@voxgig/sdkgen 4.19.1 → 4.21.0

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/onepassword.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/onepassword.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/onepassword.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # 1Password, through a Connect server, as a sekreto plugin.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/proc.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/proc.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/proc.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # The child-process half of the two plugins that read a store through its
 # own CLI - boru and secretspec - in one place and OUTSIDE THE CORE.

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/secretspec.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/secretspec.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/secretspec.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # SecretSpec, as a sekreto plugin.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/sigv4.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/sigv4.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/sigv4.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # AWS Signature Version 4, hand-rolled - and OUTSIDE THE CORE, because it
 # is the library's one cryptographic edge. Only the two aws kinds sign

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/provider.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/src/provider.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/src/provider.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # A source of secrets.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/providers.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/src/providers.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/src/providers.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # What a provider is, how a provider kind becomes a voxgig/plugin
 # definition - and the four BUILT-IN kinds.
@@ -141,7 +141,18 @@ defmodule Sekreto.ProviderSpec do
             config: "",
             # infisical: the environment slug and secret path.
             environment: "",
-            path: ""
+            path: "",
+            # minivault: the passphrase that unwraps `vaultkey`.
+            passphrase: "",
+            # minivault: which key in the vault file to open with,
+            # defaulting to `master`. Named apart from `key` and `keyid`
+            # because those already mean a secret name and an AWS access
+            # key id.
+            vaultkey: "",
+            # minivault: PBKDF2 rounds, used only when a key is created.
+            iterations: nil,
+            # minivault: make the vault file if it is not there.
+            create: false
 end
 
 # Printed without its credentials. See the AuthSpec implementation: the
@@ -167,7 +178,7 @@ defmodule Sekreto.Providers do
 
   A provider kind is a voxgig/plugin `Definition`, and `providerplugin/2`
   is the whole bridge between the two libraries - the four kinds below are
-  made with it, the ten under plugins/ are made with it, and so is a
+  made with it, the eleven under plugins/ are made with it, and so is a
   caller's own.
   """
 
@@ -526,7 +537,8 @@ defmodule Sekreto.Providers do
         "onepassword",
         "doppler",
         "infisical",
-        "secretspec"
+        "secretspec",
+        "minivault"
       ]
     }
   end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/sekreto.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/src/sekreto.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/src/sekreto.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # sekreto: one interface for secrets, wherever they live.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/validate.ex

@@ -0,0 +1,320 @@
+# ProjectName SDK validate feature
+#
+# Payload validation against the model's own field types (the elixir port of
+# tm/ts/src/feature/validate/ValidateFeature.ts).
+#
+# The specs are NOT written here and not written in the model either: every
+# entity field already carries a canonical type sentinel (`$STRING`,
+# `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+# vocabulary S.validate speaks. The generator maps them once
+# (helpers/canonSpec) and emits `ProjectName.Schema.entityspec`, so a field
+# whose type changes in the API spec changes what this feature enforces with
+# no edit anywhere.
+#
+# WHAT IS CHECKED
+#   outbound (PreSpec)  the payload the caller asked to send, against
+#                       spec.op[<opname>] - the operation's request shape.
+#   inbound  (PreDone)  each record the operation returned, against
+#                       spec.data - the entity's own field types.
+#
+# WHAT IS NOT. The model carries no array element types, no nested object
+# schemas, no enums, formats or bounds, so this checks the shape the model
+# knows and nothing more.
+#
+# Short-circuit mechanism: the failure error is placed in ctx.out["spec"],
+# which make_spec_impl already surfaces as the operation's error (H.is_error)
+# rather than using as a Spec - the same seam rbac uses one stage earlier
+# through ctx.out["point"].
+
+defmodule ProjectName.Feature.Validate do
+  alias Voxgig.Struct, as: S
+  alias ProjectName.Helpers, as: H
+  alias ProjectName.{Feature, Context, Schema, EntityBase}
+
+  # Built rather than written, so the backticks cannot be lost in an edit.
+  @open <<96>> <> "$OPEN" <> <<96>>
+
+  def new do
+    f = Feature.base("validate")
+    Feature.install(f, "init", fn ctx, opts -> init(f, ctx, opts) end)
+    Feature.install(f, "PreSpec", fn ctx -> pre_spec(f, ctx) end)
+    Feature.install(f, "PreDone", fn ctx -> pre_done(f, ctx) end)
+    f
+  end
+
+  def init(f, ctx, options) do
+    Feature.init_common(f, ctx, options)
+    opts = Feature.opts(f)
+
+    # DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+    # `config.options` documents them and types them; it does not inject them,
+    # because each feature entry in the spec is optional and struct fills in
+    # nothing through an optional union. So every feature resolves its own.
+    S.setprop(f, "request", S.getprop(opts, "request") != false)
+    S.setprop(f, "response", S.getprop(opts, "response") == true)
+
+    # FAIL CLOSED. Only the exact string "report" selects report mode, so a
+    # typo (`mode: "thow"`) still rejects rather than silently turning
+    # enforcement off - the failure nobody would notice. The option spec
+    # rejects the typo outright; this is what happens if it ever does not.
+    S.setprop(f, "mode", if(S.getprop(opts, "mode") == "report", do: "report", else: "throw"))
+
+    # `strict` is applied ONCE, here, by rebuilding the spec tree without the
+    # `$OPEN` markers - rather than per call, which would clone a spec for
+    # every request an SDK ever makes.
+    spec =
+      if S.getprop(opts, "strict") == true do
+        close_spec(Schema.entityspec())
+      else
+        Schema.entityspec()
+      end
+
+    S.setprop(f, "spec", spec)
+    nil
+  end
+
+  defp pre_spec(f, ctx) do
+    if Feature.active?(f) and S.getprop(f, "request") == true do
+      opname = opname_of(ctx)
+      espec = entity_spec(f, ctx)
+      ops = if espec != nil, do: S.getprop(espec, "op"), else: nil
+      opspec = if S.ismap(ops), do: S.getprop(ops, opname), else: nil
+
+      if opspec != nil do
+        errs = check(f, ctx, payload(ctx, opname), opspec, "request")
+
+        if errs != [] and S.getprop(f, "mode") != "report" do
+          err =
+            Context.make_error(
+              ctx,
+              "validate_failed",
+              "Invalid " <>
+                opname <>
+                " request for entity \"" <> entity_of(ctx) <> "\": " <> Enum.join(errs, "; ")
+            )
+
+          S.setprop(S.getprop(ctx, "out"), "spec", err)
+          err
+        end
+      end
+    end
+  end
+
+  # Inbound. PreDone rather than PreResult: the records are extracted from the
+  # response body by make_result, which runs between the two, so at PreResult
+  # there is nothing to check but the envelope.
+  #
+  # HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+  # PreDone hooks fire in feature ADD order, which defaults to `test` first and
+  # then names sorted - and `validate` sorts last, after audit, cost, debug,
+  # metrics and telemetry. Those observers therefore record the operation as a
+  # success before this hook has looked at it. Activating features as an
+  # ORDERED LIST fixes it.
+  defp pre_done(f, ctx) do
+    if Feature.active?(f) and S.getprop(f, "response") == true do
+      espec = entity_spec(f, ctx)
+      dataspec = if espec != nil, do: S.getprop(espec, "data"), else: nil
+      result = S.getprop(ctx, "result")
+      resdata = if result != nil, do: S.getprop(result, "resdata"), else: nil
+
+      if dataspec != nil and resdata != nil do
+        # A list op returns many records and a load returns one; both are
+        # checked against the same record spec, because they are the same
+        # entity.
+        records =
+          if S.islist(resdata) do
+            n = S.size(resdata)
+            if n == 0, do: [], else: Enum.map(0..(n - 1), fn i -> S.getelem(resdata, i) end)
+          else
+            [resdata]
+          end
+
+        errs =
+          Enum.flat_map(records, fn record ->
+            if record == nil do
+              []
+            else
+              # A NON-OBJECT IS A FAILURE, not something to skip. A load that
+              # answered 42 where the entity's spec wants a record must not
+              # pass this feature silently - struct rejects it with the field
+              # it could not find.
+              check(f, ctx, unwrap(record), dataspec, "response")
+            end
+          end)
+
+        if errs != [] and S.getprop(f, "mode") != "report" do
+          err =
+            Context.make_error(
+              ctx,
+              "validate_failed",
+              "Invalid response for entity \"" <> entity_of(ctx) <> "\": " <> Enum.join(errs, "; ")
+            )
+
+          # BOTH, and `ok` is the load-bearing half: done returns resdata
+          # whenever result.ok is true and never looks at err, so setting the
+          # error alone would hand the caller the very records that failed the
+          # spec.
+          S.setprop(result, "ok", false)
+          S.setprop(result, "err", err)
+
+          # AND THE DATA GOES. The load/update paths copy resdata into the
+          # entity's own state on any non-nil value, BEFORE done raises - so
+          # rejecting the operation while leaving the records in place would
+          # leave the caller holding an entity populated from a payload this
+          # feature had just declared invalid.
+          S.setprop(result, "resdata", nil)
+          err
+        end
+      end
+    end
+  end
+
+  # The payload an operation is about to send.
+  #
+  # TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+  # caller's argument in `reqdata` over the entity's `data`; a match op
+  # (load/list/remove) carries it in `reqmatch` over `match`. That is what the
+  # entity operations pass to Context.new and what make_point reads - so
+  # reading `reqdata` for every op would check a `load(%{"id" => ...})`
+  # against the entity's STALE stored match and reject it for the id the
+  # caller had just supplied.
+  defp payload(ctx, opname) do
+    body = opname in ["create", "update", "patch"]
+    base = S.getprop(ctx, if(body, do: "data", else: "match"))
+    req = S.getprop(ctx, if(body, do: "reqdata", else: "reqmatch"))
+
+    out = S.jm([])
+
+    Enum.each([base, req], fn src ->
+      if S.ismap(src) do
+        Enum.each(H.entries(src), fn {k, v} -> S.setprop(out, k, v) end)
+      end
+    end)
+
+    # `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record.
+    # make_point reads it off this same argument and the request transformer
+    # drops it before the body is built, so a spec built from the API's own
+    # fields will never name it - and under `strict` every custom-action call
+    # would be rejected for the one key that made it reachable.
+    S.delprop(out, "$action")
+
+    out
+  end
+
+  defp entity_spec(f, ctx) do
+    spec = S.getprop(f, "spec")
+    if S.ismap(spec), do: S.getprop(spec, entity_of(ctx)), else: nil
+  end
+
+  defp entity_of(ctx) do
+    name = Context.entity_name(S.getprop(ctx, "entity"))
+    name = if name == "_", do: "", else: name
+
+    if name == "" do
+      op = S.getprop(ctx, "op")
+      oe = if op != nil, do: S.getprop(op, "entity"), else: nil
+      if is_binary(oe), do: oe, else: ""
+    else
+      name
+    end
+  end
+
+  defp opname_of(ctx) do
+    op = S.getprop(ctx, "op")
+    nm = if op != nil, do: S.getprop(op, "name"), else: nil
+    if is_binary(nm), do: nm, else: ""
+  end
+
+  # One validate call. Errors are COLLECTED, never raised: S.validate raises on
+  # the first failure unless given an `errs` list, and a caller fixing a
+  # payload wants every problem with it, not the first one.
+  defp check(f, ctx, data, spec, direction) do
+    errs = S.jt([])
+
+    try do
+      S.validate(data, spec, S.jm(["errs", errs]))
+    rescue
+      e ->
+        # A spec this port cannot run at all (rather than a payload that fails
+        # it) must not take the operation down with it: report it like any
+        # other failure and let `mode` decide.
+        if S.size(errs) == 0 do
+          S.setprop(errs, S.size(errs), Exception.message(e))
+        end
+    end
+
+    n = S.size(errs)
+    msgs = if n == 0, do: [], else: Enum.map(0..(n - 1), fn i -> to_string(S.getelem(errs, i)) end)
+
+    cb = S.getprop(Feature.opts(f), "onInvalid")
+
+    if msgs != [] and is_function(cb, 1) do
+      # A callback receiving every failure, whatever `mode` does with it, so a
+      # client can log or count invalid payloads without changing what the SDK
+      # returns.
+      try do
+        cb.(
+          S.jm([
+            "entity",
+            entity_of(ctx),
+            "op",
+            opname_of(ctx),
+            "direction",
+            direction,
+            "errs",
+            errs,
+            "data",
+            data
+          ])
+        )
+      rescue
+        _e -> nil
+      end
+    end
+
+    msgs
+  end
+
+  # A RESULT RECORD AS DATA.
+  #
+  # make_result turns every record of a LIST into an entity instance, so what
+  # reaches PreDone for a list is wrappers, not records - and a wrapper checked
+  # against a field spec fails on every required field while its actual data
+  # goes unchecked. A load returns the record itself, so this handles both.
+  defp unwrap(record) do
+    if S.ismap(record) and S.getprop(record, "_module") != nil do
+      data = EntityBase.data_get(record)
+      if data != nil, do: data, else: record
+    else
+      record
+    end
+  end
+
+  # The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+  # error rather than a pass. Rebuilt rather than mutated: Schema.entityspec is
+  # a module attribute shared by every client in the process.
+  defp close_spec(node) do
+    cond do
+      S.islist(node) ->
+        n = S.size(node)
+
+        S.jt(
+          if n == 0,
+            do: [],
+            else: Enum.map(0..(n - 1), fn i -> close_spec(S.getelem(node, i)) end)
+        )
+
+      S.ismap(node) ->
+        out = S.jm([])
+
+        Enum.each(H.entries(node), fn {k, v} ->
+          if k != @open, do: S.setprop(out, k, close_spec(v))
+        end)
+
+        out
+
+      true ->
+        node
+    end
+  end
+end

package/project/.sdk/tm/elixir/lib/projectname/utility.ex

@@ -10,6 +10,12 @@ defmodule ProjectName.Utility do
   alias Voxgig.Struct, as: S
   alias ProjectName.Helpers, as: H
   alias ProjectName.{Context, Spec, Result, Response, Operation}
+  # prepare_auth IS GENERATED, not templated: where the credential goes
+  # (header | query | cookie, and under what name) is a fact about the API,
+  # which apidef resolves into main.kit.info.security and a template cannot
+  # express. It lives in ProjectName.PrepareAuth, emitted by
+  # src/cmp/elixir/PrepareAuth_elixir.ts into lib/<app>/prepare_auth.ex.
+  alias ProjectName.PrepareAuth
 
   @default_user_agent "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)"
 
@@ -41,7 +47,7 @@ defmodule ProjectName.Utility do
       {"make_spec", &make_spec_impl/1},
       {"make_url", &make_url_impl/1},
       {"param", &param_impl/2},
-      {"prepare_auth", &prepare_auth_impl/1},
+      {"prepare_auth", &PrepareAuth.prepare_auth_impl/1},
       {"prepare_body", &prepare_body_impl/1},
       {"prepare_headers", &prepare_headers_impl/1},
       {"prepare_method", &prepare_method_impl/1},
@@ -298,41 +304,16 @@ defmodule ProjectName.Utility do
     co = S.getprop(config, "options")
     cfgopts = if S.ismap(co), do: co, else: S.jm([])
 
-    optspec =
-      H.deep(%{
-        "apikey" => "",
-        "secret" => "",
-        "base" => "http://localhost:8000",
-        "prefix" => "",
-        "suffix" => "",
-        # `basic` and `secret`: HTTP Basic Auth needs a second credential and
-        # a flag to say the pair is Basic rather than a single bearer token.
-        "auth" => %{"prefix" => "", "basic" => false},
-        "headers" => %{"`$CHILD`" => "`$STRING`"},
-        "allow" => %{
-          "method" => "GET,PUT,POST,PATCH,DELETE,OPTIONS",
-          "op" => "create,update,load,list,remove,command,direct,graphql"
-        },
-        "entity" => %{"`$CHILD`" => %{"`$OPEN`" => true, "active" => false, "alias" => %{}}},
-        "feature" => %{"`$CHILD`" => %{"`$OPEN`" => true, "active" => false}},
-        "utility" => %{},
-        # Feature INSTANCES supplied at construction (the station adopt
-        # path): consumed by the constructor's extend loop, so they are
-        # struct feature nodes, not data - `$ANY` accepts them verbatim.
-        # Without this entry the seam is dead: the constructor reads
-        # options.extend, but validate rejected the key.
-        "extend" => "`$ANY`",
-        "system" => %{},
-        "test" => %{"active" => false, "entity" => %{"`$OPEN`" => true}},
-        "clean" => %{"keys" => "key,token,id"},
-        # Server-variable values for a templated base URL (OpenAPI server
-        # variables): {name} placeholders in "base" are substituted from this
-        # map at construction. Spec defaults arrive via the generated config;
-        # user values override them. Mirrors go's make_options optspec - elixir
-        # was the only target validating options that did not accept it, so a
-        # spec with a templated server URL failed validation outright.
-        "server" => %{"`$CHILD`" => ""}
-      })
+    # THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+    #
+    # `ProjectName.Schema.optspec/0` is built from the model:
+    # `main.kit.optspec` for the standard options, plus one entry per
+    # feature this target carries, taken from that feature's own
+    # `config.options` / `config.optspec`. Editing this file to add an
+    # option would put it back where it was — one of twenty hand-maintained
+    # copies of a schema nothing cross-checked — so add it to the model
+    # instead and every ported target validates it.
+    optspec = ProjectName.Schema.optspec()
 
     sys_fetch = S.getpath(opts0, "system.fetch")
 
@@ -1391,36 +1372,6 @@ defmodule ProjectName.Utility do
     end
   end
 
-  def prepare_auth_impl(ctx) do
-    spec = S.getprop(ctx, "spec")
-
-    if spec == nil do
-      {nil, Context.make_error(ctx, "auth_no_spec", "Expected context spec property to be defined.")}
-    else
-      headers = S.getprop(spec, "headers")
-      options = opts_map(S.getprop(ctx, "client"))
-
-      if S.getprop(options, "auth") == nil do
-        S.delprop(headers, "authorization")
-        {spec, nil}
-      else
-        apikey = S.getprop(options, "apikey", "__NOTFOUND__")
-
-        if (is_binary(apikey) and apikey == "__NOTFOUND__") or apikey == nil or apikey == "" do
-          S.delprop(headers, "authorization")
-        else
-          ap = S.getpath(options, "auth.prefix")
-          auth_prefix = if is_binary(ap), do: ap, else: ""
-          apikey_val = if is_binary(apikey), do: apikey, else: ""
-          hv = if auth_prefix != "", do: auth_prefix <> " " <> apikey_val, else: apikey_val
-          S.setprop(headers, "authorization", hv)
-        end
-
-        {spec, nil}
-      end
-    end
-  end
-
   # ---- result_* ------------------------------------------------------------
 
   def result_basic_impl(ctx) do

package/project/.sdk/tm/elixir/test/vendor/omni/json.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/json.ex)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (elixir/lib/json.ex)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # The omni JSON parser.
 #

package/project/.sdk/tm/elixir/test/vendor/omni/runner.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/runner.ex)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (elixir/lib/runner.ex)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni: the shared multi-language test runner (Elixir port).
 #

package/project/.sdk/tm/elixir/test/vendor/omni/util.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/util.ex)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (elixir/lib/util.ex)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni internal JSON utilities.
 #

package/project/.sdk/tm/go/feature/secrets/plugin/capability.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/capability.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/catalog.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/catalog.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/config.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/config.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/go/feature/secrets/plugin/depend.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/depend.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/env.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/env.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/export.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/export.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *
@@ -28,7 +28,7 @@ type Exported struct {
 }
 
 func ResolveExport(spec string, exported []Exported) (any, error) {
-	cut := strings.Index(spec, "/")
+	cut := strings.LastIndex(spec, "/")
 	if -1 == cut {
 		return nil, Fail("plugin_export_ambiguous", "export spec needs a key: "+spec,
 			map[string]any{"spec": spec})

package/project/.sdk/tm/go/feature/secrets/plugin/graph.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/graph.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *