@voxgig/sdkgen 4.20.0 → 4.21.0

package/project/.sdk/tm/go/feature/secrets/plugins/onepassword/onepassword.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/onepassword/onepassword.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/onepassword/onepassword.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The onepassword plugin: 1Password, through a Connect server. Needs
 // HTTPS. A port of typescript/plugins/onepassword.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/secretspec/secretspec.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/secretspec/secretspec.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/secretspec/secretspec.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The secretspec plugin: SecretSpec, through its CLI. Needs a child
 // process. A port of typescript/plugins/secretspec.ts.

package/project/.sdk/tm/go/feature/secrets/sekreto/addr.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/addr.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/sekreto/addr.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The plaintext-address guard, in the core because it is pure - a
 // handful of string steps, no socket - and because it is on the spec:

package/project/.sdk/tm/go/feature/secrets/sekreto/providers.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/providers.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/sekreto/providers.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, how a provider
 // kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.
@@ -127,6 +127,17 @@ type ProviderSpec struct {
 	// infisical: the environment slug and secret path.
 	Environment string `json:"environment,omitempty"`
 	Path        string `json:"path,omitempty"`
+	// Passphrase is the minivault passphrase that unwraps VaultKey.
+	Passphrase string `json:"passphrase,omitempty"`
+	// VaultKey is which key in a minivault file to open with, defaulting
+	// to `master`. Named apart from Key and KeyID because those already
+	// mean a secret name and an AWS access key id.
+	VaultKey string `json:"vaultkey,omitempty"`
+	// Iterations is minivault's PBKDF2 round count, used only when a key
+	// is created.
+	Iterations int `json:"iterations,omitempty"`
+	// Create makes a minivault file if it is not there.
+	Create bool `json:"create,omitempty"`
 
 	// Provider is a provider already built, joining the chain as it is.
 	// Never serialized: a live provider is not data.
@@ -438,5 +449,6 @@ var Kinds = struct {
 	Plugin: []string{
 		"hashicorp", "boru", "awssecrets", "awsparams", "gcpsecrets",
 		"azuresecrets", "onepassword", "doppler", "infisical", "secretspec",
+		"minivault",
 	},
 }

package/project/.sdk/tm/go/feature/secrets/sekreto/sekreto.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/sekreto.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/sekreto/sekreto.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/go/feature/validate_feature.go

