@voxgig/sdkgen 4.19.1 → 4.21.0

package/project/.sdk/tm/ocaml/sdk_runtime.ml

@@ -239,9 +239,6 @@ let make_context_impl (cs : ctxspec) (basectx : ctx option) : ctx =
 (* utilities                                                           *)
 (* ------------------------------------------------------------------ *)
 
-let client_options_map (client : sdk_client) : value =
-  match clone client.cl_options with Map _ as m -> m | _ -> empty_map ()
-
 let clean_util (_ctx : ctx) (v : value) : value = v
 
 let make_error_util (ctx : ctx) (err_opt : sdk_error option) : value =
@@ -537,26 +534,24 @@ let graphql_errors_util (ctx : ctx) : bool =
         true
       end
 
-let prepare_auth_util (ctx : ctx) : (spec option * sdk_error option) =
-  match ctx.c_spec with
-  | None -> (None, Some (ctx_make_error ctx "auth_no_spec" "Expected context spec property to be defined."))
-  | Some spec ->
-    let headers = spec.sp_headers in
-    let options = client_options_map (cc ctx) in
-    (match getp options "auth" with
-     | Noval | Null -> ignore (delprop headers (Str "authorization")); (Some spec, None)
-     | _ ->
-       let apikey = getprop ~alt:(Str "__NOTFOUND__") options (Str "apikey") in
-       let is_notfound = (match apikey with Str "__NOTFOUND__" -> true | _ -> false) in
-       if is_notfound || is_noval apikey || apikey = Str "" then
-         ignore (delprop headers (Str "authorization"))
-       else begin
-         let auth_prefix = match getpath_s options "auth.prefix" with Str s -> s | _ -> "" in
-         let apikey_val = match apikey with Str s -> s | _ -> "" in
-         let authval = if auth_prefix <> "" then auth_prefix ^ " " ^ apikey_val else apikey_val in
-         setp headers "authorization" (Str authval)
-       end;
-       (Some spec, None))
+(* prepare_auth lives in its own GENERATED module, Sdk_prepare_auth
+ * (src/cmp/ocaml/PrepareAuth_ocaml.ts), and this is the binding every caller
+ * still reaches it by.
+ *
+ * WHY IT LEFT THIS FILE. WHERE the credential goes - a header, a query
+ * parameter or a cookie, and under what name - is a fact about the API, which
+ * apidef resolves into main.kit.info.security. A template can hold only one
+ * answer, so this one hardcoded an `authorization` header and an
+ * apiKey-in-query API (joplin's `?token=`) got a header it does not read and
+ * never got the parameter it does. The three placements need three different
+ * bodies, so the body is generated and the name stays here.
+ *
+ * The alias is not cosmetic: `new_utility`/`register` below bind
+ * `u_prepare_auth` to this name, make_spec_util calls it through the utility
+ * record, the secrets feature re-runs it the same way, and
+ * test/primary_utility_test.ml reaches `prepare_auth_util` by `open
+ * Sdk_runtime` to drive the shared corpus section. All of that is unchanged. *)
+let prepare_auth_util = Sdk_prepare_auth.prepare_auth_util
 
 (* ----- transforms / result helpers ----- *)
 
@@ -934,31 +929,6 @@ let fetcher_util (ctx : ctx) (fullurl : string) (fetchdef : value) : (value * sd
 (* make_options                                                        *)
 (* ------------------------------------------------------------------ *)
 
-let opt_spec_value () : value =
-  jo [
-    ("apikey", Str "");
-    ("secret", Str "");
-    ("base", Str "http://localhost:8000");
-    ("prefix", Str "");
-    ("suffix", Str "");
-    (* `basic` and `secret`: HTTP Basic Auth needs a second credential and a
-       flag to say the pair is Basic rather than a single bearer token. *)
-    ("auth", jo [("prefix", Str ""); ("basic", Bool false)]);
-    ("headers", jo [("`$CHILD`", Str "`$STRING`")]);
-    ("allow", jo [("method", Str "GET,PUT,POST,PATCH,DELETE,OPTIONS");
-                  ("op", Str "create,update,load,list,remove,command,direct,graphql")]);
-    ("entity", jo [("`$CHILD`", jo [("`$OPEN`", Bool true); ("active", Bool false); ("alias", empty_map ())])]);
-    ("feature", jo [("`$CHILD`", jo [("`$OPEN`", Bool true); ("active", Bool false)])]);
-    ("utility", empty_map ());
-    ("system", empty_map ());
-    ("test", jo [("active", Bool false); ("entity", jo [("`$OPEN`", Bool true)])]);
-    ("clean", jo [("keys", Str "key,token,id")]);
-      (* Server-variable values for a templated base URL (OpenAPI server
-       * variables): {name} placeholders in "base" are substituted from this
-       * map at construction. Spec defaults arrive via the generated config;
-       * user values override them. Mirrors go's make_options optspec. *)
-      ("server", jo [("`$CHILD`", Str "")]);
-  ]
 
 let make_options_util (ctx : ctx) : value =
   let options = match ctx.c_options with Noval -> empty_map () | v -> v in
@@ -1003,7 +973,18 @@ let make_options_util (ctx : ctx) : value =
     | _ -> None in
   let config = match ctx.c_config with Map _ as m -> m | _ -> empty_map () in
   let cfgopts = match to_map (getp config "options") with Map _ as m -> m | _ -> empty_map () in
-  let optspec = opt_spec_value () in
+  (* THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+
+     Built from the model: main.kit.optspec for the standard options, plus one
+     entry per feature this target carries, from that feature's own
+     config.options / config.optspec. This file used to carry its own
+     opt_spec_value - one of twenty hand-maintained copies of a schema nothing
+     cross-checked - so add an option to the model instead and every ported
+     target validates it.
+
+     Parsed once and memoised by Sdk_schema: validate reads the spec and
+     writes into the options, never into the spec. *)
+  let optspec = Sdk_schema.opt_spec_value () in
   let sys_fetch = getpath_s opts "system.fetch" in
   let merged = merge (ja [empty_map (); cfgopts; opts]) in
   let validated = validate merged optspec in

package/project/.sdk/tm/ocaml/test/feature/secrets/t_secrets.ml

@@ -12,8 +12,11 @@
  *   - the client is LIVE (Sdk_client.make), so `options.system.fetch` really
  *     is the transport and the feature's wrapper sits above it - never the
  *     test-mode mock, which replaces the fetcher and hides the seam;
- *   - every assertion reads the authorization header the RECORDER received,
- *     never the options map, which this feature never writes;
+ *   - every assertion reads what the RECORDER received, never the options
+ *     map, which this feature never writes. The FEATURE writes the
+ *     authorization header (see the header-only note on placed_cred_of
+ *     below), so its cases read that; the three cases where the feature is
+ *     inactive or missed read whatever the generated prepare_auth placed;
  *   - a refusal must carry the PROVIDER'S OWN message (sekreto's wording),
  *     not any error;
  *   - beside every refusal is a CONTROL leg: the same construction with a
@@ -87,7 +90,94 @@ let api_calls (r : recorder) : value list =
 let token_calls (r : recorder) : value list =
   List.filter (fun c -> is_token (match getp c "url" with Str u -> u | _ -> "")) !(r.calls)
 
-(* The authorization header the i-th API call carried, or Noval. *)
+(* WHERE prepare_auth PUT THE CREDENTIAL, asked of the generated module
+ * rather than assumed to be a header.
+ *
+ * prepare_auth is GENERATED (Sdk_prepare_auth) from the API's own security
+ * scheme, so it is not always a header: an apiKey-in-query API - joplin's
+ * `?token=` - carries the credential in the URL, and a cookie scheme in the
+ * shared `cookie` header. Reading `authorization` outright made
+ * `inactive.apikey_option_behaves_as_before` a HEADER assertion, so it
+ * failed on a query-placement SDK that was carrying its credential
+ * perfectly well.
+ *
+ * KNOWN GAP, DELIBERATELY NOT PAPERED OVER HERE: the FEATURE'S own rewrite
+ * (secrets_feature.ml) still writes `authorization` whatever the scheme
+ * says, so a chain-resolved secret does NOT follow the placement. Every
+ * target's secrets feature does the same. The cases below that exercise the
+ * feature therefore keep reading the header - which is what the code
+ * actually does - and only the three cases where the feature is inactive or
+ * missed read the placed bag. Making the feature placement-aware is a
+ * separate change, across every target at once. *)
+
+(* Percent-decoding, because make_url escapes a query value on the way in.
+ * `+` is NOT treated as a space: that is form encoding, and a literal `+`
+ * in a token must survive. *)
+let pct_decode (s : string) : string =
+  let hex c =
+    if c >= '0' && c <= '9' then Char.code c - 48
+    else if c >= 'a' && c <= 'f' then Char.code c - 87
+    else if c >= 'A' && c <= 'F' then Char.code c - 55
+    else (-1) in
+  let n = String.length s in
+  let buf = Buffer.create n in
+  let i = ref 0 in
+  while !i < n do
+    if s.[!i] = '%' && !i + 2 < n && hex s.[!i + 1] >= 0 && hex s.[!i + 2] >= 0 then begin
+      Buffer.add_char buf (Char.chr ((hex s.[!i + 1] * 16) + hex s.[!i + 2]));
+      i := !i + 3
+    end
+    else (Buffer.add_char buf s.[!i]; incr i)
+  done;
+  Buffer.contents buf
+
+(* The first `name=` value in a `sep`-separated list, trimmed and optionally
+ * percent-decoded. Noval when the list has no such entry. *)
+let pair_value ?(decode = false) (raw : string) (sep : char) (name : string) : value =
+  let want = name ^ "=" in
+  let wl = String.length want in
+  let trim s =
+    let n = String.length s in
+    let b = ref 0 and e = ref n in
+    while !b < !e && s.[!b] = ' ' do incr b done;
+    while !e > !b && s.[!e - 1] = ' ' do decr e done;
+    String.sub s !b (!e - !b) in
+  let rec go = function
+    | [] -> Noval
+    | part :: rest ->
+      let part = trim part in
+      if String.length part >= wl && String.sub part 0 wl = want then
+        let v = String.sub part wl (String.length part - wl) in
+        Str (if decode then pct_decode v else v)
+      else go rest in
+  go (String.split_on_char sep raw)
+
+(* The credential one recorded fetchdef carried, read from the bag this
+ * SDK's generated prepare_auth places it in. *)
+let placed_cred_of (fd : value) : value =
+  let headers = getp fd "headers" in
+  if Sdk_prepare_auth.cred_where = "query" then
+    let url = match getp fd "url" with Str u -> u | _ -> "" in
+    (match String.index_opt url '?' with
+     | None -> Noval
+     | Some at ->
+       pair_value ~decode:true
+         (String.sub url (at + 1) (String.length url - at - 1)) '&'
+         Sdk_prepare_auth.cred_name)
+  else if Sdk_prepare_auth.cred_where = "cookie" then
+    (match headers with
+     | Map _ ->
+       (match Sdk_features.header_ci headers "cookie" with
+        | Str raw -> pair_value raw ';' Sdk_prepare_auth.cred_name
+        | _ -> Noval)
+     | _ -> Noval)
+  else
+    (match headers with
+     | Map _ -> Sdk_features.header_ci headers Sdk_prepare_auth.cred_name
+     | _ -> Noval)
+
+(* The AUTHORIZATION HEADER the i-th API call carried, or Noval - what the
+ * feature's own rewrite writes (see the note above). *)
 let auth_of (r : recorder) (i : int) : value =
   match List.nth_opt (api_calls r) i with
   | Some c -> (match getp (getp c "fetchdef") "headers" with
@@ -95,9 +185,18 @@ let auth_of (r : recorder) (i : int) : value =
       | _ -> Noval)
   | None -> Noval
 
-(* The Authorization header carries the SPEC's credential prefix, which a
- * TEMPLATE cannot know - so assert on the CREDENTIAL and let the prefix be
- * whatever this SDK's API declares. *)
+(* The same call read through the SCHEME'S placement, for the cases where no
+ * chain resolved anything and prepare_auth's own placement is what reached
+ * the wire. *)
+let placed_of (r : recorder) (i : int) : value =
+  match List.nth_opt (api_calls r) i with
+  | Some c -> placed_cred_of (getp c "fetchdef")
+  | None -> Noval
+
+(* A header credential carries the SPEC's prefix, which a TEMPLATE cannot
+ * know - so assert on the CREDENTIAL and let the prefix be whatever this
+ * SDK's API declares. A query parameter and a cookie carry no prefix at all,
+ * which the bare equality already covers. *)
 let credential_is (header : value) (token : string) : bool =
   match header with
   | Str s -> s = token || Sdk_features.ends_with s (" " ^ token)
@@ -105,6 +204,14 @@ let credential_is (header : value) (token : string) : bool =
 
