@voxgig/sdkgen 4.19.1 → 4.21.0

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Version.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Version.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Version.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Versions and ranges (section 11.2).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Aws.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Aws.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `awssecrets` and `awsparams` provider kinds: AWS Secrets Manager and
 // SSM Parameter Store.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Azuresecrets.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Azuresecrets.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Azuresecrets.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `azuresecrets` provider kind: Azure Key Vault.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Boru.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Boru.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Boru.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `boru` provider kind: a boru vault, through its CLI or its wire
 // protocol.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Crypto.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Crypto.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Crypto.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // SHA-256 and HMAC-SHA256, hand-rolled.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Doppler.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Doppler.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Doppler.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `doppler` provider kind: Doppler.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Gcpsecrets.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Gcpsecrets.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Gcpsecrets.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `gcpsecrets` provider kind: GCP Secret Manager.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Hashicorp.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Hashicorp.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Hashicorp.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `hashicorp` provider kind: HashiCorp Vault over its HTTP API.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Httpjson.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Httpjson.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Httpjson.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The shared HTTP-JSON round-trip, and the small helpers every remote
 // store needs.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Infisical.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Infisical.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Infisical.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `infisical` provider kind: Infisical.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Onepassword.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Onepassword.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Onepassword.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `onepassword` provider kind: 1Password Connect.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Proc.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Proc.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Proc.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Running a child process, for the two provider kinds that read a vault
 // through its own CLI.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Secretspec.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Secretspec.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Secretspec.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `secretspec` provider kind: SecretSpec, through its CLI.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Sigv4.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Sigv4.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Sigv4.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Addr.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Addr.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Addr.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Refusing to send a secret-bearing credential in the clear.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Json.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Json.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Json.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON support for sekreto.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Provider.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Provider.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Provider.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // A source of secrets.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Providers.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Providers.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Providers.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, how a provider
 // kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Sekreto.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Sekreto.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Sekreto.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/Make.swift

@@ -131,9 +131,15 @@ func makePointUtil(_ ctx: Context) throws -> VMap? {
 }
 
 func makeSpecUtil(_ ctx: Context) throws -> Spec {
-  if let cached = ctx.out["spec"] as? Spec {
-    ctx.spec = cached
-    return cached
+  if let stored = ctx.out["spec"], let sp = stored {
+    // A PreSpec feature hook (e.g. validate) may short-circuit the operation
+    // by storing an error here; surface it before the request is built, the
+    // same way makePointUtil surfaces out["point"].
+    if let err = sp as? Error { throw err }
+    if let cached = sp as? Spec {
+      ctx.spec = cached
+      return cached
+    }
   }
 
   let options = ctx.options

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/MakeOptions.swift

@@ -3,65 +3,6 @@
 
 import Foundation
 
-private func buildOptSpec() -> Value {
-  let authPrefix = VMap()
-  authPrefix.entries["prefix"] = .string("")
-
-  let headers = VMap()
-  headers.entries["`$CHILD`"] = .string("`$STRING`")
-
-  let allow = VMap()
-  allow.entries["method"] = .string("GET,PUT,POST,PATCH,DELETE,OPTIONS")
-  allow.entries["op"] = .string("create,update,load,list,remove,command,direct,graphql")
-
-  let entityChild = VMap()
-  entityChild.entries["`$OPEN`"] = .bool(true)
-  entityChild.entries["active"] = .bool(false)
-  entityChild.entries["alias"] = .map(VMap())
-  let entity = VMap()
-  entity.entries["`$CHILD`"] = .map(entityChild)
-
-  let featureChild = VMap()
-  featureChild.entries["`$OPEN`"] = .bool(true)
-  featureChild.entries["active"] = .bool(false)
-  let feature = VMap()
-  feature.entries["`$CHILD`"] = .map(featureChild)
-
-  let testEntity = VMap()
-  testEntity.entries["`$OPEN`"] = .bool(true)
-  let test = VMap()
-  test.entries["active"] = .bool(false)
-  test.entries["entity"] = .map(testEntity)
-
-  let clean = VMap()
-  clean.entries["keys"] = .string("key,token,id")
-
-  let spec = VMap()
-  spec.entries["apikey"] = .string("")
-  spec.entries["base"] = .string("http://localhost:8000")
-  spec.entries["prefix"] = .string("")
-  spec.entries["suffix"] = .string("")
-  spec.entries["auth"] = .map(authPrefix)
-  spec.entries["headers"] = .map(headers)
-  spec.entries["allow"] = .map(allow)
-  spec.entries["entity"] = .map(entity)
-  spec.entries["feature"] = .map(feature)
-  spec.entries["utility"] = .map(VMap())
-  // `extend` is the runtime feature-injection seam: a list of feature
-  // objects the constructor adds after the model-activated ones. Without
-  // this entry the seam is dead: the constructor reads options.extend, but
-  // validate rejected the key, so a caller could not hand in a feature the
-  // model did not activate, although the README documents the option - and
-  // every test that adopts a feature through it passed VACUOUSLY. Ported
-  // from MakeOptionsUtility.ts / make_options.go / MakeOptions.cs, which all
-  // carry it.
-  spec.entries["extend"] = .string("`$ANY`")
-  spec.entries["system"] = .map(VMap())
-  spec.entries["test"] = .map(test)
-  spec.entries["clean"] = .map(clean)
-
-  return .map(spec)
-}
 
