@voxgig/sdkgen 4.19.1 → 4.21.0

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/onepassword.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/onepassword.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/secretspec.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/secretspec.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/plugins/sigv4.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/plugins/sigv4.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/addr.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/addr.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/builtin.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/builtin.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 
@@ -33,5 +33,6 @@ export const KINDS = {
   plugin: [
     'hashicorp', 'boru', 'awssecrets', 'awsparams', 'gcpsecrets',
     'azuresecrets', 'onepassword', 'doppler', 'infisical', 'secretspec',
+    'minivault',
   ],
 }

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/dotenv.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/dotenv.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/env.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/env.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/file.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/file.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/memory.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/memory.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/support.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/support.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, and how a
 // provider kind becomes a voxgig/plugin definition.
@@ -161,6 +161,16 @@ export type ProviderSpec = {
   /** infisical: the environment slug and secret path. */
   environment?: string
   path?: string
+  /** minivault: the passphrase that unwraps `vaultkey`. */
+  passphrase?: string
+  /** minivault: which key in the vault file to open with, defaulting to
+   * `master`. Named apart from `key` and `keyid` because those already
+   * mean a secret name and an AWS access key id. */
+  vaultkey?: string
+  /** minivault: PBKDF2 rounds, used only when a key is created. */
+  iterations?: number
+  /** minivault: make the vault file if it is not there. */
+  create?: boolean
 }
 
 // --- providers as voxgig/plugin definitions --------------------------

package/project/.sdk/tm/ts/src/utility/StructUtility.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.3.4 (typescript/src/StructUtility.ts)
-// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
 

package/project/.sdk/tm/ts/test/vendor/omni/Runner.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Runner.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/ts/test/vendor/omni/Util.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Util.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/ts/test/vendor/omni/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/omni - shared multi-language test runner.
 

package/project/.sdk/tm/zig/core/utility.zig

@@ -19,6 +19,9 @@ const result_mod = @import("result.zig");
 const operation_mod = @import("operation.zig");
 const jsonparse = @import("../utility/jsonparse.zig");
 const sdk = @import("sdk.zig");
+// The GENERATED option spec make_options validates against. A leaf module
+// (it imports only helpers and jsonparse), so this closes no cycle.
+const schema = @import("schema.zig");
 
 const Value = h.Value;
 const Context = ctxmod.Context;
@@ -367,39 +370,18 @@ pub fn make_options_util(ctx: *Context) Value {
         else => h.omap(),
     };
 
-    const optspec = h.jo(&.{
-        .{ "apikey", h.vstr("") },
-        .{ "base", h.vstr("http://localhost:8000") },
-        .{ "prefix", h.vstr("") },
-        .{ "suffix", h.vstr("") },
-        .{ "auth", h.jo(&.{ .{ "prefix", h.vstr("") }, .{ "basic", h.vbool(false) } }) },
-        .{ "headers", h.jo(&.{.{ "`$CHILD`", h.vstr("`$STRING`") }}) },
-        .{ "allow", h.jo(&.{
-            .{ "method", h.vstr("GET,PUT,POST,PATCH,DELETE,OPTIONS") },
-            .{ "op", h.vstr("create,update,load,list,remove,command,direct,graphql") },
-        }) },
-        .{ "entity", h.jo(&.{.{ "`$CHILD`", h.jo(&.{
-            .{ "`$OPEN`", h.vbool(true) },
-            .{ "active", h.vbool(false) },
-            .{ "alias", h.omap() },
-        }) }}) },
-        .{ "feature", h.jo(&.{.{ "`$CHILD`", h.jo(&.{
-            .{ "`$OPEN`", h.vbool(true) },
-            .{ "active", h.vbool(false) },
-        }) }}) },
-        .{ "utility", h.omap() },
-        .{ "system", h.omap() },
-        .{ "test", h.jo(&.{
-            .{ "active", h.vbool(false) },
-            .{ "entity", h.jo(&.{.{ "`$OPEN`", h.vbool(true) }}) },
-        }) },
-        .{ "clean", h.jo(&.{.{ "keys", h.vstr("key,token,id") }}) },
-        // Server-variable values for a templated base URL (OpenAPI server
-        // variables): {name} placeholders in "base" are substituted from this
-        // map at construction. Spec defaults arrive via the generated config;
-        // user values override them. Mirrors go's make_options optspec.
-        .{ "server", h.jo(&.{.{ "`$CHILD`", h.vstr("") }}) },
-    });
+    // THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+    //
+    // Built from the model: `main.kit.optspec` for the standard options, plus
+    // one entry per feature this target carries, from that feature's own
+    // `config.options` / `config.optspec`. Editing this file to add an option
+    // would put it back where it was - one of twenty hand-maintained copies of
+    // a schema nothing cross-checked - so add it to the model instead and
+    // every ported target validates it.
+    //
+    // Parsed once and shared: make_options validates AGAINST the spec and
+    // writes into the options, never into the spec.
+    const optspec = schema.shared_optspec();
 
