@voxgig/sdkgen 4.19.1 → 4.21.0

package/project/.sdk/tm/ocaml/feature/secrets/plugins/minivault_stubs.c

@@ -0,0 +1,222 @@
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/plugins/minivault_stubs.c) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+/* The four primitives the mini vault is made of: AES-256-GCM,
+ * PBKDF2-HMAC-SHA256, HMAC-SHA256, and the entropy under them.
+ *
+ * THE SECOND FILE IN THIS PORT THAT NAMES OpenSSL, and the only other
+ * one. `tls_stubs.c` is the first, and its note says the exception the
+ * link is taken under covered TRANSPORT only. AGENTS.md now says
+ * cryptography, because a block cipher protecting secrets AT REST has
+ * properties no known-answer vector can check - a table-driven AES
+ * passes every vector in the world and still hands its key to anyone who
+ * can time a cache. The in-tree SHA-256 and HMAC in `crypto.ml` stay
+ * where they are, as the widened rule says outright: they work, a SigV4
+ * signature is a chain of them so one wrong bit fails the published
+ * vectors loudly, and rewriting them buys nothing.
+ *
+ * WHY C AT ALL. OCaml's distribution has no cryptographic digest but MD5
+ * and no cipher at all, and the no-new-package rule stands, so the
+ * primitives come from the library this port already links. `plugins/
+ * minivault.ml` is the whole OCaml side and holds every decision about
+ * the format; this file does the four calls and nothing else.
+ *
+ * Bytes travel as OCaml STRINGS, which are byte sequences and may hold
+ * NULs - so every length here comes from `caml_string_length` and never
+ * from `strlen`. A failure raises `Failure`, which the OCaml side turns
+ * into the library's own error.
+ */
+
+#include <caml/mlvalues.h>
+#include <caml/alloc.h>
+#include <caml/memory.h>
+#include <caml/fail.h>
+
+#include <string.h>
+
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/rand.h>
+
+#define SEK_MV_KEYLEN 32
+#define SEK_MV_IVLEN 12
+#define SEK_MV_TAGLEN 16
+
+/* Fresh entropy from the platform's CSPRNG. A nonce repeated under one
+ * AES-GCM key loses the confidentiality of both messages, so a failure
+ * here is raised rather than papered over. */
+CAMLprim value sekreto_mv_random(value vlen)
+{
+  CAMLparam1(vlen);
+  CAMLlocal1(out);
+
+  const int len = Int_val(vlen);
+
+  if (0 > len) {
+    caml_failwith("sekreto: minivault: a negative length");
+  }
+
+  out = caml_alloc_string((mlsize_t) len);
+
+  if (0 < len && 1 != RAND_bytes((unsigned char *) Bytes_val(out), len)) {
+    caml_failwith("sekreto: minivault: no randomness available");
+  }
+
+  CAMLreturn(out);
+}
+
+/* HMAC-SHA256 of `msg` under `key`. */
+CAMLprim value sekreto_mv_hmac(value vkey, value vmsg)
+{
+  CAMLparam2(vkey, vmsg);
+  CAMLlocal1(out);
+
+  unsigned char mac[EVP_MAX_MD_SIZE];
+  unsigned int len = 0;
+
+  if (NULL == HMAC(EVP_sha256(), String_val(vkey), (int) caml_string_length(vkey),
+                   (const unsigned char *) String_val(vmsg), caml_string_length(vmsg), mac,
+                   &len)) {
+    caml_failwith("sekreto: minivault: cannot compute a mac");
+  }
+
+  out = caml_alloc_initialized_string((mlsize_t) len, (const char *) mac);
+
+  CAMLreturn(out);
+}
+
+/* PBKDF2-HMAC-SHA256.
+ *
+ * A round count below one is refused here rather than passed on: it is
+ * what a damaged or hostile file records to make the derivation free, and
+ * OpenSSL would accept it. */
+CAMLprim value sekreto_mv_pbkdf2(value vpass, value vsalt, value viters, value vlen)
+{
+  CAMLparam4(vpass, vsalt, viters, vlen);
+  CAMLlocal1(out);
+
+  const int iters = Int_val(viters);
+  const int len = Int_val(vlen);
+
+  if (1 > iters) {
+    caml_failwith("sekreto: minivault: unusable round count");
+  }
+  if (0 >= len) {
+    caml_failwith("sekreto: minivault: a bad key length");
+  }
+
+  out = caml_alloc_string((mlsize_t) len);
+
+  if (1 != PKCS5_PBKDF2_HMAC(String_val(vpass), (int) caml_string_length(vpass),
+                             (const unsigned char *) String_val(vsalt),
+                             (int) caml_string_length(vsalt), iters, EVP_sha256(), len,
