@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/csharp/feature/secrets/plugins/AzureSecrets.cs

@@ -0,0 +1,195 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/AzureSecrets.cs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Azure Key Vault, as a voxgig/plugin definition.
+//
+// PLUGIN CODE. This file is in the VoxgigSekretoPlugins assembly, which
+// the core does not reference - so nothing here is linked into an
+// application whose chain names only built-in kinds. See
+// docs/design/plugin-providers.md.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Net.Http;
+using System.Text;
+
+using Definition = Voxgig.Plugin.Definition;
+
+namespace Voxgig.Sekreto.Plugins
+{
+    /// <summary>
+    /// Azure Key Vault.
+    ///
+    /// <para>`api.token` reads secret `api-token` (dots flattened to `-`;
+    /// Key Vault names allow nothing else), current version. The token comes
+    /// from config, then a client-credentials login when
+    /// tenant/clientid/clientsecret are given, then the IMDS
+    /// managed-identity endpoint - so on Azure's own platform no credential
+    /// configuration is needed.</para>
+    ///
+    /// <para>As with GCP, the IMDS call is plain http to a link-local host
+    /// by platform design and carries no credential; the login and vault
+    /// addresses are Addr.Check-guarded.</para>
+    /// </summary>
+    public class AzureSecretsProvider : IProvider
+    {
+        private const string Resource = "https://vault.azure.net";
+
+        private readonly string vault;
+        private readonly string token;
+        private readonly string tenant;
+        private readonly string clientid;
+        private readonly string clientsecret;
+        private readonly string loginaddr;
+        private readonly string imdsaddr;
+        private readonly string apiversion;
+
+        // A configured token is kept forever; logged-in and IMDS tokens
+        // carry expires_in and are renewed shortly before they run out.
+        private string livetoken;
+        private DateTimeOffset renewat = DateTimeOffset.MaxValue;
+
+        public AzureSecretsProvider(string vault = null, string token = null, string tenant = null,
+            string clientid = null, string clientsecret = null, string loginaddr = null,
+            string imdsaddr = null, string apiversion = null)
+        {
+            this.vault = vault;
+            this.token = token;
+            this.tenant = tenant;
+            this.clientid = clientid;
+            this.clientsecret = clientsecret;
+            this.loginaddr = loginaddr;
+            this.imdsaddr = imdsaddr;
+            this.apiversion = apiversion;
+        }
+
+        private string Login()
+        {
+            if (!string.IsNullOrEmpty(token))
+            {
+                return token;
+            }
+
+            if (!string.IsNullOrEmpty(tenant) && !string.IsNullOrEmpty(clientid)
+                && !string.IsNullOrEmpty(clientsecret))
+            {
+                string uselogin = string.IsNullOrEmpty(loginaddr)
+                    ? "https://login.microsoftonline.com"
+                    : loginaddr;
+                Addr.Check(uselogin);
+
+                string url = uselogin.TrimEnd('/') + "/" + tenant + "/oauth2/v2.0/token";
+                string form = "grant_type=client_credentials&client_id=" + Url.Encode(clientid)
+                    + "&client_secret=" + Url.Encode(clientsecret)
+                    + "&scope=" + Url.Encode(Resource + "/.default");
+
+                var (status, body) = Http.FetchJson("POST", url,
+                    new Dictionary<string, string>
+                    {
+                        ["content-type"] = "application/x-www-form-urlencoded",
+                    },
+                    form);
+
+                object got = (body as Dictionary<string, object>)?.GetValueOrDefault("access_token");
+                string text = null == got ? null : Convert.ToString(got);
+
+                if (200 != status || string.IsNullOrEmpty(text))
+                {
+                    throw new SekretoError("sekreto: azure login failed: " + status);
+                }
+
+                renewat = Renew.At(
+                    (body as Dictionary<string, object>)?.GetValueOrDefault("expires_in"));
+
+                return text;
+            }
+
+            string imds = (string.IsNullOrEmpty(imdsaddr) ? "http://169.254.169.254" : imdsaddr)
+                .TrimEnd('/')
+                + "/metadata/identity/oauth2/token?api-version=2018-02-01&resource="
+                + Url.Encode(Resource);
+
+            var (imdsstatus, imdsbody) = Http.FetchJson("GET", imds,
+                new Dictionary<string, string> { ["Metadata"] = "true" });
+
+            object found = (imdsbody as Dictionary<string, object>)?.GetValueOrDefault("access_token");
+            string foundtext = null == found ? null : Convert.ToString(found);
+
+            if (200 != imdsstatus || string.IsNullOrEmpty(foundtext))
+            {
+                throw new SekretoError(
+                    "sekreto: azure: no token, no client credentials, and IMDS did not answer");
+            }
+
+            renewat = Renew.At(
+                (imdsbody as Dictionary<string, object>)?.GetValueOrDefault("expires_in"));
+
+            return foundtext;
+        }
+
+        public string Lookup(string name)
+        {
+            if (string.IsNullOrEmpty(vault))
+            {
+                throw new SekretoError("sekreto: azure: no vault");
+            }
+
+            // Only an explicit scheme is a URL; a vault NAMED httpvault must
+            // still become https://httpvault.vault.azure.net.