     // Preserve system.fetch before merge/validate (validation strips it).
     const sys_fetch = h.getpath(&.{ "system", "fetch" }, opts);
@@ -700,6 +682,11 @@ pub fn make_point_util(ctx: *Context) E!Value {
 pub fn make_spec_util(ctx: *Context) E!*Spec {
     if (ctx.out_get("spec")) |ov| {
         switch (ov) {
+            // A PreSpec feature hook (e.g. validate) may short-circuit the
+            // operation by storing an error here; surface it before the
+            // request is built, the same way make_point surfaces
+            // out["point"].
+            .err => |e| return ctx.fail_err(e),
             .spec => |sp| {
                 ctx.spec = sp;
                 return sp;
@@ -1308,50 +1295,31 @@ pub fn graphql_errors_util(ctx: *Context) bool {
     return true;
 }
 
-const HEADER_AUTH = "authorization";
-const OPTION_APIKEY = "apikey";
-const NOT_FOUND = "__NOTFOUND__";
-
-pub fn prepare_auth_util(ctx: *Context) E!*Spec {
-    const spec = ctx.spec orelse return ctx.fail("auth_no_spec", "Expected context spec property to be defined.");
-
-    const headers = spec.headers;
-    const options: Value = if (ctx.client) |client| client.options_map() else ctx.options;
-
-    const auth = h.getp(options, "auth");
-    if (h.is_noval(auth)) {
-        h.del_prop(headers, h.vstr(HEADER_AUTH));
-        return spec;
-    }
-
-    const apikey = vs.getprop(h.A(), options, h.vstr(OPTION_APIKEY), h.vstr(NOT_FOUND)) catch h.vstr(NOT_FOUND);
-
-    const skip = switch (apikey) {
-        .null => true,
-        .string => |s| std.mem.eql(u8, s, NOT_FOUND) or s.len == 0,
-        else => false,
-    };
-
-    if (skip) {
-        h.del_prop(headers, h.vstr(HEADER_AUTH));
-    } else {
-        const auth_prefix: []const u8 = switch (h.getpath(&.{ "auth", "prefix" }, options)) {
-            .string => |s| s,
-            else => "",
-        };
-        const apikey_val: []const u8 = switch (apikey) {
-            .string => |s| s,
-            else => "",
-        };
-        if (auth_prefix.len == 0) {
-            h.setp(headers, HEADER_AUTH, h.vstr(apikey_val));
-        } else {
-            h.setp(headers, HEADER_AUTH, h.vstr(fmt("{s} {s}", .{ auth_prefix, apikey_val })));
-        }
-    }
-
-    return spec;
-}
+// prepare_auth IS GENERATED (src/cmp/zig/PrepareAuth_zig.ts), not templated.
+//
+// WHERE THE CREDENTIAL GOES IS A FACT ABOUT THE API. apidef resolves the
+// security scheme's `in` and `name` into main.kit.info.security - joplin's
+// says `in: "query", name: "token"` - and this file could hold only one
+// answer, which was `const HEADER_AUTH = "authorization"`. So an
+// apiKey-in-query API was sent a header it does not read and never sent the
+// query parameter it does. Header, query and cookie need three different
+// bodies; a component emits the one this API uses and nothing else.
+//
+// RE-EXPORTED, NOT REWIRED. Every caller keeps naming the same symbol:
+// `Utility.prepare_auth` above, `make_spec_util`'s unqualified
+// `try prepare_auth_util(ctx)`, and `sdk.utilmod.prepare_auth_util` - the
+// path root.zig publishes and test/primary_utility_test.zig drives the
+// shared corpus's `prepareAuth` section through. A file-scope const bound to
+// the generated function is the whole of the binding change.
+pub const prepare_auth_util = @import("prepare_auth.zig").prepare_auth_util;
+
+// The two comptime FACTS the generated file decided: where this SDK puts its
+// credential ("header" | "query" | "cookie" | "none"), and whether the scheme
+// is genuine HTTP Basic. Re-exported on the same path as the function, so
+// test/pipeline_test.zig can reach both as `sdk.utilmod.<name>` and skip the
+// header-shape cases on an SDK that has no header credential to assert on.
+pub const prepare_auth_placement = @import("prepare_auth.zig").PLACEMENT;
+pub const prepare_auth_basic = @import("prepare_auth.zig").BASIC;
 
 pub fn result_basic_util(ctx: *Context) ?*SdkResult {
     const response = ctx.response;

package/project/.sdk/tm/zig/feature/secrets/plugin/capability.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/capability.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/capability.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Capabilities (§11.1).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/catalog.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/catalog.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/catalog.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The definition catalog (§10.1).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/config.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/config.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/config.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The declarative document (§9): normalization, and the ten-level
 //! precedence ladder.

