@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/go/feature/secrets_feature.go

@@ -265,10 +265,18 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 }
 
 // resolve runs one resolution, shared by every concurrent caller. A
-// settled SUCCESS is kept only when caching is on (`cache: false` means
-// every resolve asks the chain again); a FAILURE is always cleared, so a
+// settled HIT is kept only when caching is on (`cache: false` means every
+// resolve asks the chain again); a FAILURE is always cleared, so a
 // transient vault outage never poisons the client permanently - the next
 // operation asks the chain again.
+//
+// A MISS is cleared too, however caching is set. That rule is sekreto's,
+// not this feature's: `A miss is never cached: the next read asks again`,
+// in sekreto's own source. Retaining a settled miss here would override
+// that from the layer above, and a secret provisioned after startup - a
+// mounted file, a policy granted a minute late - would never be picked up
+// for the life of the client. `cache` is about caching a HIT; it was never
+// a promise to keep saying no.
 func (f *SecretsFeature) resolve() error {
 	if nil != f.initerr {
 		return f.initerr
@@ -284,11 +292,11 @@ func (f *SecretsFeature) resolve() error {
 	f.resolving = call
 	f.mu.Unlock()
 
-	err := f.resolveonce()
+	hit, err := f.resolveonce()
 
 	f.mu.Lock()
 	call.err = err
-	if nil != err || !f.cache {
+	if nil != err || !f.cache || !hit {
 		f.resolving = nil
 	}
 	f.mu.Unlock()
@@ -297,16 +305,19 @@ func (f *SecretsFeature) resolve() error {
 	return err
 }
 
-func (f *SecretsFeature) resolveonce() error {
+// resolveonce resolves once, reporting whether a credential came out of it.
+// That bool is the whole of what resolve() needs to tell a cacheable HIT
+// from a miss it must not retain.
+func (f *SecretsFeature) resolveonce() (bool, error) {
 	if nil == f.sek {
-		return nil
+		return false, nil
 	}
 
 	found, has, err := f.sek.Try(f.secretname)
 	if nil != err {
 		// A provider ERROR fails the op (via the transport gate); only a
 		// MISS falls through.
-		return err
+		return false, err
 	}
 
 	if nil == f.exchange {
@@ -323,7 +334,7 @@ func (f *SecretsFeature) resolveonce() error {
 			f.cred = ""
 		}
 		f.mu.Unlock()
-		return nil
+		return has, nil
 	}
 
 	// Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -350,11 +361,22 @@ func (f *SecretsFeature) resolveonce() error {
 		// A starting access token was supplied. Spend it: if it is stale
 		// the API answers with an expiry status and the transport wrapper
 		// buys another, which is the same path expiry takes anyway.
-		return nil
+		return true, nil
+	}
+
+	// `auth: nil` is the documented way to send NO credential, and a
+	// purchase is a credential-bearing call: the refresh token goes to the
+	// token endpoint in the request body. withrefresh honours suppression
+	// for the RETRY, but it runs after this - by then the refresh token has
+	// already left the process, and no later check can call it back. The
+	// suppression has to be honoured here, before the first purchase, or it
+	// only ever half-held.
+	if nil == f.liveopts["auth"] {
+		return false, nil
 	}
 
 	_, err = f.buy()
-	return err
+	return nil == err, err
 }
 
 // transport wraps whatever transport was current at Init.

package/project/.sdk/tm/go/test/feature/secrets/secrets_feature_test.go

@@ -488,6 +488,89 @@ func TestSecretsChain(t *testing.T) {
 	})
 }
 
+// A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+// feature used to override from the layer above.
+//
+// DEFAULT caching here, which is the whole point: `cache: true` is about
+// holding a HIT, and holding the settled resolution after a miss meant the
+// chain was never asked again for the life of the client. A secret
+// provisioned after startup (a mounted file, a vault policy granted a
+// minute late) was invisible forever, and the only workaround was giving up
+// hit caching entirely.
+func TestSecretsCachedMissIsReasked(t *testing.T) {
+	var mu sync.Mutex
+	calls := 0
+
+	w := makewire()
+	client := secretsClient(w, map[string]any{
+		"feature": map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						mu.Lock()
+						defer mu.Unlock()
+						calls++
+						// Absent on the first ask, present on the second.
+						if 1 < calls {
+							return "LATEKEY01", true, nil
+						}
+						return "", false, nil
+					},
+				},
+			},
+		}},
+	})
+
+	driveEntityOp(t, client, w)
+	if first := w.api()[0]; first.has && "" != first.auth {
+		t.Fatalf("the first resolve missed, so no credential should go out; got %q", first.auth)
+	}
+
+	driveEntityOp(t, client, w)
+	credentialIs(t, w.api()[len(w.api())-1].auth, "LATEKEY01")
+
+	mu.Lock()
+	defer mu.Unlock()
+	if 1 >= calls {
+		t.Fatal("the chain was asked once and the MISS cached: a secret " +
+			"that appears later can never be picked up")
+	}
+}
+
+// The other half of the same rule: a HIT is still cached by default, so the
+// fix above must not turn every request into a chain walk.
+func TestSecretsCachedHitIsKept(t *testing.T) {
+	var mu sync.Mutex
+	calls := 0
+
+	w := makewire()
+	client := secretsClient(w, map[string]any{
+		"feature": map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						mu.Lock()
+						defer mu.Unlock()
+						calls++
+						return "STABLEKEY01", true, nil
+					},
+				},
+			},
+		}},
+	})
+
+	driveEntityOp(t, client, w)
+	driveEntityOp(t, client, w)
+
+	mu.Lock()
+	defer mu.Unlock()
+	if 1 != calls {
+		t.Fatalf("a hit must be cached under the default cache: true, chain asked %d times", calls)
+	}
+}
+
 // customProvider is a sekreto.Provider built in code (the interface is
 // structural: Lookup + Describe).
 type customProvider struct {
@@ -538,6 +621,39 @@ func TestSecretsExchange(t *testing.T) {
 		credentialIs(t, api[1].auth, "ACCESS02")
 	})
 
+	// `auth: nil` SUPPRESSES THE PURCHASE, not just the retry.
+	//
+	// resolve() runs before withrefresh's suppression check, so the refresh
+	// token used to go to the token endpoint in a request body even here.
+	// Stopping the retry does not unsend it - this asserts on the token
+	// endpoint, which is the half the API-call assertions cannot see.
+	t.Run("auth nil buys no token at all", func(t *testing.T) {
+		os.Setenv(envprefix+"REFRESH_TOKEN", "REFRESH01")
+		defer os.Unsetenv(envprefix + "REFRESH_TOKEN")
+
+		w := makewire()
+		w.apistatus = []int{401}
+
+		client := secretsClient(w, map[string]any{
+			"auth": nil,
+			"feature": secretsOpts(map[string]any{
+				"name":     "refresh_token",
+				"exchange": map[string]any{"active": true},
+			}),
+		})
+
+		driveEntityOp(t, client, w)
+
+		if 0 != len(w.token()) {
+			t.Fatalf("auth nil suppressed the credential but the refresh "+
+				"token was still POSTed to the exchange endpoint (%d calls)",
+				len(w.token()))
+		}
+		if call := w.api()[0]; call.has {
+			t.Fatalf("no credential may be sent when auth is suppressed, got %q", call.auth)
+		}
+	})
+
 	t.Run("test mode buys nothing and needs no token endpoint", func(t *testing.T) {
 		os.Setenv(envprefix+"REFRESH_TOKEN", "REFRESH01")
 		defer os.Unsetenv(envprefix + "REFRESH_TOKEN")

package/project/.sdk/tm/go/test/omni/omni.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (go/omni.go)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/go/test/omni/util.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (go/util.go)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/go/utility/struct/voxgigstruct.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.0 (go/voxgigstruct.go)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd. MIT LICENSE. */
 

package/project/.sdk/tm/java/feature/SecretsFeature.java

@@ -325,10 +325,18 @@ public class SecretsFeature extends BaseFeature {
   }
 
   // resolve runs one resolution, shared by every concurrent caller. A
-  // settled SUCCESS is kept only when caching is on (`cache: false` means
-  // every resolve asks the chain again); a FAILURE is always cleared, so a
+  // settled HIT is kept only when caching is on (`cache: false` means every
+  // resolve asks the chain again); a FAILURE is always cleared, so a
   // transient vault outage never poisons the client permanently - the next
   // operation asks the chain again.
+  //
+  // A MISS is cleared too, however caching is set. That rule is sekreto's,
+  // not this feature's: `A miss is never cached: the next read asks again`,
+  // in sekreto's own source. Keeping a settled miss here would override
+  // that from the layer above, and a secret provisioned after startup - a
+  // mounted file, a policy granted a minute late - would never be picked up
+  // for the life of the client. `cache` is about caching a HIT; it was
+  // never a promise to keep saying no.
   private void resolve() {
     SecretsCall call;
     boolean mine = false;
@@ -353,8 +361,9 @@ public class SecretsFeature extends BaseFeature {
     }
 
     RuntimeException err = null;
+    boolean hit = false;
     try {
-      resolveonce();
+      hit = resolveonce();
     }
     catch (RuntimeException e) {
       err = e;
@@ -362,7 +371,7 @@ public class SecretsFeature extends BaseFeature {
 
     synchronized (this.lock) {
       call.err = err;
-      if (err != null || !this.cache) {
+      if (err != null || !this.cache || !hit) {
         this.resolving = null;
       }
     }
@@ -373,9 +382,12 @@ public class SecretsFeature extends BaseFeature {
     }
   }
 
-  private void resolveonce() {
+  // resolveonce resolves once, reporting whether a credential came out of
+  // it. That boolean is the whole of what resolve() needs to tell a
+  // cacheable HIT from a miss it must not keep.
+  private boolean resolveonce() {
     if (this.sek == null) {
-      return;
+      return false;
     }
 
     // tryget: null is a MISS (the chain had nothing), an exception is an
@@ -392,7 +404,7 @@ public class SecretsFeature extends BaseFeature {
         // unreachable.)
         this.cred = found == null ? "" : found;
       }
-      return;
+      return found != null;
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -416,10 +428,23 @@ public class SecretsFeature extends BaseFeature {
       // A starting access token was supplied. Spend it: if it is stale the
       // API answers with an expiry status and the transport wrapper buys
       // another, which is the same path expiry takes anyway.
-      return;
+      return true;
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. withrefresh honours suppression
+    // for the RETRY, but it runs after this - by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (this.liveopts.get("auth") == null) {
+      return false;
     }
 
     buy();
+
+    return true;
   }
 
   // withrefresh buys a token and tries the request again when the API says

package/project/.sdk/tm/java/feature/secrets/plugin/Capability.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Capability.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Catalog.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Catalog.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Config.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Config.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Definition.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Definition.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Depend.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Depend.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Entry.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Entry.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Env.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Env.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Export.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Export.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Graph.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Graph.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Host.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Host.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Inst.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Inst.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Json.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Json.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Order.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Order.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Plugin.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Plugin.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/PluginException.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/PluginException.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Point.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Point.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Refs.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Refs.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Resolve.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Resolve.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Types.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Types.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/plugin/Version.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (java/src/voxgig/plugin/Version.java)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.feature.secrets.plugin;
 

package/project/.sdk/tm/java/feature/secrets/sekreto/Addr.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Addr.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Reading a vault address, and refusing the ones that would leak.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/Builtins.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Builtins.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // THE BUILT-IN PROVIDER KINDS - the same four in every port.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/Json.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Json.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON support for sekreto.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/Provider.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Provider.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // A source of secrets.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/Sekreto.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Sekreto.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/Support.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/src/com/voxgig/sekreto/Support.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // How a provider kind becomes a voxgig/plugin definition, and the few
 // helpers both halves of the split need.

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Aws.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Aws.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Secrets Manager and SSM Parameter Store, as voxgig/plugin
 // definitions: two kinds, one plugin, because they share a signer.

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Azuresecrets.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Azuresecrets.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Azure Key Vault, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Boru.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Boru.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // A boru vault, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Doppler.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Doppler.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Doppler, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Gcpsecrets.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Gcpsecrets.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // GCP Secret Manager, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Hashicorp.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Hashicorp.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // HashiCorp Vault, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Httpjson.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Httpjson.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // One JSON round-trip, shared by every plugin that speaks HTTP - and by
 // nothing in the core. A chain of built-ins never links this file, which

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Infisical.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Infisical.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Infisical, as a voxgig/plugin definition.
 //