core`, and both take two
+  arguments here.
+
+  Works whether or not caching is enabled: the redaction list is kept
+  independently of the read cache."
+  [secrets text]
+  (core/redact text @(:seen secrets)))
+
+(defn refresh
+  "Drop cached values, so the next `get` asks the providers again."
+  [secrets]
+  (reset! (:cache secrets) [])
+  nil)
+
+(defn close
+  "Tear the chain down: every plugin instance is deactivated and unloaded,
+  in reverse, releasing whatever a provider acquired at activation.
+  Afterwards there is nothing to read from - `get` reports every secret
+  unknown - and the cache is dropped, though `redactall` still knows every
+  value that was ever resolved."
+  [secrets]
+  (host/close (:host secrets))
+  (reset! (:entries secrets) [])
+  (reset! (:cache secrets) [])
+  nil)