@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/java/feature/secrets/sekreto/Addr.java

@@ -0,0 +1,142 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Addr.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Reading a vault address, and refusing the ones that would leak.
+//
+// Core, not a plugin: nothing here opens anything. It is the check every
+// plugin that DOES open a socket runs first, so it has to be reachable
+// from a place that reaches no plugin.
+//
+// A port of typescript/src/provider/addr.ts, which is canonical.
+
+package JAVAPACKAGE.feature.secrets.sekreto;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+
+public final class Addr {
+
+  private Addr() {}
+
+  /**
+   * An address with any userinfo replaced by `[redacted]`, for messages.
+   *
+   * <p>Every refusal below names the address it refused, and one of them
+   * fires precisely because the address carries a credential - so printing it
+   * verbatim wrote the password to stderr and into the logs. It cannot be
+   * cleaned up afterwards either: that password was never resolved as a
+   * secret, so redact() has never seen it and never will. The host is what a
+   * reader needs to identify which chain entry is at fault; the userinfo is
+   * not.
+   */
+  public static String safeaddr(String addr) {
+    int mark = addr.indexOf("://");
+    if (-1 == mark) {
+      return addr;
+    }
+
+    String rest = addr.substring(mark + 3);
+    int end = rest.length();
+    for (String mark2 : new String[] {"/", "?", "#"}) {
+      int found = rest.indexOf(mark2);
+      if (-1 != found && found < end) {
+        end = found;
+      }
+    }
+
+    int at = rest.substring(0, end).lastIndexOf('@');
+    if (-1 == at) {
+      return addr;
+    }
+
+    return addr.substring(0, mark + 3) + "[redacted]" + addr.substring(mark + 3 + at);
+  }
+
+  /**
+   * Refuse to send a secret-bearing credential in the clear.
+   *
+   * <p>A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+   * convenience. Sending a token over http to anything but the local machine
+   * puts both the token and the secret it fetches on the wire for anyone on
+   * the path, so sekreto will not do it. Loopback stays allowed: that is
+   * `vault server -dev`, `boru vault serve`, and this repo's own test
+   * harness.
+   *
+   * <p>The address is read by hand, in the same handful of steps in every
+   * port, rather than by each platform's URL parser. That is deliberate.
+   * Twelve parsers disagree about malformed input - where userinfo ends,
+   * whether `0177.0.0.1` is loopback, what an unclosed bracket means - and a
+   * check that answers differently in different ports is not a check.
+   *
+   * <p>The rule this parse obeys, and the reason it can be trusted: it is
+   * never more permissive than the HTTP client that will dial the address. It
+   * ends the authority at `/`, `?` or `#` only, so a client that also breaks
+   * on `\` (WHATWG does) can only ever see a SHORTER host than this does. It
+   * refuses userinfo outright rather than locating its end. It compares the
+   * host literally, so a numeric form no parser here agrees on is refused
+   * rather than guessed at.
+   */
+  public static void checkaddr(String addr) {
+    String scheme;
+    if (addr.startsWith("https://")) {
+      scheme = "https://";
+    } else if (addr.startsWith("http://")) {
+      scheme = "http://";
+    } else {
+      throw new SekretoError("sekreto: not an http(s) address: " + safeaddr(addr));
+    }
+
+    String rest = addr.substring(scheme.length());
+
+    int end = rest.length();
+    for (String mark : new String[] {"/", "?", "#"}) {
+      int at = rest.indexOf(mark);
+      if (-1 != at && at < end) {
+        end = at;
+      }
+    }
+    String authority = rest.substring(0, end);
+
+    // Userinfo is refused outright rather than parsed around, and on https as
+    // well as http. No store this library speaks authenticates by userinfo -
+    // they take a token or a signature - so an address carrying one is a
+    // mistake at best. At worst it is the attack this whole function exists
+    // to stop: http://localhost:8200@evil.example.com/ is a request to
+    // evil.example.com that reads, to anything that splits the authority on
+    // ':', as loopback.
