@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/secretspec.rb

@@ -0,0 +1,113 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/secretspec.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# The secretspec plugin: SecretSpec, read through its own CLI. Needs a
+# child process. A port of typescript/plugins/secretspec.ts, which is
+# canonical.
+
+require 'open3'
+
+require_relative '../../voxgig_sekreto'
+
+module VoxgigSekreto
+  module_function
+
+  # Does this SecretSpec failure mean "no such secret" rather than "I
+  # could not answer"?
+  #
+  # SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+  # not declare and one declared with no value, and both are misses: this
+  # store does not hold it, so the chain carries on.
+  #
+  # MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+  # `Provider backend 'keyring' not found`, which is a store that could
+  # not answer at all - and reading that as a miss is the worst failure
+  # this library has, because the chain then falls through to a weaker
+  # store without saying so. The key is required to appear, so the two
+  # cannot be confused.
+  def secretspecmiss(why, key)
+    why.include?("Secret '" + key + "' not found")
+  end
+
+  # SecretSpec (https://secretspec.dev).
+  #
+  # SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+  # project needs - plus a chain of its own backends to satisfy them from.
+  # That makes it the same shape as sekreto one level down, and the reason
+  # to support it is the same reason sekreto exists: a project that has
+  # already declared its secrets there should not have to declare them
+  # again here.
+  #
+  # Read through its CLI, as boru is, because that is the interface it
+  # offers a program in another language: `secretspec get API_TOKEN`
+  # prints the value on stdout and nothing else. A sekreto name maps to a
+  # SecretSpec key exactly as it maps to an environment variable -
+  # `api.token` is `API_TOKEN` - which is the convention SecretSpec's own
+  # examples use.
+  #
+  # `backend` selects one of SecretSpec's backends (`--provider`, e.g.
+  # `keyring` or `dotenv://.env`) and is called `backend` here only
+  # because `provider` already means something else in this library.
+  #
+  # A reason is required, not optional: SecretSpec records every read in
+  # an audit log and refuses to read at all without one. sekreto sends
+  # `sekreto` unless told otherwise, so the audit trail says which tool
+  # asked.
+  class SecretspecProvider
+    def initialize(command = nil, file = nil, profile = nil,
+                   backend = nil, reason = nil, prefix = nil)
+      @command = command || 'secretspec'
+      @file = file
+      @profile = profile
+      @backend = backend
+      @reason = reason
+      @prefix = prefix
+    end
+
+    def lookup(name)
+      key = VoxgigSekreto.envkey(name, @prefix)
+
+      args = []
+      args += ['--file', @file] if @file
+      args += ['get', key]
+      args += ['--provider', @backend] if @backend
+      args += ['--profile', @profile] if @profile
+      args += ['--reason', @reason || 'sekreto']
+
+      begin
+        out, err, status = Open3.capture3(@command, *args)
+      rescue SystemCallError => e
+        raise SekretoError, 'sekreto: cannot run ' + @command + ': ' + e.message
+      end
+
+      # The value and one newline, and nothing else. Open3 tags the
+      # child's bytes with the default external encoding, US-ASCII in a
+      # stripped environment - and SecretSpec draws its errors with box
+      # characters, so matching them as ASCII raises. Read both as the
+      # UTF-8 they are.
+      return out.force_encoding('UTF-8').sub(/\n\z/, '') if status.success?
+
+      why = err.to_s.force_encoding('UTF-8').scrub.strip
+
+      return nil if VoxgigSekreto.secretspecmiss(why, key)
+
+      raise SekretoError,
+            'sekreto: secretspec error: ' + (why.empty? ? 'exit ' + status.exitstatus.to_s : why)
+    end
+
+    def describe
+      'secretspec' + (@backend ? ':' + @backend : '')
+    end
+  end
+
+  module Plugins
+    # The plugin: the `secretspec` provider kind, as a voxgig/plugin
+    # definition.
