@voxgig/sdkgen 4.20.0 → 4.21.0

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/onepassword.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/onepassword.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ruby/lib/voxgig_sekreto/plugins/onepassword.rb)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/secretspec.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/secretspec.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ruby/lib/voxgig_sekreto/plugins/secretspec.rb)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/plugins/sigv4.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/plugins/sigv4.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ruby/lib/voxgig_sekreto/plugins/sigv4.rb)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/providers.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/providers.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ruby/lib/voxgig_sekreto/providers.rb)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 
@@ -20,8 +20,9 @@
 #
 # THIS FILE REQUIRES NO net/http, NO openssl AND NO open3. What makes a
 # kind built in is that it needs nothing of the platform beyond reading a
-# local file; every kind that opens a socket, signs a request or spawns a
-# process is a plugin under plugins/, its own file, required only by a
+# local file; every kind that opens a socket, signs a request, spawns a
+# process or does cryptography is a plugin under plugins/, its own file,
+# required only by a
 # program that names it (docs/design/plugin-providers.md).
 #
 # A port of typescript/src/provider/support.ts and
@@ -204,7 +205,7 @@ module VoxgigSekreto
     'builtin' => %w[env memory dotenv file].freeze,
     'plugin' => %w[
       hashicorp boru awssecrets awsparams gcpsecrets azuresecrets
-      onepassword doppler infisical secretspec
+      onepassword doppler infisical secretspec minivault
     ].freeze
   }.freeze
 end

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto/sekreto.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto/sekreto.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ruby/lib/voxgig_sekreto/sekreto.rb)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/secrets/voxgig_sekreto.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (ruby/lib/voxgig_sekreto.rb)
-# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (ruby/lib/voxgig_sekreto.rb)
+# Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # frozen_string_literal: true
 

