@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/sigv4.clj

@@ -0,0 +1,142 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/sigv4.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; AWS Signature Version 4, hand-rolled - and OUTSIDE THE CORE, because it
+;; is this library's one cryptographic edge. Only the two aws kinds sign
+;; anything, which is why the core of no port imports a hash function
+;; (docs/design/plugin-providers.md).
+;;
+;; The AWS providers need exactly one thing from the AWS SDK - request
+;; signing - and taking the SDK for it would break the no-dependency rule
+;; that keeps the ports honest. SigV4 is a stable, published algorithm built
+;; from HMAC-SHA256, which the JDK already has.
+;;
+;; `sigv4` is pure: the caller passes the timestamp, so the same input
+;; yields the same signature everywhere. That is what lets the shared spec
+;; carry known-answer cases that all ports must reproduce bit-for-bit, and
+;; lets the integration mock recompute the signature server-side.
+;;
+;; A port of typescript/plugins/sigv4.ts, which is canonical.
+
+(ns voxgig.sekreto.plugins.sigv4
+  (:require [clojure.string :as string]
+            [voxgig.sekreto.core :as core]
+            [voxgig.sekreto.json :as json]
+            [voxgig.sekreto.plugins.httpjson :as http])
+  (:import [java.net URI]
+           [java.nio.charset StandardCharsets]
+           [java.security GeneralSecurityException MessageDigest NoSuchAlgorithmException]
+           [java.util Locale]
+           [javax.crypto Mac]
+           [javax.crypto.spec SecretKeySpec]))
+
+(defn hex [^bytes bytes]
+  (let [out (StringBuilder.)]
+    (doseq [byte bytes]
+      (.append out (format "%02x" (bit-and (int byte) 0xff))))
+    (.toString out)))
+
+(defn sha256hex [^String text]
+  (try
+    (hex (.digest (MessageDigest/getInstance "SHA-256") (.getBytes text StandardCharsets/UTF_8)))
+    ;; Every JDK ships SHA-256; a JVM without it cannot sign anything.
+    (catch NoSuchAlgorithmException err
+      (throw (core/sekretoerror (str "sekreto: sigv4: no SHA-256: " (.getMessage err)))))))
+
+(defn hmac ^bytes [^bytes key ^String text]
+  (try
+    (let [mac (Mac/getInstance "HmacSHA256")]
+      (.init mac (SecretKeySpec. key "HmacSHA256"))
+      (.doFinal mac (.getBytes text StandardCharsets/UTF_8)))
+    (catch GeneralSecurityException err
+      (throw (core/sekretoerror (str "sekreto: sigv4: no HmacSHA256: " (.getMessage err)))))))
+
+(defn canonicalquery
+  "The canonical query string: each pair RFC 3986-escaped, sorted by escaped
+  key then escaped value. The escaping itself lives with the shared HTTP
+  helpers, because four plugins that sign nothing need it too."
+  [^String query]
+  (if (= "" query)
+    ""
+    (->> (string/split query #"&" -1)
+         (map (fn [pair]
+                (let [eq (string/index-of pair "=")
+                      key (if (nil? eq) pair (subs pair 0 eq))
+                      value (if (nil? eq) "" (subs pair (inc eq)))]
+                  [(http/uriescape (http/uridecode key))
+                   (http/uriescape (http/uridecode value))])))
+         (sort)
+         (map (fn [[key value]] (str key "=" value)))
+         (string/join "&"))))
+
+(defn sigv4
+  "Sign one request. Answers the headers to attach: authorization,
+  x-amz-date, and x-amz-security-token when a session token was given, in
+  that order - the spec compares the result as a JSON object, and callers
+  print it field by field.
+
+  The input is the same declarative shape the shared spec uses: `:method`,
+  `:url`, `:service`, `:region`, `:keyid`, `:secret`, `:datetime`
+  (`YYYYMMDDTHHMMSSZ`, and it is the caller's, so that signing is a pure
+  function of its input), and optionally `:headers`, `:body`, `:session`."
+  [{:keys [method url service region keyid secret datetime headers body session]}]
+  (let [uri (URI/create url)
+        date (subs datetime 0 8)
+        body (or body "")
+        session (core/notempty session)
+
+        ;; Every header that will be signed: the caller's extras, plus host
+        ;; and x-amz-date (and the session token when present), lower-cased
+        ;; and trimmed the way the canonical form requires. A sorted map
+        ;; keeps them in the canonical order, which is by name.
+        ;;
+        ;; Canonical header values are trimmed AND internally collapsed -
+        ;; AWS folds sequential whitespace to one space before signing, so a
+        ;; header like "a  b" must sign as "a b" or the service refuses it.
+        signheaders (cond-> (reduce-kv
+                             (fn [out key value]
+                               (assoc out
+                                      (.toLowerCase ^String key Locale/ROOT)
+                                      (string/replace (string/trim value) #"\s+" " ")))
+                             (sorted-map)
+                             (or headers {}))
+                      true (assoc "host" (str (.getHost uri)
+                                              (when (not= -1 (.getPort uri))
+                                                (str ":" (.getPort uri)))))
+                      true (assoc "x-amz-date" datetime)
+                      session (assoc "x-amz-security-token" session))
+
+        canonicalheaders (apply str (map (fn [[key value]] (str key ":" value "\n")) signheaders))
+        signedheaders (string/join ";" (keys signheaders))
+
+        rawpath (.getRawPath uri)
+        path (if (or (nil? rawpath) (= "" rawpath)) "/" rawpath)
+
+        canonicalrequest (string/join
+                          "\n"
+                          [(.toUpperCase ^String method Locale/ROOT)
+                           path
+                           (canonicalquery (or (.getRawQuery uri) ""))
+                           canonicalheaders
+                           signedheaders
+                           (sha256hex body)])
+
+        scope (str date "/" region "/" service "/aws4_request")
+
+        stringtosign (string/join "\n" ["AWS4-HMAC-SHA256"
+                                        datetime
+                                        scope
+                                        (sha256hex canonicalrequest)])
+
+        kdate (hmac (.getBytes (str "AWS4" secret) StandardCharsets/UTF_8) date)
+        kregion (hmac kdate region)
+        kservice (hmac kregion service)
+        ksigning (hmac kservice "aws4_request")
+        signature (hex (hmac ksigning stringtosign))]
+
+    (json/omap
+     (cond-> [["authorization" (str "AWS4-HMAC-SHA256 Credential=" keyid "/" scope
+                                    ", SignedHeaders=" signedheaders
+                                    ", Signature=" signature)]
+              ["x-amz-date" datetime]]
+       session (conj ["x-amz-security-token" session])))))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/provider.clj

@@ -0,0 +1,25 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/provider.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; A source of secrets.
+;;
+;; A provider answers one question: "do you have this secret?" It returns
+;; the value, or nil to mean "ask the next one". Nothing else about a
+;; provider is visible to the caller - which is the point: an app reads
+;; `api.token` and never learns whether it came from the environment, a
+;; .env file, HashiCorp Vault or a boru vault.
+;;
+;; A protocol rather than a map of functions: a provider of your own is any
+;; type that satisfies it, and `satisfies?` can say so before a chain is
+;; built.
+
+(ns voxgig.sekreto.provider)
+
+(defprotocol Provider
+
+  (lookup [this name]
+    "The value, or nil if this provider does not have it.")
+
+  (describe [this]
+    "A short description, shown by `sources`. It opens with the provider's
+    kind, because that is what a store's default name is taken from."))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/providers.clj

@@ -0,0 +1,196 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/providers.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; What a provider is, how a provider kind becomes a voxgig/plugin
+;; definition - and the four BUILT-IN kinds.
+;;
+;; A provider answers one question: "do you have this secret?" It returns
+;; the value, or nil to mean "ask the next one". Nothing else about a
+;; provider is visible to the caller - which is the point: an app reads
+;; `api.token` and never learns whether it came from the environment, a
+;; .env file, HashiCorp Vault or a boru vault.
+;;
+;; Two failure shapes, and they are never interchangeable. A store that does
+;; not hold the secret is a MISS (nil) - the chain carries on. A store that
+;; could not answer - bad credentials, unreachable host, missing
+;; configuration - is an ERROR, because falling through there would quietly
+;; reach for a weaker store.
+;;
+;; THIS NAMESPACE IMPORTS NO HTTP CLIENT, NO HASH FUNCTION AND NO
+;; ProcessBuilder. What makes a kind built in is that it needs nothing of
+;; the platform beyond reading a local file; every kind that opens a
+;; socket, signs a request or spawns a process is a plugin under
+;; `plugins/`, its own namespace, required only by a program that names it
+;; (docs/design/plugin-providers.md).
+;;
+;; A port of typescript/src/provider/support.ts and
+;; typescript/src/provider/builtin.ts, which are canonical.
+
+(ns voxgig.sekreto.providers
+  (:require [clojure.string :as string]
+            [voxgig.sekreto.core :as core]
+            [voxgig.sekreto.provider :as provider]
+            [voxgig.plugin.host :as host]
+            [voxgig.plugin.types :as plugintypes])
+  (:import [java.io IOException]
+           [java.nio.charset StandardCharsets]
+           [java.nio.file Files LinkOption NoSuchFileException Path Paths]))
+
+(defn path-of ^Path [& parts]
+  (Paths/get ^String (first parts) ^"[Ljava.lang.String;" (into-array String (rest parts))))
+
+(defn absent?
+  "Does this read failure mean \"no secrets here\", rather than \"I could
+  not answer\"?
+
+  Absence is a MISS and the chain carries on; anything else - permission
+  denied, an unreadable mount, a failing disk - is an ERROR, because
+  returning a miss there falls silently through to a weaker store.
+
+  Asked of the directory, not of the file. The obvious spelling, \"the file
+  does not exist\", is wrong in exactly the case the rule exists for: that
+  question is \"did the access check throw\", so it answers *no* for a
+  permission failure and turned a locked directory - the canonical
+  \"unreadable mount\" - into a miss. A path whose parent is a plain file
+  really is \"no secrets here\", and that is what this asks. The reason
+  string is not consulted: it comes from the C library's strerror and
+  follows the machine's locale."
+  [^Path file]
+  (let [dir (.getParent file)]
+    (and (some? dir) (not (Files/isDirectory dir (make-array LinkOption 0))))))
+
+(defn readfile
+  "A file's whole text, or nil when there is simply no file there.
+
+  Reading a local file is the whole of what a built-in kind is allowed to
+  do, which is why this lives here and not with the plugins - though the
+  hashicorp plugin reads its Kubernetes service-account JWT through it."
+  [^Path file what]
+  (try
+    (String. (Files/readAllBytes file) StandardCharsets/UTF_8)
+    ;; An absent file - or an absent directory - means "no secrets here".
+    (catch NoSuchFileException _ nil)
+    (catch IOException err
+      (if (absent? file)
+        nil
+        (throw (core/sekretoerror (str "sekreto: " what " cannot read " file ": "
+                                       (.getMessage err))))))))
+
+;; ------------------------------------------------------------- the builtins
+;;
+;; What makes a kind built in is that it reads at most a local file: it
+;; opens no socket, signs no request and spawns no process.
+
+(defrecord Env [prefix source]
+  provider/Provider
+
+  (lookup [_ name]
+    (let [key (core/envkey name prefix)]
+      (if (nil? source) (core/getenv key) (get source key))))
+
+  (describe [_]
+    (str "env" (when (core/notempty prefix) (str ":" prefix)))))
+
+(defrecord Dotenv [file prefix values]
+  provider/Provider
+
+  (lookup [_ name]
+    ;; Read once. A file that was not there when the chain was built is not
+    ;; read again either: a missing .env means "no secrets here", and
+    ;; re-reading it on every lookup would make a chain's answers depend on
+    ;; when it was asked.
+    (get (or @values (reset! values (core/parsedotenv (readfile (path-of file) "dotenv provider"))))
+         (core/envkey name prefix)))
+
+  (describe [_] (str "dotenv:" file)))
+
+(defrecord Memory [values prefix]
+  provider/Provider
+
+  (lookup [_ name] (get values (core/envkey name prefix)))
+
+  (describe [_]
+    (str "memory" (when (core/notempty prefix) (str ":" prefix)))))
+
+(defrecord Filedir [dir prefix]
+  provider/Provider
+
+  ;; A directory of one-secret-per-file entries, keyed like the environment:
+  ;; `api.token` reads `<dir>/API_TOKEN`.
+  ;;
+  ;; This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+  ;; secret, and a systemd credentials directory, so those all work with no
+  ;; further configuration. One trailing newline is stripped - tools that
+  ;; write these files disagree about it, and a newline is never part of a
+  ;; secret on purpose.
+  (lookup [_ name]
+    (when-let [text (readfile (path-of dir (core/envkey name prefix)) "file provider")]
+      (cond
+        (string/ends-with? text "\r\n") (subs text 0 (- (count text) 2))
+        (string/ends-with? text "\n") (subs text 0 (dec (count text)))
+        :else text)))
+
+  (describe [_] (str "file:" dir)))
+
+;; ------------------------------- providers as voxgig/plugin definitions
+
+;; The export key under which a provider definition publishes the provider
+;; it built. `voxgig.sekreto.chain` reads `<ref>/provider` off the host.
+(def PROVIDER-EXPORT "provider")
+
+;; The voxgig/plugin error code a sekreto error travels under when it is
+;; raised inside a definition's `define`.
+;;
+;; plugin wraps a code-less error raised by a callback as
+;; `plugin_define_failed`, and keeps an error that already carries a code.
+;; A provider that refuses its own configuration - `kv: 3`, a missing
+;; project - raises a sekreto error, and that message is pinned by the spec
+;; byte for byte, so it must come back out of the host exactly as it went
+;; in. `providerplugin` gives it this code on the way in; the chain turns
+;; it back into a sekreto error on the way out.
+(def ERROR-CODE "sekreto_error")
+
+(defn providerplugin
+  "A provider kind, as a voxgig/plugin definition.
+
+  This is the whole bridge between the two libraries. The definition's
+  `name` is the `kind` a spec names; its `define` reads the spec as the
+  instance's options, builds the provider with `make`, and exports it.
+  Nothing runs at `activate`: a provider opens nothing until its first
+  lookup, so there is nothing to capture - a provider that does hold a
+  resource acquires it there and lets the instance scope unwind it.
+
+  Every built-in and every plugin is made this way, so a custom provider
+  kind is one call:
+
+    (providerplugin \"mystore\" (fn [spec] (mystore (:addr spec))))"
+  [kind make]
+  {"name" kind
+   "define" (fn [inst]
+              (let [built (try
+                            (make (host/inst-options inst))
+                            (catch clojure.lang.ExceptionInfo err
+                              (if (core/sekretoerror? err)
+                                (plugintypes/fail ERROR-CODE (ex-message err)
+                                                  {"ref" (host/inst-ref inst)
+                                                   "cause" (ex-message err)})
+                                (throw err))))]
+                (host/export! inst PROVIDER-EXPORT built)))})
+
+(def BUILTINS
+  "The four built-in provider kinds - the same four in every port. What
+  makes a kind built in is that it needs nothing of the platform beyond
+  reading a local file: no socket, no TLS, no crypto, no child process."
+  [(providerplugin "env" (fn [spec] (->Env (:prefix spec) nil)))
+   (providerplugin "memory" (fn [spec] (->Memory (or (:values spec) {}) (:prefix spec))))
+   (providerplugin "dotenv" (fn [spec]
+                              (->Dotenv (or (core/notempty (:file spec)) ".env")
+                                        (:prefix spec) (atom nil))))
+   (providerplugin "file" (fn [spec] (->Filedir (or (:dir spec) "") (:prefix spec))))])
+
+(def KINDS
+  "Every kind this library ships, built in or as a plugin, so that an
+  unknown kind can be told from a plugin that was not loaded."
+  {:builtin ["env" "memory" "dotenv" "file"]
+   :plugin ["hashicorp" "boru" "awssecrets" "awsparams" "gcpsecrets"
+            "azuresecrets" "onepassword" "doppler" "infisical" "secretspec"]})

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto.clj

@@ -0,0 +1,113 @@
+;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto.clj)
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+;; sekreto: one interface for secrets, wherever they live.
+;;
+;; This is the namespace a consumer requires. THE CORE SURFACE: the chain,
+;; the four built-in provider kinds, and the means of adding a fifth.
+;;
+;; The built-ins are the kinds that read at most a local file - env,
+;; memory, dotenv, file. Everything that opens a socket, spawns a process
+;; or signs a request is a PLUGIN, is not required by this namespace, and
+;; is handed to a chain by the calling project:
+;;
+;;   (require '[voxgig.sekreto :as sekreto]
+;;            '[voxgig.sekreto.plugins.hashicorp :refer [hashicorp]])
+;;
+;;   (def secrets
+;;     (sekreto/sekreto [{:kind "env"}
+;;                       {:kind "dotenv" :file ".env"}
+;;                       {:kind "hashicorp" :addr vaultaddr :token vaulttoken}]
+;;                      {:plugins [hashicorp]}))
+;;
+;;   (sekreto/get secrets "api.token")                  ; the chain answers
+;;   (sekreto/getfrom secrets "hashicorp" "api.token")  ; one named store
+;;
+;; ...or, for every kind at once, `ALL` from `voxgig.sekreto.plugins`. See
+;; docs/design/plugin-providers.md.
+;;
+;; Everything below this namespace is split by subject rather than by
+;; audience: the names, the errors and the text helpers in
+;; `voxgig.sekreto.core`, the address guard in `voxgig.sekreto.addr`, the
+;; four built-in kinds and the plugin bridge in `voxgig.sekreto.providers`,
+;; the chain itself in `voxgig.sekreto.chain`, and just enough JSON in
+;; `voxgig.sekreto.json`.
+;;
+;; The split is not a matter of taste. The provider kinds need the name
+;; helpers, so the namespace that defines those cannot be the one that
+;; builds a chain out of kinds - a namespace cycle is a load error in
+;; Clojure, not a warning. `carry` below republishes the parts as one API.
+
+(ns voxgig.sekreto
+  (:refer-clojure :exclude [get])
+  (:require [voxgig.sekreto.addr :as addr]
+            [voxgig.sekreto.chain :as chain]
+            [voxgig.sekreto.core :as core]
+            [voxgig.sekreto.providers :as providers]))
+
+(defmacro ^:private carry
+  "Republish another namespace's var here, under the same name and with its
+  own docstring and argument lists, so that `doc` and every editor find them
+  through this namespace."
+  [source]
+  `(doto (def ~(symbol (name source)) ~source)
+     (alter-meta! merge (select-keys (meta (var ~source)) [:doc :arglists]))))
+
+;; The names.
+(carry core/validname)
+(carry core/checkname)
+(carry core/envkey)
+(carry core/vaultref)
+(carry core/flatname)
+(carry core/awsparam)
+
+;; The text helpers.
+(carry core/parsedotenv)
+(carry core/redact)
+
+;; Errors: one type, asked about rather than caught by class.
+(carry core/sekretoerror)
+(carry core/sekretoerror?)
+
+;; Refusing to send a credential in the clear. Every plugin that opens a
+;; socket guards its address with this.
+(carry addr/checkaddr)
+(carry addr/safeaddr)
+
+;; A chain, and the two ways to read it.
+(carry chain/make)
+(carry chain/get)
+(carry chain/tryget)
+(carry chain/getfrom)
+(carry chain/tryfrom)
+(carry chain/has)
+(carry chain/hasin)
+(carry chain/all)
+(carry chain/sources)
+(carry chain/stores)
+(carry chain/storename)
+(carry chain/redactall)
+(carry chain/refresh)
+(carry chain/close)
+
+;; The four built-in kinds, and the one call that makes a fifth.
+(carry providers/providerplugin)
+(carry providers/BUILTINS)
+(carry providers/KINDS)
+(carry providers/PROVIDER-EXPORT)
+(carry providers/ERROR-CODE)
+
+(defn sekreto
+  "A Sekreto from declarative provider specs - the same shape the shared
+  spec and an app's config file use.
+
+  Each spec is a map whose `:kind` picks the provider; `:name` gives the
+  store name `getfrom` addresses, and defaults to the kind. `:plugins` in
+  the options carries the provider kinds beyond the four built-ins that the
+  chain may name, and `:cache false` turns the read cache off.
+
+    (sekreto [{:kind \"memory\" :name \"local\" :values {\"API_TOKEN\" \"T\"}}
+              {:kind \"hashicorp\" :addr addr :token token}]
+             {:plugins [hashicorp]})"
+  ([specs] (sekreto specs nil))
+  ([specs opts] (chain/make specs opts)))

package/project/.sdk/tm/clojure/src/sdk/core.clj

@@ -1039,6 +1039,15 @@
                    "entity" (vs/jm "`$CHILD`" (vs/jm "`$OPEN`" true "active" false "alias" (vs/jm)))
                    "feature" (vs/jm "`$CHILD`" (vs/jm "`$OPEN`" true "active" false))
                    "utility" (vs/jm)
+                   ;; Feature INSTANCES supplied at construction (the station
+                   ;; adopt path): consumed by make-sdk's feature-add loop, so
+                   ;; they are live feature atoms, not data - `$ANY` accepts
+                   ;; them verbatim. Without this entry the seam is DEAD:
+                   ;; client.clj reads options.extend, but validate rejected
+                   ;; the key ("Unexpected keys at field <root>: extend"), so
+                   ;; every construction that used it failed outright.
+                   ;; Mirrors go's make_options.go and MakeOptionsUtility.ts.
+                   "extend" "`$ANY`"
                    "system" (vs/jm)
                    "test" (vs/jm "active" false "entity" (vs/jm "`$OPEN`" true))
                    "clean" (vs/jm "keys" "key,token,id")

package/project/.sdk/tm/clojure/src/sdk/features.clj

@@ -10,8 +10,18 @@
 ;; hooks. All features are inactive by default and self-gate on
 ;; options["active"].
 
+;; EXTENSION FEATURES. A feature whose source lives OUTSIDE this module -
+;; today only `secrets`, whose implementation sits in the gated feature
+;; container alongside its vendored library - is reached through the
+;; GENERATED sdk.config's `feature-extra` map. Static, not a dynamic
+;; resolve: a namespace that fails to load must be a hard error at load
+;; time, because the alternative is make-feature quietly answering with the
+;; base feature and an SDK sending unauthenticated requests. sdk.config
+;; always defines the map (empty when the model selected nothing), and it
+;; requires nothing from here, so there is no cycle.
 (ns sdk.features
   (:require [sdk.core :as core]
+            [sdk.config :as config]
             [voxgig.struct :as vs]
             [clojure.string :as str]))
 
@@ -1283,4 +1293,6 @@
     "rbac" (rbac-feature)
     "netsim" (netsim-feature)
     "cost" (cost-feature)
-    (base-feature)))
+    (if-let [ctor (get config/feature-extra name)]
+      (ctor)
+      (base-feature))))