+    SECRETSPEC = VoxgigSekreto.providerplugin('secretspec', lambda { |spec|
+      SecretspecProvider.new(spec['command'], spec['file'], spec['profile'],
+                             spec['backend'], spec['reason'], spec['prefix'])
+    })
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/sigv4.rb

@@ -0,0 +1,127 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/sigv4.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# AWS Signature Version 4, hand-rolled - and OUTSIDE THE CORE, because it
+# is the library's one cryptographic edge. Only the two aws kinds sign
+# anything, which is why the core requires no hash function at all.
+#
+# The AWS providers need exactly one thing from the AWS SDK - request
+# signing - and taking the SDK for it would break the no-dependency rule
+# that keeps twenty-three ports honest. SigV4 is a stable, published
+# algorithm built from HMAC-SHA256, which the standard library's openssl
+# already carries.
+#
+# `sigv4` is pure: the caller passes the timestamp, so the same input
+# yields the same signature everywhere. That is what lets the shared spec
+# carry known-answer cases that every port must reproduce bit-for-bit,
+# and lets the integration mock recompute the signature server-side.
+#
+# A port of typescript/plugins/sigv4.ts, which is canonical.
+
+require 'openssl'
+require 'uri'
+
+# `uriescape` and `uridecode` live in httpjson, because four plugins that
+# sign nothing need them too.
+require_relative 'httpjson'
+
+module VoxgigSekreto
+  module_function
+
+  def sha256hex(text)
+    OpenSSL::Digest::SHA256.hexdigest(text)
+  end
+
+  def hmacsha256(key, text)
+    OpenSSL::HMAC.digest('SHA256', key, text)
+  end
+
+  # The canonical query string: each pair RFC 3986-escaped, sorted by
+  # escaped key then escaped value.
+  def canonicalquery(query)
+    return '' if query.empty?
+
+    pairs = query.split('&', -1).map do |pair|
+      eq = pair.index('=')
+      key = eq.nil? ? pair : pair[0...eq]
+      value = eq.nil? ? '' : pair[(eq + 1)..]
+      [uriescape(uridecode(key)), uriescape(uridecode(value))]
+    end
+
+    pairs.sort.map { |key, value| key + '=' + value }.join('&')
+  end
+
+  # Sign one request. Returns the headers to attach: authorization,
+  # x-amz-date, and x-amz-security-token when a session token was given.
+  def sigv4(input)
+    get = ->(key) { input[key.to_s].nil? ? input[key] : input[key.to_s] }
+
+    uri = URI.parse(get.call(:url))
+    datetime = get.call(:datetime)
+    date = datetime[0, 8]
+    body = get.call(:body) || ''
+    session = get.call(:session)
+
+    # Every header that will be signed: the caller's extras, plus host and
+    # x-amz-date (and the session token when present), lower-cased and
+    # trimmed the way the canonical form requires.
+    # Canonical header values are trimmed AND internally collapsed -
+    # AWS folds sequential whitespace to one space before signing, so a
+    # header like "a  b" must sign as "a b" or the service refuses it.
+    headers = {}
+    (get.call(:headers) || {}).each do |key, value|
+      headers[key.to_s.downcase] = value.to_s.strip.gsub(/\s+/, ' ')
+    end
+
+    # The host includes the port only when it is not the scheme's default,
+    # which is how a URL prints it.
+    host = uri.host
+    host += ':' + uri.port.to_s if uri.port != uri.default_port
+    headers['host'] = host
+    headers['x-amz-date'] = datetime
+    headers['x-amz-security-token'] = session unless session.nil? || '' == session
+
+    names = headers.keys.sort
+    canonicalheaders = names.map { |name| name + ':' + headers[name] + "\n" }.join
+    signedheaders = names.join(';')
+
+    path = uri.path
+    path = '/' if path.empty?
