@voxgig/sdkgen 4.20.0 → 4.21.0

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/onepassword.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/onepassword.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/onepassword.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # 1Password, through a Connect server, as a sekreto plugin.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/proc.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/proc.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/proc.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # The child-process half of the two plugins that read a store through its
 # own CLI - boru and secretspec - in one place and OUTSIDE THE CORE.

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/secretspec.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/secretspec.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/secretspec.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # SecretSpec, as a sekreto plugin.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/sigv4.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/sigv4.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/plugins/sigv4.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # AWS Signature Version 4, hand-rolled - and OUTSIDE THE CORE, because it
 # is the library's one cryptographic edge. Only the two aws kinds sign

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/provider.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/src/provider.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/src/provider.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # A source of secrets.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/providers.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/src/providers.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/src/providers.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # What a provider is, how a provider kind becomes a voxgig/plugin
 # definition - and the four BUILT-IN kinds.
@@ -141,7 +141,18 @@ defmodule Sekreto.ProviderSpec do
             config: "",
             # infisical: the environment slug and secret path.
             environment: "",
-            path: ""
+            path: "",
+            # minivault: the passphrase that unwraps `vaultkey`.
+            passphrase: "",
+            # minivault: which key in the vault file to open with,
+            # defaulting to `master`. Named apart from `key` and `keyid`
+            # because those already mean a secret name and an AWS access
+            # key id.
+            vaultkey: "",
+            # minivault: PBKDF2 rounds, used only when a key is created.
+            iterations: nil,
+            # minivault: make the vault file if it is not there.
+            create: false
 end
 
 # Printed without its credentials. See the AuthSpec implementation: the
@@ -167,7 +178,7 @@ defmodule Sekreto.Providers do
 
   A provider kind is a voxgig/plugin `Definition`, and `providerplugin/2`
   is the whole bridge between the two libraries - the four kinds below are
-  made with it, the ten under plugins/ are made with it, and so is a
+  made with it, the eleven under plugins/ are made with it, and so is a
   caller's own.
   """
 
@@ -526,7 +537,8 @@ defmodule Sekreto.Providers do
         "onepassword",
         "doppler",
         "infisical",
-        "secretspec"
+        "secretspec",
+        "minivault"
       ]
     }
   end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/sekreto.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/src/sekreto.ex)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (elixir/src/sekreto.ex)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # sekreto: one interface for secrets, wherever they live.
 #