+    if (authority.contains("@")) {
+      throw new SekretoError("sekreto: refusing an address with embedded credentials: " + safeaddr(addr));
+    }
+
+    // An opening bracket with no closing one is not an address at all.
+    if (authority.startsWith("[") && !authority.contains("]")) {
+      throw new SekretoError("sekreto: not a valid http(s) address: " + safeaddr(addr));
+    }
+
+    if ("https://".equals(scheme)) {
+      return;
+    }
+
+    // A bracketed IPv6 literal keeps its brackets. Splitting the authority on
+    // the first colon yields "[", so http://[::1]:8200 could never match -
+    // which made the "[::1]" entry below unreachable, and refused a
+    // legitimate local vault.
+    String host;
+    if (authority.startsWith("[")) {
+      host = authority.substring(0, authority.indexOf("]") + 1);
+    } else {
+      int colon = authority.indexOf(':');
+      host = -1 == colon ? authority : authority.substring(0, colon);
+    }
+    host = host.toLowerCase(java.util.Locale.ROOT);
+
+    if ("localhost".equals(host)
+        || "127.0.0.1".equals(host)
+        || "::1".equals(host)
+        || "[::1]".equals(host)) {
+      return;
+    }
+
+    throw new SekretoError(
+        "sekreto: refusing to send a token in plaintext to " + safeaddr(addr) + " (use https)");
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/Builtins.java

@@ -0,0 +1,229 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Builtins.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// THE BUILT-IN PROVIDER KINDS - the same four in every port.
+//
+// What makes a kind built in is that it needs nothing of the platform
+// beyond reading a local file: no socket, no TLS, no crypto, no child
+// process. These four are the floor every chain stands on, and a chain
+// that reads secrets from options, the environment, a plaintext `.env`
+// and a mounted secret directory works with no plugin loaded at all.
+// Everything else - the vault clients, the cloud stores, the CLIs - is a
+// plugin, and lives under plugins/ (docs/design/plugin-providers.md).
+//
+// A port of typescript/src/provider/builtin.ts, which is canonical.
+
+package JAVAPACKAGE.feature.secrets.sekreto;
+
+import JAVAPACKAGE.feature.secrets.sekreto.Sekreto.SekretoError;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import JAVAPACKAGE.feature.secrets.plugin.Definition;
+
+public final class Builtins {
+
+  private Builtins() {}
+
+  /** The four kinds every Sekreto can build, whatever it was handed. */
+  public static final List<Definition> BUILTINS = List.of(
+      Support.providerplugin("env", spec -> new Env(Support.text(spec.get("prefix")))),
+      Support.providerplugin("memory", spec ->
+          new Memory(Support.map(spec.get("values")), Support.text(spec.get("prefix")))),
+      Support.providerplugin("dotenv", spec ->
+          new Dotenv(Support.textor(spec.get("file"), ".env"), Support.text(spec.get("prefix")))),
+      Support.providerplugin("file", spec ->
+          new File(Support.textor(spec.get("dir"), ""), Support.text(spec.get("prefix")))));
+
+  /** The four names above, in the order the design document lists them. */
+  public static final List<String> BUILTIN_KINDS = List.of("env", "memory", "dotenv", "file");
+
+  /**
+   * Every kind this library ships as a PLUGIN, so that a kind nobody
+   * ships can be told from one the caller simply did not pass in.
+   *
+   * <p>A list of names and nothing more: naming a plugin here does not
+   * reach it, which is the point - the core must not.
+   */
+  public static final List<String> PLUGIN_KINDS = List.of(
+      "hashicorp", "boru", "awssecrets", "awsparams", "gcpsecrets",
+      "azuresecrets", "onepassword", "doppler", "infisical", "secretspec");
+
+  /**
+   * Does this read failure mean "no secrets here", rather than "I could not
+   * answer"?
+   *
+   * <p>Absence is a MISS and the chain carries on; anything else - permission
+   * denied, an unreadable mount, a failing disk - is an ERROR, because
+   * returning a miss there falls silently through to a weaker store.
+   *
+   * <p>Asked of the directory, not of the file. The obvious spelling,
+   * {@code !Files.exists(file)}, is wrong in exactly the case the rule exists
+   * for: {@code Files.exists} is "did checkAccess throw", so it answers
+   * <em>false</em> for an {@code AccessDeniedException} and turned a locked
+   * directory - the canonical "unreadable mount" - into a miss. A path whose
+   * parent is a plain file (ENOTDIR) really is "no secrets here", and that is
+   * what this asks. The reason string is not consulted: it comes from the C
+   * library's strerror and follows the machine's locale.
+   */
+  static boolean absent(Path file) {
+    Path dir = file.getParent();
+    return null != dir && !Files.isDirectory(dir);
+  }
+
+  /** Environment variables: `api.token` from `API_TOKEN`. */
+  public static final class Env implements Provider {
+    private final String prefix;
+    private final Map<String, Object> source;
+
+    public Env(String prefix) {
+      this(prefix, null);
+    }
+
+    public Env(String prefix, Map<String, Object> source) {
+      this.prefix = prefix;
+      this.source = source;
+    }
+
+    @Override
+    public String lookup(String name) {
+      String key = Sekreto.envkey(name, prefix);
+      Object value = null == source ? System.getenv(key) : source.get(key);
+      return null == value ? null : String.valueOf(value);
+    }
+
+    @Override
+    public String describe() {
+      return "env" + (null == prefix || prefix.isEmpty() ? "" : ":" + prefix);
+    }
+  }
+
+  /** A `.env` file, read once, keyed exactly like the environment. */
+  public static final class Dotenv implements Provider {
+    private final String file;
+    private final String prefix;
+    private Map<String, Object> values;
+
+    public Dotenv(String file, String prefix) {
+      this.file = file;
+      this.prefix = prefix;
+    }
+
+    private Map<String, Object> load() {
+      if (null == values) {
+        Path path = Paths.get(file);
+        try {
+          values = Sekreto.parsedotenv(
+              new String(Files.readAllBytes(path), StandardCharsets.UTF_8));
+        } catch (NoSuchFileException err) {
+          // An absent file - or an absent directory - means "no secrets
+          // here", exactly like the file provider.
+          values = new LinkedHashMap<>();
+        } catch (IOException err) {
+          if (absent(path)) {
+            values = new LinkedHashMap<>();
+          } else {
+            throw new SekretoError(
+                "sekreto: dotenv provider cannot read " + file + ": " + err.getMessage());
+          }
+        }
+      }
+      return values;
+    }
+
+    @Override
+    public String lookup(String name) {
+      Object value = load().get(Sekreto.envkey(name, prefix));
+      return null == value ? null : String.valueOf(value);
+    }
+
+    @Override
+    public String describe() {
+      return "dotenv:" + file;
+    }
+  }
+
+  /**
+   * Literal values, keyed like environment variables. The spec uses this to
+   * test chain behaviour without touching the outside world.
+   */
+  public static final class Memory implements Provider {
+    private final Map<String, Object> values;
+    private final String prefix;
+
+    public Memory(Map<String, Object> values, String prefix) {
+      this.values = null == values ? new LinkedHashMap<>() : values;
+      this.prefix = prefix;
+    }
+
+    @Override
+    public String lookup(String name) {
+      Object value = values.get(Sekreto.envkey(name, prefix));
+      return null == value ? null : String.valueOf(value);
+    }
+
+    @Override
+    public String describe() {
+      return "memory" + (null == prefix || prefix.isEmpty() ? "" : ":" + prefix);
+    }
+  }
+
+  /**
+   * A directory of one-secret-per-file entries, keyed like the environment:
+   * `api.token` reads `<dir>/API_TOKEN`.
+   *
+   * <p>This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+   * secret, and a systemd credentials directory, so those all work with no
+   * further configuration. One trailing newline is stripped - tools that
+   * write these files disagree about it, and a newline is never part of a
+   * secret on purpose.
+   */
+  public static final class File implements Provider {
+    private final String dir;
+    private final String prefix;
+
+    public File(String dir, String prefix) {
+      this.dir = null == dir ? "" : dir;
+      this.prefix = prefix;
+    }
+
+    @Override
+    public String lookup(String name) {
+      Path file = Paths.get(dir, Sekreto.envkey(name, prefix));
+
+      String text;
+      try {
+        text = new String(Files.readAllBytes(file), StandardCharsets.UTF_8);
+      } catch (NoSuchFileException err) {
+        // An absent file - or an absent directory - means "no secrets
+        // here", exactly like a missing .env.
+        return null;
+      } catch (IOException err) {
+        if (absent(file)) {
+          return null;
+        }
+        throw new SekretoError(
+            "sekreto: file provider cannot read " + file + ": " + err.getMessage());
+      }
+
+      if (text.endsWith("\r\n")) {
+        return text.substring(0, text.length() - 2);
+      }
+      if (text.endsWith("\n")) {
+        return text.substring(0, text.length() - 1);
+      }
+      return text;
+    }
+
+    @Override
+    public String describe() {
+      return "file:" + dir;
+    }
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/Json.java

@@ -0,0 +1,302 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Json.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Minimal JSON support for sekreto.
+//
+// sekreto adds no third-party dependencies, so it carries just enough JSON
+// to read a vault's answer and write the CLI's own line of output. It is
+// deliberately not a general-purpose library.
+//
+// Parses into plain Java values:
+//   object  -> LinkedHashMap<String,Object> (insertion ordered)
+//   array   -> ArrayList<Object>
+//   string  -> String
+//   number  -> Double
+//   boolean -> Boolean
+//   null    -> null
+
+package JAVAPACKAGE.feature.secrets.sekreto;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+public final class Json {
+
+  private Json() {}
+
+  private static final class Reader {
+    private final String text;
+    private int at;
+
+    Reader(String text) {
+      this.text = text;
+    }
+
+    void skip() {
+      while (at < text.length() && Character.isWhitespace(text.charAt(at))) {
+        at++;
+      }
+    }
+
+    char peek() {
+      return at < text.length() ? text.charAt(at) : '\0';
+    }
+
+    boolean done() {
+      return at >= text.length();
+    }
+
+    Object value() {
+      skip();
+
+      if (done()) {
+        return null;
+      }
+
+      char head = peek();
+
+      if ('{' == head) {
+        return object();
+      }
+      if ('[' == head) {
+        return array();
+      }
+      if ('"' == head) {
+        return string();
+      }
+      if (text.startsWith("true", at)) {
+        at += 4;
+        return Boolean.TRUE;
+      }
+      if (text.startsWith("false", at)) {
+        at += 5;
+        return Boolean.FALSE;
+      }
+      if (text.startsWith("null", at)) {
+        at += 4;
+        return null;
+      }
+
+      return number();
+    }
+
+    Map<String, Object> object() {
+      Map<String, Object> out = new LinkedHashMap<>();
+      at++; // {
+      skip();
+
+      if ('}' == peek()) {
+        at++;
+        return out;
+      }
+
+      while (!done()) {
+        skip();
+        String key = string();
+        skip();
+        at++; // :
+        out.put(key, value());
+        skip();
+
+        if (',' == peek()) {
+          at++;
+          continue;
+        }
+
+        at++; // }
+        break;
+      }
+
+      return out;
+    }
+
+    List<Object> array() {
+      List<Object> out = new ArrayList<>();
+      at++; // [
+      skip();
+
+      if (']' == peek()) {
+        at++;
+        return out;
+      }
+
+      while (!done()) {
+        out.add(value());
+        skip();
+
+        if (',' == peek()) {
+          at++;
+          continue;
+        }
+
+        at++; // ]
+        break;
+      }
+
+      return out;
+    }
+
+    String string() {
+      StringBuilder out = new StringBuilder();
+      at++; // opening quote
+
+      while (at < text.length()) {
+        char head = text.charAt(at++);
+
+        if ('"' == head) {
+          break;
+        }
+
+        if ('\\' != head) {
+          out.append(head);
+          continue;
+        }
+
+        char next = text.charAt(at++);
+        switch (next) {
+          case 'n':
+            out.append('\n');
+            break;
+          case 'r':
+            out.append('\r');
+            break;
+          case 't':
+            out.append('\t');
+            break;
+          case 'b':
+            out.append('\b');
+            break;
+          case 'f':
+            out.append('\f');
+            break;
+          case 'u':
+            out.append((char) Integer.parseInt(text.substring(at, at + 4), 16));
+            at += 4;
+            break;
+          default:
+            out.append(next);
+        }
+      }
+
+      return out.toString();
+    }
+
+    Double number() {
+      int start = at;
+
+      while (at < text.length() && 0 > "]},\n\r\t ".indexOf(text.charAt(at))) {
+        at++;
+      }
+
+      try {
+        return Double.valueOf(text.substring(start, at));
+      } catch (NumberFormatException err) {
+        return null;
+      }
+    }
+  }
+
+  /** Parse JSON text, answering null for anything unreadable. */
+  public static Object parse(String text) {
+    if (null == text || text.isEmpty()) {
+      return null;
+    }
+
+    try {
+      return new Reader(text).value();
+    } catch (RuntimeException err) {
+      return null;
+    }
+  }
+
+  /** Render a value as compact JSON. */
+  public static String stringify(Object value) {
+    StringBuilder out = new StringBuilder();
+    write(value, out);
+    return out.toString();
+  }
+
+  private static void write(Object value, StringBuilder out) {
+    if (null == value) {
+      out.append("null");
+      return;
+    }
+
+    if (value instanceof String) {
+      quote((String) value, out);
+      return;
+    }
+
+    if (value instanceof Boolean || value instanceof Number) {
+      out.append(String.valueOf(value));
+      return;
+    }
+
+    if (value instanceof Map) {
+      out.append('{');
+      boolean first = true;
+      for (Map.Entry<?, ?> entry : ((Map<?, ?>) value).entrySet()) {
+        if (!first) {
+          out.append(',');
+        }
+        first = false;
+        quote(String.valueOf(entry.getKey()), out);
+        out.append(':');
+        write(entry.getValue(), out);
+      }
+      out.append('}');
+      return;
+    }
+
+    if (value instanceof List) {
+      out.append('[');
+      boolean first = true;
+      for (Object item : (List<?>) value) {
+        if (!first) {
+          out.append(',');
+        }
+        first = false;
+        write(item, out);
+      }
+      out.append(']');
+      return;
+    }
+
+    quote(String.valueOf(value), out);
+  }
+
+  private static void quote(String text, StringBuilder out) {
+    out.append('"');
+
+    for (int index = 0; index < text.length(); index++) {
+      char head = text.charAt(index);
+      switch (head) {
+        case '"':
+          out.append("\\\"");
+          break;
+        case '\\':
+          out.append("\\\\");
+          break;
+        case '\n':
+          out.append("\\n");
+          break;
+        case '\r':
+          out.append("\\r");
+          break;
+        case '\t':
+          out.append("\\t");
+          break;
+        default:
+          if (0x20 > head) {
+            out.append(String.format("\\u%04x", (int) head));
+          } else {
+            out.append(head);
+          }
+      }
+    }
+
+    out.append('"');
+  }
+}

package/project/.sdk/tm/java/feature/secrets/sekreto/Provider.java

@@ -0,0 +1,21 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Provider.java)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// A source of secrets.
+//
+// A provider answers one question: "do you have this secret?" It returns
+// the value, or null to mean "ask the next one". Nothing else about a
+// provider is visible to the caller - which is the point: an app reads
+// `api.token` and never learns whether it came from the environment, a
+// .env file, HashiCorp Vault or a boru vault.
+
+package JAVAPACKAGE.feature.secrets.sekreto;
+
+public interface Provider {
+
+  /** The value, or null if this provider does not have it. */
+  String lookup(String name);
+
+  /** A short description, shown by `Sekreto.sources()`. */
+  String describe();
+}