@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/ocaml/feature/secrets/plugins/runcmd.ml

@@ -0,0 +1,97 @@
+(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/runcmd.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* Running a store's own CLI, and collecting both its streams.
+
+   Two of the ten plugin kinds read their store through a child process -
+   `boru` and `secretspec` - and a child process is one of the three things
+   that keeps a kind out of the core, beside a socket and a signature. *)
+
+open Secret
+
+type ran = { out : string; why : string; status : int }
+
+(* Where a command lives, or nowhere.
+
+   Resolved before forking: OCaml's `create_process` execs in the child, so
+   a command that is not there makes the child exit 127 with no error in the
+   parent - which is indistinguishable from a command that ran and failed.
+   "cannot run" and "the store said no" are different answers. *)
+let findexe (command : string) : string option =
+  let executable path = match Unix.access path [ Unix.X_OK ] with () -> true | exception _ -> false in
+
+  if String.contains command '/' then if executable command then Some command else None
+  else
+    let path = match Sys.getenv_opt "PATH" with Some value -> value | None -> "/usr/bin:/bin" in
+    let rec walk = function
+      | [] -> None
+      | dir :: rest ->
+        let cand = (if "" = dir then "." else dir) ^ "/" ^ command in
+        if executable cand then Some cand else walk rest
+    in
+    walk (String.split_on_char ':' path)
+
+(* Run a child to completion and collect both its streams.
+
+   The two streams are drained CONCURRENTLY, through one select loop.
+   Reading stdout to EOF and only then reading stderr deadlocks the moment
+   the child writes more than one pipe buffer (64 KiB on Linux) to stderr:
+   the parent is blocked waiting for stdout, the child is blocked waiting
+   for room on stderr, and neither can move. Nothing here sets a timeout, so
+   that hang is permanent - `get` simply never returns. secretspec's
+   diagnostics are box-drawn and reach that size easily.
+
+   The child's stdin is closed rather than left open on a pipe nobody writes
+   to, so a CLI that reads it - one prompting for a passphrase when its
+   environment variable is absent - sees EOF and gives up instead of waiting
+   forever.
+
+   Arguments go as an array, never through a shell, and no secret is ever
+   put on a command line where the process table would publish it. *)
+let runcmd (argv : string list) (env : string array) (command : string) : ran =
+  let exe =
+    match findexe command with
+    | Some path -> path
+    | None -> fail ("sekreto: cannot run " ^ command ^ ": No such file or directory")
+  in
+
+  let outr, outw = Unix.pipe () in
+  let errr, errw = Unix.pipe () in
+  let inr, inw = Unix.pipe () in
+  Unix.close inw;
+
+  let pid =
+    match Unix.create_process_env exe (Array.of_list argv) env inr outw errw with
+    | pid -> pid
+    | exception Unix.Unix_error (err, _, _) ->
+      List.iter (fun fd -> try Unix.close fd with _ -> ()) [ inr; outr; outw; errr; errw ];
+      fail ("sekreto: cannot run " ^ command ^ ": " ^ Unix.error_message err)
+  in
+
+  Unix.close inr;
+  Unix.close outw;
+  Unix.close errw;
+
+  let obuf = Buffer.create 4096 and ebuf = Buffer.create 4096 in
+  let live = ref [ outr; errr ] in
+  let chunk = Bytes.create 65536 in
+
+  while [] <> !live do
+    let ready, _, _ = Unix.select !live [] [] (-1.0) in
+    List.iter
+      (fun fd ->
+        let got = try Unix.read fd chunk 0 65536 with Unix.Unix_error _ -> 0 in
+        if 0 = got then begin
+          (try Unix.close fd with _ -> ());
+          live := List.filter (fun other -> other <> fd) !live
+        end
+        else Buffer.add_subbytes (if fd = outr then obuf else ebuf) chunk 0 got)
+      ready
+  done;
+
+  let status = match snd (Unix.waitpid [] pid) with
+    | Unix.WEXITED code -> code
+    | Unix.WSIGNALED code | Unix.WSTOPPED code -> 128 + code
+  in
+
+  { out = Buffer.contents obuf; why = trim (Buffer.contents ebuf); status }

package/project/.sdk/tm/ocaml/feature/secrets/plugins/secretspec.ml

@@ -0,0 +1,68 @@
+(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/secretspec.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* The `secretspec` provider kind, as a voxgig/plugin definition.