package/project/.sdk/tm/elixir/lib/projectname/feature/validate.ex

@@ -0,0 +1,320 @@
+# ProjectName SDK validate feature
+#
+# Payload validation against the model's own field types (the elixir port of
+# tm/ts/src/feature/validate/ValidateFeature.ts).
+#
+# The specs are NOT written here and not written in the model either: every
+# entity field already carries a canonical type sentinel (`$STRING`,
+# `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+# vocabulary S.validate speaks. The generator maps them once
+# (helpers/canonSpec) and emits `ProjectName.Schema.entityspec`, so a field
+# whose type changes in the API spec changes what this feature enforces with
+# no edit anywhere.
+#
+# WHAT IS CHECKED
+#   outbound (PreSpec)  the payload the caller asked to send, against
+#                       spec.op[<opname>] - the operation's request shape.
+#   inbound  (PreDone)  each record the operation returned, against
+#                       spec.data - the entity's own field types.
+#
+# WHAT IS NOT. The model carries no array element types, no nested object
+# schemas, no enums, formats or bounds, so this checks the shape the model
+# knows and nothing more.
+#
+# Short-circuit mechanism: the failure error is placed in ctx.out["spec"],
+# which make_spec_impl already surfaces as the operation's error (H.is_error)
+# rather than using as a Spec - the same seam rbac uses one stage earlier
+# through ctx.out["point"].
+
+defmodule ProjectName.Feature.Validate do
+  alias Voxgig.Struct, as: S
+  alias ProjectName.Helpers, as: H
+  alias ProjectName.{Feature, Context, Schema, EntityBase}
+
+  # Built rather than written, so the backticks cannot be lost in an edit.
+  @open <<96>> <> "$OPEN" <> <<96>>
+
+  def new do
+    f = Feature.base("validate")
+    Feature.install(f, "init", fn ctx, opts -> init(f, ctx, opts) end)
+    Feature.install(f, "PreSpec", fn ctx -> pre_spec(f, ctx) end)
+    Feature.install(f, "PreDone", fn ctx -> pre_done(f, ctx) end)
+    f
+  end
+
+  def init(f, ctx, options) do
+    Feature.init_common(f, ctx, options)
+    opts = Feature.opts(f)
+
+    # DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+    # `config.options` documents them and types them; it does not inject them,
+    # because each feature entry in the spec is optional and struct fills in
+    # nothing through an optional union. So every feature resolves its own.
+    S.setprop(f, "request", S.getprop(opts, "request") != false)
+    S.setprop(f, "response", S.getprop(opts, "response") == true)
+
+    # FAIL CLOSED. Only the exact string "report" selects report mode, so a
+    # typo (`mode: "thow"`) still rejects rather than silently turning
+    # enforcement off - the failure nobody would notice. The option spec
+    # rejects the typo outright; this is what happens if it ever does not.
+    S.setprop(f, "mode", if(S.getprop(opts, "mode") == "report", do: "report", else: "throw"))
+
+    # `strict` is applied ONCE, here, by rebuilding the spec tree without the
+    # `$OPEN` markers - rather than per call, which would clone a spec for
+    # every request an SDK ever makes.
+    spec =
+      if S.getprop(opts, "strict") == true do
+        close_spec(Schema.entityspec())
+      else
+        Schema.entityspec()
+      end
+
+    S.setprop(f, "spec", spec)
+    nil
+  end
+
+  defp pre_spec(f, ctx) do
+    if Feature.active?(f) and S.getprop(f, "request") == true do
+      opname = opname_of(ctx)
+      espec = entity_spec(f, ctx)
+      ops = if espec != nil, do: S.getprop(espec, "op"), else: nil
+      opspec = if S.ismap(ops), do: S.getprop(ops, opname), else: nil
+
+      if opspec != nil do
+        errs = check(f, ctx, payload(ctx, opname), opspec, "request")
+
+        if errs != [] and S.getprop(f, "mode") != "report" do
+          err =
+            Context.make_error(
+              ctx,
+              "validate_failed",
+              "Invalid " <>
+                opname <>
+                " request for entity \"" <> entity_of(ctx) <> "\": " <> Enum.join(errs, "; ")
+            )
+
+          S.setprop(S.getprop(ctx, "out"), "spec", err)
+          err
+        end
+      end
+    end
+  end
+
+  # Inbound. PreDone rather than PreResult: the records are extracted from the
+  # response body by make_result, which runs between the two, so at PreResult
+  # there is nothing to check but the envelope.
+  #
+  # HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+  # PreDone hooks fire in feature ADD order, which defaults to `test` first and
+  # then names sorted - and `validate` sorts last, after audit, cost, debug,
+  # metrics and telemetry. Those observers therefore record the operation as a
+  # success before this hook has looked at it. Activating features as an
+  # ORDERED LIST fixes it.
+  defp pre_done(f, ctx) do
+    if Feature.active?(f) and S.getprop(f, "response") == true do
+      espec = entity_spec(f, ctx)
+      dataspec = if espec != nil, do: S.getprop(espec, "data"), else: nil
+      result = S.getprop(ctx, "result")
+      resdata = if result != nil, do: S.getprop(result, "resdata"), else: nil
+
+      if dataspec != nil and resdata != nil do
+        # A list op returns many records and a load returns one; both are
+        # checked against the same record spec, because they are the same
+        # entity.
+        records =
+          if S.islist(resdata) do
+            n = S.size(resdata)
+            if n == 0, do: [], else: Enum.map(0..(n - 1), fn i -> S.getelem(resdata, i) end)
+          else
+            [resdata]
+          end
+
+        errs =
+          Enum.flat_map(records, fn record ->
+            if record == nil do
+              []
+            else
+              # A NON-OBJECT IS A FAILURE, not something to skip. A load that
+              # answered 42 where the entity's spec wants a record must not
+              # pass this feature silently - struct rejects it with the field
+              # it could not find.
+              check(f, ctx, unwrap(record), dataspec, "response")
+            end
+          end)
+
+        if errs != [] and S.getprop(f, "mode") != "report" do
+          err =
+            Context.make_error(
+              ctx,
+              "validate_failed",
+              "Invalid response for entity \"" <> entity_of(ctx) <> "\": " <> Enum.join(errs, "; ")
+            )
+
+          # BOTH, and `ok` is the load-bearing half: done returns resdata
+          # whenever result.ok is true and never looks at err, so setting the
+          # error alone would hand the caller the very records that failed the
+          # spec.
+          S.setprop(result, "ok", false)
+          S.setprop(result, "err", err)
+
+          # AND THE DATA GOES. The load/update paths copy resdata into the
+          # entity's own state on any non-nil value, BEFORE done raises - so
+          # rejecting the operation while leaving the records in place would
+          # leave the caller holding an entity populated from a payload this
+          # feature had just declared invalid.
+          S.setprop(result, "resdata", nil)
+          err
+        end
+      end
+    end
+  end
+
+  # The payload an operation is about to send.
+  #
+  # TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+  # caller's argument in `reqdata` over the entity's `data`; a match op
+  # (load/list/remove) carries it in `reqmatch` over `match`. That is what the
+  # entity operations pass to Context.new and what make_point reads - so
+  # reading `reqdata` for every op would check a `load(%{"id" => ...})`
+  # against the entity's STALE stored match and reject it for the id the
+  # caller had just supplied.
+  defp payload(ctx, opname) do
+    body = opname in ["create", "update", "patch"]
+    base = S.getprop(ctx, if(body, do: "data", else: "match"))
+    req = S.getprop(ctx, if(body, do: "reqdata", else: "reqmatch"))
+
+    out = S.jm([])
+
+    Enum.each([base, req], fn src ->
+      if S.ismap(src) do
+        Enum.each(H.entries(src), fn {k, v} -> S.setprop(out, k, v) end)
+      end
+    end)
+
+    # `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record.
+    # make_point reads it off this same argument and the request transformer
+    # drops it before the body is built, so a spec built from the API's own
+    # fields will never name it - and under `strict` every custom-action call
+    # would be rejected for the one key that made it reachable.
+    S.delprop(out, "$action")
+
+    out
+  end
+
+  defp entity_spec(f, ctx) do
+    spec = S.getprop(f, "spec")
+    if S.ismap(spec), do: S.getprop(spec, entity_of(ctx)), else: nil
+  end
+
+  defp entity_of(ctx) do
+    name = Context.entity_name(S.getprop(ctx, "entity"))
+    name = if name == "_", do: "", else: name
+
+    if name == "" do
+      op = S.getprop(ctx, "op")
+      oe = if op != nil, do: S.getprop(op, "entity"), else: nil
+      if is_binary(oe), do: oe, else: ""
+    else
+      name
+    end
+  end
+
+  defp opname_of(ctx) do
+    op = S.getprop(ctx, "op")
+    nm = if op != nil, do: S.getprop(op, "name"), else: nil
+    if is_binary(nm), do: nm, else: ""
+  end
+
+  # One validate call. Errors are COLLECTED, never raised: S.validate raises on
+  # the first failure unless given an `errs` list, and a caller fixing a
+  # payload wants every problem with it, not the first one.
+  defp check(f, ctx, data, spec, direction) do
+    errs = S.jt([])
+
+    try do
+      S.validate(data, spec, S.jm(["errs", errs]))
+    rescue
+      e ->
+        # A spec this port cannot run at all (rather than a payload that fails
+        # it) must not take the operation down with it: report it like any
+        # other failure and let `mode` decide.
+        if S.size(errs) == 0 do
+          S.setprop(errs, S.size(errs), Exception.message(e))
+        end
+    end
+
+    n = S.size(errs)
+    msgs = if n == 0, do: [], else: Enum.map(0..(n - 1), fn i -> to_string(S.getelem(errs, i)) end)
+
+    cb = S.getprop(Feature.opts(f), "onInvalid")
+
+    if msgs != [] and is_function(cb, 1) do
+      # A callback receiving every failure, whatever `mode` does with it, so a
+      # client can log or count invalid payloads without changing what the SDK
+      # returns.
+      try do
+        cb.(
+          S.jm([
+            "entity",
+            entity_of(ctx),
+            "op",
+            opname_of(ctx),
+            "direction",
+            direction,
+            "errs",
+            errs,
+            "data",
+            data
+          ])
+        )
+      rescue
+        _e -> nil
+      end
+    end
+
+    msgs
+  end
+
+  # A RESULT RECORD AS DATA.
+  #
+  # make_result turns every record of a LIST into an entity instance, so what
+  # reaches PreDone for a list is wrappers, not records - and a wrapper checked
+  # against a field spec fails on every required field while its actual data
+  # goes unchecked. A load returns the record itself, so this handles both.
+  defp unwrap(record) do
+    if S.ismap(record) and S.getprop(record, "_module") != nil do
+      data = EntityBase.data_get(record)
+      if data != nil, do: data, else: record
+    else
+      record
+    end
+  end
+
+  # The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+  # error rather than a pass. Rebuilt rather than mutated: Schema.entityspec is
+  # a module attribute shared by every client in the process.
+  defp close_spec(node) do
+    cond do
+      S.islist(node) ->
+        n = S.size(node)
+
+        S.jt(
+          if n == 0,
+            do: [],
+            else: Enum.map(0..(n - 1), fn i -> close_spec(S.getelem(node, i)) end)
+        )
+
+      S.ismap(node) ->
+        out = S.jm([])
+
+        Enum.each(H.entries(node), fn {k, v} ->
+          if k != @open, do: S.setprop(out, k, close_spec(v))
+        end)
+
+        out
+
+      true ->
+        node
+    end
+  end
+end

package/project/.sdk/tm/elixir/lib/projectname/utility.ex

@@ -304,52 +304,16 @@ defmodule ProjectName.Utility do
     co = S.getprop(config, "options")
     cfgopts = if S.ismap(co), do: co, else: S.jm([])
 
-    optspec =
-      H.deep(%{
-        "apikey" => "",
-        "secret" => "",
-        "base" => "http://localhost:8000",
-        "prefix" => "",
-        "suffix" => "",
-        # `basic` and `secret`: HTTP Basic Auth needs a second credential and
-        # a flag to say the pair is Basic rather than a single bearer token.
-        #
-        # `in` and `name` say WHERE the credential goes and under what name
-        # (header | query | cookie). The generated config carries them
-        # whenever the spec's scheme is not the header/Authorization default,
-        # and this port's validate REJECTS a key the spec does not declare -
-        # so without them an apiKey-in-query SDK cannot be CONSTRUCTED at all:
-        #
-        #   ** (Voxgig.Struct.Error) Unexpected keys at field auth: in, name
-        #
-        # "" means "take what the spec said", which is what the generated
-        # prepare_auth was built from.
-        "auth" => %{"prefix" => "", "basic" => false, "in" => "", "name" => ""},
-        "headers" => %{"`$CHILD`" => "`$STRING`"},
-        "allow" => %{
-          "method" => "GET,PUT,POST,PATCH,DELETE,OPTIONS",
-          "op" => "create,update,load,list,remove,command,direct,graphql"
-        },
-        "entity" => %{"`$CHILD`" => %{"`$OPEN`" => true, "active" => false, "alias" => %{}}},
-        "feature" => %{"`$CHILD`" => %{"`$OPEN`" => true, "active" => false}},
-        "utility" => %{},
-        # Feature INSTANCES supplied at construction (the station adopt
-        # path): consumed by the constructor's extend loop, so they are
-        # struct feature nodes, not data - `$ANY` accepts them verbatim.
-        # Without this entry the seam is dead: the constructor reads
-        # options.extend, but validate rejected the key.
-        "extend" => "`$ANY`",
-        "system" => %{},
-        "test" => %{"active" => false, "entity" => %{"`$OPEN`" => true}},
-        "clean" => %{"keys" => "key,token,id"},
-        # Server-variable values for a templated base URL (OpenAPI server
-        # variables): {name} placeholders in "base" are substituted from this
-        # map at construction. Spec defaults arrive via the generated config;
-        # user values override them. Mirrors go's make_options optspec - elixir
-        # was the only target validating options that did not accept it, so a
-        # spec with a templated server URL failed validation outright.
-        "server" => %{"`$CHILD`" => ""}
-      })
+    # THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+    #
+    # `ProjectName.Schema.optspec/0` is built from the model:
+    # `main.kit.optspec` for the standard options, plus one entry per
+    # feature this target carries, taken from that feature's own
+    # `config.options` / `config.optspec`. Editing this file to add an
+    # option would put it back where it was — one of twenty hand-maintained
+    # copies of a schema nothing cross-checked — so add it to the model
+    # instead and every ported target validates it.
+    optspec = ProjectName.Schema.optspec()
 
     sys_fetch = S.getpath(opts0, "system.fetch")
 

package/project/.sdk/tm/elixir/test/vendor/omni/json.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/json.ex)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (elixir/lib/json.ex)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # The omni JSON parser.
 #

package/project/.sdk/tm/elixir/test/vendor/omni/runner.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/runner.ex)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (elixir/lib/runner.ex)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni: the shared multi-language test runner (Elixir port).
 #

package/project/.sdk/tm/elixir/test/vendor/omni/util.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/util.ex)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (elixir/lib/util.ex)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni internal JSON utilities.
 #

package/project/.sdk/tm/go/feature/secrets/plugin/capability.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/capability.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/catalog.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/catalog.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/config.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/config.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/go/feature/secrets/plugin/depend.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/depend.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/env.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/env.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/export.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/export.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *
@@ -28,7 +28,7 @@ type Exported struct {
 }
 
 func ResolveExport(spec string, exported []Exported) (any, error) {
-	cut := strings.Index(spec, "/")
+	cut := strings.LastIndex(spec, "/")
 	if -1 == cut {
 		return nil, Fail("plugin_export_ambiguous", "export spec needs a key: "+spec,
 			map[string]any{"spec": spec})

package/project/.sdk/tm/go/feature/secrets/plugin/graph.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/graph.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/host.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/host.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The host: the lifecycle state machine (§5), extension points (§6), and
  * resource capture (§8).
@@ -393,6 +393,30 @@ func (i *Inst) Export(key string, value any) { i.e.exports[key] = value }
 // Provides declares what this instance can do for others (§11.1).
 func (i *Inst) Provides(p Provided) { i.e.provides = append(i.e.provides, p) }
 
+// Capability is WHICH provider this instance is bound to for name
+// (§11.1), as a ref, or "" when nothing provides it.
+//
+// §11.1 says "the first is bound, and inst.capability(name) returns it",
+// and §11.3 gives the case that needs it: a plugin that works without
+// metrics and uses metrics when it is there has to be able to ask.
+// Host.Capability answers with the live providers RANKED -- not with the
+// one THIS instance took, and §11.4's reluctant rebinding makes those
+// differ: a better-ranked newcomer tops the ranking while the consumer
+// keeps what it had.
+//
+// A REF, not the instance: every port can return a string and a corpus
+// entry can assert on one. The selection is REMEMBERED, because this is
+// the instance asking; `remember` is false only for questions asked
+// ABOUT an instance, where answering must not create a binding.
+func (i *Inst) Capability(name string) string {
+	for _, req := range Requirements(i.e.Options) {
+		if req.Name == name {
+			return i.h.chosen(i.e, req, true)
+		}
+	}
+	return ""
+}
+
 type Position struct {
 	Index     int  `json:"index"`
 	Count     int  `json:"count"`

package/project/.sdk/tm/go/feature/secrets/plugin/order.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/order.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Ordering (§7) — one rule, one place.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/point.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/point.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Extension points (§6). Three kinds, chosen because they are what the
  * two existing systems actually needed, and no more.

package/project/.sdk/tm/go/feature/secrets/plugin/ref.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/ref.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag, written `name$tag` (§4).
  *