@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/core.clj

@@ -0,0 +1,192 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/core.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; The names, the errors and the text helpers - the half of sekreto that
+;; does not know what a provider is.
+;;
+;; `voxgig.sekreto.providers` builds the four built-in kinds out of these,
+;; and `voxgig.sekreto.chain` builds a chain out of those; `voxgig.sekreto`
+;; is the one namespace a consumer requires, and republishes all three.
+;;
+;; The split is not a matter of taste. The provider kinds need the name
+;; helpers, so the namespace that defines those cannot be the one that
+;; builds a chain out of kinds - a namespace cycle is a load error in
+;; Clojure, not a warning.
+;;
+;; A port of typescript/src/Sekreto.ts, which is canonical.
+
+(ns voxgig.sekreto.core
+  (:require [clojure.string :as string]
+            [voxgig.sekreto.json :as json])
+  (:import [java.util Locale]))
+
+(defn sekretoerror
+  "Anything sekreto refuses to do: a bad name, a missing secret, a provider
+  that could not be reached. One error type, carrying the message the spec
+  pins, so a caller can tell the library's own refusals from a bug."
+  [message]
+  (ex-info message {:sekreto true}))
+
+(defn sekretoerror?
+  "Is this one of sekreto's own errors?"
+  [err]
+  (boolean (:sekreto (ex-data err))))
+
+;; `re-matches` anchors at both ends of the whole input. The obvious `^...$`
+;; with a find would not: in java.util.regex `$` also matches BEFORE a final
+;; newline, so `token\n` would pass - and the spec has that exact case.
+(def ^:private NAMEPART #"[a-z0-9_]+")
+
+(defn dropsuffix
+  "Drop a suffix if it is there. `.` and `_` both appear in names, so this
+  is spelled out rather than reached for through a regex."
+  [^String text ^String suffix]
+  (if (.endsWith text suffix) (subs text 0 (- (count text) (count suffix))) text))
+
+(defn- upper
+  "Upper case in the root locale. The default locale is the machine's, and
+  in a Turkish one `i` upper-cases to a dotted capital that is not ASCII -
+  so an environment variable's name would depend on where the process runs."
+  [^String text]
+  (.toUpperCase text Locale/ROOT))
+
+(defn segments
+  "Split on the literal dot, KEEPING trailing empties: the usual split drops
+  them, which would make `a.` a valid one-segment name."
+  [^String name]
+  (string/split name #"\." -1))
+
+(defn validname
+  "Is this a well-formed secret name: dot-separated lowercase segments?"
+  [name]
+  (and (string? name)
+       (not= "" name)
+       (every? (fn [part] (some? (re-matches NAMEPART part))) (segments name))))
+
+(defn checkname
+  "The name, or a sekreto error. Every entry point checks its name here."
+  [name]
+  (when-not (validname name)
+    (throw (sekretoerror (str "sekreto: invalid name: " (if (nil? name) "" name)))))
+  name)
+
+(defn envkey
+  "The environment-variable key for a name: `api.token` -> `API_TOKEN`."
+  ([name] (envkey name nil))
+  ([name prefix]
+   (str (or prefix "") (upper (string/join "_" (segments (checkname name)))))))
+
+(defn vaultref
+  "Where a name lives in a KV vault: `api.token` -> `api` / `token`.
+
+  A single-segment name has no path of its own, so it becomes a secret of
+  that name with the conventional field `value`."
+  [name]
+  (let [parts (segments (checkname name))]
+    (if (= 1 (count parts))
+      {:path (nth parts 0) :field "value"}
+      {:path (string/join "/" (butlast parts)) :field (last parts)})))
+
+(defn flatname
+  "A name flattened to one segment: `api.token` -> `api_token` (GCP Secret
+  Manager, `_`) or `api-token` (Azure Key Vault, `-`).
+
+  Those stores have no path hierarchy and reject dots in ids, so the dots
+  become the store's conventional separator. With `-` as the separator,
+  underscores flatten too: Azure Key Vault's alphabet is letters, digits
+  and hyphens only, and a valid sekreto name like `with_underscore` must
+  still be representable there. (The resulting `.`/`_` collision mirrors
+  the documented envkey behaviour, where both already map to `_`.)"