+            string vaulturl = vault.StartsWith("http://", StringComparison.Ordinal)
+                || vault.StartsWith("https://", StringComparison.Ordinal)
+                ? vault
+                : "https://" + vault + ".vault.azure.net";
+            Addr.Check(vaulturl);
+
+            if (null == livetoken || DateTimeOffset.UtcNow >= renewat)
+            {
+                livetoken = Login();
+            }
+
+            string url = vaulturl.TrimEnd('/') + "/secrets/" + Names.FlatName(name, "-")
+                + "?api-version=" + (string.IsNullOrEmpty(apiversion) ? "7.4" : apiversion);
+
+            var (status, body) = Http.FetchJson("GET", url,
+                new Dictionary<string, string> { ["authorization"] = "Bearer " + livetoken });
+
+            if (404 == status)
+            {
+                return null;
+            }
+
+            if (200 != status)
+            {
+                throw new SekretoError(
+                    "sekreto: azure error: " + status + ": " + url.Split('?')[0]);
+            }
+
+            object value = (body as Dictionary<string, object>)?.GetValueOrDefault("value");
+
+            return null == value ? null : Convert.ToString(value);
+        }
+
+        public string Describe()
+        {
+            return "azuresecrets:" + (vault ?? "");
+        }
+    }
+
+    /// <summary>The <c>azuresecrets</c> provider kind.</summary>
+    public static class AzureSecrets
+    {
+        public static readonly Definition Plugin = Providers.ProviderPlugin(
+            "azuresecrets", spec => new AzureSecretsProvider(
+                Providers.Text(spec.GetValueOrDefault("vault")),
+                Providers.Text(spec.GetValueOrDefault("token")),
+                Providers.Text(spec.GetValueOrDefault("tenant")),
+                Providers.Text(spec.GetValueOrDefault("clientid")),
+                Providers.Text(spec.GetValueOrDefault("clientsecret")),
+                Providers.Text(spec.GetValueOrDefault("loginaddr")),
+                Providers.Text(spec.GetValueOrDefault("imdsaddr")),
+                Providers.Text(spec.GetValueOrDefault("apiversion"))));
+    }
+}

package/project/.sdk/tm/csharp/feature/secrets/plugins/Boru.cs

@@ -0,0 +1,192 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Boru.cs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The boru vault, as a voxgig/plugin definition.
+//
+// PLUGIN CODE. This file is in the VoxgigSekretoPlugins assembly, which
+// the core does not reference - so nothing here is linked into an
+// application whose chain names only built-in kinds. See
+// docs/design/plugin-providers.md.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Net.Http;
+using System.Text;
+
+using Definition = Voxgig.Plugin.Definition;
+
+namespace Voxgig.Sekreto.Plugins
+{
+    /// <summary>
+    /// A boru vault (https://github.com/boru-lang/boru).