@@ -0,0 +1,346 @@
+package feature
+
+import (
+	"sort"
+	"strings"
+
+	vs "github.com/voxgig/struct"
+
+	"GOMODULE/core"
+)
+
+// Payload validation against the model's own field types. The go port of
+// tm/ts/src/feature/validate/ValidateFeature.ts.
+//
+// The specs are NOT written here and not written in the model either: every
+// entity field already carries a canonical type sentinel (`$STRING`,
+// `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+// vocabulary struct.Validate speaks. The generator maps them once
+// (helpers/canonSpec) and emits `core.ENTITYSPEC`, so a field whose type
+// changes in the API spec changes what this feature enforces with no edit
+// anywhere.
+//
+// WHAT IS CHECKED
+//
+//	outbound (PreSpec)  the payload the caller asked to send, against
+//	                    `spec.op[<opname>]` - the operation's request shape.
+//	inbound  (PreDone)  each record the operation returned, against
+//	                    `spec.data` - the entity's own field types.
+//
+// WHAT IS NOT. The model carries no array element types, no nested object
+// schemas, no enums, formats or bounds, so this checks the shape the model
+// knows and nothing more.
+type ValidateFeature struct {
+	BaseFeature
+	client  *core.ProjectNameSDK
+	options map[string]any
+	spec    map[string]any
+
+	request  bool
+	response bool
+	mode     string
+}
+
+func NewValidateFeature() *ValidateFeature {
+	return &ValidateFeature{
+		BaseFeature: BaseFeature{
+			Version: "0.0.1",
+			Name:    "validate",
+			Active:  true,
+		},
+	}
+}
+
+func (f *ValidateFeature) Init(ctx *core.Context, options map[string]any) {
+	f.client = ctx.Client
+	f.options = options
+	f.Active = foptBool(options, "active", false)
+
+	// DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+	// `config.options` documents them and types them; it does not inject
+	// them, because each feature entry in the spec is optional and struct
+	// fills in nothing through an optional union.
+	f.request = foptBool(options, "request", true)
+	f.response = foptBool(options, "response", false)
+
+	// FAIL CLOSED. Only the exact string "report" selects report mode, so a
+	// typo (`mode: "thow"`) still rejects rather than silently turning
+	// enforcement off. The option spec rejects the typo outright; this is
+	// what happens if it ever does not.
+	f.mode = "throw"
+	if "report" == foptStr(options, "mode", "throw") {
+		f.mode = "report"
+	}
+
+	// `strict` is applied ONCE, here, by rebuilding the spec tree without the
+	// `$OPEN` markers - rather than per call, which would clone a spec for
+	// every request an SDK ever makes.
+	f.spec = core.ENTITYSPEC
+	if foptBool(options, "strict", false) {
+		if closed, ok := validateClose(core.ENTITYSPEC).(map[string]any); ok {
+			f.spec = closed
+		}
+	}
+}
+
+// Outbound. MakeSpec short-circuits on a `ctx.Out["spec"]` that is already
+// set, so assigning the error here rejects the operation before the request
+// is built - the same seam rbac uses one stage earlier.
+func (f *ValidateFeature) PreSpec(ctx *core.Context) {
+	if !f.Active || !f.request {
+		return
+	}
+
+	opname := ""
+	if ctx.Op != nil {
+		opname = ctx.Op.Name
+	}
+
+	opspec := validateOpSpec(f.entitySpec(ctx), opname)
+	if opspec == nil {
+		return
+	}
+
+	errs := f.check(ctx, f.payload(ctx, opname), opspec, "request")
+	if 0 == len(errs) || "report" == f.mode {
+		return
+	}
+
+	ctx.Out["spec"] = ctx.MakeError("validate_failed",
+		"Invalid "+opname+" request for entity \""+validateEntName(ctx)+"\": "+
+			strings.Join(errs, "; "))
+}
+
+// Inbound. PreDone rather than PreResult: the records are extracted from the
+// response body by MakeResult, which runs between the two, so at PreResult
+// there is nothing to check but the envelope.
+//
+// HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+// PreDone hooks fire in feature ADD order, which defaults to `test` first and
+// then names sorted - and `validate` sorts last, after audit, cost, debug,
+// metrics and telemetry. Those observers therefore record the operation as a
+// success before this hook has looked at it. Activating features as an
+// ORDERED LIST fixes it.
+func (f *ValidateFeature) PreDone(ctx *core.Context) {
+	if !f.Active || !f.response {
+		return
+	}
+
+	espec := f.entitySpec(ctx)
+	if espec == nil {
+		return
+	}
+
+	dataspec, has := espec["data"]
+	if !has || dataspec == nil {
+		return
+	}
+
+	if ctx.Result == nil || ctx.Result.Resdata == nil {
+		return
+	}
+
+	// A list op returns many records and a load returns one; both are checked
+	// against the same record spec, because they are the same entity.
+	records, isList := ctx.Result.Resdata.([]any)
+	if !isList {
+		records = []any{ctx.Result.Resdata}
+	}
+
+	errs := []string{}
+	for _, record := range records {
+		if record == nil {
+			continue
+		}
+
+		// A NON-OBJECT IS A FAILURE, not something to skip. A load that
+		// answered `42` where the entity's spec wants a record must not pass
+		// this feature silently - struct rejects it with the field it could
+		// not find.
+		errs = append(errs, f.check(ctx, validateUnwrap(record), dataspec, "response")...)
+	}
+
+	if 0 == len(errs) || "report" == f.mode {
+		return
+	}
+
+	err := ctx.MakeError("validate_failed",
+		"Invalid response for entity \""+validateEntName(ctx)+"\": "+
+			strings.Join(errs, "; "))
+
+	// BOTH, and `Ok` is the load-bearing half: Done returns Resdata whenever
+	// Result.Ok is true and never looks at Err, so setting the error alone
+	// would hand the caller the very records that failed the spec.
+	ctx.Result.Ok = false
+	ctx.Result.Err = err
+
+	// AND THE DATA GOES. The load/update paths copy Result.Resdata into the
+	// entity's own state on any non-nil value, BEFORE Done raises - so
+	// rejecting the operation while leaving the records in place would leave
+	// the caller holding an entity populated from a payload this feature had
+	// just declared invalid.
+	ctx.Result.Resdata = nil
+}
+
+// The payload an operation is about to send.
+//
+// TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+// caller's argument in Reqdata over the entity's Data; a match op
+// (load/list/remove) carries it in Reqmatch over Match. That is what the
+// entity operations pass to NewContext and what MakePoint reads - so reading
+// Reqdata for every op would check a `Load({id})` against the entity's STALE
+// stored match and reject it for the id the caller had just supplied.
+func (f *ValidateFeature) payload(ctx *core.Context, opname string) map[string]any {
+	body := "create" == opname || "update" == opname || "patch" == opname
+
+	base := ctx.Match
+	req := ctx.Reqmatch
+	if body {
+		base = ctx.Data
+		req = ctx.Reqdata
+	}
+
+	out := map[string]any{}
+	for k, v := range base {
+		out[k] = v
+	}
+	for k, v := range req {
+		out[k] = v
+	}
+
+	// `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record.
+	// MakePoint reads it off this same argument and the request transformer
+	// drops it before the body is built, so a spec built from the API's own
+	// fields will never name it - and under `strict` every custom-action call
+	// would be rejected for the one key that made it reachable.
+	delete(out, "$action")
+
+	return out
+}
+
+func (f *ValidateFeature) entitySpec(ctx *core.Context) map[string]any {
+	if f.spec == nil {
+		return nil
+	}
+	espec, _ := f.spec[validateEntName(ctx)].(map[string]any)
+	return espec
+}
+
+// One Validate call. Errors are COLLECTED, never returned as one: struct
+// stops at the first failure unless given an errs collector, and a caller
+// fixing a payload wants every problem with it, not the first one.
+func (f *ValidateFeature) check(
+	ctx *core.Context, data any, spec any, direction string,
+) []string {
+	collect := vs.ListRefCreate[any]()
+
+	// A spec this port cannot run at all (rather than a payload that fails
+	// it) must not take the operation down with it: report it like any other
+	// failure and let `mode` decide.
+	if _, err := vs.Validate(data, spec, &vs.Injection{Errs: collect}); err != nil &&
+		0 == len(collect.List) {
+		collect.Append(err.Error())
+	}
+
+	errs := []string{}
+	for _, e := range collect.List {
+		if s, ok := e.(string); ok {
+			errs = append(errs, s)
+		}
+	}
+
+	if 0 < len(errs) {
+		if cb, ok := f.options["onInvalid"].(func(map[string]any)); ok {
+			cb(map[string]any{
+				"entity":    validateEntName(ctx),
+				"op":        validateOpName(ctx),
+				"direction": direction,
+				"errs":      errs,
+				"data":      data,
+			})
+		}
+	}
+
+	return errs
+}
+
+func validateOpSpec(espec map[string]any, opname string) any {
+	if espec == nil {
+		return nil
+	}
+	ops, _ := espec["op"].(map[string]any)
+	if ops == nil {
+		return nil
+	}
+	return ops[opname]
+}
+
+func validateOpName(ctx *core.Context) string {
+	if ctx.Op != nil {
+		return ctx.Op.Name
+	}
+	return ""
+}
+
+func validateEntName(ctx *core.Context) string {
+	if ctx.Entity != nil {
+		if n := ctx.Entity.GetName(); "" != n {
+			return n
+		}
+	}
+	if ctx.Op != nil {
+		return ctx.Op.Entity
+	}
+	return ""
+}
+
+// A RESULT RECORD AS DATA.
+//
+// MakeResult turns every record of a LIST into an entity instance, so what
+// reaches PreDone for a list is wrappers, not records - and a wrapper checked
+// against a field spec fails on every required field while its actual data
+// goes unchecked. A load returns the record itself, so this handles both.
+func validateUnwrap(record any) any {
+	if ent, ok := record.(core.Entity); ok && ent != nil {
+		if data := ent.Data(); data != nil {
+			return data
+		}
+	}
+	return record
+}
+
+// The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+// error rather than a pass. Rebuilt rather than mutated: core.ENTITYSPEC is a
+// package constant shared by every client in the process.
+func validateClose(node any) any {
+	switch n := node.(type) {
+	case []any:
+		out := make([]any, 0, len(n))
+		for _, item := range n {
+			out = append(out, validateClose(item))
+		}
+		return out
+
+	case map[string]any:
+		// Sorted, so a rebuilt spec is byte-stable when it is printed in an
+		// error - go map order is randomised per run.
+		keys := make([]string, 0, len(n))
+		for k := range n {
+			if validateOpenKey != k {
+				keys = append(keys, k)
+			}
+		}
+		sort.Strings(keys)
+
+		out := make(map[string]any, len(keys))
+		for _, k := range keys {
+			out[k] = validateClose(n[k])
+		}
+		return out
+	}
+
+	return node
+}
+
+// Built rather than written, so the backticks cannot be lost in an edit.
+var validateOpenKey = string(rune(96)) + "$OPEN" + string(rune(96))

package/project/.sdk/tm/go/test/omni/omni.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (go/omni.go)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (go/omni.go)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/go/test/omni/util.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (go/util.go)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (go/util.go)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/go/utility/make_options.go

@@ -93,60 +93,19 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 		}
 	}
 
-	optspec := map[string]any{
-		"apikey": "",
-		"base":   "http://localhost:8000",
-		"prefix": "",
-		"suffix": "",
-		"auth": map[string]any{
-			"prefix": "",
-		},
-		"headers": map[string]any{
-			"`$CHILD`": "`$STRING`",
-		},
-		"allow": map[string]any{
-			"method": "GET,PUT,POST,PATCH,DELETE,OPTIONS",
-			"op":     "create,update,load,list,remove,command,direct,graphql",
-		},
-		"entity": map[string]any{
-			"`$CHILD`": map[string]any{
-				"`$OPEN`": true,
-				"active":  false,
-				"alias":   map[string]any{},
-			},
-		},
-		"feature": map[string]any{
-			"`$CHILD`": map[string]any{
-				"`$OPEN`": true,
-				"active":  false,
-			},
-		},
-		"utility": map[string]any{},
-		// Feature INSTANCES supplied at construction (the station adopt
-		// path): consumed by the constructor's featureAdd loop, so they
-		// are class instances, not data - `$ANY` accepts them verbatim.
-		// Without this entry the seam is dead: the constructor reads
-		// options.extend, but validate rejected the key (mirrors
-		// MakeOptionsUtility.ts).
-		"extend": "`$ANY`",
-		"system": map[string]any{},
-		"test": map[string]any{
-			"active": false,
-			"entity": map[string]any{
-				"`$OPEN`": true,
-			},
-		},
-		"clean": map[string]any{
-			"keys": "key,token,id",
-		},
-		// Server-variable values for a templated base URL (OpenAPI server
-		// variables): {name} placeholders in "base" are substituted from this
-		// map at construction. Spec defaults arrive via the generated config;
-		// user values override them.
-		"server": map[string]any{
-			"`$CHILD`": "",
-		},
-	}
+	// THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+	//
+	// core.OPTSPEC is built from the model: `main.kit.optspec` for the
+	// standard options, plus one entry per feature this target carries, taken
+	// from that feature's own `config.options` / `config.optspec`. Editing
+	// this file to add an option would put it back where it was — one of
+	// twenty hand-maintained copies of a schema nothing cross-checked — so
+	// add it to the model instead and every ported target validates it.
+	//
+	// NOT MUTATED. It is a package-level map shared by every client this
+	// process constructs; the platform default below is applied to the
+	// RESULT, never to the spec.
+	optspec := core.OPTSPEC
 
 	// Preserve system.fetch before merge/validate.
 	var sysFetch any

package/project/.sdk/tm/go/utility/struct/voxgigstruct.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.0 (go/voxgigstruct.go)
-// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd. MIT LICENSE. */
 
@@ -3867,13 +3867,29 @@ func init_validate_ONE() {
 				return nil
 			}
 
-			// Get grandparent and grandkey to replace the structure
-			grandparent := inj.Nodes.List[len(inj.Nodes.List)-2]
-			grandkey := inj.Path.List[len(inj.Path.List)-2]
+			// PATCH (optspec port, pending upstream fix): use inj.setval, as
+			// the ts reference and the py/java ports do, instead of writing
+			// through a hand-held grandparent.
+			//
+			// setval DELETES on a nil value; SetProp deliberately keeps one
+			// ("Preserve nil values (like JS null)"). For a key the DATA does
+			// not have, the reference therefore removes the `[$ONE, ...]` node
+			// outright, while this set it to the data's nil and then, below,
+			// to whichever alternative matched. An OPTIONAL entry
+			// (`['`$ONE`', <spec>, '`$NIL`']`) that the caller omitted came
+			// back MATERIALISED, complete with the spec's `$OPEN` marker and a
+			// null for every option — which is exactly what that encoding
+			// exists to prevent. In an SDK's option spec that put an entry in
+			// `options.feature` for every feature the model declares, and the
+			// feature ADD ORDER is derived from those keys.
+			//
+			// Reassigning inj.Parent is part of the same divergence: the
+			// reference leaves it pointing at the `[$ONE, ...]` LIST, so the
+			// write-back below lands on a list under a string key and is a
+			// no-op — the data node, already replaced above, is what survives.
 
 			// Clean up structure by replacing [$ONE, ...] with current value
-			SetProp(grandparent, grandkey, inj.Dparent)
-			inj.Parent = inj.Dparent
+			inj.setval(inj.Dparent, 2)
 
 			// Adjust the path
 			inj.Path.List = inj.Path.List[:len(inj.Path.List)-1]
@@ -3902,8 +3918,8 @@ func init_validate_ONE() {
 				// Attempt validation of data with shape `tval`
 				vcurrent, err := Validate(inj.Dparent, tval, &Injection{Extra: vstore, Errs: terrs})
 
-				// Update the value in the grandparent
-				SetProp(grandparent, grandkey, vcurrent)
+				// PATCH (optspec port, pending upstream fix): see above.
+				inj.setval(vcurrent, -2)
 
 				// If no errors, we found a match
 				if err == nil && len(terrs.List) == 0 {