@voxgig/sdkgen 4.11.0 → 4.13.0

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Ref.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Ref.ts)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag, written `name$tag` (§4).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Resolve.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Resolve.ts)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dynamic resolution (§10.2) — name to candidate module ids.
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Types.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Types.ts)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Shared types. Deliberately small: the design's §19 budget says the
  * library owns naming, configuration, lifecycle, ordering, binding and

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Version.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Version.ts)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Versions and ranges (§11.2).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The canonical surface `make parity` checks (AGENTS.md §4). Small on
  * purpose (§19): everything else is methods on the host and instance

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sekreto.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/Sekreto.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/sekreto - one interface for secrets, wherever they live.
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/aws.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/aws.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/azuresecrets.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/azuresecrets.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/boru.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/boru.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/doppler.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/doppler.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/gcpsecrets.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/gcpsecrets.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/hashicorp.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/hashicorp.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/httpjson.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/httpjson.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/infisical.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/infisical.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/onepassword.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/onepassword.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/secretspec.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/secretspec.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/sigv4.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/sigv4.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/addr.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/addr.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/builtin.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/builtin.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/dotenv.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/dotenv.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/env.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/env.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/file.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/file.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/memory.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/memory.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/support.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/support.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, and how a
 // provider kind becomes a voxgig/plugin definition.

package/project/.sdk/tm/ts/src/feature/test/TestFeature.ts

@@ -17,6 +17,8 @@ const S_NOT_FOUND = 'Not found'
 // against the API's real param names, never a bare 'id' the API itself
 // does not use.
 function ownIdField(config: any, getpath: any, entityName: string): string {
+  let fallback = ''
+
   for (const opname of ['load', 'remove', 'update']) {
     const points = getpath(config, ['entity', entityName, 'op', opname, 'points']) || []
     const canonical = points.filter((pt: any) =>
@@ -50,7 +52,41 @@ function ownIdField(config: any, getpath: any, entityName: string): string {
     const query = (best && best.args && best.args.query) || []
     const reqdQuery = query.filter((q: any) => false !== q.reqd)
     if (1 === reqdQuery.length) return String(reqdQuery[0].name)
+
+    // The last path parameter of a literal-terminal route is remembered as
+    // a LAST RESORT, but not returned yet — see below.
+    if ('' === fallback) {
+      for (let i = parts.length - 1; 0 <= i; i--) {
+        const part = String(parts[i])
+        if (part.startsWith('{')) {
+          fallback = part.slice(1, -1)
+          break
+        }
+      }
+    }
+  }
+
+  // ONLY AFTER EVERY OP, because an op whose routes all end in a literal
+  // says nothing while another op may still name the key outright.
+  // github's `private_registry` reads
+  // `/orgs/{org}/private-registries/public-key` under `load` and writes
+  // `/orgs/{org}/private-registries/{secret_name}` under `update`:
+  // returning the load route's last parameter made the key `org`, and its
+  // update answered 404 for want of a registry named after an
+  // organisation.
+  //
+  // Reached at all only by an entity with no record-terminal route
+  // anywhere — github's `copilot` is read from
+  // `/orgs/{org_id}/members/{username}/copilot`, whose key is plainly
+  // `username`. Abstaining left the mock stamping no key on a created
+  // record while the provider addressed it by `username`, so the load
+  // straight after a create found nothing. The provider's recordKey has
+  // always used this fallback; matching it removes a disagreement rather
+  // than adding a guess.
+  if ('' !== fallback) {
+    return fallback
   }
+
   return 'id'
 }
 
@@ -354,7 +390,69 @@ class TestFeature extends BaseFeature {
     const qand: any[] = []
     const q = { '`$AND`': qand }
 
-    for (let k of keysof(args)) {
+    // WHERE A PATH PARAMETER'S VALUE ACTUALLY LIVES IN A RECORD.
+    //
+    // A request addresses a record by path parameter; a stored record carries
+    // whatever the API's response carries. Those are not always the same
+    // name, and are not always at the same depth: github addresses a repo by
+    // `{owner}/{repo}` and returns the owner as an OBJECT (`owner.login`)
+    // with the repository under `name`. Matching by parameter name alone
+    // found nothing for such a record, so a seeded composite record was
+    // unfindable and every read of it came back 404.
+    //
+    // `id.from` in the model says where each parameter is carried, as a
+    // dotted path. `select` matches a NESTED query shape but not a dotted
+    // key, so the path is expanded into one — `owner.login` becomes
+    // `{ owner: { login: value } }`.
+    const idfrom = getpath(ctx.config, [
+      'entity', getprop(ctx.entity, 'name'), 'id', 'from']) || {}
+
+    const nest = (path: string, value: any) => {
+      const keys = String(path).split('.')
+      let out: any = value
+      for (let i = keys.length - 1; 0 <= i; i--) {
+        out = { [keys[i]]: out }
+      }
+      return out
+    }
+
+    // THE COMPOSITE PARTS FROM THE ENTITY MATCH TOO.
+    //
+    // A path parameter does not have to travel with the body. The seneca
+    // provider puts a composite record's parts in the ENTITY MATCH and
+    // leaves the body as the caller wrote it, because a path parameter is
+    // not a field — so `update`, which builds its query from `reqdata`,
+    // never looked at them. The query then matched every repo and
+    // `Repo({match:{owner,repo}}).update(...)` answered 404 while the same
+    // call with the parts in the body succeeded.
+    //
+    // EXACTLY THE PARTS, and only when nothing else addresses the record.
+    //
+    // Not every key the match holds: the match ACCRETES across calls on one
+    // entity instance, so after a create and an update it carries that
+    // record's parent scope as well — and the create branch below stamps the
+    // record's OWN key over the field it was seeded with, so a later read
+    // constrained on an accreted value finds nothing. Twenty-five of this
+    // SDK's own entity tests failed that way.
+    //
+    // And not when the call already carries an `id`: a direct id IS the
+    // address, and an accreted part then only narrows it wrongly — this
+    // SDK's own activity test updates `id: ACTIVITY00` on an entity whose
+    // match still holds the `repo` a previous list used.
+    const match = ctx.match || {}
+    const names: any[] = [...keysof(args)]
+
+    if (null == getprop(args, 'id')) {
+      for (const part of (getpath(ctx.config, [
+        'entity', getprop(ctx.entity, 'name'), 'id', 'parts']) || [])) {
+        const pname = String(part)
+        if (!names.includes(pname) && null != getprop(match, pname)) {
+          names.push(pname)
+        }
+      }
+    }
+
+    for (let k of names) {
       if ('id' === k || !isempty(select(reqd, k))) {
         const v = param(ctx, k)
         const ka = getprop(op.alias, k)
@@ -364,6 +462,14 @@ class TestFeature extends BaseFeature {
           qor.push({ [ka]: v })
         }
 
+        // An ALTERNATIVE, never a replacement: the parameter name still
+        // matches a record that happens to carry it flat, so a seed written
+        // either way is found. `$OR` is what makes that safe.
+        const kf = getprop(idfrom, k)
+        if (null != kf && k !== kf) {
+          qor.push(nest(kf, v))
+        }
+
         qor = { '`$OR`': qor }
 
         qand.push(qor)

package/project/.sdk/tm/ts/src/utility/StructUtility.ts

@@ -1,9 +1,9 @@
 // VENDORED: @voxgig/struct 0.3.4 (typescript/src/StructUtility.ts)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
 
-// VERSION: @voxgig/struct 0.3.5
+// VERSION: @voxgig/struct 0.3.6
 
 /* Voxgig Struct
  * =============

package/project/.sdk/tm/ts/src/utility/TransformRequestUtility.ts

@@ -22,7 +22,7 @@ function transformRequest(ctx: Context) {
       reqdata: ctx.reqdata
     }, reqform)
 
-    return reqdata
+    return stripAction(reqdata)
   }
   catch (err) {
     return utility.makeError(ctx, err)
@@ -30,6 +30,54 @@ function transformRequest(ctx: Context) {
 }
 
 
+
+// `$action` selects WHICH POINT of the op to use (see MakePointUtility). It
+// is the SDK's own discriminator, never an API field, so it must not survive
+// into the wire body. The GraphQL path already strips it where it builds its
+// input object; this is the same rule on the REST path, which had no such
+// step and sent it verbatim -- `{"$action":"merge", ...}` to GitHub's merge
+// endpoint. Harmless there, because GitHub ignores unknown keys; not
+// harmless against an API that validates its request bodies strictly.
+//
+// Only a top-level key of a plain object: a body may legitimately be an
+// array or a scalar, and neither can carry a selector.
+//
+// `__proto__` is assigned through Object.defineProperty, never `body[key] =`.
+// It is a legal JSON key and can be a real API field, but plain assignment
+// invokes the inherited setter: the key would vanish from the serialised
+// request and silently become the body's prototype instead. Same treatment
+// as StructUtility's condenseSet, for the same reason.
+
+function stripAction(reqdata: any) {
+  if (null == reqdata || 'object' !== typeof reqdata || Array.isArray(reqdata)) {
+    return reqdata
+  }
+
+  if (!Object.prototype.hasOwnProperty.call(reqdata, '$action')) {
+    return reqdata
+  }
+
+  const body: Record<string, any> = {}
+  for (const key of Object.keys(reqdata)) {
+    if ('$action' === key) {
+      continue
+    }
+    if ('__proto__' === key) {
+      Object.defineProperty(body, key, {
+        value: reqdata[key],
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      })
+    }
+    else {
+      body[key] = reqdata[key]
+    }
+  }
+
+  return body
+}
+
 export {
   transformRequest
 }

package/project/.sdk/tm/ts/test/vendor/omni/Runner.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Runner.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/ts/test/vendor/omni/Util.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Util.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/ts/test/vendor/omni/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/omni - shared multi-language test runner.
 

package/project/.sdk/tm/zig/feature/secrets/plugin/capability.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/capability.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Capabilities (§11.1).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/catalog.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/catalog.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The definition catalog (§10.1).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/config.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/config.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The declarative document (§9): normalization, and the ten-level
 //! precedence ladder.

package/project/.sdk/tm/zig/feature/secrets/plugin/depend.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/depend.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dependency cardinality, policy, and the restart graph (§11.3).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/env.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/env.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Environment overrides (§9.5) — level 7 of the ladder.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/export.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/export.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Exports (§11).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/graph.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/graph.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Whole-graph resolution (§11.4) — a phase, not a discovery.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/host.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/host.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The host: the lifecycle state machine (§5), extension points (§6),
 //! and resource capture (§8).

package/project/.sdk/tm/zig/feature/secrets/plugin/inst.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/inst.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The instance and host records.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/order.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/order.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Ordering (§7) — one rule, one place.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/plugin.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/plugin.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! THE ROOT A CONSUMER IMPORTS.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/point.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/point.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Extension points (§6). Three kinds, chosen because they are what the
 //! two existing systems actually needed, and no more.

package/project/.sdk/tm/zig/feature/secrets/plugin/ref.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/ref.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Identity: name+tag, written `name$tag` (§4).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/resolve.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/resolve.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dynamic resolution (§10.2) — name to candidate module ids.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/types.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/types.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Errors, and the raise mechanism (§12).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/value.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/value.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The dynamic value, and the JSON reader that fills it (§16).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/version.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/version.zig)
-// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Versions and ranges (§11.2).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugins/aws.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/aws.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! AWS Secrets Manager and SSM Parameter Store - one sekreto plugin,
 //! two kinds: `awssecrets` and `awsparams`.

package/project/.sdk/tm/zig/feature/secrets/plugins/azuresecrets.zig

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/azuresecrets.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Azure Key Vault - a sekreto plugin. Needs HTTPS.