+
+    canonicalrequest = [
+      get.call(:method).upcase,
+      path,
+      canonicalquery(uri.query || ''),
+      canonicalheaders,
+      signedheaders,
+      sha256hex(body)
+    ].join("\n")
+
+    scope = date + '/' + get.call(:region) + '/' + get.call(:service) + '/aws4_request'
+
+    stringtosign = [
+      'AWS4-HMAC-SHA256',
+      datetime,
+      scope,
+      sha256hex(canonicalrequest)
+    ].join("\n")
+
+    kdate = hmacsha256('AWS4' + get.call(:secret), date)
+    kregion = hmacsha256(kdate, get.call(:region))
+    kservice = hmacsha256(kregion, get.call(:service))
+    ksigning = hmacsha256(kservice, 'aws4_request')
+    signature = OpenSSL::HMAC.hexdigest('SHA256', ksigning, stringtosign)
+
+    out = {
+      'authorization' => 'AWS4-HMAC-SHA256 Credential=' + get.call(:keyid) + '/' + scope +
+                         ', SignedHeaders=' + signedheaders + ', Signature=' + signature,
+      'x-amz-date' => datetime
+    }
+
+    out['x-amz-security-token'] = session unless session.nil? || '' == session
+
+    out
+  end
+end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/providers.rb

@@ -0,0 +1,210 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/providers.rb)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# frozen_string_literal: true
+
+# What a provider is, how a provider kind becomes a voxgig/plugin
+# definition - and the four BUILT-IN kinds.
+#
+# A provider answers one question: "do you have this secret?" It returns
+# the value, or nil to mean "ask the next one". Nothing else about a
+# provider is visible to the caller - which is the point: an app reads
+# `api.token` and never learns whether it came from the environment, a
+# .env file, HashiCorp Vault or a boru vault.
+#
+# Two failure shapes, and they are never interchangeable. A store that
+# does not hold the secret is a MISS (nil) - the chain carries on. A
+# store that could not answer - bad credentials, unreachable host,
+# missing configuration - is an ERROR: falling through there would
+# quietly reach for a weaker store.
+#
+# THIS FILE REQUIRES NO net/http, NO openssl AND NO open3. What makes a
+# kind built in is that it needs nothing of the platform beyond reading a
+# local file; every kind that opens a socket, signs a request or spawns a
+# process is a plugin under plugins/, its own file, required only by a
+# program that names it (docs/design/plugin-providers.md).
+#
+# A port of typescript/src/provider/support.ts and
+# typescript/src/provider/builtin.ts, which are canonical.
+
+require_relative 'sekreto'
+
+module VoxgigSekreto
+  # Environment variables: `api.token` from `API_TOKEN`.
+  class EnvProvider
+    def initialize(prefix = nil, source = nil)
+      @prefix = prefix
+      @source = source || ENV
+    end
+
+    def lookup(name)
+      value = @source[VoxgigSekreto.envkey(name, @prefix)]
+      value.nil? ? nil : value.to_s
+    end
+
+    def describe
+      'env' + (@prefix ? ':' + @prefix : '')
+    end
+  end
+
+  # A `.env` file, read once, keyed exactly like the environment.
+  class DotenvProvider
+    def initialize(file, prefix = nil)
+      @file = file
+      @prefix = prefix
+      @values = nil
+    end
+
+    def load
+      if @values.nil?
+        @values = begin
+          VoxgigSekreto.parsedotenv(File.read(@file))
+        rescue Errno::ENOENT, Errno::ENOTDIR
+          # An absent file - or an absent directory - means "no secrets
+          # here", exactly like FileProvider. Anything else (permission
+          # denied, an unreadable mount) is a store that could not answer,
+          # and swallowing it would fall through to a weaker store.
+          {}
+        rescue StandardError => e
+          raise SekretoError, 'sekreto: dotenv provider cannot read ' + @file + ': ' + e.message
+        end
+      end
+      @values
+    end
+
+    def lookup(name)
+      load[VoxgigSekreto.envkey(name, @prefix)]
+    end
+
+    def describe
+      'dotenv:' + @file
+    end
+  end
+
+  # Literal values, keyed like environment variables. The spec uses this to
+  # test chain behaviour without touching the outside world.
+  class MemoryProvider
+    def initialize(values, prefix = nil)
+      @values = values || {}
+      @prefix = prefix
+    end
+
+    def lookup(name)
+      @values[VoxgigSekreto.envkey(name, @prefix)]
+    end
+
+    def describe
+      'memory' + (@prefix ? ':' + @prefix : '')
+    end
+  end
+
+  # A directory of one-secret-per-file entries, keyed like the
+  # environment: `api.token` reads `<dir>/API_TOKEN`.