 func makeOptionsUtil(_ ctx: Context) -> VMap {
   let options = ctx.options ?? VMap()
@@ -135,7 +76,18 @@ func makeOptionsUtil(_ ctx: Context) -> VMap {
   let config = ctx.config ?? VMap()
   let cfgopts = gp(config, "options").asMap ?? VMap()
 
-  let optspec = buildOptSpec()
+  // THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+  //
+  // Built from the model: `main.kit.optspec` for the standard options, plus
+  // one entry per feature this target carries, from that feature's own
+  // `config.options` / `config.optspec`. Editing this file to add an option
+  // would put it back where it was - one of twenty hand-maintained copies of
+  // a schema nothing cross-checked - so add it to the model instead and every
+  // ported target validates it.
+  //
+  // Already parsed, and shared: makeOptions validates AGAINST the spec and
+  // writes into the options, never into the spec.
+  let optspec = SdkSchema.optspec
 
   // Preserve system.fetch across merge/validate (closures survive Clone, but
   // validation reshapes the system block).

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/Prepare.swift

@@ -1,5 +1,6 @@
 // ProjectName SDK utility: request preparation steps (method, path, params,
-// query, headers, body, auth) plus param resolution.
+// query, headers, body) plus param resolution. The auth step is GENERATED
+// into utility/PrepareAuth.swift - see the note below.
 
 import Foundation
 
@@ -89,44 +90,25 @@ func prepareBodyUtil(_ ctx: Context) -> Value {
   return .noval
 }
 
-private let headerAuth = "authorization"
-private let optionApikey = "apikey"
-private let notFound = "__NOTFOUND__"
-
-func prepareAuthUtil(_ ctx: Context) throws -> Spec {
-  guard let spec = ctx.spec else {
-    throw ctx.makeError("auth_no_spec", "Expected context spec property to be defined.")
-  }
-
-  let headers = spec.headers
-  let options = ctx.client!.optionsMap()
-
-  // Public APIs that need no auth omit the options.auth block entirely.
-  let auth = getprop(.map(options), .string("auth"))
-  if isNil(auth) {
-    headers.entries.removeValue(forKey: headerAuth)
-    return spec
-  }
-
-  let apikey = getprop(.map(options), .string(optionApikey), .string(notFound))
-
-  var skip = isNil(apikey)
-  if let apikeyStr = apikey.asString, apikeyStr == notFound || apikeyStr == "" {
-    skip = true
-  }
-
-  if skip {
-    headers.entries.removeValue(forKey: headerAuth)
-  } else {
-    var authPrefix = ""
-    if let ap = gpath(options, "auth", "prefix").asString { authPrefix = ap }
-    let apikeyVal = apikey.asString ?? ""
-    // Empty prefix (raw apiKey credential) must not add a leading space.
-    headers.entries[headerAuth] = .string(authPrefix == "" ? apikeyVal : authPrefix + " " + apikeyVal)
-  }
-
-  return spec
-}
+// prepareAuth IS NOT HERE. It was, and it hardcoded
+//
+//   private let headerAuth = "authorization"
+//
+// WHERE THE CREDENTIAL GOES IS A FACT ABOUT THE API - header, query or
+// cookie, and under what name - and apidef resolves it into
+// main.kit.info.security. A template can only hold one answer, so an
+// apiKey-in-query API (joplin's `?token=`) got an Authorization header it
+// does not read and never got the query parameter it does.
+//
+// So `prepareAuthUtil` is GENERATED, into utility/PrepareAuth.swift beside
+// this file, by cmp/swift/PrepareAuth_swift.ts. Same module, same internal
+// symbol, so utility/Register.swift still binds it with
+// `u.prepareAuth = prepareAuthUtil` and nothing else moved. Declaring it
+// here as well would be an "invalid redeclaration" that fails the whole
+// SwiftPM target.
+//
+// The seven functions above and paramUtil below do not depend on the model,
+// so they stay templated.
 
 func paramUtil(_ ctx: Context, _ paramdef: Value) -> Value {
   let point = ctx.point

package/project/.sdk/tm/swift/Tests/ProjectNameSDKTests/PrimaryUtilityTest.swift

@@ -289,12 +289,12 @@ final class PrimaryUtilityTest: XCTestCase {
   // THE `extend` SEAM IS REAL. options.extend is the runtime
   // feature-injection seam the README documents, and the constructor reads
   // it - but only after makeOptions' validate, which used to REJECT the key
-  // because buildOptSpec never named it. The seam was dead: a caller could
+  // because the option spec never named it. The seam was dead: a caller could
   // not hand in a feature the model did not activate, and every suite that
   // adopts a feature through `extend` passed VACUOUSLY on a client that
   // never held it. Pinned here, in the ungated suite, so the seam is proven
-  // whatever features a project selects. Delete the `extend` optspec entry
-  // and this goes red.
+  // whatever features a project selects. Delete `extend` from
+  // `main.kit.optspec` and this goes red.
   func testExtendOptionInstallsAndInitialisesTheFeature() {
     var initCalled = false
     let feature = TestInitFeature()

package/project/.sdk/tm/swift/Tests/vendor/omni/Json.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (swift/Sources/Omni/Json.swift)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Json.swift)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The omni JSON value model, with a small in-tree parser.
 //

package/project/.sdk/tm/swift/Tests/vendor/omni/Runner.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (swift/Sources/Omni/Runner.swift)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Runner.swift)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (Swift port).
 //

package/project/.sdk/tm/swift/Tests/vendor/omni/Util.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (swift/Sources/Omni/Util.swift)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Util.swift)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Capability.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Capability.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Catalog.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Catalog.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Config.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Config.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Depend.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Depend.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Env.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Env.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Export.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Export.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *
@@ -19,7 +19,18 @@ import { parseref, canonref } from './Ref'
 export type Exported = { ref: string, key: string, value: any }
 
 export function resolveexport(spec: string, exported: Exported[]): any {
-  const cut = spec.indexOf('/')
+  // THE LAST SLASH, not the first. §4's `checkname` permits `/` in a
+  // NAME — `@acme/store` is legal, and `resolvecandidates` has a branch
+  // for resolving a scoped name verbatim — so splitting at the first one
+  // read `@acme/store/client` as the ref `@acme` with the key
+  // `store/client`, which matches nothing. A scoped definition had no
+  // spelling for its exports at all, and said so by answering absent.
+  //
+  // The cost is that an export KEY may not contain `/`. Nothing declares
+  // one, no port shipped one, and the two cannot both be reachable with
+  // one separator: a name may hold slashes because §4 says so, a key
+  // holds them because nobody stopped it.
+  const cut = spec.lastIndexOf('/')
   if (-1 === cut) {
     fail('plugin_export_ambiguous', 'export spec needs a key: ' + spec, { spec })
   }

package/project/.sdk/tm/ts/src/feature/secrets/plugin/FeatureHost.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/FeatureHost.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The sdkgen bridge (§17.2, P3 item 2).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Graph.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Graph.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Host.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Host.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The host: the lifecycle state machine (§5), extension points (§6),
  * and resource capture (§8).
@@ -267,6 +267,32 @@ export function makehost(options?: HostOptions) {
       /** Published for other plugins and for the application (§11). */
       export: (key: string, value: any) => { e.exports[key] = value },
 
+      /** WHICH provider this instance is bound to for `name` (§11.1),
+       * as a ref, or undefined when nothing provides it.
+       *
+       * §11.1 says "the first is bound, and `inst.capability(name)`
+       * returns it", and §11.3 gives the case that needs it: a plugin
+       * that works without metrics and uses metrics when it is there
+       * has to be able to ask. Every port had `host.capability(name)`,
+       * which answers with the live providers RANKED — not with the one
+       * THIS instance actually took. §11.4's reluctant rebinding makes
+       * those differ: a better-ranked newcomer tops the ranking while
+       * the consumer keeps what it had.
+       *
+       * A REF, not the instance. `host.capability` answers in refs,
+       * every port can return a string, and a corpus entry can assert
+       * on one — an instance api is shaped differently in each and
+       * cannot be asserted at all.
+       *
+       * The selection is REMEMBERED, because this is the instance
+       * asking. `chosen(..., false)` is for questions asked ABOUT an
+       * instance, where answering must not create a binding. */
+      capability: (name: string): string | undefined => {
+        const req = requirements(e.options).find((r) => r.name === name)
+        if (undefined === req) return undefined
+        return chosen(e, req, true)
+      },
+
       /** What this instance can do for others (§11.1). */
       provides: (p: Provided) => { e.provides.push(p) },
 

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Order.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Order.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Ordering (§7) — one rule, one place.
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Point.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Point.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Extension points (§6). Three kinds, chosen because they are what the
  * two existing systems actually needed, and no more.

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Ref.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Ref.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag, written `name$tag` (§4).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Resolve.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Resolve.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dynamic resolution (§10.2) — name to candidate module ids.
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Types.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Types.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Shared types. Deliberately small: the design's §19 budget says the
  * library owns naming, configuration, lifecycle, ordering, binding and

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Version.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Version.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Versions and ranges (§11.2).
  *

package/project/.sdk/tm/ts/src/feature/secrets/plugin/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The canonical surface `make parity` checks (AGENTS.md §4). Small on
  * purpose (§19): everything else is methods on the host and instance

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sekreto.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/Sekreto.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //