@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/java/feature/secrets/sekreto/Support.java

@@ -0,0 +1,100 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Support.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// How a provider kind becomes a voxgig/plugin definition, and the few
+// helpers both halves of the split need.
+//
+// This is the whole bridge between the two libraries. A definition's
+// `name` is the `kind` a spec names; its `define` reads the spec as
+// `inst.options()`, builds the provider, and exports it under
+// PROVIDER_EXPORT. Every built-in and every plugin is made this way, so
+// a custom provider kind is one call.
+//
+// A port of typescript/src/provider/support.ts, which is canonical.
+
+package JAVAPACKAGE.feature.secrets.sekreto;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import java.util.Map;
+import java.util.TreeMap;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+import JAVAPACKAGE.feature.secrets.plugin.PluginException;
+
+public final class Support {
+
+  private Support() {}
+
+  /**
+   * The export key under which a provider definition publishes the
+   * provider it built. `Sekreto` reads `<ref>/provider` off the host.
+   */
+  public static final String PROVIDER_EXPORT = "provider";
+
+  /**
+   * The voxgig/plugin error code a SekretoError travels under when it is
+   * raised inside a definition's `define`.
+   *
+   * <p>plugin wraps a code-less error raised by a callback as
+   * `plugin_define_failed`, and keeps one that already carries a code. A
+   * provider that refuses its own configuration - `kv: 3`, a missing
+   * project - raises a SekretoError, and the spec pins that message byte
+   * for byte, so it must come back out of the host exactly as it went in.
+   * `providerplugin` gives it this code on the way in; `Sekreto` turns it
+   * back into a SekretoError on the way out. Nowhere else catches and
+   * rewraps.
+   */
+  public static final String ERROR_CODE = "sekreto_error";
+
+  /** Builds one provider from its declarative spec. */
+  public interface Make {
+    Provider make(Map<String, Object> spec);
+  }
+
+  /**
+   * A provider kind, as a voxgig/plugin definition.
+   *
+   * <p>Nothing runs at `activate`: a provider opens nothing until its
+   * first lookup, so there is nothing to capture - one that does hold a
+   * resource acquires it there and lets the instance scope unwind it.
+   *
+   * <pre>
+   *   Definition mystore = Support.providerplugin(
+   *       "mystore", spec -&gt; new MyStore(Support.text(spec.get("addr"))));
+   * </pre>
+   */
+  public static Definition providerplugin(String kind, Make make) {
+    Definition definition = new Definition(kind);
+
+    definition.define = inst -> {
+      Map<String, Object> spec = map(inst.options());
+      Provider provider;
+      try {
+        provider = make.make(null == spec ? new TreeMap<>() : spec);
+      } catch (SekretoError err) {
+        Map<String, Object> details = new TreeMap<>();
+        details.put("ref", inst.ref);
+        details.put("cause", err.getMessage());
+        throw new PluginException(ERROR_CODE, err.getMessage(), details);
+      }
+      inst.export(PROVIDER_EXPORT, provider);
+    };
+
+    return definition;
+  }
+
+  /** A spec field as text, or null when it is not there. */
+  public static String text(Object value) {
+    return null == value ? null : String.valueOf(value);
+  }
+
+  /** A spec field as text, or the fallback when it is not there. */
+  public static String textor(Object value, String fallback) {
+    return null == value ? fallback : String.valueOf(value);
+  }
+
+  /** A spec field as a map, or null when it is not one. */
+  @SuppressWarnings("unchecked")
+  public static Map<String, Object> map(Object value) {
+    return value instanceof Map ? (Map<String, Object>) value : null;
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Aws.java

@@ -0,0 +1,294 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Aws.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// AWS Secrets Manager and SSM Parameter Store, as voxgig/plugin
+// definitions: two kinds, one plugin, because they share a signer.
+//
+// A PLUGIN, NOT PART OF THE CORE: it opens a socket and signs every
+// request. SigV4 travels with it - Sigv4.java is in this folder and not
+// in the core, because the core of no port imports a hash function.
+// See docs/design/plugin-providers.md.
+
+package JAVAPACKAGE.feature.secrets.sekreto.plugins;
+
+import static JAVAPACKAGE.feature.secrets.sekreto.Addr.checkaddr;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.dig;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.fetchjson;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.first;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.trimslash;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Json;
+import JAVAPACKAGE.feature.secrets.sekreto.Provider;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import JAVAPACKAGE.feature.secrets.sekreto.Support;
+import JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.Answer;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+
+public final class Aws {
+
+  private Aws() {}
+
+  /** The `awssecrets` kind: what `plugins` hands to Sekreto. */
+  public static final Definition SECRETS = Support.providerplugin("awssecrets", spec ->
+      new Secrets(
+          Support.text(spec.get("region")), Support.text(spec.get("keyid")),
+          Support.text(spec.get("secret")), Support.text(spec.get("session")),
+          Support.text(spec.get("addr"))));
+
+  /** The `awsparams` kind: what `plugins` hands to Sekreto. */
+  public static final Definition PARAMS = Support.providerplugin("awsparams", spec ->
+      new Params(
+          Support.text(spec.get("region")), Support.text(spec.get("keyid")),
+          Support.text(spec.get("secret")), Support.text(spec.get("session")),
+          Support.text(spec.get("addr")), Support.text(spec.get("prefix"))));
+
+  /** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
+  static String awsnow() {
+    return DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmss'Z'")
+        .withZone(ZoneOffset.UTC)
+        .format(Instant.now());
+  }
+
+  /** Region and credentials, resolved for one call. */
+  private static final class Awsauth {
+    final String region;
+    final String keyid;
+    final String secret;
+    final String session;
+
+    Awsauth(String region, String keyid, String secret, String session) {
+      this.region = region;
+      this.keyid = keyid;
+      this.secret = secret;
+      this.session = session;
+    }
+  }
+
+  /**
+   * Region and credentials, from config first and the standard AWS_*
+   * environment variables second - those are AWS's own convention, and a
+   * pod or CI job that has them set should just work. Missing either is an
+   * error: an AWS store with no credentials could not answer.
+   */
+  static Awsauth awsauth(String region, String keyid, String secret, String session) {
+    String useregion =
+        first(region, System.getenv("AWS_REGION"), System.getenv("AWS_DEFAULT_REGION"));
+    String usekeyid = first(keyid, System.getenv("AWS_ACCESS_KEY_ID"));
+    String usesecret = first(secret, System.getenv("AWS_SECRET_ACCESS_KEY"));
+    String usesession = first(session, System.getenv("AWS_SESSION_TOKEN"));
+
+    if (useregion.isEmpty()) {
+      throw new SekretoError("sekreto: aws: no region (set region or AWS_REGION)");
+    }
+    if (usekeyid.isEmpty() || usesecret.isEmpty()) {
+      throw new SekretoError(
+          "sekreto: aws: no credentials"
+              + " (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)");
+    }
+
+    return new Awsauth(useregion, usekeyid, usesecret,
+        usesession.isEmpty() ? null : usesession);
+  }
+
+  /** One signed call to an AWS JSON-1.1 API. */
+  static Answer awscall(String region, String keyid, String secret, String session,
+      String addr, String service, String target, String payload) {
+    Awsauth auth = awsauth(region, keyid, secret, session);
+    // The China partition lives under its own suffix; every other
+    // commercial region is plain amazonaws.com.