+  #
+  # This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+  # secret, and a systemd credentials directory, so those all work with no
+  # further configuration. One trailing newline is stripped - tools that
+  # write these files disagree about it, and a newline is never part of a
+  # secret on purpose.
+  class FileProvider
+    def initialize(dir, prefix = nil)
+      @dir = dir
+      @prefix = prefix
+    end
+
+    def lookup(name)
+      file = File.join(@dir, VoxgigSekreto.envkey(name, @prefix))
+
+      text = begin
+        File.read(file)
+      rescue Errno::ENOENT, Errno::ENOTDIR
+        # An absent file - or an absent directory - means "no secrets
+        # here", exactly like a missing .env. Anything else (permission
+        # denied, an unreadable mount) is a store that could not answer.
+        return nil
+      rescue StandardError => e
+        raise SekretoError, 'sekreto: file provider cannot read ' + file + ': ' + e.message
+      end
+
+      text.sub(/\r?\n\z/, '')
+    end
+
+    def describe
+      'file:' + @dir
+    end
+  end
+
+  # --- providers as voxgig/plugin definitions ----------------------------
+
+  # The export key under which a provider definition publishes the
+  # provider it built. `Sekreto` reads `<ref>/provider` off the host.
+  PROVIDER_EXPORT = 'provider'
+
+  # The voxgig/plugin error code a SekretoError travels under when it is
+  # raised inside a definition's `define`.
+  #
+  # plugin wraps a code-less error raised by a callback as
+  # `plugin_define_failed`, and keeps an error that already carries a
+  # code. A provider that refuses its own configuration - `kv: 3`, a
+  # missing project - raises a SekretoError, and that message is pinned
+  # by the spec byte for byte, so it must come back out of the host
+  # exactly as it went in. `providerplugin` gives it this code on the way
+  # in; `Sekreto` turns it back into a SekretoError on the way out.
+  ERROR_CODE = 'sekreto_error'
+
+  module_function
+
+  # A provider kind, as a voxgig/plugin definition.
+  #
+  # This is the whole bridge between the two libraries. The definition's
+  # `name` is the `kind` a spec names; its `define` reads the spec as
+  # `inst.options`, builds the provider with `make`, and exports it.
+  # Nothing runs at `activate`: a provider opens nothing until its first
+  # lookup, so there is nothing to capture - a provider that does hold a
+  # resource acquires it there and lets the instance scope unwind it.
+  #
+  # Every built-in and every plugin is made this way, so a custom
+  # provider kind is one call:
+  #
+  #     providerplugin('mystore', ->(spec) { MyStore.new(spec['addr']) })
+  def providerplugin(kind, make)
+    {
+      'name' => kind,
+      'define' => lambda { |inst|
+        provider = begin
+          make.call(inst.options || {})
+        rescue SekretoError => e
+          raise VoxgigPlugin::PluginError.new(
+            ERROR_CODE, e.message, { 'ref' => inst.ref, 'cause' => e.message }
+          )
+        end
+
+        inst.export(PROVIDER_EXPORT, provider)
+      }
+    }
+  end
+
+  # The four built-in provider kinds - the same four in every port. What
+  # makes a kind built in is that it reads at most a local file: no
+  # socket, no TLS, no crypto, no child process.
+  BUILTINS = [
+    providerplugin('env', ->(spec) { EnvProvider.new(spec['prefix']) }),
+    providerplugin('memory', lambda { |spec|
+      MemoryProvider.new(spec['values'] || {}, spec['prefix'])
+    }),
+    providerplugin('dotenv', lambda { |spec|
+      DotenvProvider.new(spec['file'] || '.env', spec['prefix'])
+    }),
+    providerplugin('file', ->(spec) { FileProvider.new(spec['dir'] || '', spec['prefix']) })
+  ].freeze
+
+  # Every kind this library ships, built in or as a plugin, so that a kind
+  # sekreto has never heard of can be told from one that was not passed in.
+  KINDS = {
+    'builtin' => %w[env memory dotenv file].freeze,
+    'plugin' => %w[
+      hashicorp boru awssecrets awsparams gcpsecrets azuresecrets
+      onepassword doppler infisical secretspec
+    ].freeze
+  }.freeze
+end