 let absent (header : value) : bool = is_nullish header
 
+(* SUPPRESSION IS ABOUT EVERY BAG, not just the header. `auth: null` must
+ * leave nothing anywhere, so a suppression case asserts the authorization
+ * header AND the bag this API's scheme places its credential in - otherwise
+ * a query-placement SDK could leak `?token=...` and still read green,
+ * because the header it never uses was empty. *)
+let nothing_placed (r : recorder) (i : int) : bool =
+  absent (auth_of r i) && absent (placed_of r i)
+
 (* ---------------------------------------------------------------------- *)
 (* clients and paths                                                      *)
 (* ---------------------------------------------------------------------- *)
@@ -217,13 +324,17 @@ let () =
       let client = inactive ~sdkopts:[("apikey", Str "OPTKEY01")] fetch in
       check "ok" (res_ok (direct client));
       check_int "one call" (List.length (api_calls r)) 1;
-      check "carries OPTKEY01" (credential_is (auth_of r 0) "OPTKEY01"));
+      (* THE FEATURE IS INACTIVE HERE, so what reaches the wire is exactly
+         what the generated prepare_auth placed - in the bag this API's
+         scheme names, which for an apiKey-in-query SDK is the query string
+         and not a header. *)
+      check "carries OPTKEY01" (credential_is (placed_of r 0) "OPTKEY01"));
 
   test "inactive.no_apikey_no_header" (fun () ->
       let (r, fetch) = recorder () in
       let client = inactive fetch in
       check "ok" (res_ok (direct client));
-      check "no header" (absent (auth_of r 0)));
+      check "no header" (absent (placed_of r 0)));
 
   (* ---------------------------------------------------------------------- *)
   (* the chain                                                              *)
@@ -276,7 +387,9 @@ let () =
       let client = live fetch [("providers", ja [fn])] in
       check "ok" (res_ok (direct client));
       check_int "one call" (List.length (api_calls r)) 1;
-      check "no header" (absent (auth_of r 0));
+      (* NOTHING resolved, so the feature wrote nothing and the placed bag -
+         whichever this API's scheme names - is what must be empty. *)
+      check "no header" (absent (placed_of r 0));
       check_int "the chain was asked" !asked 1);
 
   test "chain.miss_falls_through_to_the_next_provider" (fun () ->
@@ -451,7 +564,7 @@ let () =
           [("providers", ja [jo [("kind", Str "env"); ("prefix", Str envprefix)]])] in
       check "ok" (res_ok (direct client));
       check_int "one call" (List.length (api_calls r)) 1;
-      check "no header, though the chain resolved" (absent (auth_of r 0));
+      check "nothing placed, though the chain resolved" (nothing_placed r 0);
       (* The suppression survives option validation as a present null. *)
       check "options.auth survives as a present null"
         (getprop_raw client.cl_options "auth" = Null));
@@ -461,7 +574,7 @@ let () =
       let client = live ~sdkopts:[("auth", Null); ("apikey", Str "OPTKEY01")] fetch
           [("providers", ja [working "CUSTOM01"])] in
       check "ok" (res_ok (direct client));
-      check "no header" (absent (auth_of r 0)));
+      check "nothing placed" (nothing_placed r 0));
 
   test "auth.null_suppresses_on_the_entity_path" (fun () ->
       let (r, fetch) = recorder () in
@@ -470,7 +583,7 @@ let () =
        | Ok () -> ()
        | Error msg -> failwith ("entity op failed: " ^ msg));
       check_int "reached the transport once" (List.length (api_calls r)) 1;
-      check "no header" (absent (auth_of r 0)));
+      check "nothing placed" (nothing_placed r 0));
 
   test "entity.carries_the_chain_resolved_credential" (fun () ->
       let (r, fetch) = recorder () in

package/project/.sdk/tm/ocaml/test/t_pipeline.ml

@@ -308,13 +308,71 @@ let () =
       ignore (u.u_fetcher ctx "http://h/a" (jo [("method", Str "GET"); ("headers", empty_map ())]));
       check "order" (!order = ["second"; "first"; "server"]));
 
+  (* prepare_auth IS GENERATED (Sdk_prepare_auth), so these four cases ask
+   * the generated module where this SDK puts its credential instead of
+   * assuming a header. They used to read `spec.headers["authorization"]`
+   * outright, which made them pass only for a header scheme and FAIL on
+   * every apiKey-in-query SDK - joplin's `?token=` - i.e. on exactly the
+   * SDKs the model-driven placement exists to make work. The assertions
+   * still drive the real u_prepare_auth end to end and check the bag, the
+   * key and the value it actually wrote; only the expectation is read from
+   * the SDK's own declared contract rather than hardcoded. *)
+  let auth_bag (ctx : ctx) : value =
+    let sp = match ctx.c_spec with Some s -> s | None -> assert false in
+    if Sdk_prepare_auth.cred_where = "query" then sp.sp_query else sp.sp_headers in
+
+  (* A cookie rides the shared `cookie` header, so the KEY is that header and
+   * the VALUE is a `name=value` pair. A header and a query parameter are
+   * keyed by the credential name itself. *)
+  let auth_key =
+    if Sdk_prepare_auth.cred_where = "cookie" then "cookie"
+    else Sdk_prepare_auth.cred_name in
+
+  (* A header carries the auth.prefix, space-joined when it is non-empty. A
+   * query parameter and a cookie do NOT: `?token=Bearer%20abc` is not a
+   * thing any API reads. *)
+  let auth_placed (prefix : string) (cred : string) : string =
+    if Sdk_prepare_auth.cred_where = "query" then cred
+    else if Sdk_prepare_auth.cred_where = "cookie" then
+      Sdk_prepare_auth.cred_name ^ "=" ^ cred
+    else if prefix <> "" then prefix ^ " " ^ cred
+    else cred in
+
+  (* An SDK built with main.kit.config.auth.active: false places nothing at
+   * all, by design, so the two placement cases assert the absence instead. *)
+  let check_placed (label : string) (ctx : ctx) (prefix : string) (cred : string) =
+    if Sdk_prepare_auth.cred_active then
+      check_vstr label (getp (auth_bag ctx) auth_key) (auth_placed prefix cred)
+    else
+      check (label ^ ": auth off, nothing placed")
+        (is_noval (getp (auth_bag ctx) auth_key)) in
+
+  (* The stale credential a clearing case must remove, written the way
+   * prepare_auth would have written it - a bare value for a header or a
+   * query parameter, a `name=value` pair for a cookie, since cookie_set
+   * splices OUR pair out and leaves every other cookie alone. *)
+  let stale_spec () : spec =
+    let placed = Str (auth_placed "" "stale") in
+    if Sdk_prepare_auth.cred_where = "query" then
+      new_spec (jo [("headers", empty_map ()); ("query", jo [(auth_key, placed)])])
+    else
+      new_spec (jo [("headers", jo [(auth_key, placed)])]) in
+
+  (* With auth switched off nothing is removed either: the function is a
+   * no-op by design, so a stale value is expected to survive. *)
+  let check_cleared (label : string) (ctx : ctx) =
+    let got = getp (auth_bag ctx) auth_key in
+    if Sdk_prepare_auth.cred_active then check label (is_noval got)
+    else check (label ^ ": auth off, nothing touched")
+        (got = Str (auth_placed "" "stale")) in
+
   test "prepare_auth.apikey_prefix_space_joined" (fun () ->
       let cl = client () in
       let ctx = mk_ctx cl "load" in
       cl.cl_options <- jo [("apikey", Str "K"); ("auth", jo [("prefix", Str "Bearer")])];
       ctx.c_spec <- Some (new_spec (jo [("headers", empty_map ())]));
       ignore (cl.cl_utility.u_prepare_auth ctx);
-      check_vstr "auth" (getp (match ctx.c_spec with Some s -> s.sp_headers | None -> Noval) "authorization") "Bearer K");
+      check_placed "auth" ctx "Bearer" "K");
 
   test "prepare_auth.raw_apikey" (fun () ->
       let cl = client () in
@@ -322,23 +380,23 @@ let () =
       cl.cl_options <- jo [("apikey", Str "K"); ("auth", jo [("prefix", Str "")])];
       ctx.c_spec <- Some (new_spec (jo [("headers", empty_map ())]));
       ignore (cl.cl_utility.u_prepare_auth ctx);
-      check_vstr "auth" (getp (match ctx.c_spec with Some s -> s.sp_headers | None -> Noval) "authorization") "K");
+      check_placed "auth" ctx "" "K");
 
   test "prepare_auth.empty_apikey_drops_header" (fun () ->
       let cl = client () in
       let ctx = mk_ctx cl "load" in
       cl.cl_options <- jo [("apikey", Str ""); ("auth", jo [("prefix", Str "Bearer")])];
-      ctx.c_spec <- Some (new_spec (jo [("headers", jo [("authorization", Str "stale")])]));
+      ctx.c_spec <- Some (stale_spec ());
       ignore (cl.cl_utility.u_prepare_auth ctx);
-      check "dropped" (is_noval (getp (match ctx.c_spec with Some s -> s.sp_headers | None -> Noval) "authorization")));
+      check_cleared "dropped" ctx);
 
   test "prepare_auth.no_auth_block_drops_header" (fun () ->
       let cl = client () in
       let ctx = mk_ctx cl "load" in
       cl.cl_options <- jo [("apikey", Str "K")];
-      ctx.c_spec <- Some (new_spec (jo [("headers", jo [("authorization", Str "stale")])]));
+      ctx.c_spec <- Some (stale_spec ());
       ignore (cl.cl_utility.u_prepare_auth ctx);
-      check "dropped" (is_noval (getp (match ctx.c_spec with Some s -> s.sp_headers | None -> Noval) "authorization")));
+      check_cleared "dropped" ctx);
 
   test "result_headers.no_headers_empty_map" (fun () ->
       let cl = client () in

package/project/.sdk/tm/ocaml/test/vendor/omni/omni.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/omni sdk-20260908-1556-0 (ocaml/src/omni.ml) *)
-(* Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/omni sdk-20260917-1242-0 (ocaml/src/omni.ml) *)
+(* Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* Omni: the shared multi-language test runner (OCaml port).
 

package/project/.sdk/tm/perl/core/helpers.pm

@@ -96,26 +96,74 @@ sub sleep_ms {
   Time::HiRes::sleep($ms / 1000.0) if defined $ms && $ms > 0;
 }
 
-# Perl cannot distinguish plain 1/0 from JSON booleans; normalize the known
-# boolean option slots ("active") so option validation sees real booleans.
+# The alternatives a `$ONE` union offers, or the spec itself when it is not
+# one. Every FEATURE option in the generated spec is wrapped
+# `['`$ONE`', <type>, '`$NIL`']` (an option a caller may omit), so a walker
+# that does not unwrap it sees no types at all.
+sub _spec_alts {
+  my ($spec) = @_;
+  if (Voxgig::Struct::islist($spec) && @$spec
+      && defined $spec->[0] && !ref $spec->[0] && '`$ONE`' eq $spec->[0]) {
+    return [ @{$spec}[1 .. $#$spec] ];
+  }
+  return [ $spec ];
+}
+
+# Does this spec slot accept a boolean? Either by example (the slot holds a
+# real JSON boolean, as `main.kit.optspec` writes `auth.basic: false`) or by
+# sentinel (`$BOOLEAN`, which is what a feature option's default widens to).
+sub _spec_takes_bool {
+  my ($spec) = @_;
+  for my $alt (@{ _spec_alts($spec) }) {
+    next unless defined $alt;
+    return 1 if ref($alt) eq 'Voxgig::Struct::Bool';
+    return 1 if !ref($alt) && '`$BOOLEAN`' eq $alt;
+  }
+  return 0;
+}
+
+# PERL HAS NO NATIVE BOOLEAN, so a caller writes `cache => 0` and
+# `active => 1` - which is what every shipped test and every perl author
+# writes. The vendored struct carries real JTRUE/JFALSE singletons and
+# `$BOOLEAN` matches only those, so a plain scalar at a boolean slot is a
+# validation ERROR rather than a false. Normalize before validate.
+#
+# SPEC-DRIVEN, not a list of known key names. This used to coerce any key
+# literally named `active`, at any depth, which covered the standard options
+# and nothing else - the shipped spec typed no feature option at all. The
+# generated option spec types every one of them (secrets' `cache`, netsim's
+# `offline`, ...), and a hand-kept name list would have to grow with every
+# feature anyone ever adds. The spec already says which slots are boolean, so
+# read it: one rule, one place, and a feature added tomorrow is covered.
+#
+# A slot the spec does not describe is left ALONE. `$OPEN` specs pass unknown
+# keys through untouched, and guessing at a value the spec says nothing about
+# is how a string "0" would silently become a false.
 sub coerce_bools {
-  my ($v) = @_;
-  if (Voxgig::Struct::ismap($v)) {
-    for my $k (keys %$v) {
-      if ('active' eq $k) {
-        my $b = $v->{$k};
-        if (defined $b && !ref $b) {
-          $v->{$k} = Voxgig::Struct::jbool($b ? 1 : 0);
-        }
-      }
-      else {
-        coerce_bools($v->{$k});
-      }
+  my ($v, $spec) = @_;
+  return $v unless defined $spec;
+
+  if (_spec_takes_bool($spec)) {
+    if (defined $v && !ref $v) {
+      return Voxgig::Struct::jbool($v ? 1 : 0);
     }
+    return $v;
   }
-  elsif (Voxgig::Struct::islist($v)) {
-    coerce_bools($_) for @$v;
+
+  return $v unless Voxgig::Struct::ismap($v);
+
+  # The map alternative of the slot's spec, if it offers one. `$CHILD` is the
+  # spec for any key the map does not name.
+  my ($mapspec) = grep { Voxgig::Struct::ismap($_) } @{ _spec_alts($spec) };
+  return $v unless defined $mapspec;
+
+  my $child = $mapspec->{'`$CHILD`'};
+  for my $k (keys %$v) {
+    my $sub = exists $mapspec->{$k} ? $mapspec->{$k} : $child;
+    next unless defined $sub;
+    $v->{$k} = coerce_bools($v->{$k}, $sub);
   }
+
   return $v;
 }
 

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Capability.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Capability.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Capability.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Capability;
 

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Catalog.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Catalog.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Catalog.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Catalog;
 

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Config.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Config.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Config.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Config;
 

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Depend.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Depend.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Depend.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Depend;
 

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Env.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Env.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Env.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Env;
 

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Export.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Export.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Export.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Export;
 
@@ -25,7 +25,7 @@ our @EXPORT_OK = qw(resolve_export);
 
 sub resolve_export {
     my ($spec, $exported) = @_;
-    my $cut = index($spec, '/');
+    my $cut = rindex($spec, '/');
     fail_with('plugin_export_ambiguous', "export spec needs a key: $spec",
               { spec => $spec })
         if $cut < 0;

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Graph.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Graph.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Graph.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Graph;
 

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Host.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Host.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Host.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Host;
 
@@ -159,6 +159,23 @@ our @EXPORT_OK = qw(make_host);
         return;
     }
 
+    # WHICH provider this instance is bound to for $name (11.1), as a
+    # ref, or undef when nothing provides it.
+    #
+    # The host's own `capability` answers with the live providers
+    # RANKED, not with the one THIS instance took; 11.4's reluctant
+    # rebinding makes those differ. A REF, not the instance: every port
+    # can return a string and a corpus entry can assert on one. The
+    # selection is REMEMBERED, because this is the instance asking.
+    sub capability {
+        my ($self, $name) = @_;
+        for my $req (@{ Voxgig::Plugin::Depend::requirements($self->{entry}{options}) }) {
+            return $self->{host}->chosen($self->{entry}, $req, 1)
+                if ($req->{name} // '') eq $name;
+        }
+        return undef;
+    }
+
     # What this instance can do for others (section 11.1).
     sub provides {
         my ($self, $prov) = @_;

package/project/.sdk/tm/perl/feature/secrets/plugin/Voxgig/Plugin/Order.pm

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (perl/lib/Voxgig/Plugin/Order.pm)
-# Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/plugin sdk-20260917-1242-0 (perl/lib/Voxgig/Plugin/Order.pm)
+# Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package Voxgig::Plugin::Order;