+                             (unsigned char *) Bytes_val(out))) {
+    caml_failwith("sekreto: minivault: cannot derive a key");
+  }
+
+  CAMLreturn(out);
+}
+
+/* AES-256-GCM, sealing. The answer is ciphertext followed by the 16-byte
+ * tag, which is where every other port's AEAD leaves it and therefore
+ * what the format records. */
+CAMLprim value sekreto_mv_seal(value vkey, value viv, value vplain, value vaad)
+{
+  CAMLparam4(vkey, viv, vplain, vaad);
+  CAMLlocal1(out);
+
+  EVP_CIPHER_CTX *ctx = NULL;
+  const size_t plainlen = caml_string_length(vplain);
+  unsigned char *raw = NULL;
+  int len = 0;
+  int ok = 0;
+
+  if (SEK_MV_KEYLEN != caml_string_length(vkey) || SEK_MV_IVLEN != caml_string_length(viv)) {
+    caml_failwith("sekreto: minivault: bad key");
+  }
+
+  out = caml_alloc_string((mlsize_t) (plainlen + SEK_MV_TAGLEN));
+  raw = (unsigned char *) Bytes_val(out);
+
+  ctx = EVP_CIPHER_CTX_new();
+  if (NULL == ctx) {
+    caml_failwith("sekreto: minivault: cannot seal");
+  }
+
+  ok = 1 == EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL) &&
+       1 == EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, SEK_MV_IVLEN, NULL) &&
+       1 == EVP_EncryptInit_ex(ctx, NULL, NULL, (const unsigned char *) String_val(vkey),
+                               (const unsigned char *) String_val(viv)) &&
+       1 == EVP_EncryptUpdate(ctx, NULL, &len, (const unsigned char *) String_val(vaad),
+                              (int) caml_string_length(vaad)) &&
+       1 == EVP_EncryptUpdate(ctx, raw, &len, (const unsigned char *) String_val(vplain),
+                              (int) plainlen) &&
+       1 == EVP_EncryptFinal_ex(ctx, raw + len, &len) &&
+       1 == EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, SEK_MV_TAGLEN, raw + plainlen);
+
+  EVP_CIPHER_CTX_free(ctx);
+
+  if (!ok) {
+    caml_failwith("sekreto: minivault: cannot seal");
+  }
+
+  CAMLreturn(out);
+}
+
+/* AES-256-GCM, opening.
+ *
+ * A tag that fails to verify raises, and the OCaml side turns that into
+ * the message the format's contract names. The tag is the only evidence
+ * there is, and it cannot tell a wrong passphrase from a damaged file. */
+CAMLprim value sekreto_mv_unseal(value vkey, value viv, value vblob, value vaad)
+{
+  CAMLparam4(vkey, viv, vblob, vaad);
+  CAMLlocal1(out);
+
+  EVP_CIPHER_CTX *ctx = NULL;
+  const size_t bloblen = caml_string_length(vblob);
+  const unsigned char *blob = (const unsigned char *) String_val(vblob);
+  size_t cut = 0;
+  unsigned char *raw = NULL;
+  int len = 0;
+  int ok = 0;
+
+  if (SEK_MV_KEYLEN != caml_string_length(vkey) || SEK_MV_IVLEN != caml_string_length(viv)) {
+    caml_failwith("sekreto: minivault: bad key");
+  }
+  if (SEK_MV_TAGLEN > bloblen) {
+    caml_failwith("sekreto: minivault: truncated");
+  }
+
+  cut = bloblen - SEK_MV_TAGLEN;
+  out = caml_alloc_string((mlsize_t) cut);
+  raw = (unsigned char *) Bytes_val(out);
+
+  /* Re-read after the allocation: caml_alloc_string may move the heap,
+   * and `blob` points into an OCaml string. */
+  blob = (const unsigned char *) String_val(vblob);
+
+  ctx = EVP_CIPHER_CTX_new();
+  if (NULL == ctx) {
+    caml_failwith("sekreto: minivault: cannot open");
+  }
+
+  ok = 1 == EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL) &&
+       1 == EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, SEK_MV_IVLEN, NULL) &&
+       1 == EVP_DecryptInit_ex(ctx, NULL, NULL, (const unsigned char *) String_val(vkey),
+                               (const unsigned char *) String_val(viv)) &&
+       1 == EVP_DecryptUpdate(ctx, NULL, &len, (const unsigned char *) String_val(vaad),
+                              (int) caml_string_length(vaad)) &&
+       1 == EVP_DecryptUpdate(ctx, raw, &len, blob, (int) cut) &&
+       1 == EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, SEK_MV_TAGLEN,
+                                (void *) (blob + cut)) &&
+       0 < EVP_DecryptFinal_ex(ctx, raw + len, &len);
+
+  EVP_CIPHER_CTX_free(ctx);
+
+  if (!ok) {
+    caml_failwith("sekreto: minivault: cannot open");
+  }
+
+  CAMLreturn(out);
+}