package/project/.sdk/tm/zig/feature/secrets/plugin/depend.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/depend.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/depend.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dependency cardinality, policy, and the restart graph (§11.3).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/env.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/env.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/env.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Environment overrides (§9.5) — level 7 of the ladder.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/export.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/export.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/export.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Exports (§11).
 //!
@@ -24,7 +24,7 @@ fn lessStr(_: void, a: []const u8, b: []const u8) bool {
 /// rather than a null Value.
 pub fn resolveexport(spec: ?*v.Value, exported: ?*v.Value) t.Err!?*v.Value {
     const s = if (v.isStr(spec)) v.asStr(spec) else "";
-    const cut = std.mem.indexOfScalar(u8, s, '/') orelse
+    const cut = std.mem.lastIndexOfScalar(u8, s, '/') orelse
         return t.fail("plugin_export_ambiguous", v.print("export spec needs a key: {s}", .{s}), t.details1("spec", v.vstr(s)));
     const head = s[0..cut];
     const key = s[cut + 1 ..];

package/project/.sdk/tm/zig/feature/secrets/plugin/graph.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/graph.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/graph.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Whole-graph resolution (§11.4) — a phase, not a discovery.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/host.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/host.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/host.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The host: the lifecycle state machine (§5), extension points (§6),
 //! and resource capture (§8).
@@ -424,6 +424,22 @@ fn chosen(h: *Host, e: *Inst, req: ?*v.Value, remember: bool) ?[]const u8 {
     return first;
 }
 
+/// WHICH provider this instance is bound to for `name` (§11.1), as a
+/// ref, or null when nothing provides it.
+///
+/// The host's own `capability` answers with the live providers RANKED,
+/// not with the one THIS instance took; §11.4's reluctant rebinding
+/// makes those differ. A REF, not the instance. The selection is
+/// REMEMBERED, because this is the instance asking.
+pub fn instcapability(e: *Inst, name: []const u8) ?[]const u8 {
+    for (v.items(dep.requirements(e.options))) |r| {
+        const rn = v.get(r, "name");
+        if (!v.isStr(rn) or !std.mem.eql(u8, v.asStr(rn), name)) continue;
+        return chosen(e.owner, e, r, true);
+    }
+    return null;
+}
+
 /// The instance currently SELECTED for each of this one's
 /// restart-causing requirements. A BINDING IS TO AN INSTANCE, not to a
 /// capability (§11.1): the selected one going away restarts a `static`

package/project/.sdk/tm/zig/feature/secrets/plugin/inst.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/inst.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/inst.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The instance and host records.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/order.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/order.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/order.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Ordering (§7) — one rule, one place.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/plugin.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/plugin.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/plugin.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! THE ROOT A CONSUMER IMPORTS.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/point.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/point.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/point.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Extension points (§6). Three kinds, chosen because they are what the
 //! two existing systems actually needed, and no more.

package/project/.sdk/tm/zig/feature/secrets/plugin/ref.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/ref.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/ref.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Identity: name+tag, written `name$tag` (§4).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/resolve.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/resolve.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/resolve.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dynamic resolution (§10.2) — name to candidate module ids.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/types.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/types.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/types.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Errors, and the raise mechanism (§12).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/value.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/value.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/value.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The dynamic value, and the JSON reader that fills it (§16).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/version.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/version.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/version.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Versions and ranges (§11.2).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugins/aws.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/aws.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/aws.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! AWS Secrets Manager and SSM Parameter Store - one sekreto plugin,
 //! two kinds: `awssecrets` and `awsparams`.

package/project/.sdk/tm/zig/feature/secrets/plugins/azuresecrets.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/azuresecrets.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/azuresecrets.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Azure Key Vault - a sekreto plugin. Needs HTTPS.
 

package/project/.sdk/tm/zig/feature/secrets/plugins/boru.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/boru.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/boru.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! A boru vault (https://github.com/boru-lang/boru) - a sekreto plugin.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugins/doppler.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/doppler.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/doppler.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Doppler - a sekreto plugin. Needs HTTPS.
 

package/project/.sdk/tm/zig/feature/secrets/plugins/gcpsecrets.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/gcpsecrets.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/gcpsecrets.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! GCP Secret Manager - a sekreto plugin. Needs HTTPS.
 

package/project/.sdk/tm/zig/feature/secrets/plugins/hashicorp.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/hashicorp.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/hashicorp.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! HashiCorp Vault - a sekreto plugin.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugins/httpjson.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/httpjson.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/httpjson.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! One JSON round-trip, for the plugins that talk to a vault over HTTP -
 //! and the small helpers every plugin shares: address trimming, the

package/project/.sdk/tm/zig/feature/secrets/plugins/infisical.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/infisical.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/infisical.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Infisical - a sekreto plugin. Needs HTTPS.