+
+   SecretSpec read through its own CLI - a child process, which is one of
+   the three things that keeps a kind out of the core.
+
+   A port of typescript/plugins/secretspec.ts, which is canonical. *)
+
+open Secret
+open Provider
+open Runcmd
+
+(* Does this SecretSpec failure mean "no such secret" rather than "I could
+   not answer"?
+
+   MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec says
+   `Secret 'API_TOKEN' not found` for both a name it does not declare and
+   one declared with no value, and both are misses. It also says
+   `Provider backend 'keyring' not found`, which is a store that could not
+   answer at all - and reading that as a miss is the worst failure this
+   library has. The key is required to appear, so the two cannot be
+   confused. *)
+let secretspecmiss (why : string) (key : string) : bool =
+  None <> findsub why ("Secret '" ^ key ^ "' not found")
+
+(* SecretSpec (https://secretspec.dev), read through its CLI.
+
+   `backend` selects one of SecretSpec's own backends (`--provider`) and is
+   called `backend` here only because `provider` already means something
+   else in this library.
+
+   A reason is required, not optional: SecretSpec records every read in an
+   audit log and refuses to read at all without one. *)
+let secretspec_provider (commandgiven : string) (file : string) (profile : string)
+    (backend : string) (reason : string) (prefix : string) : provider =
+  let command = if "" = commandgiven then "secretspec" else commandgiven in
+
+  {
+    lookup =
+      (fun name ->
+        let key = envkey ~prefix name in
+
+        (* `--file` before the subcommand, `--reason` always sent. *)
+        let argv =
+          [ command ]
+          @ (if "" = file then [] else [ "--file"; file ])
+          @ [ "get"; key ]
+          @ (if "" = backend then [] else [ "--provider"; backend ])
+          @ (if "" = profile then [] else [ "--profile"; profile ])
+          @ [ "--reason"; firstof [ reason; "sekreto" ] ]
+        in
+
+        let ran = runcmd argv (Unix.environment ()) command in
+
+        if 0 = ran.status then Some (dropsuffix ran.out "\n")
+        else if secretspecmiss ran.why key then None
+        else
+          fail
+            ("sekreto: secretspec error: "
+            ^ if "" = ran.why then "exit " ^ string_of_int ran.status else ran.why));
+    describe = (fun () -> if "" = backend then "secretspec" else "secretspec:" ^ backend);
+  }
+
+let plugin () : Defs.definition =
+  providerplugin "secretspec" (fun spec ->
+      secretspec_provider spec.command spec.file spec.profile spec.backend spec.reason spec.prefix)

package/project/.sdk/tm/ocaml/feature/secrets/plugins/sigv4.ml

@@ -0,0 +1,259 @@
+(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/sigv4.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* AWS Signature Version 4, hand-rolled.
+
+   The AWS providers need exactly one thing from the AWS SDK - request
+   signing - and taking the SDK for it would break the no-dependency rule
+   that keeps the ports honest. SigV4 is a stable, published algorithm built
+   from HMAC-SHA256, which plugins/crypto.ml carries.
+
+   `sigv4` is pure: the caller passes the timestamp, so the same input
+   yields the same signature everywhere. That is what lets the shared spec
+   carry known-answer cases that all ports must reproduce bit for bit, and
+   lets the integration mock recompute the signature server-side. Nothing
+   here samples the clock.
+
+   A port of typescript/src/Sigv4.ts, which is canonical. *)
+
+open Secret
+
+(* One request to sign - the same declarative shape the shared spec uses.
+   `datetime` is `YYYYMMDDTHHMMSSZ`, and it is the caller's. *)
+type signing = {
+  smethod : string;
+  url : string;
+  service : string;
+  region : string;
+  keyid : string;
+  secret : string;
+  datetime : string;
+  headers : (string * string) list;
+  body : string;
+  session : string;
+}
+
+let nosigning =
+  {
+    smethod = "";
+    url = "";
+    service = "";
+    region = "";
+    keyid = "";
+    secret = "";
+    datetime = "";
+    headers = [];
+    body = "";
+    session = "";
+  }
+
+(* RFC 3986 escaping, which is stricter than the usual URL encoder: AWS
+   wants everything but the unreserved set escaped, byte by byte over UTF-8,
+   with UPPERCASE hex. `!'()*` are escaped here and are not by the encoders
+   most standard libraries offer. *)
+let uriescape (text : string) : string =
+  let out = Buffer.create (String.length text) in
+  String.iter
+    (fun ch ->
+      let code = Char.code ch in
+      if
+        ('A' <= ch && ch <= 'Z')
+        || ('a' <= ch && ch <= 'z')
+        || ('0' <= ch && ch <= '9')
+        || '-' = ch || '_' = ch || '.' = ch || '~' = ch
+      then Buffer.add_char out ch
+      else Buffer.add_string out (Printf.sprintf "%%%02X" code))
+    text;
+  Buffer.contents out
+
+let hexvalue (ch : char) : int option =
+  match ch with
+  | '0' .. '9' -> Some (Char.code ch - Char.code '0')
+  | 'a' .. 'f' -> Some (Char.code ch - Char.code 'a' + 10)
+  | 'A' .. 'F' -> Some (Char.code ch - Char.code 'A' + 10)
+  | _ -> None
+
+(* Percent-decode, and nothing else: `+` stays `+`, as on the wire, and a
+   malformed escape is kept literally. *)
+let uridecode (text : string) : string =
+  let out = Buffer.create (String.length text) in
+  let len = String.length text in
+  let index = ref 0 in
+
+  while !index < len do
+    let taken = ref false in
+
+    if '%' = text.[!index] && !index + 2 < len then begin
+      match (hexvalue text.[!index + 1], hexvalue text.[!index + 2]) with
+      | Some high, Some low ->
+        Buffer.add_char out (Char.chr ((high * 16) + low));
+        index := !index + 3;
+        taken := true
+      | _ -> ()
+    end;
+
+    if not !taken then begin
+      Buffer.add_char out text.[!index];
+      incr index
+    end
+  done;
+
+  Buffer.contents out
+
+(* Split a query into pairs on `&`, then each on its FIRST `=`. A pair with
+   no `=` keeps an empty value and is still emitted with one. *)
+let canonicalquery (query : string) : string =
+  if "" = query then ""
+  else
+    let pairs =
+      List.map
+        (fun pair ->
+          match String.index_opt pair '=' with
+          | None -> (uriescape (uridecode pair), "")
+          | Some eq ->
+            ( uriescape (uridecode (String.sub pair 0 eq)),
+              uriescape (uridecode (String.sub pair (eq + 1) (String.length pair - eq - 1))) ))
+        (String.split_on_char '&' query)
+    in
+    let sorted =
+      List.stable_sort
+        (fun (lk, lv) (rk, rv) -> if lk = rk then compare lv rv else compare lk rk)
+        pairs
+    in
+    String.concat "&" (List.map (fun (key, value) -> key ^ "=" ^ value) sorted)
+
+(* The url, hand-split into the four parts signing needs.
+
+   Hand-split, not handed to a URL type: twelve URL parsers disagree about
+   malformed input, and the signature covers `host` and the raw path, so a
+   parser that normalises either of them signs something the server will not
+   recompute. *)
+type parts = { scheme : string; authority : string; path : string; query : string }
+
+let urlparts (url : string) : parts =
+  match findsub url "://" with
+  | None -> { scheme = ""; authority = ""; path = url; query = "" }
+  | Some mark ->
+    let scheme = String.sub url 0 mark in
+    let rest = String.sub url (mark + 3) (String.length url - mark - 3) in
+    let stop = match splitfirst rest "/?#" with Some at -> at | None -> String.length rest in
+    let authority = String.sub rest 0 stop in
+    let tail = String.sub rest stop (String.length rest - stop) in
+    let path, query =
+      match String.index_opt tail '?' with
+      | None -> (tail, "")
+      | Some at -> (String.sub tail 0 at, String.sub tail (at + 1) (String.length tail - at - 1))
+    in
+    let path = match String.index_opt path '#' with None -> path | Some at -> String.sub path 0 at in
+    { scheme; authority; path = (if "" = path then "/" else path); query }
+
+(* The `host` header as the canonical form wants it: the hostname
+   lowercased, any userinfo stripped, and the port appended ONLY when it is
+   not the scheme's default - `:443` on https is not what a URL normalises
+   to and not what the service recomputes. *)
+let hostheader (scheme : string) (authority : string) : string =
+  let bare =
+    match String.rindex_opt authority '@' with
+    | None -> authority
+    | Some at -> String.sub authority (at + 1) (String.length authority - at - 1)
+  in
+
+  let host, port =
+    if String.length bare > 0 && '[' = bare.[0] then
+      match String.index_opt bare ']' with
+      | None -> (bare, "")
+      | Some close ->
+        let head = String.sub bare 0 (close + 1) in
+        let tail = String.sub bare (close + 1) (String.length bare - close - 1) in
+        (head, if String.length tail > 1 && ':' = tail.[0] then String.sub tail 1 (String.length tail - 1) else "")
+    else
+      match String.rindex_opt bare ':' with
+      | None -> (bare, "")
+      | Some at ->
+        ( String.sub bare 0 at,
+          String.sub bare (at + 1) (String.length bare - at - 1) )
+  in
+
+  let host = String.lowercase_ascii host in
+  let default = if "https" = scheme then "443" else "80" in
+
+  if "" = port || port = default then host else host ^ ":" ^ port
+
+(* Collapse every internal whitespace run - spaces AND tabs - to one space,
+   after trimming. AWS folds header values before signing, so `a  b\tc`
+   must sign as `a b c` or the service refuses the request. *)
+let foldvalue (value : string) : string =
+  let trimmed = trim value in
+  let out = Buffer.create (String.length trimmed) in
+  let inrun = ref false in
+  String.iter
+    (fun ch ->
+      if ' ' = ch || '\t' = ch || '\n' = ch || '\r' = ch then inrun := true
+      else begin
+        if !inrun then Buffer.add_char out ' ';
+        inrun := false;
+        Buffer.add_char out ch
+      end)
+    trimmed;
+  Buffer.contents out
+
+(* Sign one request. Answers the headers to attach: authorization,
+   x-amz-date, and x-amz-security-token when a session token was given, in
+   that order - the spec compares the result as a whole JSON object, so the
+   order is contract. *)
+let sigv4 (input : signing) : (string * string) list =
+  let parts = urlparts input.url in
+  let date = String.sub input.datetime 0 (min 8 (String.length input.datetime)) in
+
+  (* The caller's headers first, then host, x-amz-date and the session
+     token, so that those three win over anything the caller passed. *)
+  let headers = ref [] in
+  List.iter
+    (fun (key, value) -> headers := assocset !headers (String.lowercase_ascii key) (foldvalue value))
+    input.headers;
+  headers := assocset !headers "host" (hostheader parts.scheme parts.authority);
+  headers := assocset !headers "x-amz-date" input.datetime;
+  if "" <> input.session then headers := assocset !headers "x-amz-security-token" input.session;
+
+  let sorted = List.stable_sort (fun (l, _) (r, _) -> compare l r) !headers in
+
+  let canonicalheaders =
+    String.concat "" (List.map (fun (key, value) -> key ^ ":" ^ value ^ "\n") sorted)
+  in
+  let signedheaders = String.concat ";" (List.map fst sorted) in
+
+  let canonicalrequest =
+    String.concat "\n"
+      [
+        String.uppercase_ascii input.smethod;
+        parts.path;
+        canonicalquery parts.query;
+        canonicalheaders;
+        signedheaders;
+        Crypto.sha256hex input.body;
+      ]
+  in
+
+  let scope = date ^ "/" ^ input.region ^ "/" ^ input.service ^ "/aws4_request" in
+
+  let stringtosign =
+    String.concat "\n"
+      [ "AWS4-HMAC-SHA256"; input.datetime; scope; Crypto.sha256hex canonicalrequest ]
+  in
+
+  let kdate = Crypto.hmac ("AWS4" ^ input.secret) date in
+  let kregion = Crypto.hmac kdate input.region in
+  let kservice = Crypto.hmac kregion input.service in
+  let ksigning = Crypto.hmac kservice "aws4_request" in
+  let signature = Crypto.hex (Crypto.hmac ksigning stringtosign) in
+
+  let out =
+    [
+      ( "authorization",
+        "AWS4-HMAC-SHA256 Credential=" ^ input.keyid ^ "/" ^ scope ^ ", SignedHeaders="
+        ^ signedheaders ^ ", Signature=" ^ signature );
+      ("x-amz-date", input.datetime);
+    ]
+  in
+
+  if "" = input.session then out else out @ [ ("x-amz-security-token", input.session) ]

package/project/.sdk/tm/ocaml/feature/secrets/plugins/tls.ml

@@ -0,0 +1,44 @@
+(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/tls.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* The OCaml side of the TLS binding.
+
+   Thin on purpose: everything that has to be got right is in
+   plugins/tls_stubs.c, next to the OpenSSL calls it is about, and this module
+   only decides whether a host is a name or an address, reads
+   SEKRETO_CA_BUNDLE, and turns a C-side failure into the library's own
+   error type.
+
+   The socket is OCaml's throughout - connected, bounded and closed by
+   plugins/http.ml - so the C side never owns a file descriptor. *)
+
+type conn
+
+external tls_connect : Unix.file_descr -> string -> bool -> string -> conn = "sekreto_tls_connect"
+external tls_write : conn -> string -> int -> int -> int = "sekreto_tls_write"
+external tls_read : conn -> Bytes.t -> int -> int -> int = "sekreto_tls_read"
+external tls_close : conn -> unit = "sekreto_tls_close"
+
+(* The cross-port way to add a private CA. Additive, never a replacement,
+   and it fails open in silence - see the note in tls_stubs.c. *)
+let cabundle = "SEKRETO_CA_BUNDLE"
+
+(* Is this host an IP literal rather than a DNS name?
+
+   It decides two things in the binding: an address is verified against the
+   certificate's iPAddress SAN rather than by DNS-name matching, and SNI is
+   not sent for it. Asked of the platform's own parser, which is the same
+   one the socket layer will use. *)
+let isip (host : string) : bool =
+  match Unix.inet_addr_of_string host with _ -> true | exception _ -> false
+
+(* Handshake over an already-connected socket, verifying the chain and the
+   host name. Any failure raises `Failure`, which plugins/http.ml turns into
+   `sekreto: cannot reach ...`. *)
+let connect (fd : Unix.file_descr) (host : string) : conn =
+  let extra = match Sys.getenv_opt cabundle with Some path -> path | None -> "" in
+  tls_connect fd host (isip host) extra
+
+let write (conn : conn) (text : string) (ofs : int) (len : int) : int = tls_write conn text ofs len
+let read (conn : conn) (buf : Bytes.t) (ofs : int) (len : int) : int = tls_read conn buf ofs len
+let close (conn : conn) : unit = tls_close conn