@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Onepassword.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Onepassword.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // 1Password, through a Connect server, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Proc.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Proc.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Running a child process to completion, shared by the two plugins that
 // read a secret through somebody else's CLI - boru and secretspec.

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Secretspec.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Secretspec.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // SecretSpec, as a voxgig/plugin definition.
 //

package/project/.sdk/tm/java/feature/secrets/sekreto/plugins/Sigv4.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (java/plugins/com/voxgig/sekreto/plugins/Sigv4.java)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/java/test/feature/secrets/SecretsFeatureTest.java

@@ -760,6 +760,62 @@ public class SecretsFeatureTest {
         + " the wire saw \"" + last.auth + "\"");
   }
 
+  // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // DEFAULT caching here, which is the whole point: `cache: true` is about
+  // holding a HIT, and keeping the settled resolution after a miss meant
+  // the chain was never asked again for the life of the client. A secret
+  // provisioned after startup (a mounted file, a vault policy granted a
+  // minute late) was invisible forever, and the only workaround was giving
+  // up hit caching entirely.
+  @Test
+  public void active_aCachedMissIsReasked() {
+    final boolean[] present = {false};
+    final int[] calls = {0};
+    Wire wire = new Wire();
+    ProjectNameSDK client = liveClient(wire, secretsOpts(
+        List.of(new TestProvider((name) -> {
+          calls[0]++;
+          return present[0] ? "LATEKEY01" : null;
+        }))));
+
+    client.direct(map("path", "/one"));
+    Call first = wire.api().get(0);
+    assertFalse(first.has && !"".equals(first.auth),
+        "the chain has nothing yet, so no credential should go out");
+
+    int asked = calls[0];
+    assertTrue(0 < asked);
+
+    // The secret is provisioned while the client is live.
+    present[0] = true;
+    client.direct(map("path", "/two"));
+
+    credentialIs(wire.api().get(wire.api().size() - 1).auth, "LATEKEY01");
+    assertTrue(asked < calls[0],
+        "the MISS was cached: a secret that appears later can never be picked up");
+  }
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  @Test
+  public void active_aCachedHitIsKept() {
+    final int[] calls = {0};
+    Wire wire = new Wire();
+    ProjectNameSDK client = liveClient(wire, secretsOpts(
+        List.of(new TestProvider((name) -> {
+          calls[0]++;
+          return "STABLEKEY01";
+        }))));
+
+    client.direct(map("path", "/one"));
+    client.direct(map("path", "/two"));
+
+    assertEquals(1, calls[0],
+        "a hit must be cached under the default cache: true");
+  }
+
   // `auth: null` - the documented way to disable auth outright, which
   // prepareAuth honours before it ever reads the apikey.
   //
@@ -966,6 +1022,14 @@ public class SecretsFeatureTest {
     assertFalse(wire.api().get(0).has,
         "no credential may be sent when auth is suppressed, got \""
         + wire.api().get(0).auth + "\"");
+
+    // AND NO PURCHASE. resolve() runs before withrefresh's suppression
+    // check, so the refresh token used to go to the token endpoint in a
+    // request body even here. Stopping the retry does not unsend it, and
+    // only the token endpoint can see this.
+    assertEquals(0, wire.token().size(),
+        "auth null suppressed the credential but the refresh token was still"
+        + " POSTed to the exchange endpoint");
   }
 
   @Test

package/project/.sdk/tm/java/test/vendor/omni/Json.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (java/src/com/voxgig/omni/Json.java)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON parser for omni.
 //

package/project/.sdk/tm/java/test/vendor/omni/Runner.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (java/src/com/voxgig/omni/Runner.java)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/java/test/vendor/omni/Util.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni sdk-20260908-1556-0 (java/src/com/voxgig/omni/Util.java)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/java/utility/struct/Struct.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.1 (java/src/Struct.java)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.utility.struct;
 

package/project/.sdk/tm/js/src/feature/secrets/SecretsFeature.js

@@ -174,18 +174,25 @@ class SecretsFeature extends BaseFeature {
   // the op — sekreto's miss-vs-error rule: never fall through to an
   // unauthenticated request because a store was broken.
   //
-  // The promise is cleared on REJECTION, and after success when caching is
-  // off. Holding a settled promise forever would mean a transient vault
-  // outage poisoned the client permanently — every later operation failing
-  // with the original error long after the vault recovered — and it would
-  // make the documented `cache: false` a lie, since the chain would never
-  // be asked a second time.
+  // The promise is cleared on REJECTION, after success when caching is off,
+  // and after a MISS however caching is set. Holding a settled promise
+  // forever would mean a transient vault outage poisoned the client
+  // permanently — every later operation failing with the original error long
+  // after the vault recovered — and it would make the documented
+  // `cache: false` a lie, since the chain would never be asked a second time.
+  //
+  // The MISS rule is sekreto's, not this feature's: `A miss is never cached:
+  // the next read asks again`, in sekreto's own source. Retaining a settled
+  // miss here would override that from the layer above, and a secret
+  // provisioned after startup — a mounted file, a policy granted a minute
+  // late — would never be picked up for the life of the client. `cache` is
+  // about caching a HIT; it was never a promise to keep saying no.
   resolve() {
     if (null == this._resolving) {
       const inflight = this._resolveonce()
         .then(
-          () => {
-            if (!this._cache) {
+          (hit) => {
+            if (!this._cache || !hit) {
               this._resolving = undefined
             }
           },
@@ -201,9 +208,12 @@ class SecretsFeature extends BaseFeature {
   }
 
 
+  // Resolve once, reporting whether a credential came out of it. That
+  // boolean is the whole of what resolve() needs to tell a cacheable HIT
+  // from a miss it must not retain.
   async _resolveonce() {
     if (null == this._sekreto) {
-      return
+      return false
     }
 
     const found = await this._sekreto.try(this._secretname)
@@ -215,7 +225,7 @@ class SecretsFeature extends BaseFeature {
         // resolved value lands where the sync auth path already looks.
         this._client._options.apikey = found
       }
-      return
+      return undefined !== found
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -229,10 +239,23 @@ class SecretsFeature extends BaseFeature {
       // A starting access token was supplied. Spend it: if it is stale the
       // API answers 401 and the transport wrapper buys another, which is
       // the same path expiry takes anyway.
-      return
+      return true
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. _withRefresh honours suppression
+    // for the RETRY, but it runs after this — by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (null == this._client.options().auth) {
+      return false
     }
 
     this._client._options.apikey = await this._buy()
+
+    return true
   }
 
 

package/project/.sdk/tm/js/src/feature/secrets/plugin/capability.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/capability.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/catalog.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/catalog.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/config.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/config.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/js/src/feature/secrets/plugin/depend.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/depend.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/env.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/env.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/export.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/export.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/graph.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/graph.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/host.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/host.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The host: the lifecycle state machine (§5), extension points (§6), and
  * resource capture (§8).

package/project/.sdk/tm/js/src/feature/secrets/plugin/index.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/index.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The canonical surface `make parity` checks (AGENTS.md §4). Small on
  * purpose (§19): everything else is methods on the host and instance

package/project/.sdk/tm/js/src/feature/secrets/plugin/order.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/order.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Ordering (§7) — one rule, one place.
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/point.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/point.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Extension points (§6). Three kinds, chosen because they are what the
  * two existing systems actually needed, and no more.

package/project/.sdk/tm/js/src/feature/secrets/plugin/ref.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/ref.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag, written `name$tag` (§4).
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/resolve.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/resolve.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dynamic resolution (§10.2) — name to candidate module ids.
  *

package/project/.sdk/tm/js/src/feature/secrets/plugin/types.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/types.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Shared types. Deliberately small: the design's §19 budget says the
  * library owns naming, configuration, lifecycle, ordering, binding and

package/project/.sdk/tm/js/src/feature/secrets/plugin/version.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/version.js)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Versions and ranges (§11.2).
  *

package/project/.sdk/tm/js/src/feature/secrets/sekreto/Sekreto.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/Sekreto.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/js/src/feature/secrets/sekreto/index.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/index.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/sekreto-js - one interface for secrets, wherever they live.
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/aws.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/aws.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/azuresecrets.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/azuresecrets.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/boru.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/boru.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/doppler.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/doppler.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/gcpsecrets.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/gcpsecrets.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/hashicorp.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/hashicorp.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/httpjson.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/httpjson.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/infisical.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/infisical.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/onepassword.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/onepassword.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/secretspec.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/secretspec.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/plugins/sigv4.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/plugins/sigv4.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/addr.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/addr.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/builtin.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/builtin.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/dotenv.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/dotenv.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/env.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/env.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/file.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/file.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/memory.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/memory.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/feature/secrets/sekreto/provider/support.js

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (javascript/src/provider/support.js)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/js/src/utility/StructUtility.js

@@ -1,8 +1,8 @@
 // VENDORED: @voxgig/struct 0.1.4 (javascript/src/struct.js)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
-// VERSION: @voxgig/struct-js 0.1.5
+// VERSION: @voxgig/struct-js 0.1.6
 /* Voxgig Struct
  * =============
  *

package/project/.sdk/tm/js/src/utility/TransformRequestUtility.js

@@ -16,13 +16,61 @@ function transformRequest(ctx) {
       reqdata: ctx.reqdata
     }, reqform)
 
-    return reqdata
+    return stripAction(reqdata)
   }
   catch (err) {
     return utility.makeError(ctx, err)
   }
 }
 
+
+// `$action` selects WHICH POINT of the op to use (see MakePointUtility). It
+// is the SDK's own discriminator, never an API field, so it must not survive
+// into the wire body. The GraphQL path already strips it where it builds its
+// input object; this is the same rule on the REST path, which had no such
+// step and sent it verbatim -- `{"$action":"merge", ...}` to GitHub's merge
+// endpoint. Harmless there, because GitHub ignores unknown keys; not
+// harmless against an API that validates its request bodies strictly.
+//
+// Only a top-level key of a plain object: a body may legitimately be an
+// array or a scalar, and neither can carry a selector.
+//
+// `__proto__` is assigned through Object.defineProperty, never `body[key] =`.
+// It is a legal JSON key and can be a real API field, but plain assignment
+// invokes the inherited setter: the key would vanish from the serialised
+// request and silently become the body's prototype instead. Same treatment
+// as StructUtility's condenseSet, for the same reason.
+
+function stripAction(reqdata) {
+  if (null == reqdata || 'object' !== typeof reqdata || Array.isArray(reqdata)) {
+    return reqdata
+  }
+
+  if (!Object.prototype.hasOwnProperty.call(reqdata, '$action')) {
+    return reqdata
+  }
+
+  const body = {}
+  for (const key of Object.keys(reqdata)) {
+    if ('$action' === key) {
+      continue
+    }
+    if ('__proto__' === key) {
+      Object.defineProperty(body, key, {
+        value: reqdata[key],
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      })
+    }
+    else {
+      body[key] = reqdata[key]
+    }
+  }
+
+  return body
+}
+
 module.exports = {
   transformRequest
 }