@voxgig/sdkgen 4.19.1 → 4.21.0

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/onepassword.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/onepassword.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (clojure/plugins/voxgig/sekreto/plugins/onepassword.clj)
+;; Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; 1Password through a Connect server, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/proc.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/proc.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (clojure/plugins/voxgig/sekreto/plugins/proc.clj)
+;; Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Running a child to completion, for the two kinds that read a secret
 ;; through somebody else's CLI - boru and secretspec.

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/secretspec.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/secretspec.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (clojure/plugins/voxgig/sekreto/plugins/secretspec.clj)
+;; Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; SecretSpec, as a voxgig/plugin definition.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/plugins/sigv4.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/plugins/voxgig/sekreto/plugins/sigv4.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (clojure/plugins/voxgig/sekreto/plugins/sigv4.clj)
+;; Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; AWS Signature Version 4, hand-rolled - and OUTSIDE THE CORE, because it
 ;; is this library's one cryptographic edge. Only the two aws kinds sign

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/provider.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/provider.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (clojure/src/voxgig/sekreto/provider.clj)
+;; Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; A source of secrets.
 ;;

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto/providers.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto/providers.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (clojure/src/voxgig/sekreto/providers.clj)
+;; Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; What a provider is, how a provider kind becomes a voxgig/plugin
 ;; definition - and the four BUILT-IN kinds.
@@ -19,7 +19,8 @@
 ;; THIS NAMESPACE IMPORTS NO HTTP CLIENT, NO HASH FUNCTION AND NO
 ;; ProcessBuilder. What makes a kind built in is that it needs nothing of
 ;; the platform beyond reading a local file; every kind that opens a
-;; socket, signs a request or spawns a process is a plugin under
+;; socket, signs a request, spawns a process or does cryptography is a
+;; plugin under
 ;; `plugins/`, its own namespace, required only by a program that names it
 ;; (docs/design/plugin-providers.md).
 ;;
@@ -193,4 +194,5 @@
   unknown kind can be told from a plugin that was not loaded."
   {:builtin ["env" "memory" "dotenv" "file"]
    :plugin ["hashicorp" "boru" "awssecrets" "awsparams" "gcpsecrets"
-            "azuresecrets" "onepassword" "doppler" "infisical" "secretspec"]})
+            "azuresecrets" "onepassword" "doppler" "infisical" "secretspec"
+            "minivault"]})

package/project/.sdk/tm/clojure/feature/secrets/voxgig/sekreto.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (clojure/src/voxgig/sekreto.clj)
-;; Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (clojure/src/voxgig/sekreto.clj)
+;; Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; sekreto: one interface for secrets, wherever they live.
 ;;

package/project/.sdk/tm/clojure/src/sdk/core.clj

@@ -14,6 +14,7 @@
 
 (ns sdk.core
   (:require [voxgig.struct :as vs]
+            [sdk.schema :as schema]
             [clojure.string :as str]))
 
 (def SDK-NAME "ProjectName")
@@ -92,6 +93,21 @@
                            (bigint (java.math.BigInteger. tok))))))))]
       (parse-val))))
 
+;; The option spec, parsed ONCE. sdk.schema holds the raw JSON and nothing
+;; else — it cannot parse its own data without requiring this namespace,
+;; which would close a cycle — so the parse lives here, behind a delay so it
+;; happens on first use rather than at load.
+;;
+;; sdk.schema also carries `entityspec-data`, the per-entity field specs the
+;; `validate` feature checks payloads against. Parsed here for the same
+;; reason and behind the same delay; `entityspec` is public because the
+;; feature module reads it, and it is READ-ONLY — validate rebuilds the tree
+;; for `strict` rather than mutating this one.
+(def ^:private optspec-parsed (delay (json-parse schema/optspec-data)))
+(def ^:private entityspec-parsed (delay (json-parse schema/entityspec-data)))
+
+(defn entityspec [] @entityspec-parsed)
+
 ;; ---------------------------------------------------------------------------
 ;; Atom-object helpers. Every mutable "object" is an atom wrapping a map.
 ;; ---------------------------------------------------------------------------
@@ -604,25 +620,27 @@
         (oset! result :ok false)
         true))))
 