+    String suffix = auth.region.startsWith("cn-") ? ".amazonaws.com.cn" : ".amazonaws.com";
+    String useaddr = first(addr, "https://" + service + "." + auth.region + suffix);
+    checkaddr(useaddr);
+
+    String url = trimslash(useaddr) + "/";
+
+    Map<String, Object> extras = new LinkedHashMap<>();
+    extras.put("content-type", "application/x-amz-json-1.1");
+    extras.put("x-amz-target", target);
+
+    Map<String, Object> input = new LinkedHashMap<>();
+    input.put("method", "POST");
+    input.put("url", url);
+    input.put("headers", extras);
+    input.put("body", payload);
+    input.put("service", service);
+    input.put("region", auth.region);
+    input.put("keyid", auth.keyid);
+    input.put("secret", auth.secret);
+    if (null != auth.session) {
+      input.put("session", auth.session);
+    }
+    input.put("datetime", awsnow());
+
+    Map<String, Object> signed = Sigv4.sigv4(input);
+
+    Map<String, String> send = new LinkedHashMap<>();
+    for (Map.Entry<String, Object> entry : extras.entrySet()) {
+      send.put(entry.getKey(), String.valueOf(entry.getValue()));
+    }
+    for (Map.Entry<String, Object> entry : signed.entrySet()) {
+      send.put(entry.getKey(), String.valueOf(entry.getValue()));
+    }
+
+    return fetchjson("POST", url, send, payload);
+  }
+
+  /**
+   * Does this AWS error body name one of the not-found types? Those are a
+   * miss; every other failure is a store that could not answer.
+   */
+  static boolean awsmiss(Object body, String... types) {
+    Object errtype = dig(body, "__type");
+    if (!(errtype instanceof String)) {
+      return false;
+    }
+    for (String type : types) {
+      if (((String) errtype).contains(type)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * AWS Secrets Manager.
+   *
+   * <p>`api.token` reads the secret named `api` (the vaultref path, so
+   * `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+   * SecretString - the AWS idiom of one JSON map per secret. A SecretString
+   * that is not JSON is the value itself, under the conventional field
+   * `value`. Requests are SigV4-signed in-tree; see Sigv4.java.
+   */
+  public static final class Secrets implements Provider {
+    private final String region;
+    private final String keyid;
+    private final String secret;
+    private final String session;
+    private final String addr;
+
+    public Secrets(String region, String keyid, String secret, String session, String addr) {
+      this.region = region;
+      this.keyid = keyid;
+      this.secret = secret;
+      this.session = session;
+      this.addr = addr;
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public String lookup(String name) {
+      Map<String, Object> ref = Sekreto.vaultref(name);
+
+      Map<String, Object> payload = new LinkedHashMap<>();
+      payload.put("SecretId", ref.get("path"));
+
+      Answer res = awscall(region, keyid, secret, session, addr,
+          "secretsmanager", "secretsmanager.GetSecretValue", Json.stringify(payload));
+
+      if (400 == res.status && awsmiss(res.body, "ResourceNotFoundException")) {
+        return null;
+      }
+
+      if (200 != res.status) {
+        throw new SekretoError("sekreto: aws secretsmanager error: " + res.status);
+      }
+
+      Object text = dig(res.body, "SecretString");
+
+      if (!(text instanceof String)) {
+        // A binary secret has no fields to address; only the conventional
+        // `value` field can mean "the bytes themselves".
+        Object bin = dig(res.body, "SecretBinary");
+        if (bin instanceof String && "value".equals(ref.get("field"))) {
+          // decode() throws IllegalArgumentException on a bad payload,
+          // which is not a SekretoError and so escaped the library's own
+          // error type. A store that answered incoherently is an error.
+          try {
+            return new String(
+                Base64.getDecoder().decode((String) bin), StandardCharsets.UTF_8);
+          } catch (IllegalArgumentException err) {
+            throw new SekretoError("sekreto: aws secretsmanager: undecodable secret");
+          }
+        }
+        return null;
+      }
+
+      Object parsed = Json.parse((String) text);
+
+      if (parsed instanceof Map) {
+        Object value = ((Map<String, Object>) parsed).get(ref.get("field"));
+        return null == value ? null : String.valueOf(value);
+      }
+
+      // A plain-string secret is the whole value; it has no named fields.
+      return "value".equals(ref.get("field")) ? (String) text : null;
+    }
+
+    // Config only, never the environment: describe() feeds the spec's
+    // sources group, which must answer the same everywhere.
+    @Override
+    public String describe() {
+      return "awssecrets:" + (null == region ? "" : region);
+    }
+  }
+
+  /**
+   * AWS SSM Parameter Store.
+   *
+   * <p>`db.pass.main` reads the parameter `/db/pass/main` (under an
+   * optional prefix path), decrypted. Parameter Store carries flat strings,
+   * so there is no field indirection.
+   */
+  public static final class Params implements Provider {
+    private final String region;
+    private final String keyid;
+    private final String secret;
+    private final String session;
+    private final String addr;
+    private final String prefix;
+
+    public Params(String region, String keyid, String secret, String session,
+        String addr, String prefix) {
+      this.region = region;
+      this.keyid = keyid;
+      this.secret = secret;
+      this.session = session;
+      this.addr = addr;
+      this.prefix = prefix;
+    }
+
+    @Override
+    public String lookup(String name) {
+      Map<String, Object> payload = new LinkedHashMap<>();
+      payload.put("Name", Sekreto.awsparam(name, prefix));
+      payload.put("WithDecryption", Boolean.TRUE);
+
+      Answer res = awscall(region, keyid, secret, session, addr,
+          "ssm", "AmazonSSM.GetParameter", Json.stringify(payload));
+
+      if (400 == res.status && awsmiss(res.body, "ParameterNotFound")) {
+        return null;
+      }
+
+      if (200 != res.status) {
+        throw new SekretoError("sekreto: aws ssm error: " + res.status);
+      }
+
+      Object value = dig(res.body, "Parameter", "Value");
+      return null == value ? null : String.valueOf(value);
+    }
+
+    @Override
+    public String describe() {
+      return "awsparams:" + (null == region ? "" : region) + (null == prefix ? "" : prefix);
+    }
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Azuresecrets.java

@@ -0,0 +1,164 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Azuresecrets.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Azure Key Vault, as a voxgig/plugin definition.
+//
+// A PLUGIN, NOT PART OF THE CORE: it opens a socket, and the core reads
+// at most a local file. A chain that does not name this kind must not
+// carry it, so the calling project imports this definition and hands it
+// to Sekreto in the `plugins` option.
+// See docs/design/plugin-providers.md.
+
+package JAVAPACKAGE.feature.secrets.sekreto.plugins;
+
+import static JAVAPACKAGE.feature.secrets.sekreto.Addr.checkaddr;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.dig;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.fetchjson;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.first;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.headers;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.renewtime;
+import static JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.trimslash;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Provider;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto;
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import JAVAPACKAGE.feature.secrets.sekreto.Support;
+import JAVAPACKAGE.feature.secrets.sekreto.plugins.Httpjson.Answer;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+
+/**
+ * Azure Key Vault.
+ *
+ * <p>`api.token` reads secret `api-token` (dots flattened to `-`; Key
+ * Vault names allow nothing else), current version. The token comes from
+ * config, then a client-credentials login when tenant/clientid/
+ * clientsecret are given, then the IMDS managed-identity endpoint - so on
+ * Azure's own platform no credential configuration is needed.
+ *
+ * <p>As with GCP, the IMDS call is plain http to a link-local host by
+ * platform design and carries no credential; the login and vault
+ * addresses are `checkaddr`-guarded.
+ */
+public final class Azuresecrets implements Provider {
+
+  /** The `azuresecrets` kind: what `plugins` hands to Sekreto. */
+  public static final Definition PLUGIN = Support.providerplugin("azuresecrets", spec ->
+      new Azuresecrets(
+          Support.text(spec.get("vault")), Support.text(spec.get("token")),
+          Support.text(spec.get("tenant")), Support.text(spec.get("clientid")),
+          Support.text(spec.get("clientsecret")), Support.text(spec.get("loginaddr")),
+          Support.text(spec.get("imdsaddr")), Support.text(spec.get("apiversion"))));
+  private static final String RESOURCE = "https://vault.azure.net";
+
+  private final String vault;
+  private final String token;
+  private final String tenant;
+  private final String clientid;
+  private final String clientsecret;
+  private final String loginaddr;
+  private final String imdsaddr;
+  private final String apiversion;
+
+  // A configured token is kept forever; logged-in and IMDS tokens carry
+  // expires_in and are renewed shortly before they run out.
+  private String livetoken;
+  private long renewat = Long.MAX_VALUE;
+
+  public Azuresecrets(String vault, String token, String tenant, String clientid,
+      String clientsecret, String loginaddr, String imdsaddr, String apiversion) {
+    this.vault = vault;
+    this.token = token;
+    this.tenant = tenant;
+    this.clientid = clientid;
+    this.clientsecret = clientsecret;
+    this.loginaddr = loginaddr;
+    this.imdsaddr = imdsaddr;
+    this.apiversion = apiversion;
+  }
+
+  private String login() {
+    if (null != token && !token.isEmpty()) {
+      return token;
+    }
+
+    if (null != tenant && !tenant.isEmpty()
+        && null != clientid && !clientid.isEmpty()
+        && null != clientsecret && !clientsecret.isEmpty()) {
+      String useloginaddr = first(loginaddr, "https://login.microsoftonline.com");
+      checkaddr(useloginaddr);
+
+      String url = trimslash(useloginaddr) + "/" + tenant + "/oauth2/v2.0/token";
+      String form = "grant_type=client_credentials&client_id=" + Sigv4.uriescape(clientid)
+          + "&client_secret=" + Sigv4.uriescape(clientsecret)
+          + "&scope=" + Sigv4.uriescape(RESOURCE + "/.default");
+
+      Answer res = fetchjson(
+          "POST", url, headers("content-type", "application/x-www-form-urlencoded"), form);
+
+      Object got = dig(res.body, "access_token");
+      if (200 != res.status || null == got || String.valueOf(got).isEmpty()) {
+        throw new SekretoError("sekreto: azure login failed: " + res.status);
+      }
+
+      renewat = renewtime(dig(res.body, "expires_in"));
+      return String.valueOf(got);
+    }
+
+    String imds = trimslash(first(imdsaddr, "http://169.254.169.254"))
+        + "/metadata/identity/oauth2/token?api-version=2018-02-01&resource="
+        + Sigv4.uriescape(RESOURCE);
+
+    Answer res = fetchjson("GET", imds, headers("Metadata", "true"), null);
+
+    Object got = dig(res.body, "access_token");
+    if (200 != res.status || null == got || String.valueOf(got).isEmpty()) {
+      throw new SekretoError(
+          "sekreto: azure: no token, no client credentials, and IMDS did not answer");
+    }
+
+    renewat = renewtime(dig(res.body, "expires_in"));
+    return String.valueOf(got);
+  }
+
+  @Override
+  public String lookup(String name) {
+    String usevault = null == vault ? "" : vault;
+    if (usevault.isEmpty()) {
+      throw new SekretoError("sekreto: azure: no vault");
+    }
+
+    // Only an explicit scheme is a URL; a vault NAMED httpvault must
+    // still become https://httpvault.vault.azure.net.
+    String vaulturl =
+        usevault.startsWith("http://") || usevault.startsWith("https://")
+            ? usevault
+            : "https://" + usevault + ".vault.azure.net";
+    checkaddr(vaulturl);
+
+    if (null == livetoken || System.currentTimeMillis() >= renewat) {
+      livetoken = login();
+    }
+
+    String url = trimslash(vaulturl) + "/secrets/" + Sekreto.flatname(name, "-")
+        + "?api-version=" + first(apiversion, "7.4");
+
+    Answer res = fetchjson("GET", url, headers("authorization", "Bearer " + livetoken), null);
+
+    if (404 == res.status) {
+      return null;
+    }
+
+    if (200 != res.status) {
+      throw new SekretoError(
+          "sekreto: azure error: " + res.status + ": " + url.split("\\?")[0]);
+    }
+
+    Object value = dig(res.body, "value");
+    return null == value ? null : String.valueOf(value);
+  }
+
+  @Override
+  public String describe() {
+    return "azuresecrets:" + (null == vault ? "" : vault);
+  }
+}