@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/c/tests/vendor/omni/json.c

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/json.c)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The omni JSON value model, pool allocator, parser and printer.
  *

package/project/.sdk/tm/c/tests/vendor/omni/omni.h

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/omni.h)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Omni: the shared multi-language test runner (C port).
  *

package/project/.sdk/tm/c/tests/vendor/omni/runner.c

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/runner.c)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Omni: the shared multi-language test runner (C port).
  *

package/project/.sdk/tm/c/tests/vendor/omni/util.c

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/util.c)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Omni internal JSON utilities: clone, path lookup, deep equality, and
  * the regex bridge.

package/project/.sdk/tm/clojure/feature/secrets/sdk/feature/secrets.clj

@@ -268,8 +268,11 @@
 ;; Resolution.
 ;; ---------------------------------------------------------------------------
 
+;; Resolve once, answering whether a credential came out of it. That
+;; boolean is the whole of what resolve! needs to tell a cacheable HIT from
+;; a miss it must not keep.
 (defn- resolve-once [fa]
-  (when-let [s (st fa :sek)]
+  (if-let [s (st fa :sek)]
     ;; tryget: nil for a MISS, THROWS for a provider ERROR.
     (let [found (sekreto/tryget s (st fa :secretname))]
       (if (nil? (st fa :exchange))
@@ -278,7 +281,9 @@
         ;; going out on the wire. (An explicit apikey OPTION is never lost
         ;; here - it seats FIRST in the chain as a memory store, so the
         ;; chain HITS while one is set and this branch is unreachable.)
-        (swap! fa assoc :cred (if (string? found) found ""))
+        (do
+          (swap! fa assoc :cred (if (string? found) found ""))
+          (string? found))
 
         ;; Exchanging: what the chain resolved is the REFRESH token, kept
         ;; for every later purchase. A miss is not fatal - an explicit
@@ -292,19 +297,41 @@
                          (let [k (vs/getprop (liveopts fa) "apikey")]
                            (if (string? k) k "")))]
             (swap! fa assoc :cred apikey)
-            (when-not (seq apikey)
+            (cond
+              (seq apikey) true
+
+              ;; `auth: nil` is the documented way to send NO credential,
+              ;; and a purchase is a credential-bearing call: the refresh
+              ;; token goes to the token endpoint in the request body.
+              ;; with-refresh honours suppression for the RETRY, but it runs
+              ;; after this - by then the refresh token has already left the
+              ;; process, and no later check can call it back. The
+              ;; suppression has to be honoured here, before the first
+              ;; purchase, or it only ever half-held.
+              (nil? (auth-of fa)) false
+
+              :else
               ;; No starting access token: buy one now. A failure here is a
               ;; failure of the operation - fail closed.
-              (buy fa))))))))
+              (do (buy fa) true))))))
+    false))
 
 
 ;; One resolution, shared by every concurrent caller.
 ;;
-;; Returns nil on success, or the Throwable that failed it. A settled
-;; SUCCESS is kept only when caching is on (`cache: false` means every
-;; request asks the chain again); a FAILURE is NEVER kept, so a transient
-;; vault outage cannot poison the client permanently - the next operation
-;; asks the chain again and recovers.
+;; Returns nil on success, or the Throwable that failed it. A settled HIT is
+;; kept only when caching is on (`cache: false` means every request asks the
+;; chain again); a FAILURE is NEVER kept, so a transient vault outage cannot
+;; poison the client permanently - the next operation asks the chain again
+;; and recovers.
+;;
+;; A MISS is not kept either, however caching is set. That rule is
+;; sekreto's, not this feature's: `A miss is never cached: the next read
+;; asks again`, in sekreto's own source. Keeping a settled miss here would
+;; override that from the layer above, and a secret provisioned after
+;; startup - a mounted file, a policy granted a minute late - would never be
+;; picked up for the life of the client. `cache` is about caching a HIT; it
+;; was never a promise to keep saying no.
 (defn- resolve! [fa]
   (if-let [e (st fa :initerr)]
     e
@@ -312,8 +339,8 @@
       (if (and (st fa :cache) (st fa :resolved))
         nil
         (try
-          (resolve-once fa)
-          (swap! fa assoc :resolved true)
+          (let [hit (resolve-once fa)]
+            (swap! fa assoc :resolved (boolean hit)))
           nil
           (catch Throwable e
             (swap! fa assoc :resolved false)

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/capability.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/capability.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.capability
   "Capabilities (section 11.1).

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/catalog.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/catalog.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.catalog
   "The definition catalog (section 10.1).

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/config.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/config.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.config
   "The declarative document (section 9): normalization, and the ten-level

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/depend.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/depend.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.depend
   "Dependency cardinality, policy, and the restart graph (section 11.3).

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/env.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/env.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.env
   "Environment overrides (section 9.5) - level 7 of the ladder.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/export.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/export.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.export
   "Exports (section 11).

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/graph.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/graph.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.graph
   "Whole-graph resolution (section 11.4) - a phase, not a discovery.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/host.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/host.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.host
   "The host: the lifecycle state machine (section 5), extension points

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/json.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/json.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.json
   "The JSON parser, and the only one this port has.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/order.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/order.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.order
   "Ordering (section 7) - one rule, one place.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/point.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/point.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.point
   "Extension points (section 6). Three kinds, chosen because they are what

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/ref.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/ref.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.ref
   "Identity: name+tag, written `name$tag` (section 4).

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/resolve.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/resolve.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.resolve
   "Dynamic resolution (section 10.2) - name to candidate module ids.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/types.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/types.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.types
   "The value model, the error type, and the JSON writer.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/version.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/version.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin.version
   "Versions and ranges (section 11.2).

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin.clj)
-;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 (ns voxgig.plugin
   "The canonical surface `make parity` checks (AGENTS.md section 4). Small

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/addr.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/addr.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Refusing to send a secret-bearing credential in the clear.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/chain.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/chain.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; The chain: a Sekreto is an ordered list of providers on a voxgig/plugin
 ;; host. `get` asks each in turn and returns the first hit, so an app can be

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/core.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/core.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; The names, the errors and the text helpers - the half of sekreto that
 ;; does not know what a provider is.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/json.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/json.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Minimal JSON support for sekreto.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/aws.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/aws.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; The two AWS stores, as voxgig/plugin definitions - and the only two
 ;; kinds that sign a request.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/azuresecrets.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/azuresecrets.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Azure Key Vault, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/boru.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/boru.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; A boru vault, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/doppler.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/doppler.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Doppler, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/gcpsecrets.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/gcpsecrets.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; GCP Secret Manager, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/hashicorp.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/hashicorp.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; HashiCorp Vault, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/httpjson.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/httpjson.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; The HTTP-JSON edge every plugin that speaks to a store shares - and
 ;; NOTHING IN THE CORE REACHES IT.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/infisical.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/infisical.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Infisical, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/onepassword.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/onepassword.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; 1Password through a Connect server, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/proc.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/proc.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Running a child to completion, for the two kinds that read a secret
 ;; through somebody else's CLI - boru and secretspec.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/secretspec.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/secretspec.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; SecretSpec, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/sigv4.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/sigv4.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; AWS Signature Version 4, hand-rolled - and OUTSIDE THE CORE, because it
 ;; is this library's one cryptographic edge. Only the two aws kinds sign

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/provider.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/provider.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; A source of secrets.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/providers.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/providers.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; What a provider is, how a provider kind becomes a voxgig/plugin
 ;; definition - and the four BUILT-IN kinds.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; sekreto: one interface for secrets, wherever they live.
 ;;

package/project/.sdk/tm/clojure/test/sdk/test/feature/secrets.clj

@@ -461,6 +461,33 @@
              (credential-is (:auth (call-at stub 0)) "ROT01" "first")
              (credential-is (:auth (call-at stub 1)) "ROT02" "asked again"))))
 
+    ;; A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+    ;; feature used to override from the layer above. DEFAULT caching here,
+    ;; which is the whole point: `cache: true` is about holding a HIT (the
+    ;; test above pins that half), and keeping the settled resolution after
+    ;; a miss meant the chain was never asked again for the life of the
+    ;; client - a secret provisioned after startup was invisible forever.
+    (chk "secrets-cache-true-re-asks-after-a-miss"
+         (fn []
+           (let [present (atom false)
+                 n (atom 0)
+                 late (reify provider/Provider
+                        (lookup [_ _]
+                          (swap! n inc)
+                          (when @present "LATEKEY01"))
+                        (describe [_] "late:test"))
+                 stub (counting-fetch)
+                 sdk (live-sdk stub :secrets (sekopts "providers" (vs/jt late)))]
+             (client/direct sdk (vs/jm "path" "/thing"))
+             (t/is-nil (:auth (call-at stub 0))
+                       "the chain has nothing yet, so no credential should go out")
+             (let [asked @n]
+               (reset! present true)
+               (client/direct sdk (vs/jm "path" "/thing"))
+               (t/is-eq (< asked @n) true
+                        "the MISS was cached: a secret that appears later can never be picked up")
+               (credential-is (:auth (call-at stub 1)) "LATEKEY01" "late secret")))))
+
     ;; ---- auth: nil SUPPRESSES, chain or no chain ----
 
     (chk "secrets-auth-nil-suppresses-the-credential"
@@ -518,7 +545,7 @@
                (credential-is (:auth (call-at stub 1)) "ACCESS01" "attempt 1")
                (credential-is (:auth (call-at stub 3)) "ACCESS02" "the retry"))))
 
-      (chk "secrets-exchange-with-auth-nil-never-retries"
+      (chk "secrets-exchange-with-auth-nil-never-buys-or-retries"
            (fn []
              (let [stub (counting-fetch
                          (fn [_n url _fd]
@@ -527,11 +554,18 @@
                              [(response 401 (vs/jm "err" "expired")) nil])))
                    sdk (live-sdk stub :auth-nil true :secrets (xsecrets))]
                (client/direct sdk (vs/jm "path" "/thing"))
-               ;; The token was bought at resolution, and the API request
-               ;; went out ONCE: a deliberately unauthenticated request that
-               ;; is refused is not an expired token.
-               (t/is-eq (sent stub) 2 (str "token + one API call only: " (wire stub)))
-               (t/is-nil (:auth (call-at stub 1)) "no authorization header"))))
+               ;; NOTHING IS BOUGHT, and the API request goes out ONCE.
+               ;;
+               ;; This used to read "token + one API call only": the token
+               ;; WAS bought at resolution, because resolve! ran before
+               ;; with-refresh's suppression check. A purchase is a
+               ;; credential-bearing call - the refresh token travels to the
+               ;; token endpoint in the request body - so `auth: nil` was
+               ;; only ever half-held, and stopping the retry could not
+               ;; unsend it. The suppression is now honoured before the
+               ;; first purchase.
+               (t/is-eq (sent stub) 1 (str "one API call, no purchase: " (wire stub)))
+               (t/is-nil (:auth (call-at stub 0)) "no authorization header"))))
 
       (chk "secrets-exchange-with-no-refresh-token-fails-closed"
            (fn []

package/project/.sdk/tm/clojure/test/vendor/omni/voxgig/omni/json.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/omni sdk-20260908-1556-0 (clojure/src/voxgig/omni/json.clj)
-;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; The omni JSON parser.
 ;;

package/project/.sdk/tm/clojure/test/vendor/omni/voxgig/omni/runner.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/omni sdk-20260908-1556-0 (clojure/src/voxgig/omni/runner.clj)
-;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Omni: the shared multi-language test runner (Clojure port).
 ;;

package/project/.sdk/tm/clojure/test/vendor/omni/voxgig/omni/util.clj

@@ -1,5 +1,5 @@
 ;; VENDORED: @voxgig/omni sdk-20260908-1556-0 (clojure/src/voxgig/omni/util.clj)
-;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Omni internal JSON utilities.
 ;;

package/project/.sdk/tm/cpp/Makefile

@@ -3,11 +3,40 @@
 # Header-only runtime (core/, utility/, feature/, entity/); each test/*.cpp is
 # an independent executable. `make test` compiles and runs them all, failing
 # if any test binary exits non-zero. Mirrors the struct/cpp and tm/rust build.
+#
+# The ONE exception to header-only is a gated feature's vendored payload
+# (below): a multi-translation-unit library, compiled into an archive the
+# test executables link - and only while that feature is wired in.
 
 CXX ?= g++
 CXXFLAGS ?= -std=c++17 -O0 -g -Wall -Wextra -Wno-unused-parameter -pthread
 
-TEST_SRCS := $(wildcard test/*.cpp)
+# ---- gated feature payloads (model/feature/<name>.aon plugin groups) --------
+#
+# A gated feature's vendored payload sits two levels under feature/
+# (feature/<name>/<lib>/*.cpp), as .cpp/.hpp pairs that cannot ride inside
+# a test's single translation unit. What of it is built is decided by a
+# GENERATED make fragment, feature/<name>/kinds.mk, that the feature's
+# Config component emits beside its generated wiring file only when the
+# model activates the feature for this target. The fragment appends the
+# payload sources to FEATURE_SRCS, the feature's suite to FEATURE_TEST_SRCS,
+# and - only when a plugin group is active - the plugin layer and the
+# external libraries it brings to FEATURE_LIBS. Nothing here names a
+# feature: a tree whose model never activated one has no fragment, carries
+# its payload as inert source, and links libstdc++ alone, and a project's
+# `target add` trims it outright. `ldd` on any test binary shows which case
+# this tree is. Every quoted include inside a payload is either
+# same-directory or an explicit sibling path written at vendoring time
+# (ts/vendor/routes.json), so NO -I is needed and a payload's types.hpp or
+# value.hpp can never shadow core/types.hpp.
+FEATURE_SRCS :=
+FEATURE_TEST_SRCS :=
+FEATURE_LIBS :=
+-include $(wildcard feature/*/kinds.mk)
+FEATURE_OBJS := $(FEATURE_SRCS:.cpp=.o)
+FEATURE_ARCHIVE := $(if $(strip $(FEATURE_SRCS)),libsdkfeature.a,)
+
+TEST_SRCS := $(wildcard test/*.cpp) $(FEATURE_TEST_SRCS)
 TEST_BINS := $(TEST_SRCS:.cpp=.out)
 
 # REBUILD WHEN A HEADER CHANGES. The runtime is header-only, so a test binary
@@ -20,7 +49,9 @@ TEST_BINS := $(TEST_SRCS:.cpp=.out)
 # test/ is listed too: the corpus suites are driven by test/*.hpp (the omni
 # resolver and the retained runner support) and by the vendored omni headers
 # under test/vendor/omni/, none of which the pattern rule below names either.
+# feature/*/ and feature/*/*/ cover a gated feature's vendored headers.
 SDK_HDRS := $(wildcard core/*.hpp entity/*.hpp feature/*.hpp \
+                       feature/*/*.hpp feature/*/*/*.hpp \
                        utility/*.hpp utility/*/*.hpp *.hpp \
                        test/*.hpp test/vendor/omni/*.hpp)
 
@@ -37,11 +68,24 @@ test: build
 	if [ $$fail -ne 0 ]; then echo "SOME TESTS FAILED"; exit 1; fi; \
 	echo "ALL TESTS PASSED"
 
-test/%.out: test/%.cpp $(SDK_HDRS)
-	$(CXX) $(CXXFLAGS) $< -o $@
+# The payload archive. `ar r` REPLACES a member by basename on an archive it
+# finds and KEEPS every other one, so a stale member from a removed source
+# would outlive it; one cold `ar rcs` keeps exactly the current members
+# (upstream sekreto's own Makefile deletes first for the same reason).
+%.o: %.cpp
+	$(CXX) $(CXXFLAGS) -c $< -o $@
+
+libsdkfeature.a: $(FEATURE_OBJS)
+	@rm -f $@
+	ar rcs $@ $(FEATURE_OBJS)
+
+# $(FEATURE_ARCHIVE) and $(FEATURE_LIBS) are empty unless a gated feature is
+# wired in, so this rule is byte-for-byte the header-only build otherwise.
+test/%.out: test/%.cpp $(SDK_HDRS) $(FEATURE_ARCHIVE)
+	$(CXX) $(CXXFLAGS) $< -o $@ $(FEATURE_ARCHIVE) $(FEATURE_LIBS)
 
 clean:
-	rm -f test/*.out
+	rm -f test/*.out test/*/*/*.out $(FEATURE_OBJS) libsdkfeature.a
 
 # --- Release: tag cpp/vX.Y.Z (header-only; no registry) --------------------
 VERSION := $(shell cat VERSION 2>/dev/null || echo 0.0.1)