-(def HEADER-AUTH "authorization")
-(def OPTION-APIKEY "apikey")
-(def NOT-FOUND "__NOTFOUND__")
-
-(defn u-prepare-auth [ctx]
-  (let [spec (oget ctx :spec)]
-    (if (nil? spec) [nil (ctx-error ctx "auth_no_spec" "Expected context spec property to be defined.")]
-        (let [headers (oget spec :headers)
-              options (client-options-map (oget ctx :client))]
-          (if (nil? (vs/getprop options "auth"))
-            (do (vs/delprop headers HEADER-AUTH) [spec nil])
-            (let [apikey (vs/getprop options OPTION-APIKEY NOT-FOUND)]
-              (if (or (nil? apikey) (and (string? apikey) (or (= apikey NOT-FOUND) (= apikey ""))))
-                (vs/delprop headers HEADER-AUTH)
-                (let [auth-prefix (or (vs/getpath options "auth.prefix") "")
-                      apikey-val (if (string? apikey) apikey "")]
-                  (.put ^java.util.Map headers HEADER-AUTH
-                        (if (= auth-prefix "") apikey-val (str auth-prefix " " apikey-val)))))
-              [spec nil]))))))
+;; WHERE THE CREDENTIAL GOES IS A FACT ABOUT THE API, so HEADER-AUTH,
+;; OPTION-APIKEY, NOT-FOUND and u-prepare-auth are GENERATED into
+;; src/sdk/prepare_auth.clj rather than written here.
+;;
+;; apidef resolves the security scheme's `in` and `name` into
+;; main.kit.info.security - joplin's says `in: "query", name: "token"` - and
+;; this file used to hardcode an `authorization` HEADER, so an
+;; apiKey-in-query API got a header it does not read and never got the query
+;; parameter it does. Header, query and cookie need three different bodies
+;; and a hand-written file has to pick one, so cmp/clojure/PrepareAuth_
+;; clojure.ts emits the branch the API actually uses and nothing else.
+;;
+;; `load`, NOT `require`: the generated file opens with `(in-ns 'sdk.core)`
+;; and is read INTO THIS NAMESPACE, right here, where the defn used to be.
+;; A namespace of its own would need sdk.core's oget / ctx-error /
+;; client-options-map while base-utility-map below needs its u-prepare-auth -
+;; a load cycle, which Clojure refuses. This is the idiom clojure.core itself
+;; uses to split across files, every helper above is already in scope, and
+;; both `:prepare-auth u-prepare-auth` below and `core/HEADER-AUTH` (read by
+;; feature/secrets) go on resolving exactly as before.
+(load "prepare_auth")
 
 (defn u-make-point [ctx]
   (let [preset (out-get ctx "point")]
@@ -716,7 +734,12 @@
 
 (defn u-make-spec [ctx]
   (if (some? (out-get ctx "spec"))
-    (do (oset! ctx :spec (out-get ctx "spec")) [(oget ctx :spec) nil])
+    ;; A PreSpec feature hook (e.g. validate) may short-circuit the operation
+    ;; by storing an error here; surface it before the request is built, the
+    ;; same way u-make-point surfaces out["point"].
+    (if (sdk-error? (out-get ctx "spec"))
+      [nil (out-get ctx "spec")]
+      (do (oset! ctx :spec (out-get ctx "spec")) [(oget ctx :spec) nil]))
     (let [point (oget ctx :point)
           options (oget ctx :options)
           base (or (vs/getprop options "base") "")
@@ -1026,37 +1049,15 @@
                 order)))
           config (or (oget ctx :config) (vs/jm))
           cfgopts (let [c (vs/getprop config "options")] (if (vs/ismap c) c (vs/jm)))
-          optspec (vs/jm
-                   "apikey" "" "secret" "" "base" "http://localhost:8000" "prefix" "" "suffix" ""
-                   ;; `basic` and `secret`: HTTP Basic Auth needs a second
-                   ;; credential and a flag to say the pair is Basic rather
-                   ;; than a single bearer token. Absent from the shape, a
-                   ;; client passing them is refused with "Unexpected keys".
-                   "auth" (vs/jm "prefix" "" "basic" false)
-                   "headers" (vs/jm "`$CHILD`" "`$STRING`")
-                   "allow" (vs/jm "method" "GET,PUT,POST,PATCH,DELETE,OPTIONS"
-                                  "op" "create,update,load,list,remove,command,direct,graphql")
-                   "entity" (vs/jm "`$CHILD`" (vs/jm "`$OPEN`" true "active" false "alias" (vs/jm)))
-                   "feature" (vs/jm "`$CHILD`" (vs/jm "`$OPEN`" true "active" false))
-                   "utility" (vs/jm)
-                   ;; Feature INSTANCES supplied at construction (the station
-                   ;; adopt path): consumed by make-sdk's feature-add loop, so
-                   ;; they are live feature atoms, not data - `$ANY` accepts
-                   ;; them verbatim. Without this entry the seam is DEAD:
-                   ;; client.clj reads options.extend, but validate rejected
-                   ;; the key ("Unexpected keys at field <root>: extend"), so
-                   ;; every construction that used it failed outright.
-                   ;; Mirrors go's make_options.go and MakeOptionsUtility.ts.
-                   "extend" "`$ANY`"
-                   "system" (vs/jm)
-                   "test" (vs/jm "active" false "entity" (vs/jm "`$OPEN`" true))
-                   "clean" (vs/jm "keys" "key,token,id")
-                   ;; Server-variable values for a templated base URL (OpenAPI
-                   ;; server variables): {name} placeholders in "base" are
-                   ;; substituted from this map at construction. Spec defaults
-                   ;; arrive via the generated config; user values override
-                   ;; them. Mirrors go's make_options optspec.
-                   "server" (vs/jm "`$CHILD`" ""))
+          ;; THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+          ;;
+          ;; Built from the model: main.kit.optspec for the standard
+          ;; options, plus one entry per feature this target carries, from
+          ;; that feature's own config.options / config.optspec. Editing
+          ;; this file to add an option would put it back where it was —
+          ;; one of twenty hand-maintained copies of a schema nothing
+          ;; cross-checked — so add it to the model instead.
+          optspec @optspec-parsed
           sys-fetch (vs/getpath opts0 "system.fetch")
           merged (vs/merge (vs/jt (vs/jm) cfgopts opts0))
           validated (vs/validate merged optspec)

package/project/.sdk/tm/clojure/src/sdk/features.clj

@@ -1272,6 +1272,207 @@
 ;; Factory
 ;; ---------------------------------------------------------------------------
 