+  [name sep]
+  (let [flat (string/join sep (segments (checkname name)))]
+    (if (= "-" sep) (string/replace flat "_" "-") flat)))
+
+(defn awsparam
+  "The AWS SSM Parameter Store name for a name: dots become the path
+  hierarchy, rooted at `/` (or at a prefix): `db.pass.main` ->
+  `/db/pass/main`, or `/app/db/pass/main` under prefix `/app`."
+  ([name] (awsparam name nil))
+  ([name prefix]
+   (let [checked (checkname name)
+         base (or prefix "")
+         base (if (and (not= "" base) (not (string/starts-with? base "/"))) (str "/" base) base)
+         base (dropsuffix base "/")]
+     (str base "/" (string/join "/" (segments checked))))))
+
+(defn- unescape [^String text]
+  (let [out (StringBuilder.)]
+    (loop [index 0]
+      (if (<= (count text) index)
+        (.toString out)
+        (let [ch (.charAt text index)]
+          (if (and (= \\ ch) (> (count text) (inc index)))
+            (let [next (.charAt text (inc index))]
+              (case next
+                \n (.append out \newline)
+                \r (.append out \return)
+                \t (.append out \tab)
+                \\ (.append out \\)
+                \" (.append out \")
+                (.append (.append out \\) next))
+              (recur (+ index 2)))
+            (do (.append out ch)
+                (recur (inc index)))))))))
+
+(defn- quoted? [^String value ^String mark]
+  (and (<= 2 (count value)) (string/starts-with? value mark) (string/ends-with? value mark)))
+
+(defn parsedotenv
+  "Parse `.env` text into a map of raw keys to values, in the file's order.
+
+  Deliberately small: `KEY=value`, optional `export`, `#` comments on their
+  own line, and single- or double-quoted values (double quotes also
+  unescape `\\n`, `\\r`, `\\t` and `\\\\`). A line with no `=` is skipped."
+  [text]
+  (if-not (string? text)
+    (json/omap [])
+    (json/omap
+     (for [rawline (string/split text #"\n" -1)
+           :let [line (string/trim (dropsuffix rawline "\r"))]
+           :when (and (not= "" line) (not (string/starts-with? line "#")))
+           :let [entry (if (string/starts-with? line "export ")
+                         (string/trim (subs line 7))
+                         line)
+                 eq (string/index-of entry "=")]
+           :when (and (some? eq) (< 0 eq))
+           :let [key (string/trim (subs entry 0 eq))
+                 value (string/trim (subs entry (inc eq)))]]
+       [key (cond
+              (quoted? value "\"") (unescape (subs value 1 (dec (count value))))
+              (quoted? value "'") (subs value 1 (dec (count value)))
+              :else value)]))))
+
+(defn redact
+  "Replace known secret values in text with `[redacted]`.
+
+  Only values of four characters or more are replaced: shorter ones are too
+  likely to appear in ordinary text, and redacting them would make logs
+  unreadable without making them safer."
+  [text values]
+  (let [body (if (string? text) text "")
+        ;; Longest first, so a value that contains a shorter one is redacted
+        ;; whole rather than left with a `[redacted]` in its middle. `sort-by`
+        ;; is stable, so equal lengths keep the caller's order - and the
+        ;; caller's own list is never reordered.
+        usable (->> (or values [])
+                    (filter string?)
+                    (filter (fn [value] (<= 4 (count value))))
+                    (sort-by (fn [value] (- (count value)))))]
+    (reduce (fn [out value] (string/replace out value "[redacted]")) body usable)))
+
+(defn notempty
+  "The string, when it is one and is not empty; nil otherwise. Config that
+  arrives as an empty string means \"not set\" everywhere in this library."
+  [value]
+  (when (and (string? value) (not= "" value)) value))
+
+(defn getenv
+  "An environment variable, or nil. NOT emptied: a variable set to the empty
+  string is a value the env provider answers with, and only the callers that
+  treat empty as unset - `firstof` in the shared HTTP helpers - say so."
+  [name]
+  (System/getenv name))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/json.clj

@@ -0,0 +1,261 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/json.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; Minimal JSON support for sekreto.
+;;
+;; sekreto adds no third-party dependencies, so it carries just enough JSON
+;; to read a vault's answer and write the CLI's own line of output. It is
+;; deliberately not a general-purpose library, and it is not
+;; clojure.data.json.
+;;
+;; Values are plain Clojure data - maps with string keys, vectors, strings,
+;; doubles, booleans and nil - with ONE addition. Clojure has nil for JSON
+;; null, so "there is no value here" needs a marker of its own: NONE. A
+;; store answering `null`, and a store answering text that is not JSON at
+;; all, mean different things, and only the second is a store that could not
+;; answer coherently. `parse` returns NONE for the second and nil for the
+;; first, which is the distinction the callers of fetchjson need.
+;;
+;; A port of typescript/src/Json.ts, which is canonical.
+
+(ns voxgig.sekreto.json
+  (:require [clojure.string :as string]))
+
+;; No value at all: text that is not JSON, or a walk that ran off the end of
+;; an object. Never a value a store legitimately sent.
+(def NONE ::none)
+
+(defn none?
+  "Is this the no-value marker, rather than a value (nil included)?"
+  [value]
+  (identical? NONE value))
+
+(defn omap
+  "An insertion-ordered map, built in one go from key/value pairs.
+
+  `array-map` keeps insertion order, but only until it is grown past eight
+  entries by `assoc` - after that it promotes to a hash map, whose iteration
+  order is its own. Redaction order and a signed payload's field order both
+  depend on the order a map was built in, so ordered maps here are built
+  from their pairs rather than assoc'd up one at a time. A repeated key
+  keeps its first position and takes its last value, the way an object
+  literal does."
+  [pairs]
+  (loop [keys [] values {} rest (seq pairs)]
+    (if (nil? rest)
+      (apply array-map (mapcat (fn [key] [key (get values key)]) keys))
+      (let [[key value] (first rest)]
+        (recur (if (contains? values key) keys (conj keys key))
+               (assoc values key value)
+               (next rest))))))
+
+(defn numstr
+  "Render a number the way every other port does: a whole number has no
+  fractional tail, so a JSON `1` read back and printed stays `1`."
+  [value]
+  (let [number (double value)]
+    (cond
+      (or (Double/isNaN number) (Double/isInfinite number)) "null"
+      (and (== number (Math/rint number)) (> 9007199254740992.0 (Math/abs number)))
+      (str (long number))
+      :else (str number))))
+
+(defn quotestr
+  "Render a string as a JSON string literal, quotes included."
+  [^String text]
+  (let [out (StringBuilder. "\"")]
+    (doseq [ch text]
+      (cond
+        (= \" ch) (.append out "\\\"")
+        (= \\ ch) (.append out "\\\\")
+        (= \newline ch) (.append out "\\n")
+        (= \return ch) (.append out "\\r")
+        (= \tab ch) (.append out "\\t")
+        (> 0x20 (int ch)) (.append out (format "\\u%04x" (int ch)))
+        :else (.append out ch)))
+    (.toString (.append out \"))))
+
+(defn stringify
+  "Render a value as compact JSON, keys in the order the map holds them."
+  [value]
+  (cond
+    (none? value) "null"
+    (nil? value) "null"
+    (boolean? value) (if value "true" "false")
+    (string? value) (quotestr value)
+    (number? value) (numstr value)
+    (vector? value) (str "[" (string/join "," (map stringify value)) "]")
+    (map? value) (str "{"
+                      (string/join
+                       ","
+                       (map (fn [[key entry]] (str (quotestr (str key)) ":" (stringify entry)))
+                            value))
+                      "}")
+    :else (quotestr (str value))))
+
+;; ------------------------------------------------------------- the reader
+;;
+;; Each step takes the text and a position and answers [value position].
+;; Malformed input throws, and `parse` - the only entry point - turns that
+;; into NONE, so a caller never sees this exception.
+
+(defn- bad [message]
+  (throw (ex-info (str "sekreto: json: " message) {:json true})))
+
+(defn- ws? [ch]
+  (or (= \space ch) (= \tab ch) (= \newline ch) (= \return ch)))
+
+(defn- skipws [^String text pos]
+  (loop [at pos]
+    (if (and (> (.length text) at) (ws? (.charAt text at))) (recur (inc at)) at)))
+
+(declare readvalue)
+
+(defn- readword [^String text pos ^String word value]
+  (if (and (>= (.length text) (+ pos (count word)))
+           (= word (subs text pos (+ pos (count word)))))
+    [value (+ pos (count word))]
+    (bad (str "bad literal at " pos))))
+
+(defn- readstr [^String text pos]
+  (when (or (<= (.length text) pos) (not= \" (.charAt text pos)))
+    (bad (str "expected string at " pos)))
+
+  (loop [at (inc pos)
+         out (StringBuilder.)]
+    (when (<= (.length text) at)
+      (bad "unterminated string"))
+
+    (let [ch (.charAt text at)]
+      (cond
+        (= \" ch) [(.toString out) (inc at)]
+
+        (not= \\ ch) (recur (inc at) (.append out ch))
+
+        (<= (.length text) (inc at)) (bad "unterminated string")
+
+        :else
+        (let [escape (.charAt text (inc at))]
+          (case escape
+            \" (recur (+ at 2) (.append out \"))
+            \\ (recur (+ at 2) (.append out \\))
+            \/ (recur (+ at 2) (.append out \/))
+            \b (recur (+ at 2) (.append out \backspace))
+            \f (recur (+ at 2) (.append out \formfeed))
+            \n (recur (+ at 2) (.append out \newline))
+            \r (recur (+ at 2) (.append out \return))
+            \t (recur (+ at 2) (.append out \tab))
+            \u (if (< (.length text) (+ at 6))
+                 (bad "bad unicode escape")
+                 (recur (+ at 6)
+                        (.append out (char (Integer/parseInt (subs text (+ at 2) (+ at 6)) 16)))))
+            (bad (str "bad escape [" escape "] at " at))))))))
+
+(defn- numchar? [ch]
+  (or (Character/isDigit ^char ch)
+      (= \. ch) (= \e ch) (= \E ch) (= \- ch) (= \+ ch)))
+
+(defn- readnum [^String text pos]
+  (let [end (loop [at pos]
+              (if (and (> (.length text) at) (numchar? (.charAt text at))) (recur (inc at)) at))
+        span (subs text pos end)]
+    (try
+      [(Double/parseDouble span) end]
+      (catch NumberFormatException _ (bad (str "bad number [" span "] at " pos))))))
+
+(defn- readarr [^String text pos]
+  (let [after (skipws text (inc pos))]
+    (if (and (> (.length text) after) (= \] (.charAt text after)))
+      [[] (inc after)]
+      (loop [at after
+             out []]
+        (let [[value next] (readvalue text (skipws text at))
+              done (skipws text next)]
+          (when (<= (.length text) done)
+            (bad "unterminated array"))
+          (case (.charAt text done)
+            \, (recur (inc done) (conj out value))
+            \] [(conj out value) (inc done)]
+            (bad (str "expected ',' or ']' at " done))))))))
+
+(defn- readobj [^String text pos]
+  (let [after (skipws text (inc pos))]
+    (if (and (> (.length text) after) (= \} (.charAt text after)))
+      [(omap []) (inc after)]
+      (loop [at after
+             pairs []]
+        (let [[key next] (readstr text (skipws text at))
+              colon (skipws text next)]
+          (when (or (<= (.length text) colon) (not= \: (.charAt text colon)))
+            (bad (str "expected ':' at " colon)))
+
+          (let [[value after-value] (readvalue text (skipws text (inc colon)))
+                done (skipws text after-value)]
+            (when (<= (.length text) done)
+              (bad "unterminated object"))
+            (case (.charAt text done)
+              \, (recur (inc done) (conj pairs [key value]))
+              \} [(omap (conj pairs [key value])) (inc done)]
+              (bad (str "expected ',' or '}' at " done)))))))))
+
+(defn- readvalue [^String text pos]
+  (when (<= (.length text) pos)
+    (bad "unexpected end"))
+
+  (case (.charAt text pos)
+    \{ (readobj text pos)
+    \[ (readarr text pos)
+    \" (readstr text pos)
+    \t (readword text pos "true" true)
+    \f (readword text pos "false" false)
+    \n (readword text pos "null" nil)
+    (readnum text pos)))
+
+(defn parse
+  "Parse JSON text. NONE for anything unreadable - which the caller must
+  tell apart from a literal `null` body, since only the first means the
+  store could not answer coherently."
+  [text]
+  (if (or (nil? text) (= "" text))
+    NONE
+    (try
+      (let [[value pos] (readvalue text (skipws text 0))]
+        (if (> (count text) (skipws text pos)) NONE value))
+      (catch Exception _ NONE))))
+
+;; ------------------------------------------------------------- the reads
+;;
+;; Every read answers nil (or NONE, for `dig`) rather than throwing, so a
+;; provider can walk a response body it did not write without checking each
+;; step. NONE in, NONE out.
+
+(defn dig
+  "Walk nested objects; NONE the moment a step is not there."
+  [value & keys]
+  (reduce (fn [at key]
+            (if (and (map? at) (contains? at key))
+              (get at key)
+              (reduced NONE)))
+          value
+          keys))
+
+(defn astext
+  "This value as the text a caller would print, or nil when there is no
+  value at all. A JSON null is \"no value\": every provider here treats it
+  as a miss rather than as the string \"null\"."
+  [value]
+  (cond
+    (none? value) nil
+    (nil? value) nil
+    (string? value) value
+    (boolean? value) (if value "true" "false")
+    (number? value) (numstr value)
+    :else (stringify value)))
+
+(defn asstr [value] (when (string? value) value))
+
+(defn asnum [value] (when (and (number? value) (not (boolean? value))) value))
+
+(defn asarr [value] (when (vector? value) value))
+
+(defn asobj [value] (when (map? value) value))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/aws.clj

@@ -0,0 +1,165 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/aws.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; The two AWS stores, as voxgig/plugin definitions - and the only two
+;; kinds that sign a request.
+;;
+;; ONE PLUGIN, TWO KINDS: Secrets Manager and Parameter Store share a
+;; signer, so they ship together and `sigv4` comes with them. That is what
+;; keeps the core of every port free of a hash function
+;; (docs/design/plugin-providers.md).
+;;
+;; A port of typescript/plugins/aws.ts, which is canonical.
+
+(ns voxgig.sekreto.plugins.aws
+  (:require [clojure.string :as string]
+            [voxgig.sekreto.core :as core]
+            [voxgig.sekreto.addr :refer [checkaddr]]
+            [voxgig.sekreto.json :as json]
+            [voxgig.sekreto.provider :as provider]
+            [voxgig.sekreto.providers :as providers]
+            [voxgig.sekreto.plugins.httpjson :as http]
+            [voxgig.sekreto.plugins.sigv4 :as sigv4])
+  (:import [java.nio.charset StandardCharsets]
+           [java.time Instant ZoneOffset]
+           [java.time.format DateTimeFormatter]
+           [java.util Base64]))
+
+(defn awsnow
+  "The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now."
+  []
+  (.format (.withZone (DateTimeFormatter/ofPattern "yyyyMMdd'T'HHmmss'Z'") ZoneOffset/UTC)
+           (Instant/now)))
+
+(defn awsauth
+  "Region and credentials, from config first and the standard AWS_*
+  environment variables second - those are AWS's own convention, and a pod
+  or CI job that has them set should just work. Missing either is an error:
+  an AWS store with no credentials could not answer."
+  [{:keys [region keyid secret session]}]
+  (let [useregion (http/firstof region (core/getenv "AWS_REGION") (core/getenv "AWS_DEFAULT_REGION"))
+        usekeyid (http/firstof keyid (core/getenv "AWS_ACCESS_KEY_ID"))
+        usesecret (http/firstof secret (core/getenv "AWS_SECRET_ACCESS_KEY"))
+        usesession (http/firstof session (core/getenv "AWS_SESSION_TOKEN"))]
+
+    (when (= "" useregion)
+      (throw (core/sekretoerror "sekreto: aws: no region (set region or AWS_REGION)")))
+
+    (when (or (= "" usekeyid) (= "" usesecret))
+      (throw (core/sekretoerror
+              (str "sekreto: aws: no credentials"
+                   " (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)"))))
+
+    {:region useregion :keyid usekeyid :secret usesecret :session (core/notempty usesession)}))
+
+(defn awscall
+  "One signed call to an AWS JSON-1.1 API."
+  [config service target payload]
+  (let [auth (awsauth config)
+        ;; The China partition lives under its own suffix; every other
+        ;; commercial region is plain amazonaws.com.
+        suffix (if (string/starts-with? (:region auth) "cn-") ".amazonaws.com.cn" ".amazonaws.com")
+        useaddr (http/firstof (:addr config) (str "https://" service "." (:region auth) suffix))
+        _ (checkaddr useaddr)
+        url (str (http/trimslash useaddr) "/")
+        extras (json/omap [["content-type" "application/x-amz-json-1.1"] ["x-amz-target" target]])
+        signed (sigv4/sigv4 {:method "POST"
+                             :url url
+                             :service service
+                             :region (:region auth)
+                             :keyid (:keyid auth)
+                             :secret (:secret auth)
+                             :datetime (awsnow)
+                             :headers extras
+                             :body payload
+                             :session (:session auth)})]
+    (http/fetchjson "POST" url (merge extras signed) payload)))
+
+(defn awsmiss?
+  "Does this AWS error body name one of the not-found types? Those are a
+  miss; every other failure is a store that could not answer."
+  [body & types]
+  (let [errtype (json/asstr (json/dig body "__type"))]
+    (boolean (and errtype (some (fn [want] (string/includes? errtype want)) types)))))
+
+(defrecord Awssecrets [region keyid secret session addr]
+  provider/Provider
+
+  ;; AWS Secrets Manager.
+  ;;
+  ;; `api.token` reads the secret named `api` (the vaultref path, so
+  ;; `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+  ;; SecretString - the AWS idiom of one JSON map per secret. A SecretString
+  ;; that is not JSON is the value itself, under the conventional field
+  ;; `value`. Requests are SigV4-signed in-tree; see sigv4.clj.
+  (lookup [this name]
+    (let [ref (core/vaultref name)
+          res (awscall this "secretsmanager" "secretsmanager.GetSecretValue"
+                       (json/stringify (json/omap [["SecretId" (:path ref)]])))]
+
+      (cond
+        (and (= 400 (:status res)) (awsmiss? (:body res) "ResourceNotFoundException")) nil
+
+        (not= 200 (:status res))
+        (throw (core/sekretoerror (str "sekreto: aws secretsmanager error: " (:status res))))
+
+        :else
+        (if-let [text (json/asstr (json/dig (:body res) "SecretString"))]
+          (let [fields (json/parse text)]
+            (if (map? fields)
+              (json/astext (json/dig fields (:field ref)))
+              ;; A plain-string secret is the whole value; it has no named
+              ;; fields.
+              (when (= "value" (:field ref)) text)))
+
+          ;; A binary secret has no fields to address; only the conventional
+          ;; `value` field can mean "the bytes themselves".
+          (let [bin (json/asstr (json/dig (:body res) "SecretBinary"))]
+            (when (and bin (= "value" (:field ref)))
+              (try
+                (String. (.decode (Base64/getDecoder) ^String bin) StandardCharsets/UTF_8)
+                ;; A store that answered incoherently is an error, and the
+                ;; decoder's own complaint is not one of this library's.
+                (catch IllegalArgumentException _
+                  (throw (core/sekretoerror
+                          "sekreto: aws secretsmanager: undecodable secret"))))))))))
+
+  ;; Config only, never the environment: `describe` feeds the spec's sources
+  ;; group, which must answer the same everywhere.
+  (describe [_] (str "awssecrets:" (or region ""))))
+
+(defrecord Awsparams [region keyid secret session addr prefix]
+  provider/Provider
+
+  ;; AWS SSM Parameter Store.
+  ;;
+  ;; `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+  ;; prefix path), decrypted. Parameter Store carries flat strings, so there
+  ;; is no field indirection.
+  (lookup [this name]
+    (let [payload (json/omap [["Name" (core/awsparam name prefix)] ["WithDecryption" true]])
+          res (awscall this "ssm" "AmazonSSM.GetParameter" (json/stringify payload))]
+
+      (cond
+        (and (= 400 (:status res)) (awsmiss? (:body res) "ParameterNotFound")) nil
+
+        (not= 200 (:status res))
+        (throw (core/sekretoerror (str "sekreto: aws ssm error: " (:status res))))
+
+        :else (json/astext (json/dig (:body res) "Parameter" "Value")))))
+
+  (describe [_] (str "awsparams:" (or region "") (or prefix ""))))
+
+(def awssecrets
+  "The `awssecrets` provider kind: AWS Secrets Manager."
+  (providers/providerplugin
+   "awssecrets"
+   (fn [{:keys [region keyid secret session addr]}]
+     (->Awssecrets region keyid secret session addr))))
+
+(def awsparams
+  "The `awsparams` provider kind: AWS SSM Parameter Store."
+  (providers/providerplugin
+   "awsparams"
+   (fn [{:keys [region keyid secret session addr prefix]}]
+     (->Awsparams region keyid secret session addr prefix))))