+    ///
+    /// <para>Two ways in, both boru's own.</para>
+    ///
+    /// <para>With no addr, the CLI: `boru vault get --reveal &lt;alias&gt;`
+    /// prints the secret on stdout and nothing else. The passphrase is read
+    /// by boru itself from BORU_VAULT_PASSPHRASE; sekreto never accepts it
+    /// as config and never puts it on a command line, where it would show up
+    /// in the process table.</para>
+    ///
+    /// <para>With an addr, boru's wire protocol: `boru vault serve`
+    /// publishes a read-only, HashiCorp-shaped provision API (boru's
+    /// design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+    /// from `boru vault grant`. A sekreto name is already a valid boru
+    /// alias, and boru aliases keep their dots, so `api.token` is the single
+    /// path segment `api.token` - not the `api`/`token` split a HashiCorp KV
+    /// gets. The value is the `value` field. A 404 is a miss; anything else
+    /// the server refuses (a revoked capability, a sealed vault) is an
+    /// error.</para>
+    ///
+    /// <para>boru's `vault proxy` and `vault mcp` remain out of bounds: they
+    /// are a credential *broker*, built precisely so the caller never
+    /// receives the credential. `vault serve` is the provision endpoint,
+    /// built to hand the value back - that is the one sekreto uses.</para>
+    /// </summary>
+    public class BoruProvider : IProvider
+    {
+        private readonly string command;
+        private readonly string namespace_;
+        private readonly string home;
+        private readonly string addr;
+        private readonly string token;
+        private readonly string mount;
+
+        public BoruProvider(string command, string namespace_ = null, string home = null,
+            string addr = null, string token = null, string mount = null)
+        {
+            this.command = string.IsNullOrEmpty(command) ? "boru" : command;
+            this.namespace_ = namespace_;
+            this.home = home;
+            this.addr = string.IsNullOrEmpty(addr) ? null : addr.TrimEnd('/');
+            this.token = token;
+            this.mount = string.IsNullOrEmpty(mount) ? "secret" : mount;
+        }
+
+        public string Lookup(string name)
+        {
+            Names.CheckName(name);
+
+            if (null != addr)
+            {
+                return WireLookup(name);
+            }
+
+            string alias = string.IsNullOrEmpty(namespace_) ? name : namespace_ + ":" + name;
+
+            var start = new ProcessStartInfo
+            {
+                FileName = command,
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                // Redirected so it can be CLOSED: an inherited stdin lets a
+                // CLI that prompts for a passphrase block on the parent's
+                // console forever.
+                RedirectStandardInput = true,
+                UseShellExecute = false,
+            };
+
+            // Arguments are passed one by one, never through a shell, so an
+            // alias is never word-split or interpreted.
+            start.ArgumentList.Add("vault");
+            start.ArgumentList.Add("get");
+            start.ArgumentList.Add("--reveal");
+            start.ArgumentList.Add(alias);
+
+            if (!string.IsNullOrEmpty(home))
+            {
+                start.Environment["BORU_HOME"] = home;
+            }
+
+            Ran ran = Child.Run(start, command);
+            string outtext = ran.Out;
+            string why = ran.Why;
+            int status = ran.Status;
+
+            if (0 == status)
+            {
+                // boru prints the value and one newline, and nothing else.
+                return outtext.EndsWith("\n", StringComparison.Ordinal)
+                    ? outtext.Substring(0, outtext.Length - 1)
+                    : outtext;
+            }
+
+            // "no alias named" is boru saying it does not hold this secret,
+            // which is a miss: the chain carries on to the next provider. A
+            // locked vault or a wrong passphrase is not a miss - treating it
+            // as one would fall through to a weaker store without saying so.
+            if (BoruMiss(why))
+            {
+                return null;
+            }
+
+            throw new SekretoError(
+                "sekreto: boru vault error: " + (0 == why.Length ? "exit " + status : why));
+        }
+
+        private string WireLookup(string name)
+        {
+            Addr.Check(addr);
+
+            // The DOTTED name stays one segment: boru aliases keep their
+            // dots, so there is no vaultref split here.
+            string alias = string.IsNullOrEmpty(namespace_) ? name : namespace_ + "/" + name;
+            string url = addr + "/v1/" + mount + "/data/" + alias;
+
+            var (status, body) = Http.FetchJson("GET", url,
+                new Dictionary<string, string> { ["X-Vault-Token"] = token ?? "" });
+
+            if (404 == status)
+            {
+                return null;
+            }
+
+            if (200 != status)
+            {
+                throw new SekretoError("sekreto: boru serve error: " + status + ": " + url);
+            }
+
+            object data = ((body as Dictionary<string, object>)?.GetValueOrDefault("data")
+                as Dictionary<string, object>)?.GetValueOrDefault("data");
+
+            object value = (data as Dictionary<string, object>)?.GetValueOrDefault("value");
+
+            return null == value ? null : Convert.ToString(value);
+        }
+
+        public string Describe()
+        {
+            if (null != addr)
+            {
+                return "boru:" + addr;
+            }
+
+            return "boru" + (string.IsNullOrEmpty(namespace_) ? "" : ":" + namespace_);
+        }
+
+        /// <summary>
+        /// Does this boru failure mean "no such secret" rather than "I could
+        /// not answer"? Matched on boru's own wording for a missing alias.
+        /// </summary>
+        internal static bool BoruMiss(string why)
+        {
+            return why.Contains("no alias named");
+        }
+    }
+
+    /// <summary>The <c>boru</c> provider kind.</summary>
+    public static class Boru
+    {
+        public static readonly Definition Plugin = Providers.ProviderPlugin(
+            "boru", spec => new BoruProvider(
+                Providers.Text(spec.GetValueOrDefault("command")),
+                Providers.Text(spec.GetValueOrDefault("namespace")),
+                Providers.Text(spec.GetValueOrDefault("home")),
+                Providers.Text(spec.GetValueOrDefault("addr")),
+                Providers.Text(spec.GetValueOrDefault("token")),
+                Providers.Text(spec.GetValueOrDefault("mount"))));
+    }
+}

package/project/.sdk/tm/csharp/feature/secrets/plugins/Child.cs

@@ -0,0 +1,75 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Child.cs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Running a child process, for the two provider kinds that shell out.
+//
+// PLUGIN CODE. This file is in the VoxgigSekretoPlugins assembly, which
+// the core does not reference - so the core links no
+// System.Diagnostics.Process. See docs/design/plugin-providers.md.
+
+using System;
+using System.Diagnostics;
+using System.Threading.Tasks;
+
+using Voxgig.Sekreto;
+
+namespace Voxgig.Sekreto.Plugins
+{
+    /// <summary>What a finished child process left behind.</summary>
+    internal readonly struct Ran
+    {
+        internal Ran(string outtext, string why, int status)
+        {
+            Out = outtext;
+            Why = why;
+            Status = status;
+        }
+
+        internal string Out { get; }
+
+        internal string Why { get; }
+
+        internal int Status { get; }
+    }
+    internal static class Child
+    {
+        /// <summary>
+        /// Run a child to completion and collect both its streams.
+        ///
+        /// <para>The two streams are drained CONCURRENTLY. Reading stdout to
+        /// EOF and only then reading stderr deadlocks the moment the child
+        /// writes more than one pipe buffer (64 KiB on Linux) to stderr: the
+        /// parent is blocked waiting for stdout, the child is blocked waiting
+        /// for room on stderr, and neither can move. Nothing in this library
+        /// sets a timeout, so that hang is permanent. secretspec's
+        /// diagnostics are box-drawn and reach that size easily.</para>
+        ///
+        /// <para>The child's stdin is closed rather than inherited, so a CLI
+        /// that reads it - one prompting for a passphrase when its
+        /// environment variable is absent - sees EOF and gives up instead of
+        /// waiting forever on the parent's own console.</para>
+        /// </summary>
+        internal static Ran Run(ProcessStartInfo start, string command)
+        {
+            try
+            {
+                using Process process = Process.Start(start);
+
+                process.StandardInput.Close();
+
+                // Started before stdout is read, so the child always has a
+                // reader on both pipes.
+                Task<string> errtask = process.StandardError.ReadToEndAsync();
+                string outtext = process.StandardOutput.ReadToEnd();
+                string why = errtask.GetAwaiter().GetResult();
+
+                process.WaitForExit();
+
+                return new Ran(outtext, why.Trim(), process.ExitCode);
+            }
+            catch (Exception err)
+            {
+                throw new SekretoError("sekreto: cannot run " + command + ": " + err.Message);
+            }
+        }
+    }}

package/project/.sdk/tm/csharp/feature/secrets/plugins/Doppler.cs

@@ -0,0 +1,112 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (csharp/plugins/Doppler.cs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Doppler, as a voxgig/plugin definition.
+//
+// PLUGIN CODE. This file is in the VoxgigSekretoPlugins assembly, which
+// the core does not reference - so nothing here is linked into an
+// application whose chain names only built-in kinds. See
+// docs/design/plugin-providers.md.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Net.Http;
+using System.Text;
+
+using Definition = Voxgig.Plugin.Definition;
+
+namespace Voxgig.Sekreto.Plugins
+{
+    /// <summary>
+    /// Doppler.
+    ///
+    /// <para>The whole config is downloaded once - Doppler's own bulk
+    /// endpoint - and answered from memory, like a remote .env: `api.token`
+    /// is the `API_TOKEN` entry. A service token is config-scoped, so
+    /// project and config are only needed with broader tokens.</para>
+    /// </summary>
+    public class DopplerProvider : IProvider
+    {
+        private readonly string token;
+        private readonly string project;
+        private readonly string config;
+        private readonly string addr;
+
+        private Dictionary<string, string> values;
+
+        public DopplerProvider(string token = null, string project = null,
+            string config = null, string addr = null)
+        {
+            this.token = token;
+            this.project = project;
+            this.config = config;
+            this.addr = addr;
+        }
+
+        private Dictionary<string, string> Load()
+        {
+            if (null != values)
+            {
+                return values;
+            }
+
+            string useaddr = (string.IsNullOrEmpty(addr) ? "https://api.doppler.com" : addr)
+                .TrimEnd('/');
+            Addr.Check(useaddr);
+
+            string url = useaddr + "/v3/configs/config/secrets/download?format=json";
+            if (!string.IsNullOrEmpty(project))
+            {
+                url += "&project=" + Url.Encode(project);
+            }
+            if (!string.IsNullOrEmpty(config))
+            {
+                url += "&config=" + Url.Encode(config);
+            }
+
+            var (status, body) = Http.FetchJson("GET", url,
+                new Dictionary<string, string> { ["authorization"] = "Bearer " + (token ?? "") });
+
+            if (200 != status || !(body is Dictionary<string, object> entries))
+            {
+                throw new SekretoError("sekreto: doppler error: " + status);
+            }
+
+            values = new Dictionary<string, string>();
+            foreach (var entry in entries)
+            {
+                if (null != entry.Value)
+                {
+                    values[entry.Key] = Convert.ToString(entry.Value);
+                }
+            }
+
+            return values;
+        }
+
+        public string Lookup(string name)
+        {
+            return Load().TryGetValue(Names.EnvKey(name), out string found) ? found : null;
+        }
+
+        public string Describe()
+        {
+            return "doppler"
+                + (string.IsNullOrEmpty(project) ? "" : ":" + project + "/" + (config ?? ""));
+        }
+    }
+
+    /// <summary>The <c>doppler</c> provider kind.</summary>
+    public static class Doppler
+    {
+        public static readonly Definition Plugin = Providers.ProviderPlugin(
+            "doppler", spec => new DopplerProvider(
+                Providers.Text(spec.GetValueOrDefault("token")),
+                Providers.Text(spec.GetValueOrDefault("project")),
+                Providers.Text(spec.GetValueOrDefault("config")),
+                Providers.Text(spec.GetValueOrDefault("addr"))));
+    }
+}