+;; ---------------------------------------------------------------------------
+;; validate — payload validation against the model's own field types.
+;;
+;; The specs are NOT written here and not written in the model either: every
+;; entity field already carries a canonical type sentinel (`$STRING`,
+;; `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+;; vocabulary vs/validate speaks. The generator maps them once
+;; (helpers/canonSpec) and emits sdk.schema's entityspec-data, so a field
+;; whose type changes in the API spec changes what this feature enforces with
+;; no edit anywhere.
+;;
+;; WHAT IS CHECKED
+;;   outbound (PreSpec)  the payload the caller asked to send, against
+;;                       spec.op[<opname>] — the operation's request shape.
+;;   inbound  (PreDone)  each record the operation returned, against
+;;                       spec.data — the entity's own field types.
+;;
+;; WHAT IS NOT. The model carries no array element types, no nested object
+;; schemas, no enums, formats or bounds, so this checks the shape the model
+;; knows and nothing more.
+;; ---------------------------------------------------------------------------
+
+;; Built rather than written, so the backticks cannot be lost in an edit.
+(def ^:private validate-open (str (char 96) "$OPEN" (char 96)))
+
+;; The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+;; error rather than a pass. Rebuilt rather than mutated: core/entityspec is
+;; parsed once and shared by every client in the process.
+(defn- validate-close [node]
+  (cond
+    (vs/islist node) (let [out (vs/jt)]
+                       (doseq [item (vec node)] (.add ^java.util.List out (validate-close item)))
+                       out)
+    (vs/ismap node) (let [out (vs/jm)]
+                      (doseq [k (vec (vs/keysof node))]
+                        (when (not= validate-open k)
+                          (.put ^java.util.Map out k (validate-close (mget node k)))))
+                      out)
+    :else node))
+
+;; A RESULT RECORD AS DATA.
+;;
+;; u-make-result turns every record of a LIST into an entity instance, so what
+;; reaches PreDone for a list is wrappers, not records — and a wrapper checked
+;; against a field spec fails on every required field while its actual data
+;; goes unchecked. A load returns the record itself, so this handles both.
+(defn- validate-unwrap [record]
+  (if (and (map? record) (:data-get record))
+    (or ((:data-get record)) record)
+    record))
+
+(defn validate-feature []
+  (let [fa (new-feature "validate" false "0.0.1")
+        entname (fn [ctx]
+                  (let [n (when (core/oget ctx :entity)
+                            (core/entity-get-name (core/oget ctx :entity)))]
+                    (cond
+                      (seq n) n
+                      (core/oget ctx :op) (core/op-entity (core/oget ctx :op))
+                      :else "")))
+        opname (fn [ctx] (if (core/oget ctx :op) (core/op-name (core/oget ctx :op)) ""))
+        espec (fn [ctx] (mget (:spec @fa) (entname ctx)))
+        ;; One validate call. Errors are COLLECTED, never thrown: vs/validate
+        ;; throws on the first failure unless given an `errs` list, and a
+        ;; caller fixing a payload wants every problem with it, not the first.
+        check (fn [ctx data spec direction]
+                (let [errs (vs/jt)]
+                  (try
+                    (vs/validate data spec (vs/jm "errs" errs))
+                    (catch RuntimeException e
+                      ;; A spec this port cannot run at all (rather than a
+                      ;; payload that fails it) must not take the operation
+                      ;; down with it: report it like any other failure and
+                      ;; let `mode` decide.
+                      (when (zero? (vs/size errs))
+                        (.add ^java.util.List errs (str (.getMessage e))))))
+                  (let [msgs (mapv str (vec errs))
+                        cb (opt fa "onInvalid")]
+                    (when (and (seq msgs) (fn? cb))
+                      ;; A callback receiving every failure, whatever `mode`
+                      ;; does with it, so a client can log or count invalid
+                      ;; payloads without changing what the SDK returns.
+                      (try
+                        (cb (vs/jm "entity" (entname ctx) "op" (opname ctx)
+                                   "direction" direction "errs" errs "data" data))
+                        (catch RuntimeException _e nil)))
+                    msgs)))
+        ;; The payload an operation is about to send.
+        ;;
+        ;; TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch)
+        ;; carries the caller's argument in `reqdata` over the entity's
+        ;; `data`; a match op (load/list/remove) carries it in `reqmatch` over
+        ;; `match`. So reading `reqdata` for every op would check a
+        ;; `load({id})` against the entity's STALE stored match and reject it
+        ;; for the id the caller had just supplied.
+        payload (fn [ctx op]
+                  (let [body (contains? #{"create" "update" "patch"} op)
+                        base (core/oget ctx (if body :data :match))
+                        req (core/oget ctx (if body :reqdata :reqmatch))
+                        out (vs/jm)]
+                    (doseq [src [base req]]
+                      (when (vs/ismap src)
+                        (doseq [k (vec (vs/keysof src))]
+                          (.put ^java.util.Map out k (mget src k)))))
+                    ;; `$action` SELECTS A CUSTOM ENDPOINT; it is not a field
+                    ;; of the record, and under `strict` every custom-action
+                    ;; call would be rejected for the one key that made it
+                    ;; reachable.
+                    (.remove ^java.util.Map out "$action")
+                    out))]
+    (swap! fa assoc :spec (vs/jm) :request true :response false :mode "throw")
+    (swap! fa assoc
+           "init"
+           (fn [ctx options]
+             (swap! fa assoc :client (core/oget ctx :client)
+                    :options (if (vs/ismap options) options (vs/jm))
+                    :active (opts-active? options))
+             ;; DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+             ;; `config.options` documents them and types them; it does not
+             ;; inject them, because each feature entry in the spec is
+             ;; optional and struct fills in nothing through an optional
+             ;; union. So every feature resolves its own.
+             (swap! fa assoc
+                    :request (not= false (opt fa "request"))
+                    :response (= true (opt fa "response"))
+                    ;; FAIL CLOSED. Only the exact string "report" selects
+                    ;; report mode, so a typo still rejects rather than
+                    ;; silently turning enforcement off.
+                    :mode (if (= "report" (opt fa "mode")) "report" "throw")
+                    ;; `strict` is applied ONCE, here, rather than per call.
+                    :spec (if (= true (opt fa "strict"))
+                            (validate-close (core/entityspec))
+                            (core/entityspec))))
+
+           ;; Outbound. u-make-spec surfaces an SDK error left in out["spec"]
+           ;; before the request is built — the same seam rbac uses one stage
+           ;; earlier through out["point"].
+           "PreSpec"
+           (fn [ctx]
+             (when (and (active? fa) (:request @fa))
+               (let [op (opname ctx)
+                     opspec (mget (mget (espec ctx) "op") op)]
+                 (when (some? opspec)
+                   (let [errs (check ctx (payload ctx op) opspec "request")]
+                     (when (and (seq errs) (not= "report" (:mode @fa)))
+                       (let [err (core/ctx-error ctx "validate_failed"
+                                                 (str "Invalid " op " request for entity \""
+                                                      (entname ctx) "\": "
+                                                      (str/join "; " errs)))]
+                         (core/out-set! ctx "spec" err)
+                         err)))))))
+
+           ;; Inbound. PreDone rather than PreResult: the records are
+           ;; extracted from the response body by u-make-result, which runs
+           ;; between the two, so at PreResult there is nothing to check but
+           ;; the envelope.
+           ;;
+           ;; HOOK ORDER MATTERS HERE, and the default order is not the one
+           ;; you want. PreDone hooks fire in feature ADD order, which
+           ;; defaults to `test` first and then names sorted — and `validate`
+           ;; sorts last, after audit, cost, debug, metrics and telemetry.
+           ;; Activating features as an ORDERED LIST fixes it.
+           "PreDone"
+           (fn [ctx]
+             (when (and (active? fa) (:response @fa))
+               (let [dataspec (mget (espec ctx) "data")
+                     result (core/oget ctx :result)
+                     resdata (when result (core/oget result :resdata))]
+                 (when (and (some? dataspec) (some? resdata))
+                   (let [records (if (vs/islist resdata) (vec resdata) [resdata])
+                         errs (vec (mapcat
+                                    (fn [record]
+                                      (if (nil? record)
+                                        []
+                                        ;; A NON-OBJECT IS A FAILURE, not
+                                        ;; something to skip: a load that
+                                        ;; answered 42 where the entity's spec
+                                        ;; wants a record must not pass
+                                        ;; silently.
+                                        (check ctx (validate-unwrap record)
+                                               dataspec "response")))
+                                    records))]
+                     (when (and (seq errs) (not= "report" (:mode @fa)))
+                       (let [err (core/ctx-error ctx "validate_failed"
+                                                 (str "Invalid response for entity \""
+                                                      (entname ctx) "\": "
+                                                      (str/join "; " errs)))]
+                         ;; BOTH, and `ok` is the load-bearing half: done
+                         ;; returns resdata whenever result.ok is true and
+                         ;; never looks at err, so setting the error alone
+                         ;; would hand the caller the very records that failed
+                         ;; the spec.
+                         (core/oset! result :ok false)
+                         (core/oset! result :err err)
+                         ;; AND THE DATA GOES. The load/update paths copy
+                         ;; resdata into the entity's own state on any
+                         ;; non-nil value, BEFORE done raises.
+                         (core/oset! result :resdata nil)
+                         err))))))))
+    fa))
+
 (defn make-feature [name]
   (case name
     "base" (base-feature)
@@ -1291,6 +1492,7 @@
     "audit" (audit-feature)
     "clienttrack" (clienttrack-feature)
     "rbac" (rbac-feature)
+    "validate" (validate-feature)
     "netsim" (netsim-feature)
     "cost" (cost-feature)
     (if-let [ctor (get config/feature-extra name)]

package/project/.sdk/tm/clojure/test/vendor/omni/voxgig/omni/json.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/omni sdk-20260908-1556-0 (clojure/src/voxgig/omni/json.clj)
-;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/omni sdk-20260917-1242-0 (clojure/src/voxgig/omni/json.clj)
+;; Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; The omni JSON parser.
 ;;

package/project/.sdk/tm/clojure/test/vendor/omni/voxgig/omni/runner.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/omni sdk-20260908-1556-0 (clojure/src/voxgig/omni/runner.clj)
-;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/omni sdk-20260917-1242-0 (clojure/src/voxgig/omni/runner.clj)
+;; Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Omni: the shared multi-language test runner (Clojure port).
 ;;

package/project/.sdk/tm/clojure/test/vendor/omni/voxgig/omni/util.clj

@@ -1,5 +1,5 @@
-;; VENDORED: @voxgig/omni sdk-20260908-1556-0 (clojure/src/voxgig/omni/util.clj)
-;; Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+;; VENDORED: @voxgig/omni sdk-20260917-1242-0 (clojure/src/voxgig/omni/util.clj)
+;; Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 ;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 ;; Omni internal JSON utilities.
 ;;

package/project/.sdk/tm/cpp/core/types.hpp

@@ -422,6 +422,10 @@ struct CtxOut {
   Value point = Value::undef();
   SdkErrorPtr pointError;
   SpecPtr spec;
+  // A PreSpec hook (e.g. validate) rejecting the operation. `spec` above is
+  // a Spec, so it cannot carry the error the way go's `out["spec"]` map slot
+  // does; this is the same seam as pointError, one stage later.
+  SdkErrorPtr specError;
   ResponsePtr request;
   ResponsePtr response;
   ResultPtr result;

package/project/.sdk/tm/cpp/feature/secrets/plugin/capability.cpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/capability.cpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/capability.cpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1). */
 

package/project/.sdk/tm/cpp/feature/secrets/plugin/capability.hpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/capability.hpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/capability.hpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/cpp/feature/secrets/plugin/catalog.cpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/catalog.cpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/catalog.cpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1). */
 

package/project/.sdk/tm/cpp/feature/secrets/plugin/catalog.hpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/catalog.hpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/catalog.hpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/cpp/feature/secrets/plugin/config.cpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/config.cpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/config.cpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/cpp/feature/secrets/plugin/config.hpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/config.hpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/config.hpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder. See config.cpp for why the two functions are

package/project/.sdk/tm/cpp/feature/secrets/plugin/depend.cpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/depend.cpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/depend.cpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/cpp/feature/secrets/plugin/depend.hpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/depend.hpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/depend.hpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3). Two
  * axes, both declared by the definition that has the requirement,

package/project/.sdk/tm/cpp/feature/secrets/plugin/env.cpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/env.cpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/env.cpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/cpp/feature/secrets/plugin/env.hpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/env.hpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/env.hpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder. Pure: a
  * function over a string map and a ref set, so the corpus tests it

package/project/.sdk/tm/cpp/feature/secrets/plugin/export.cpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/export.cpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/export.cpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *
@@ -20,7 +20,7 @@ namespace plugin {
 
 V resolveexport(const V& spec, const V& exported) {
   const std::string s = isstr(spec) ? asstr(spec) : "";
-  size_t cut = s.find('/');
+  size_t cut = s.rfind('/');
   if (std::string::npos == cut) {
     fail("plugin_export_ambiguous", "export spec needs a key: " + s,
          details1("spec", vstr(s)));

package/project/.sdk/tm/cpp/feature/secrets/plugin/export.hpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/export.hpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/export.hpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11). An instance publishes values for other plugins and for
  * the application. THE UNQUALIFIED ALIAS IS THE INTERESTING PART; see

package/project/.sdk/tm/cpp/feature/secrets/plugin/graph.cpp

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (cpp/src/graph.cpp)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (cpp/src/graph.cpp)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *