@voxgig/sdkgen 4.19.1 → 4.21.0

package/project/.sdk/tm/zig/feature/secrets/plugins/onepassword.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/onepassword.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/onepassword.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! 1Password, through a Connect server - a sekreto plugin. Needs HTTPS.
 

package/project/.sdk/tm/zig/feature/secrets/plugins/secretspec.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/secretspec.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/secretspec.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! SecretSpec (https://secretspec.dev) - a sekreto plugin.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugins/sigv4.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/sigv4.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/sigv4.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! AWS Signature Version 4, hand-rolled.
 //!

package/project/.sdk/tm/zig/feature/secrets/sekreto/addr.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/addr.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/addr.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The address check every network provider makes before it sends a
 //! credential anywhere.

package/project/.sdk/tm/zig/feature/secrets/sekreto/builtins.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/builtins.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/builtins.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! THE BUILT-IN PROVIDER KINDS - the same four in every port.
 //!
@@ -255,5 +255,6 @@ pub const KINDS = struct {
     pub const plugin = [_][]const u8{
         "hashicorp",    "boru",        "awssecrets", "awsparams", "gcpsecrets",
         "azuresecrets", "onepassword", "doppler",    "infisical", "secretspec",
+        "minivault",
     };
 };

package/project/.sdk/tm/zig/feature/secrets/sekreto/provider.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/provider.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/provider.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! What a provider is, what its declarative form looks like, and how a
 //! provider kind becomes a voxgig/plugin definition.
@@ -160,6 +160,17 @@ pub const ProviderSpec = struct {
     /// infisical: the environment slug and secret path.
     environment: []const u8 = "",
     path: []const u8 = "",
+    /// minivault: the passphrase that unwraps `vaultkey`.
+    passphrase: []const u8 = "",
+    /// minivault: which key in the vault file to open with, defaulting to
+    /// `master`. Named apart from `keyid` because that already means an
+    /// AWS access key id.
+    vaultkey: []const u8 = "",
+    /// minivault: PBKDF2 rounds, used only when a key is created. Zero
+    /// means unset.
+    iterations: i64 = 0,
+    /// minivault: make the vault file if it is not there.
+    create: bool = false,
 };
 
 // ---- the provider ----------------------------------------------------
@@ -292,6 +303,10 @@ pub fn optionsof(spec: ProviderSpec) *pv.Value {
                 setstr(m, "secretid", auth.secretid);
                 pv.set(out, f.name, m);
             }
+        } else if (bool == f.type) {
+            if (value) {
+                pv.set(out, f.name, pv.vbool(true));
+            }
         } else if ([]const KeyValue == f.type) {
             if (0 != value.len) {
                 const m = pv.vmap();
@@ -336,6 +351,8 @@ pub fn specof(options: ?*const pv.Value) ProviderSpec {
                     .secretid = pv.asStr(pv.get(given, "secretid")),
                 };
             }
+        } else if (bool == f.type) {
+            @field(spec, f.name) = pv.isBool(given) and pv.asBool(given);
         } else if ([]const KeyValue == f.type) {
             if (pv.isMap(given)) {
                 const keys = pv.keys(given);

package/project/.sdk/tm/zig/feature/secrets/sekreto/sekreto.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/sekreto.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/sekreto.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! sekreto: one interface for secrets, wherever they live.
 //!

package/project/.sdk/tm/zig/feature/validate.zig

@@ -0,0 +1,293 @@
+// Payload validation against the model's own field types (mirrors rust
+// feature/validate.rs and tm/ts/src/feature/validate/ValidateFeature.ts).
+//
+// The specs are NOT written here and not written in the model either: every
+// entity field already carries a canonical type sentinel (`$STRING`,
+// `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+// vocabulary vs.validate speaks. The generator maps them once
+// (helpers/canonSpec) and emits `core/schema.zig`, so a field whose type
+// changes in the API spec changes what this feature enforces with no edit
+// anywhere.
+//
+// WHAT IS CHECKED
+//   outbound (PreSpec)  the payload the caller asked to send, against
+//                       spec.op[opname] — the operation's request shape.
+//   inbound  (PreDone)  each record the operation returned, against
+//                       spec.data — the entity's own field types.
+//
+// WHAT IS NOT. The model carries no array element types, no nested object
+// schemas, no enums, formats or bounds, so this checks the shape the model
+// knows and nothing more.
+
+const std = @import("std");
+const h = @import("../core/helpers.zig");
+const types = @import("../core/types.zig");
+const schema = @import("../core/schema.zig");
+const sup = @import("support.zig");
+const vs = @import("voxgig-struct");
+
+const Value = h.Value;
+const Context = types.Context;
+const Feature = types.Feature;
+const OutVal = types.OutVal;
+
+// Built rather than written, so the backticks cannot be lost in an edit.
+const OPEN = [_]u8{96} ++ "$OPEN" ++ [_]u8{96};
+
+fn fmt(comptime f: []const u8, args: anytype) []const u8 {
+    return std.fmt.allocPrint(h.A(), f, args) catch "validate";
+}
+
+// The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+// error rather than a pass. Rebuilt rather than mutated: shared_entityspec()
+// hands out a process-lifetime singleton every client reads.
+fn close_spec(node: Value) Value {
+    switch (node) {
+        .array => |l| {
+            const out = h.olist();
+            for (l.data.items) |item| out.array.append(close_spec(item)) catch {};
+            return out;
+        },
+        .object => |m| {
+            const out = h.omap();
+            var it = m.iterator();
+            while (it.next()) |e| {
+                if (std.mem.eql(u8, e.key_ptr.*, OPEN)) continue;
+                h.setp(out, e.key_ptr.*, close_spec(e.value_ptr.*));
+            }
+            return out;
+        },
+        else => return node,
+    }
+}
+
+pub const ValidateFeature = struct {
+    name: []const u8 = "validate",
+    active: bool = true,
+    add_opts: Value = .{ .null = {} },
+    options: Value = .{ .null = {} },
+    spec: Value = .{ .null = {} },
+
+    request: bool = true,
+    response: bool = false,
+    mode: []const u8 = "throw",
+
+    pub fn make() Feature {
+        const self = h.A().create(ValidateFeature) catch unreachable;
+        self.* = .{};
+        return .{ .ptr = @ptrCast(self), .vtable = &vtable };
+    }
+
+    fn self_of(p: *anyopaque) *ValidateFeature {
+        return @ptrCast(@alignCast(p));
+    }
+
+    fn entname(ctx: *Context) []const u8 {
+        if (ctx.entity) |e| {
+            const n = e.get_name();
+            if (n.len != 0) return n;
+        }
+        return ctx.op.entity;
+    }
+
+    fn entity_spec(self: *ValidateFeature, ctx: *Context) Value {
+        return h.getp(self.spec, entname(ctx));
+    }
+
+    // The payload an operation is about to send.
+    //
+    // TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+    // caller's argument in `reqdata` over the entity's `data`; a match op
+    // (load/list/remove) carries it in `reqmatch` over `mtch`. That is what
+    // the entity operations pass to the context and what make_point reads — so
+    // reading `reqdata` for every op would check a `load({id})` against the
+    // entity's STALE stored match and reject it for the id the caller had just
+    // supplied.
+    fn payload(ctx: *Context, opname: []const u8) Value {
+        const body = std.mem.eql(u8, opname, "create") or
+            std.mem.eql(u8, opname, "update") or
+            std.mem.eql(u8, opname, "patch");
+
+        const base = if (body) ctx.data else ctx.mtch;
+        const req = if (body) ctx.reqdata else ctx.reqmatch;
+
+        const out = h.omap();
+        for ([_]Value{ base, req }) |src| {
+            if (src != .object) continue;
+            var it = src.object.iterator();
+            while (it.next()) |e| h.setp(out, e.key_ptr.*, e.value_ptr.*);
+        }
+
+        // `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the
+        // record. make_point reads it off this same argument and the request
+        // transformer drops it before the body is built, so a spec built from
+        // the API's own fields will never name it — and under `strict` every
+        // custom-action call would be rejected for the one key that made it
+        // reachable.
+        _ = out.object.fetchOrderedRemove("$action");
+
+        return out;
+    }
+
+    // One validate call. THE JOINED MESSAGE, not a list: this port's
+    // vs.validate returns a single `err` string with the collected failures
+    // already joined by " | ", rather than filling an errs array the way the
+    // ts, go and JVM ports do. Nothing is lost — every failure is still in it
+    // — so the feature reports the one string.
+    fn check(self: *ValidateFeature, ctx: *Context, data: Value, spec: Value) ?[]const u8 {
+        _ = self;
+        _ = ctx;
+        const res = vs.validate(h.A(), data, spec) catch |e| {
+            // A spec this port cannot run at all (rather than a payload that
+            // fails it) must not take the operation down with it: report it
+            // like any other failure and let `mode` decide.
+            return fmt("{s}", .{@errorName(e)});
+        };
+        return res.err;
+    }
+
+    // Outbound. make_spec surfaces an `.err` left in out["spec"] before the
+    // request is built — the same seam rbac uses one stage earlier through
+    // out["point"].
+    fn pre_spec(self: *ValidateFeature, ctx: *Context) void {
+        if (!self.active or !self.request) return;
+
+        const opname = ctx.op.name;
+        const opspec = h.getp(h.getp(self.entity_spec(ctx), "op"), opname);
+        if (opspec == .null) return;
+
+        const errs = self.check(ctx, payload(ctx, opname), opspec) orelse return;
+        if (std.mem.eql(u8, self.mode, "report")) return;
+
+        const e = ctx.make_error("validate_failed", fmt(
+            "Invalid {s} request for entity \"{s}\": {s}",
+            .{ opname, entname(ctx), errs },
+        ));
+        ctx.out_set("spec", OutVal{ .err = e });
+    }
+
+    // Inbound. PreDone rather than PreResult: the records are extracted from
+    // the response body by make_result, which runs between the two, so at
+    // PreResult there is nothing to check but the envelope.
+    //
+    // HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+    // PreDone hooks fire in feature ADD order, which defaults to `test` first
+    // and then names sorted — and `validate` sorts last, after audit, cost,
+    // debug, metrics and telemetry. Those observers therefore record the
+    // operation as a success before this hook has looked at it. Activating
+    // features as an ORDERED LIST fixes it.
+    fn pre_done(self: *ValidateFeature, ctx: *Context) void {
+        if (!self.active or !self.response) return;
+
+        const dataspec = h.getp(self.entity_spec(ctx), "data");
+        if (dataspec == .null) return;
+
+        const result = ctx.result orelse return;
+        const resdata = result.resdata;
+        if (resdata == .null) return;
+
+        // A list op returns many records and a load returns one; both are
+        // checked against the same record spec, because they are the same
+        // entity.
+        //
+        // NO UNWRAP STEP, unlike the ts and go ports: make_result already
+        // stores a list entry as the item's own data Value rather than as the
+        // entity object, so what arrives here is records either way.
+        var msg: ?[]const u8 = null;
+        if (resdata == .array) {
+            for (resdata.array.data.items) |record| {
+                if (record == .null) continue;
+
+                // A NON-OBJECT IS A FAILURE, not something to skip. A load
+                // that answered 42 where the entity's spec wants a record must
+                // not pass this feature silently — struct rejects it with the
+                // field it could not find.
+                if (self.check(ctx, record, dataspec)) |e| {
+                    msg = if (msg) |prev| fmt("{s}; {s}", .{ prev, e }) else e;
+                }
+            }
+        } else if (self.check(ctx, resdata, dataspec)) |e| {
+            msg = e;
+        }
+
+        const errs = msg orelse return;
+        if (std.mem.eql(u8, self.mode, "report")) return;
+
+        const e = ctx.make_error("validate_failed", fmt(
+            "Invalid response for entity \"{s}\": {s}",
+            .{ entname(ctx), errs },
+        ));
+
+        // BOTH, and `ok` is the load-bearing half: done returns resdata
+        // whenever result.ok is true and never looks at err, so setting the
+        // error alone would hand the caller the very records that failed the
+        // spec.
+        result.ok = false;
+        result.err = e;
+
+        // AND THE DATA GOES. The load/update paths copy result.resdata into
+        // the entity's own state on any non-null value, BEFORE done raises —
+        // so rejecting the operation while leaving the records in place would
+        // leave the caller holding an entity populated from a payload this
+        // feature had just declared invalid.
+        result.resdata = .{ .null = {} };
+    }
+
+    fn vname(p: *anyopaque) []const u8 {
+        return self_of(p).name;
+    }
+    fn vactive(p: *anyopaque) bool {
+        return self_of(p).active;
+    }
+    fn vaddopts(p: *anyopaque) Value {
+        return self_of(p).add_opts;
+    }
+    fn vinit(p: *anyopaque, ctx: *Context, options: Value) void {
+        _ = ctx;
+        const self = self_of(p);
+        self.options = options;
+        self.active = sup.fopt_bool(options, "active", false);
+
+        // DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+        // `config.options` documents them and types them; it does not inject
+        // them, because each feature entry in the spec is optional and struct
+        // fills in nothing through an optional union. So every feature
+        // resolves its own.
+        self.request = sup.fopt_bool(options, "request", true);
+        self.response = sup.fopt_bool(options, "response", false);
+
+        // FAIL CLOSED. Only the exact string "report" selects report mode, so
+        // a typo (`mode: "thow"`) still rejects rather than silently turning
+        // enforcement off — the failure nobody would notice. The option spec
+        // rejects the typo outright; this is what happens if it ever does not.
+        self.mode = if (std.mem.eql(u8, sup.fopt_str(options, "mode", "throw"), "report"))
+            "report"
+        else
+            "throw";
+
+        // `strict` is applied ONCE, here, by rebuilding the spec tree without
+        // the `$OPEN` markers — rather than per call, which would clone a spec
+        // for every request an SDK ever makes.
+        const entityspec = schema.shared_entityspec();
+        self.spec = if (sup.fopt_bool(options, "strict", false))
+            close_spec(entityspec)
+        else
+            entityspec;
+    }
+    fn vdispatch(p: *anyopaque, name: []const u8, ctx: *Context) void {
+        const self = self_of(p);
+        if (std.mem.eql(u8, name, "PreSpec")) {
+            self.pre_spec(ctx);
+        } else if (std.mem.eql(u8, name, "PreDone")) {
+            self.pre_done(ctx);
+        }
+    }
+
+    const vtable = Feature.VTable{
+        .name = vname,
+        .active = vactive,
+        .add_options = vaddopts,
+        .init = vinit,
+        .dispatch = vdispatch,
+    };
+};

package/project/.sdk/tm/zig/test/pipeline_test.zig

@@ -367,6 +367,35 @@ test "pipeline feature_add: ordering before after replace" {
 // prepare_auth
 // =====================================================================
 
+// WHERE THE CREDENTIAL GOES IS MODEL-DRIVEN: core/prepare_auth.zig is
+// GENERATED from the API's security scheme, and has exactly one branch. The
+// cases below assert the HEADER shape - a key in `spec.headers` named
+// `authorization` - which is the right assertion for the default and the
+// wrong one for the other three. An SDK whose scheme puts the credential in
+// the query string (`?token=`) or a cookie, and one whose project set
+// `main.kit.config.auth.active: false`, correctly place NOTHING in the header
+// bag, so these would go red for a reason that is not a defect.
+//
+// The generated file exports what it chose as a COMPTIME constant, and
+// core/utility.zig re-exports it. Not read from the options: a query SDK's
+// `options.auth.in` does say "query", but an auth-OFF SDK looks exactly like
+// a header one there - Config omits `options.auth` entirely when auth is
+// inactive and the optspec then supplies the same empty defaults.
+//
+// A header SDK - every SDK whose scheme resolves to the default - runs all of
+// these exactly as it did before prepare_auth became a component.
+fn headerCred() bool {
+    return std.mem.eql(u8, sdk.utilmod.prepare_auth_placement, "header");
+}
+
+// The two cases that assert how a single token is SHAPED into the header
+// value need more than a header placement: genuine HTTP Basic replaces that
+// shaping with base64(apikey:secret), and refuses outright when the secret is
+// missing - which is exactly what those two fixtures leave out.
+fn singleTokenCred() bool {
+    return headerCred() and !sdk.utilmod.prepare_auth_basic;
+}
+
 test "pipeline prepare_auth: guards missing spec" {
     const client = sdk.test_sdk(vnull(), h.jo(&.{.{ "apikey", h.vstr("K") }}));
     const utility = client.get_utility();
@@ -381,6 +410,7 @@ test "pipeline prepare_auth: apikey with prefix space joined" {
         .{ "apikey", h.vstr("K") },
         .{ "auth", h.jo(&.{.{ "prefix", h.vstr("Bearer") }}) },
     }));
+    if (!singleTokenCred()) return;
     const utility = client.get_utility();
     const ctx = plCtx(client, utility, null);
     ctx.spec = authSpec(vnull());
@@ -393,6 +423,7 @@ test "pipeline prepare_auth: raw apikey empty prefix as is" {
         .{ "apikey", h.vstr("K") },
         .{ "auth", h.jo(&.{.{ "prefix", h.vstr("") }}) },
     }));
+    if (!singleTokenCred()) return;
     const utility = client.get_utility();
     const ctx = plCtx(client, utility, null);
     ctx.spec = authSpec(vnull());
@@ -405,6 +436,7 @@ test "pipeline prepare_auth: empty apikey drops header" {
         .{ "apikey", h.vstr("") },
         .{ "auth", h.jo(&.{.{ "prefix", h.vstr("Bearer") }}) },
     }));
+    if (!headerCred()) return;
     const utility = client.get_utility();
     const ctx = plCtx(client, utility, null);
     ctx.spec = authSpec(h.jo(&.{.{ "authorization", h.vstr("stale") }}));
@@ -416,6 +448,7 @@ test "pipeline prepare_auth: missing apikey drops header" {
     const client = sdk.test_sdk(vnull(), h.jo(&.{
         .{ "auth", h.jo(&.{.{ "prefix", h.vstr("Bearer") }}) },
     }));
+    if (!headerCred()) return;
     const utility = client.get_utility();
     const options = client.options_map();
     // Skip if this SDK's options happen to carry a configured apikey.
@@ -430,6 +463,7 @@ test "pipeline prepare_auth: missing apikey drops header" {
 
 test "pipeline prepare_auth: public api no auth block drops header" {
     const client = sdk.test_sdk(vnull(), h.jo(&.{.{ "apikey", h.vstr("K") }}));
+    if (!headerCred()) return;
     const utility = client.get_utility();
     // Option validation supplies an auth shape for this SDK, so a truly
     // auth-less client cannot be constructed here — mirror the rust skip.

package/project/.sdk/tm/zig/test/vendor/omni/omni.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (zig/src/omni.zig)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (zig/src/omni.zig)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Omni: the shared multi-language test runner (Zig port).
 //!

package/project/.sdk/tm/zig/test/vendor/omni/regex.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (zig/src/regex.zig)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (zig/src/regex.zig)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! A small backtracking regex engine.
 //!

package/project/.sdk/tm/zig/utility/voxgigstruct/regex.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/struct sdk-20260908-1556-0 (zig/src/regex.zig)
-// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/struct sdk-20260917-1242-0 (zig/src/regex.zig)
+// Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 //

package/project/.sdk/tm/zig/utility/voxgigstruct/struct.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/struct sdk-20260908-1556-0 (zig/src/struct.zig)
-// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/struct sdk-20260917-1242-0 (zig/src/struct.zig)
+// Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 

package/project/sdkgen-package.json

@@ -3,7 +3,7 @@
     "package": 1
   },
   "name": "@voxgig/sdkgen",
-  "version": "4.19.1",
+  "version": "4.21.0",
   "provides": {
     "target": [
       "c",

package/src/helpers/applicability.ts

@@ -106,12 +106,17 @@ const TAGS = [
   // A vendored sekreto port lives in this target's feature container.
   'sekreto',
 
-  // The target emits the generated `Schema` module: the model's option spec
-  // and, when a feature asks for them, per-entity struct.validate specs.
-  // `validate` needs this, and the porting order is the reason it is a tag
-  // rather than an assumption — every target vendors a struct with
-  // `validate` in it, but only a target whose Main emits Schema has
-  // anything for that function to check against.
+  // The target can VALIDATE against the generated `Schema` module: the
+  // model's option spec and, when a feature asks for them, per-entity
+  // struct.validate specs.
+  //
+  // NOT "emits Schema". Every target emits one — make_options reads the
+  // option spec out of it — so that claim is universal and gates nothing.
+  // This tag is the `validate` FEATURE's `needs`, and a feature
+  // also needs its per-target source: tagging a target that has no
+  // `tm/<lang>/src/feature/validate/` makes the feature apply with nothing
+  // to copy. featuremodel.test.ts holds the two together in both
+  // directions.
   'schema',
 ]
 

package/src/helpers/collectDeps.ts

@@ -3,8 +3,17 @@
 // template was hand-rolling identically:
 //
 //   - feature deps  : included when `dep.active === true`  (default off)
+//   - plugin  deps  : the same, and only for an ACTIVE plugin of that feature
 //   - target  deps  : included when `dep.active !== false` (default on)
 //
+// THE PLUGIN LEVEL IS GATED ONE STEP DEEPER THAN THE FEATURE. A feature's
+// deps flow as soon as the feature is active; a plugin is a trimmable part
+// within an active feature, so a dependency only its files use must not
+// reach the manifest until that plugin is active too. rust's mini vault is
+// the case: it takes `ring` for AES-256-GCM, and at feature level that
+// would land in every secrets-enabled rust SDK, including the ones whose
+// chain is `[env, dotenv]` and which never compile a vault.
+//
 // The two sources are kept distinct via the `source` field so callers can
 // apply their own version defaults / formatting (e.g. go uses `v0.0.0`,
 // python `0.0`). The original dep object is exposed as `raw` for callers that
@@ -74,11 +83,27 @@ function collectDeps(
 
   each(feature, (f: any) => {
     const langDeps = f?.deps?.[targetName]
-    if (!langDeps) return
-    each(langDeps, (dep: any) => {
-      if (dep?.active) {
-        add(dep, 'feature', f.name)
-      }
+    if (langDeps) {
+      each(langDeps, (dep: any) => {
+        if (dep?.active) {
+          add(dep, 'feature', f.name)
+        }
+      })
+    }
+
+    // An inactive plugin's deps are not this SDK's deps. `true ===` rather
+    // than truthiness, matching the trim: the trim drops a plugin unless it
+    // is explicitly on, and the manifest must agree with the tree it
+    // describes or the build asks for a crate whose files were removed.
+    each(f?.plugin, (plugin: any) => {
+      if (true !== plugin?.active) return
+      const pluginDeps = plugin?.deps?.[targetName]
+      if (!pluginDeps) return
+      each(pluginDeps, (dep: any) => {
+        if (dep?.active) {
+          add(dep, 'feature', f.name + '.' + plugin.name)
+        }
+      })
     })
   })
 

package/src/helpers/naming.ts

@@ -217,7 +217,7 @@ function rbSafeTypeName(Name: string): string {
 const SWIFT_SDK_TYPES = new Set<string>([
   // core runtime
   'Context', 'Control', 'Entity', 'Operation', 'Point', 'Response', 'Result',
-  'SdkConfig', 'Spec', 'Utility',
+  'SdkConfig', 'SdkSchema', 'Spec', 'Utility',
   // struct library
   'Injection', 'Injector', 'JSON', 'JSONParseError', 'Modify',
   'OrderedDictionary', 'Sentinel', 'Value', 'VList', 'VMap', 'WalkApply',
@@ -232,7 +232,7 @@ const SWIFT_SDK_TYPES = new Set<string>([
   'MetricsBucket', 'MetricsFeature', 'NetsimFeature', 'PagingFeature',
   'ProxyFeature', 'RatelimitFeature', 'RbacFeature', 'RetryFeature',
   'SecretsFeature', 'StreamingFeature', 'TelemetryFeature', 'TestFeature',
-  'TimeoutFeature',
+  'TimeoutFeature', 'ValidateFeature',
 ])
 
 

package/src/sdkgen.ts

@@ -17,7 +17,7 @@ import type {
   ActionResult,
 } from './types'
 
-import { SdkGenError, requirePath, isAuthActive, resolveAuthPrefix, isHttpBasicAuth,
+import { SdkGenError, requirePath, isAuthActive, resolveAuthPrefix, resolveAuthIn, resolveAuthName, isAuthSuppressed, isHttpBasicAuth,
   CONFIG_DATA_THRESHOLD, CONFIG_REPR_VALUES, isConfigData, configRepr,
   configReprSetting, configDefinition, clean, rawStringLiteral } from './utility'
 
@@ -1220,6 +1220,9 @@ export {
   requirePath,
   isAuthActive,
   resolveAuthPrefix,
+  resolveAuthIn,
+  resolveAuthName,
+  isAuthSuppressed,
   isHttpBasicAuth,
   CONFIG_DATA_THRESHOLD,
   CONFIG_REPR_VALUES,