package/project/.sdk/tm/ocaml/feature/secrets/plugins/onepassword.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/onepassword.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/plugins/onepassword.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* The `onepassword` provider kind, as a voxgig/plugin definition.
 

package/project/.sdk/tm/ocaml/feature/secrets/plugins/runcmd.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/runcmd.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/plugins/runcmd.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* Running a store's own CLI, and collecting both its streams.
 

package/project/.sdk/tm/ocaml/feature/secrets/plugins/secretspec.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/secretspec.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/plugins/secretspec.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* The `secretspec` provider kind, as a voxgig/plugin definition.
 

package/project/.sdk/tm/ocaml/feature/secrets/plugins/sigv4.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/sigv4.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/plugins/sigv4.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* AWS Signature Version 4, hand-rolled.
 

package/project/.sdk/tm/ocaml/feature/secrets/plugins/tls.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/tls.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/plugins/tls.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* The OCaml side of the TLS binding.
 

package/project/.sdk/tm/ocaml/feature/secrets/plugins/tls_stubs.c

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/plugins/tls_stubs.c) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/plugins/tls_stubs.c) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 /* The TLS binding: OpenSSL, and nothing else from it.
  *

package/project/.sdk/tm/ocaml/feature/secrets/sekreto/json.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/src/json.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/src/json.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* Minimal JSON support for sekreto.
 

package/project/.sdk/tm/ocaml/feature/secrets/sekreto/provider.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/src/provider.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/src/provider.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* What a provider's declarative form looks like, how a provider kind
    becomes a voxgig/plugin definition - and the four BUILT-IN kinds.
@@ -122,6 +122,17 @@ type spec = {
   (* infisical: the environment slug and secret path. *)
   environment : string;
   secretpath : string;
+  (* minivault: the passphrase that unwraps `vaultkey`. *)
+  passphrase : string;
+  (* minivault: which key in the vault file to open with, defaulting to
+     `master`. Named apart from `keyid` because that already means an AWS
+     access key id. *)
+  vaultkey : string;
+  (* minivault: PBKDF2 rounds, used only when a key is created. Zero means
+     unset, so the library's own default still applies. *)
+  iterations : int;
+  (* minivault: make the vault file if it is not there. *)
+  create : bool;
 }
 
 let nospec =
@@ -160,6 +171,10 @@ let nospec =
     config = "";
     environment = "";
     secretpath = "";
+    passphrase = "";
+    vaultkey = "";
+    iterations = 0;
+    create = false;
   }
 
 (* Printed without its credentials. See authtostring: the obvious printer
@@ -504,6 +519,13 @@ let optionsof (spec : spec) : V.t =
   text "config" spec.config;
   text "environment" spec.environment;
   text "path" spec.secretpath;
+  text "passphrase" spec.passphrase;
+  text "vaultkey" spec.vaultkey;
+
+  (* Written only when set, like every string above: zero and false are
+     what "not configured" means for these two. *)
+  if 0 <> spec.iterations then V.set out "iterations" (V.vnum (float_of_int spec.iterations));
+  if spec.create then V.set out "create" (V.vbool true);
   out
 
 (* A non-string reads as the empty string, because "not configured" and
@@ -572,6 +594,14 @@ let specof (options : V.t) : spec =
     config = text "config";
     environment = text "environment";
     secretpath = text "path";
+    passphrase = text "passphrase";
+    vaultkey = text "vaultkey";
+    iterations =
+      (match V.get options "iterations" with
+      | held when V.is_num held -> int_of_float (V.as_num held)
+      | _ -> 0);
+    create =
+      (match V.get options "create" with held when V.is_bool held -> V.as_bool held | _ -> false);
   }
 
 (* A provider kind, as a voxgig/plugin definition.
@@ -644,4 +674,4 @@ let builtinkinds = [ "env"; "memory"; "dotenv"; "file" ]
 
 let pluginkinds =
   [ "hashicorp"; "boru"; "awssecrets"; "awsparams"; "gcpsecrets"; "azuresecrets"; "onepassword";
-    "doppler"; "infisical"; "secretspec" ]
+    "doppler"; "infisical"; "secretspec"; "minivault" ]

package/project/.sdk/tm/ocaml/feature/secrets/sekreto/secret.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/src/secret.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/src/secret.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* What a secret is called, what a provider is, and what sekreto refuses.
 

package/project/.sdk/tm/ocaml/feature/secrets/sekreto/sekreto.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ocaml/src/sekreto.ml) *)
-(* Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ocaml/src/sekreto.ml) *)
+(* Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* sekreto: one interface for secrets, wherever they live.
 
@@ -19,7 +19,8 @@
    its kind, `hashicorp$prod` otherwise - so `Sekreto.host` reads like the
    chain. Only four kinds are built in: `env`, `memory`, `dotenv` and
    `file`, the ones that read at most a local file. Every kind that opens a
-   socket, signs a request or spawns a process lives under `plugins/`, and
+   socket, signs a request, spawns a process or does cryptography lives
+   under `plugins/`, and
    a chain may name one only if the calling project handed it to
    `~plugins`. That is what keeps a chain of built-ins free of TLS, of AWS
    request signing and of seven HTTP vault clients.

package/project/.sdk/tm/ocaml/sdk_features.ml

@@ -377,6 +377,180 @@ let rbac_feature () : feature =
           else reject ctx req);
   f
 
+(* ------------------------------------------------------------------ *)
+(* validate (PreSpec / PreDone payload checks)                         *)
+(* ------------------------------------------------------------------ *)
+(* Payload validation against the model's own field types. The ocaml port
+ * of tm/ts/src/feature/validate/ValidateFeature.ts.
+ *
+ * The specs are NOT written here and not written in the model either: every
+ * entity field already carries a canonical type sentinel (`$STRING`,
+ * `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+ * vocabulary validate speaks. The generator maps them once
+ * (helpers/canonSpec) and emits Sdk_schema.entity_spec_value, so a field
+ * whose type changes in the API spec changes what this feature enforces with
+ * no edit anywhere.
+ *
+ * WHAT IS CHECKED
+ *   outbound (PreSpec)  the payload the caller asked to send, against
+ *                       spec.op[opname] - the operation's request shape.
+ *   inbound  (PreDone)  each record the operation returned, against
+ *                       spec.data - the entity's own field types.
+ *
+ * WHAT IS NOT. The model carries no array element types, no nested object
+ * schemas, no enums, formats or bounds, so this checks the shape the model
+ * knows and nothing more.
+ *
+ * Short-circuit mechanism: the failure error goes into ctx.c_out "spec" as
+ * an OErr, which make_spec_util already returns as the operation's error
+ * rather than using as a spec - the same seam rbac uses one stage earlier
+ * through "point". *)
+
+(* Built rather than written, so the backticks cannot be lost in an edit. *)
+let validate_open = String.make 1 (Char.chr 96) ^ "$OPEN" ^ String.make 1 (Char.chr 96)
+
+(* The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+ * error rather than a pass. Rebuilt rather than mutated: the schema module
+ * memoises one value every client in the process reads. *)
+let rec validate_close (node : value) : value =
+  match node with
+  | List r -> lst (List.map validate_close !r)
+  | Map m ->
+    let out = empty_map () in
+    List.iter (fun (k, v) ->
+        if k <> validate_open then ignore (setp out k (validate_close v))) m.entries;
+    out
+  | v -> v
+
+let validate_feature () : feature =
+  let options = ref (empty_map ()) in
+  let spec = ref (empty_map ()) in
+  let request = ref true in
+  let response = ref false in
+  let mode = ref "throw" in
+  let f = { f_name = "validate"; f_version = "0.0.1"; f_active = true; f_options = Noval;
+            f_init = (fun _ _ -> ()); f_hook = (fun _ _ -> ()) } in
+
+  let entname ctx =
+    match ctx.c_entity with
+    | Some e when e.e_name <> "" && e.e_name <> "_" -> e.e_name
+    | _ -> ctx.c_op.op_entity in
+
+  let entity_spec ctx = getp !spec (entname ctx) in
+
+  (* The payload an operation is about to send.
+   *
+   * TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+   * caller's argument in c_reqdata over the entity's c_data; a match op
+   * (load/list/remove) carries it in c_reqmatch over c_match. So reading
+   * c_reqdata for every op would check a load against the entity's STALE
+   * stored match and reject it for the id the caller had just supplied. *)
+  let payload ctx opname =
+    let body = opname = "create" || opname = "update" || opname = "patch" in
+    let base = if body then ctx.c_data else ctx.c_match in
+    let req = if body then ctx.c_reqdata else ctx.c_reqmatch in
+    let out = empty_map () in
+    List.iter (fun src ->
+        match src with
+        | Map m -> List.iter (fun (k, v) -> ignore (setp out k v)) m.entries
+        | _ -> ()) [base; req];
+    (* `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record,
+     * and under `strict` every custom-action call would be rejected for the
+     * one key that made it reachable. *)
+    ignore (delprop out (Str "$action"));
+    out in
+
+  (* One validate call. Errors are COLLECTED, never raised: validate raises on
+   * the first failure unless given an errs list, and a caller fixing a
+   * payload wants every problem with it, not the first one.
+   *
+   * NO `onInvalid` IN THIS PORT, and deliberately: the model types it a
+   * `$FUNCTION`, but `value`'s Func constructor holds an INJECTOR
+   * (inj -> value -> string -> value -> value), which is not a callback a
+   * report can be handed to. Every failure still reaches the caller through
+   * the operation's error; a port that grows a callback slot on the feature
+   * record can add it here. *)
+  let check ctx data sp =
+    ignore ctx;
+    let errs = empty_list () in
+    let idef = { (default_injdef ()) with d_errs = errs } in
+    (try ignore (validate ~inj:(IDef idef) data sp) with
+     | Struct_error m ->
+       (* A spec this port cannot run at all (rather than a payload that fails
+        * it) must not take the operation down with it: report it like any
+        * other failure and let `mode` decide. *)
+       if size errs = 0 then ignore (setprop errs (Num 0.) (Str m))
+     | _ -> if size errs = 0 then ignore (setprop errs (Num 0.) (Str "validate failed")));
+    (match errs with
+     | List r -> List.map (fun e -> match e with Str s -> s | v -> stringify v) !r
+     | _ -> []) in
+
+  f.f_init <- (fun _ctx opts ->
+      options := (match to_map opts with Map _ -> opts | _ -> empty_map ());
+      f.f_active <- opt_active opts;
+      (* DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+       * config.options documents them and types them; it does not inject
+       * them, because each feature entry in the spec is optional and struct
+       * fills in nothing through an optional union. *)
+      request := getp !options "request" <> Bool false;
+      response := getp !options "response" = Bool true;
+      (* FAIL CLOSED. Only the exact string "report" selects report mode, so a
+       * typo still rejects rather than silently turning enforcement off. *)
+      mode := (if opt_str !options "mode" ~default:"throw" = "report" then "report" else "throw");
+      (* `strict` is applied ONCE, here, rather than per call. *)
+      let entityspec = Sdk_schema.entity_spec_value () in
+      spec := (if getp !options "strict" = Bool true then validate_close entityspec
+               else entityspec));
+
+  f.f_hook <- (fun name ctx ->
+      if name = "PreSpec" && f.f_active && !request then begin
+        let opname = ctx.c_op.op_name in
+        let opspec = getp (getp (entity_spec ctx) "op") opname in
+        if not (is_nullish opspec) then begin
+          let errs = check ctx (payload ctx opname) opspec in
+          if errs <> [] && !mode <> "report" then
+            let err = ctx_make_error ctx "validate_failed"
+                ("Invalid " ^ opname ^ " request for entity \"" ^ entname ctx ^ "\": "
+                 ^ String.concat "; " errs) in
+            Hashtbl.replace ctx.c_out "spec" (OErr err)
+        end
+      end
+      else if name = "PreDone" && f.f_active && !response then begin
+        let dataspec = getp (entity_spec ctx) "data" in
+        match ctx.c_result with
+        | Some result when not (is_nullish dataspec) && not (is_nullish result.rt_resdata) ->
+          (* A list op returns many records and a load returns one; both are
+           * checked against the same record spec, because they are the same
+           * entity.
+           *
+           * NO UNWRAP STEP, unlike the ts and go ports: make_result_util
+           * already stores a list entry as the record itself rather than as
+           * the entity object. *)
+          let records = (match result.rt_resdata with
+              | List r -> !r
+              | v -> [v]) in
+          let errs = List.concat_map (fun record ->
+              (* A NON-OBJECT IS A FAILURE, not something to skip: a load that
+               * answered 42 where the entity's spec wants a record must not
+               * pass this feature silently. *)
+              if is_nullish record then [] else check ctx record dataspec)
+              records in
+          if errs <> [] && !mode <> "report" then begin
+            let err = ctx_make_error ctx "validate_failed"
+                ("Invalid response for entity \"" ^ entname ctx ^ "\": "
+                 ^ String.concat "; " errs) in
+            (* BOTH, and rt_ok is the load-bearing half: done returns
+             * rt_resdata whenever rt_ok is true and never looks at rt_err.
+             * AND THE DATA GOES: the load/update paths copy rt_resdata into
+             * the entity's own state BEFORE done raises. *)
+            result.rt_ok <- false;
+            result.rt_err <- Some err;
+            result.rt_resdata <- Noval
+          end
+        | _ -> ()
+      end);
+  f
+
 (* ------------------------------------------------------------------ *)
 (* metrics                                                             *)
 (* ------------------------------------------------------------------ *)

package/project/.sdk/tm/ocaml/sdk_helpers.ml

@@ -78,6 +78,21 @@ let cu (ctx : ctx) : utility =
 let cc (ctx : ctx) : sdk_client =
   match ctx.c_client with Some c -> c | None -> failwith "context client not set"
 
+(* ----- client options -----
+ * A CLONE of the client's options, so a utility that writes into the map it
+ * is handed cannot mutate the client's own (the secrets feature relies on
+ * that: it rewrites the credential in the fetchdef, never in the shared
+ * options).
+ *
+ * Lives HERE, beside the other client accessors, rather than in Sdk_runtime
+ * where it began: the generated sdk_prepare_auth.ml reads it and is compiled
+ * BEFORE Sdk_runtime (ocamlc compiles a module before anything that uses it
+ * and has no link-time reordering), so a definition in Sdk_runtime is out of
+ * reach. Sdk_runtime opens this module, so its own call sites are unchanged.
+ *)
+let client_options_map (client : sdk_client) : value =
+  match clone client.cl_options with Map _ as m -> m | _ -> empty_map ()
+
 (* ----- per-op feature scratch ----- *)
 
 let scratch_get (ctx : ctx) (key : string) : value option =