@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm

@@ -0,0 +1,263 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Aws.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Aws;
+
+# The aws plugins: Secrets Manager and SSM Parameter Store, both reached
+# with SigV4-signed requests.
+#
+# NOT IN THE CORE. A `Sekreto` can build this kind only if the calling
+# project passed this definition in through the `plugins` option; the
+# core loads nothing under `plugins/` (docs/design/plugin-providers.md).
+#
+# `sigv4` travels with them - it is the crypto edge, and the two kinds here
+# are its only callers - and is re-exported so that one `use` gets a caller
+# the signing function and the kinds together.
+#
+# A port of typescript/plugins/aws.ts, which is canonical.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use JSON::PP ();
+
+use Voxgig::Sekreto ();
+use Voxgig::Sekreto::Providers qw(providerplugin);
+use Voxgig::Sekreto::Addr ();
+use Voxgig::Sekreto::Plugins::Httpjson ();
+use Voxgig::Sekreto::Plugins::Sigv4 ();
+
+our @EXPORT_OK = qw(awssecrets awsparams sigv4);
+
+# Called by name rather than imported, the way every module here reaches the
+# core: Voxgig::Sekreto is loaded by every consumer of this one.
+sub fail { return Voxgig::Sekreto::fail(@_) }
+
+# The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now.
+sub awsnow {
+    my @t = gmtime();
+    return sprintf( '%04d%02d%02dT%02d%02d%02dZ',
+        $t[5] + 1900, $t[4] + 1, $t[3], $t[2], $t[1], $t[0] );
+}
+
+# Region and credentials, from config first and the standard AWS_*
+# environment variables second - those are AWS's own convention, and a pod
+# or CI job that has them set should just work. Missing either is an
+# error: an AWS store with no credentials could not answer.
+sub awsauth {
+    my ($opts) = @_;
+
+    my $region  = $opts->{region} || $ENV{AWS_REGION} || $ENV{AWS_DEFAULT_REGION} || '';
+    my $keyid   = $opts->{keyid} || $ENV{AWS_ACCESS_KEY_ID} || '';
+    my $secret  = $opts->{secret} || $ENV{AWS_SECRET_ACCESS_KEY} || '';
+    my $session = $opts->{session} || $ENV{AWS_SESSION_TOKEN} || undef;
+
+    fail('sekreto: aws: no region (set region or AWS_REGION)') if '' eq $region;
+
+    fail(   'sekreto: aws: no credentials'
+          . ' (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)' )
+      if '' eq $keyid || '' eq $secret;
+
+    return { region => $region, keyid => $keyid, secret => $secret, session => $session };
+}
+
+# One signed call to an AWS JSON-1.1 API.
+sub awscall {
+    my ( $opts, $service, $target, $payload ) = @_;
+
+    my $auth = awsauth($opts);
+
+    # The China partition lives under its own suffix; every other
+    # commercial region is plain amazonaws.com.
+    my $suffix =
+      0 == index( $auth->{region}, 'cn-' ) ? '.amazonaws.com.cn' : '.amazonaws.com';
+    my $addr = $opts->{addr} || 'https://' . $service . '.' . $auth->{region} . $suffix;
+    Voxgig::Sekreto::Addr::checkaddr($addr);
+
+    ( my $base = $addr ) =~ s{/$}{};
+    my $url  = $base . '/';
+    my $body = JSON::PP->new->canonical(1)->encode($payload);
+
+    my %headers = (
+        'content-type' => 'application/x-amz-json-1.1',
+        'x-amz-target' => $target,
+    );
+
+    my $signed = Voxgig::Sekreto::Plugins::Sigv4::sigv4(
+        {
+            method   => 'POST',
+            url      => $url,
+            headers  => {%headers},
+            body     => $body,
+            service  => $service,
+            region   => $auth->{region},
+            keyid    => $auth->{keyid},
+            secret   => $auth->{secret},
+            session  => $auth->{session},
+            datetime => awsnow(),
+        }
+    );
+
+    return Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'POST', $url,
+        { %headers, %$signed }, $body );
+}
+
+# Does this AWS error body name one of the not-found types? Those are a
+# miss; every other failure is a store that could not answer.
+sub awsmiss {
+    my ( $body, $types ) = @_;
+
+    my $errtype =
+      ( 'HASH' eq ref( $body || '' ) && defined $body->{__type} && !ref( $body->{__type} ) )
+      ? $body->{__type}
+      : '';
+
+    for my $name (@$types) {
+        return 1 if index( $errtype, $name ) >= 0;
+    }
+
+    return 0;
+}
+
+# AWS Secrets Manager.
+#
+# `api.token` reads the secret named `api` (the vaultref path, so
+# `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+# SecretString - the AWS idiom of one JSON map per secret. A SecretString
+# that is not JSON is the value itself, under the conventional field
+# `value`. Requests are SigV4-signed in-tree; see Sigv4.pm.
+{
+
+    package Voxgig::Sekreto::Plugins::Aws::Secrets;
+
+    sub new {
+        my ( $class, $opts ) = @_;
+        return bless { opts => $opts || {} }, $class;
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+
+        my $ref = Voxgig::Sekreto::vaultref($name);
+
+        my ( $status, $body ) =
+          Voxgig::Sekreto::Plugins::Aws::awscall( $self->{opts}, 'secretsmanager',
+            'secretsmanager.GetSecretValue', { SecretId => $ref->{path} } );
+
+        return undef
+          if 400 == $status
+          && Voxgig::Sekreto::Plugins::Aws::awsmiss( $body, ['ResourceNotFoundException'] );
+
+        Voxgig::Sekreto::fail( 'sekreto: aws secretsmanager error: ' . $status )
+          if 200 != $status;
+
+        my $text = 'HASH' eq ref( $body || '' ) ? $body->{SecretString} : undef;
+
+        if ( !defined $text || ref($text) ) {
+
+            # A binary secret has no fields to address; only the conventional
+            # `value` field can mean "the bytes themselves".
+            my $bin = 'HASH' eq ref( $body || '' ) ? $body->{SecretBinary} : undef;
+            if ( defined $bin && !ref($bin) && 'value' eq $ref->{field} ) {
+                my $decoded = Voxgig::Sekreto::Plugins::Httpjson::unbase64($bin);
+
+                # A store that answered incoherently could not answer.
+                Voxgig::Sekreto::fail(
+                    'sekreto: aws secretsmanager: undecodable secret')
+                  if !defined $decoded;
+
+                return $decoded;
+            }
+            return undef;
+        }
+
+        my $parsed = eval { JSON::PP->new->decode($text) };
+
+        if ( 'HASH' eq ref( $parsed || '' ) ) {
+            my $value = $parsed->{ $ref->{field} };
+            return Voxgig::Sekreto::Plugins::Httpjson::stringof($value);
+        }
+
+        # A plain-string secret is the whole value; it has no named fields.
+        return 'value' eq $ref->{field} ? $text : undef;
+    }
+
+    sub describe {
+        my ($self) = @_;
+
+        # Config only, never the environment: describe() feeds the spec's
+        # sources group, which must answer the same everywhere.
+        return 'awssecrets:' . ( $self->{opts}{region} || '' );
+    }
+}
+
+# AWS SSM Parameter Store.
+#
+# `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+# prefix path), decrypted. Parameter Store carries flat strings, so there
+# is no field indirection.
+{
+
+    package Voxgig::Sekreto::Plugins::Aws::Params;
+
+    sub new {
+        my ( $class, $opts ) = @_;
+        return bless { opts => $opts || {} }, $class;
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Aws::awscall(
+            $self->{opts}, 'ssm',
+            'AmazonSSM.GetParameter',
+            {
+                Name => Voxgig::Sekreto::awsparam( $name, $self->{opts}{prefix} ),
+                WithDecryption => JSON::PP::true,
+            }
+        );
+
+        return undef
+          if 400 == $status
+          && Voxgig::Sekreto::Plugins::Aws::awsmiss( $body, ['ParameterNotFound'] );
+
+        Voxgig::Sekreto::fail( 'sekreto: aws ssm error: ' . $status )
+          if 200 != $status;
+
+        my $value =
+          ( 'HASH' eq ref( $body || '' ) && 'HASH' eq ref( $body->{Parameter} || '' ) )
+          ? $body->{Parameter}{Value}
+          : undef;
+
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($value);
+    }
+
+    sub describe {
+        my ($self) = @_;
+        return 'awsparams:' . ( $self->{opts}{region} || '' ) . ( $self->{opts}{prefix} || '' );
+    }
+}
+
+
+# Signing, from the module it lives in. A glob assignment is a single
+# mention of the name, which `use warnings` reads as a probable typo; it is
+# not, the alias IS the re-export.
+no warnings 'once';
+*sigv4 = \&Voxgig::Sekreto::Plugins::Sigv4::sigv4;
+use warnings 'once';
+
+# The plugins: the `awssecrets` and `awsparams` provider kinds, as
+# voxgig/plugin definitions.
+sub awssecrets {
+    return providerplugin( 'awssecrets',
+        sub { Voxgig::Sekreto::Plugins::Aws::Secrets->new( $_[0] ) } );
+}
+
+sub awsparams {
+    return providerplugin( 'awsparams',
+        sub { Voxgig::Sekreto::Plugins::Aws::Params->new( $_[0] ) } );
+}
+
+1;

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Azuresecrets.pm

@@ -0,0 +1,159 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Azuresecrets.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Azuresecrets;
+
+# The azuresecrets plugin: Azure Key Vault over its REST API.
+#
+# NOT IN THE CORE. A `Sekreto` can build this kind only if the calling
+# project passed this definition in through the `plugins` option; the
+# core loads nothing under `plugins/` (docs/design/plugin-providers.md).
+#
+# A port of typescript/plugins/azuresecrets.ts, which is canonical.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use Voxgig::Sekreto ();
+use Voxgig::Sekreto::Providers qw(providerplugin);
+use Voxgig::Sekreto::Addr ();
+use Voxgig::Sekreto::Plugins::Httpjson ();
+
+our @EXPORT_OK = qw(azuresecrets);
+
+# Azure Key Vault.
+#
+# `api.token` reads secret `api-token` (dots flattened to `-`; Key Vault
+# names allow nothing else), current version. The token comes from config,
+# then a client-credentials login when tenant/clientid/clientsecret are
+# given, then the IMDS managed-identity endpoint - so on Azure's own
+# platform no credential configuration is needed.
+#
+# As with GCP, the IMDS call is plain http to a link-local host by
+# platform design and carries no credential; the login and vault addresses
+# are `checkaddr`-guarded.
+{
+
+    package Voxgig::Sekreto::Plugins::Azuresecrets::Provider;
+
+    my $RESOURCE = 'https://vault.azure.net';
+
+    # A configured token is kept forever; logged-in and IMDS tokens carry
+    # expires_in and are renewed shortly before they run out.
+    sub new {
+        my ( $class, $opts ) = @_;
+        return bless { opts => $opts || {}, livetoken => undef, renewat => undef }, $class;
+    }
+
+    sub login {
+        my ($self) = @_;
+        my $opts = $self->{opts};
+
+        return $opts->{token} if $opts->{token};
+
+        if ( $opts->{tenant} && $opts->{clientid} && $opts->{clientsecret} ) {
+            my $loginaddr = $opts->{loginaddr} || 'https://login.microsoftonline.com';
+            Voxgig::Sekreto::Addr::checkaddr($loginaddr);
+
+            ( my $base = $loginaddr ) =~ s{/$}{};
+            my $url = $base . '/' . $opts->{tenant} . '/oauth2/v2.0/token';
+            my $form =
+                'grant_type=client_credentials&client_id='
+              . Voxgig::Sekreto::Plugins::Httpjson::urlenc( $opts->{clientid} )
+              . '&client_secret='
+              . Voxgig::Sekreto::Plugins::Httpjson::urlenc( $opts->{clientsecret} )
+              . '&scope='
+              . Voxgig::Sekreto::Plugins::Httpjson::urlenc( $RESOURCE . '/.default' );
+
+            my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'POST', $url,
+                { 'content-type' => 'application/x-www-form-urlencoded' }, $form );
+
+            my $got = 'HASH' eq ref( $body || '' ) ? $body->{access_token} : undef;
+
+            Voxgig::Sekreto::fail( 'sekreto: azure login failed: ' . $status )
+              if 200 != $status || !$got;
+
+            $self->{renewat} = Voxgig::Sekreto::Plugins::Httpjson::renewafter( $body->{expires_in} );
+
+            return Voxgig::Sekreto::Plugins::Httpjson::stringof($got);
+        }
+
+        ( my $imdsbase = $opts->{imdsaddr} || 'http://169.254.169.254' ) =~ s{/$}{};
+        my $imds =
+            $imdsbase
+          . '/metadata/identity/oauth2/token?api-version=2018-02-01&resource='
+          . Voxgig::Sekreto::Plugins::Httpjson::urlenc($RESOURCE);
+
+        my ( $status, $body ) =
+          Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $imds, { 'Metadata' => 'true' } );
+
+        my $got = 'HASH' eq ref( $body || '' ) ? $body->{access_token} : undef;
+
+        Voxgig::Sekreto::fail(
+            'sekreto: azure: no token, no client credentials, and IMDS did not answer')
+          if 200 != $status || !$got;
+
+        $self->{renewat} = Voxgig::Sekreto::Plugins::Httpjson::renewafter( $body->{expires_in} );
+
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($got);
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+        my $opts = $self->{opts};
+
+        my $vault = $opts->{vault} || '';
+        Voxgig::Sekreto::fail('sekreto: azure: no vault') if '' eq $vault;
+
+        # Only an explicit scheme is a URL; a vault NAMED httpvault must
+        # still become https://httpvault.vault.azure.net.
+        my $vaulturl =
+          ( 0 == index( $vault, 'http://' ) || 0 == index( $vault, 'https://' ) )
+          ? $vault
+          : 'https://' . $vault . '.vault.azure.net';
+        Voxgig::Sekreto::Addr::checkaddr($vaulturl);
+
+        $self->{livetoken} = $self->login()
+          if !defined $self->{livetoken}
+          || Voxgig::Sekreto::Plugins::Httpjson::renewdue( $self->{renewat} );
+
+        ( my $base = $vaulturl ) =~ s{/$}{};
+        my $url =
+            $base
+          . '/secrets/'
+          . Voxgig::Sekreto::flatname( $name, '-' )
+          . '?api-version='
+          . ( $opts->{apiversion} || '7.4' );
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $url,
+            { 'authorization' => 'Bearer ' . $self->{livetoken} } );
+
+        return undef if 404 == $status;
+
+        if ( 200 != $status ) {
+            ( my $plain = $url ) =~ s/\?.*//s;
+            Voxgig::Sekreto::fail(
+                'sekreto: azure error: ' . $status . ': ' . $plain );
+        }
+
+        my $value = 'HASH' eq ref( $body || '' ) ? $body->{value} : undef;
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($value);
+    }
+
+    sub describe {
+        my ($self) = @_;
+        return 'azuresecrets:' . ( $self->{opts}{vault} || '' );
+    }
+}
+
+
+# The plugin: the `azuresecrets` provider kind, as a voxgig/plugin
+# definition.
+sub azuresecrets {
+    return providerplugin( 'azuresecrets',
+        sub { Voxgig::Sekreto::Plugins::Azuresecrets::Provider->new( $_[0] ) } );
+}
+
+1;

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Boru.pm

@@ -0,0 +1,180 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Boru.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Boru;
+
+# The boru plugin: a boru vault through its CLI, or over `boru vault serve`.
+# Needs a child process, or HTTPS in wire mode.
+#
+# NOT IN THE CORE. A `Sekreto` can build this kind only if the calling
+# project passed this definition in through the `plugins` option; the
+# core loads nothing under `plugins/` (docs/design/plugin-providers.md).
+#
+# A port of typescript/plugins/boru.ts, which is canonical.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use Voxgig::Sekreto ();
+use Voxgig::Sekreto::Providers qw(providerplugin);
+use Voxgig::Sekreto::Addr ();
+use Voxgig::Sekreto::Plugins::Httpjson ();
+use Voxgig::Sekreto::Plugins::Proc ();
+
+our @EXPORT_OK = qw(boru);
+
+# A boru vault (https://github.com/boru-lang/boru), read through the boru
+# CLI: `boru vault get --reveal <alias>` prints the secret on stdout, and
+# nothing else.
+#
+# A sekreto name is already a valid boru alias, so `api.token` crosses over
+# unchanged. A `namespace` qualifies it the way boru writes it,
+# `<namespace>:<name>`.
+#
+# The passphrase is read by boru itself from `BORU_VAULT_PASSPHRASE`. sekreto
+# never accepts it as config and never puts it on a command line, where it
+# would show up in the process table.
+#
+# boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+# credential *broker*, built precisely so the caller never receives the
+# credential. The wire route in is `vault serve` - the provider below.
+{
+
+    package Voxgig::Sekreto::Plugins::Boru::Cli;
+
+    sub new {
+        my ( $class, $command, $namespace, $home ) = @_;
+        return bless {
+            command   => $command || 'boru',
+            namespace => $namespace,
+            home      => $home,
+        }, $class;
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+
+        Voxgig::Sekreto::checkname($name);
+
+        my $alias = $self->{namespace} ? $self->{namespace} . ':' . $name : $name;
+
+        # BORU_HOME is set for the child only, then restored.
+        local $ENV{BORU_HOME} = $self->{home} if $self->{home};
+
+        my ( $out, $err, $status ) = Voxgig::Sekreto::Plugins::Proc::runcmd(
+            $self->{command}, 'vault', 'get', '--reveal', $alias );
+
+        if ( 0 == $status ) {
+            # boru prints the value and one newline, and nothing else.
+            $out =~ s/\n\z//;
+            return $out;
+        }
+
+        $err =~ s/^\s+|\s+$//g;
+
+        # "no alias named" is boru saying it does not hold this secret, which
+        # is a miss: the chain carries on to the next provider. A locked vault
+        # or a wrong passphrase is not a miss - treating it as one would fall
+        # through to a weaker store without saying so.
+        return undef if Voxgig::Sekreto::Plugins::Boru::borumiss($err);
+
+        Voxgig::Sekreto::fail(
+            'sekreto: boru vault error: ' . ( '' eq $err ? 'exit ' . $status : $err ) );
+    }
+
+    sub describe {
+        my ($self) = @_;
+        return 'boru' . ( $self->{namespace} ? ':' . $self->{namespace} : '' );
+    }
+}
+
+# The same boru vault over its wire protocol: `boru vault serve` publishes
+# a read-only, HashiCorp-shaped provision API (boru's
+# design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+# from `boru vault grant`.
+#
+# A sekreto name is already a valid boru alias, and boru aliases keep
+# their dots, so `api.token` is the single path segment `api.token` - not
+# the `api`/`token` split a HashiCorp KV gets. The value is the `value`
+# field. A 404 is a miss; anything else the server refuses (a revoked
+# capability, a sealed vault) is an error.
+{
+
+    package Voxgig::Sekreto::Plugins::Boru::Wire;
+
+    sub new {
+        my ( $class, $addr, $token, $namespace, $mount ) = @_;
+
+        ( my $useaddr = defined $addr ? $addr : '' ) =~ s{/$}{};
+
+        return bless {
+            addr      => $useaddr,
+            token     => defined $token ? $token : '',
+            namespace => $namespace,
+            mount     => $mount || 'secret',
+        }, $class;
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+
+        Voxgig::Sekreto::checkname($name);
+        Voxgig::Sekreto::Addr::checkaddr( $self->{addr} );
+
+        my $alias = $self->{namespace} ? $self->{namespace} . '/' . $name : $name;
+        my $url   = $self->{addr} . '/v1/' . $self->{mount} . '/data/' . $alias;
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $url,
+            { 'X-Vault-Token' => $self->{token} } );
+
+        return undef if 404 == $status;
+
+        Voxgig::Sekreto::fail(
+            'sekreto: boru serve error: ' . $status . ': ' . $url )
+          if 200 != $status;
+
+        my $data =
+          ( 'HASH' eq ref( $body || '' ) && 'HASH' eq ref( $body->{data} || '' ) )
+          ? $body->{data}{data}
+          : undef;
+
+        my $value = 'HASH' eq ref( $data || '' ) ? $data->{value} : undef;
+        return Voxgig::Sekreto::Plugins::Httpjson::stringof($value);
+    }
+
+    sub describe {
+        my ($self) = @_;
+        return 'boru:' . $self->{addr};
+    }
+}
+# Does this boru failure mean "no such secret" rather than "I could not
+# answer"? Matched on boru's own wording for a missing alias.
+sub borumiss {
+    my ($why) = @_;
+    return index( $why, 'no alias named' ) >= 0 ? 1 : 0;
+}
+
+
+# The plugin: the `boru` provider kind, as a voxgig/plugin definition.
+#
+# One kind, two ways in: an `addr` is the wire protocol, and its absence is
+# the CLI. The choice is made here, once, where the spec is read.
+sub boru {
+    return providerplugin(
+        'boru',
+        sub {
+            my ($spec) = @_;
+
+            return Voxgig::Sekreto::Plugins::Boru::Wire->new( $spec->{addr},
+                $spec->{token}, $spec->{namespace}, $spec->{mount} )
+              if $spec->{addr};
+
+            return Voxgig::Sekreto::Plugins::Boru::Cli->new( $spec->{command},
+                $spec->{namespace}, $spec->{home} );
+        }
+    );
+}
+
+1;

package/project/.sdk/tm/perl/feature/secrets/plugins/Voxgig/Sekreto/Plugins/Doppler.pm

@@ -0,0 +1,92 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (perl/plugins/Voxgig/Sekreto/Plugins/Doppler.pm)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+package Voxgig::Sekreto::Plugins::Doppler;
+
+# The doppler plugin: a Doppler config, downloaded once and answered from
+# memory.
+#
+# NOT IN THE CORE. A `Sekreto` can build this kind only if the calling
+# project passed this definition in through the `plugins` option; the
+# core loads nothing under `plugins/` (docs/design/plugin-providers.md).
+#
+# A port of typescript/plugins/doppler.ts, which is canonical.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+
+use Voxgig::Sekreto ();
+use Voxgig::Sekreto::Providers qw(providerplugin);
+use Voxgig::Sekreto::Addr ();
+use Voxgig::Sekreto::Plugins::Httpjson ();
+
+our @EXPORT_OK = qw(doppler);
+
+# Doppler.
+#
+# The whole config is downloaded once - Doppler's own bulk endpoint - and
+# answered from memory, like a remote .env: `api.token` is the `API_TOKEN`
+# entry. A service token is config-scoped, so project and config are only
+# needed with broader tokens.
+{
+
+    package Voxgig::Sekreto::Plugins::Doppler::Provider;
+
+    sub new {
+        my ( $class, $opts ) = @_;
+        return bless { opts => $opts || {}, values => undef }, $class;
+    }
+
+    sub load {
+        my ($self) = @_;
+
+        return $self->{values} if defined $self->{values};
+
+        ( my $addr = $self->{opts}{addr} || 'https://api.doppler.com' ) =~ s{/$}{};
+        Voxgig::Sekreto::Addr::checkaddr($addr);
+
+        my $url = $addr . '/v3/configs/config/secrets/download?format=json';
+        $url .= '&project=' . Voxgig::Sekreto::Plugins::Httpjson::urlenc( $self->{opts}{project} )
+          if $self->{opts}{project};
+        $url .= '&config=' . Voxgig::Sekreto::Plugins::Httpjson::urlenc( $self->{opts}{config} )
+          if $self->{opts}{config};
+
+        my ( $status, $body ) = Voxgig::Sekreto::Plugins::Httpjson::fetchjson( 'GET', $url,
+            { 'authorization' => 'Bearer ' . ( $self->{opts}{token} || '' ) } );
+
+        Voxgig::Sekreto::fail( 'sekreto: doppler error: ' . $status )
+          if 200 != $status || 'HASH' ne ref( $body || '' );
+
+        my %values;
+        for my $key ( keys %$body ) {
+            $values{$key} = Voxgig::Sekreto::Plugins::Httpjson::stringof( $body->{$key} )
+              if defined $body->{$key};
+        }
+        $self->{values} = \%values;
+
+        return $self->{values};
+    }
+
+    sub lookup {
+        my ( $self, $name ) = @_;
+        return $self->load()->{ Voxgig::Sekreto::envkey($name) };
+    }
+
+    sub describe {
+        my ($self) = @_;
+        my $opts = $self->{opts};
+        return 'doppler'
+          . ( $opts->{project} ? ':' . $opts->{project} . '/' . ( $opts->{config} || '' ) : '' );
+    }
+}
+
+
+# The plugin: the `doppler` provider kind, as a voxgig/plugin definition.
+sub doppler {
+    return providerplugin( 'doppler',
+        sub { Voxgig::Sekreto::Plugins::Doppler::Provider->new( $_[0] ) } );
+}
+
+1;