package/project/.sdk/tm/rb/feature/validate_feature.rb

@@ -0,0 +1,265 @@
+# ProjectName SDK validate feature
+#
+# Payload validation against the model's own field types. The ruby port of
+# tm/ts/src/feature/validate/ValidateFeature.ts.
+#
+# The specs are NOT written here and not written in the model either: every
+# entity field already carries a canonical type sentinel ("$STRING",
+# "$INTEGER", the "$ONE" union for an OpenAPI multi-type), which is the same
+# vocabulary VoxgigStruct.validate speaks. The generator maps them once
+# (helpers/canonSpec) and emits ProjectNameSchema::ENTITYSPEC, so a field
+# whose type changes in the API spec changes what this feature enforces with
+# no edit anywhere.
+#
+# WHAT IS CHECKED
+#   outbound (PreSpec)  the payload the caller asked to send, against
+#                       spec["op"][opname] - the operation's request shape.
+#   inbound  (PreDone)  each record the operation returned, against
+#                       spec["data"] - the entity's own field types.
+#
+# WHAT IS NOT. The model carries no array element types, no nested object
+# schemas, no enums, formats or bounds, so this checks the shape the model
+# knows and nothing more.
+
+require_relative 'base_feature'
+require_relative '../schema'
+require_relative '../utility/struct/voxgig_struct'
+
+class ProjectNameValidateFeature < ProjectNameBaseFeature
+  # Built rather than written, so the backticks cannot be lost in an edit.
+  OPEN = 96.chr + "$OPEN" + 96.chr
+
+  def initialize
+    super
+    @version = "0.0.1"
+    @name = "validate"
+    # Inactive until init (feature_init only fires init when active).
+    @active = false
+    @client = nil
+    @options = {}
+    @spec = {}
+    @request = true
+    @response = false
+    @mode = "throw"
+  end
+
+  def init(ctx, options)
+    @client = ctx.client
+    @options = options.is_a?(Hash) ? options : {}
+    @active = @options["active"] == true
+
+    # DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+    # config.options documents them and types them; it does not inject them,
+    # because each feature entry in the spec is optional and struct fills in
+    # nothing through an optional union.
+    @request = @options["request"] != false
+    @response = @options["response"] == true
+
+    # FAIL CLOSED. Only the exact string "report" selects report mode, so a
+    # typo (mode: "thow") still rejects rather than silently turning
+    # enforcement off. The option spec rejects the typo outright; this is what
+    # happens if it ever does not.
+    @mode = @options["mode"] == "report" ? "report" : "throw"
+
+    # `strict` is applied ONCE, here, by rebuilding the spec tree without the
+    # `$OPEN` markers - rather than per call, which would clone a spec for
+    # every request an SDK ever makes.
+    @spec = @options["strict"] == true ?
+      _close(ProjectNameSchema::ENTITYSPEC) : ProjectNameSchema::ENTITYSPEC
+  end
+
+  # Outbound. make_spec short-circuits on a ctx.out["spec"] that is already
+  # set, so assigning the error here rejects the operation before the request
+  # is built - the same seam rbac uses one stage earlier.
+  def PreSpec(ctx)
+    return unless @active && @request
+
+    opname = _opname(ctx)
+    espec = _entity_spec(ctx)
+    ops = espec.is_a?(Hash) ? espec["op"] : nil
+    opspec = ops.is_a?(Hash) ? ops[opname] : nil
+
+    return if opspec.nil?
+
+    errs = _check(ctx, _payload(ctx, opname), opspec, "request")
+    return if errs.empty? || @mode == "report"
+
+    err = ctx.make_error("validate_failed",
+      "Invalid #{opname} request for entity \"#{_entname(ctx)}\": #{errs.join('; ')}")
+    ctx.out["spec"] = err
+    err
+  end
+
+  # Inbound. PreDone rather than PreResult: the records are extracted from the
+  # response body by make_result, which runs between the two, so at PreResult
+  # there is nothing to check but the envelope.
+  #
+  # HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+  # PreDone hooks fire in feature ADD order, which defaults to `test` first and
+  # then names sorted - and `validate` sorts last, after audit, cost, debug,
+  # metrics and telemetry. Those observers therefore record the operation as a
+  # success before this hook has looked at it. Activating features as an
+  # ORDERED ARRAY fixes it.
+  def PreDone(ctx)
+    return unless @active && @response
+
+    espec = _entity_spec(ctx)
+    return unless espec.is_a?(Hash)
+
+    dataspec = espec["data"]
+    return if dataspec.nil?
+
+    result = ctx.result
+    return if result.nil? || result.resdata.nil?
+
+    # A list op returns many records and a load returns one; both are checked
+    # against the same record spec, because they are the same entity.
+    records = result.resdata.is_a?(Array) ? result.resdata : [result.resdata]
+
+    errs = []
+    records.each do |record|
+      next if record.nil?
+
+      # A NON-OBJECT IS A FAILURE, not something to skip. A load that answered
+      # 42 where the entity's spec wants a record must not pass this feature
+      # silently - struct rejects it with the field it could not find.
+      errs.concat(_check(ctx, _unwrap(record), dataspec, "response"))
+    end
+
+    return if errs.empty? || @mode == "report"
+
+    err = ctx.make_error("validate_failed",
+      "Invalid response for entity \"#{_entname(ctx)}\": #{errs.join('; ')}")
+
+    # BOTH, and `ok` is the load-bearing half: done returns resdata whenever
+    # result.ok is true and never looks at err, so setting the error alone
+    # would hand the caller the very records that failed the spec.
+    result.ok = false
+    result.err = err
+
+    # AND THE DATA GOES. The load/update paths copy result.resdata into the
+    # entity's own state on any non-nil value, BEFORE done raises - so
+    # rejecting the operation while leaving the records in place would leave
+    # the caller holding an entity populated from a payload this feature had
+    # just declared invalid.
+    result.resdata = nil
+
+    err
+  end
+
+  # The payload an operation is about to send.
+  #
+  # TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+  # caller's argument in reqdata over the entity's data; a match op
+  # (load/list/remove) carries it in reqmatch over match. That is what the
+  # entity operations pass to make_context and what make_point reads - so
+  # reading reqdata for every op would check a load({id}) against the entity's
+  # STALE stored match and reject it for the id the caller had just supplied.
+  def _payload(ctx, opname)
+    body = ["create", "update", "patch"].include?(opname)
+
+    base = body ? ctx.data : ctx.match
+    req = body ? ctx.reqdata : ctx.reqmatch
+
+    out = {}
+    out.merge!(base) if base.is_a?(Hash)
+    out.merge!(req) if req.is_a?(Hash)
+
+    # `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record.
+    # make_point reads it off this same argument and the request transformer
+    # drops it before the body is built, so a spec built from the API's own
+    # fields will never name it - and under `strict` every custom-action call
+    # would be rejected for the one key that made it reachable.
+    out.delete("$action")
+
+    out
+  end
+
+  def _entity_spec(ctx)
+    return nil unless @spec.is_a?(Hash)
+    @spec[_entname(ctx)]
+  end
+
+  def _opname(ctx)
+    name = ctx.op.nil? ? nil : ctx.op.name
+    name.is_a?(String) ? name : ""
+  end
+
+  def _entname(ctx)
+    name = ctx.entity.nil? ? nil : ctx.entity.name
+    return name if name.is_a?(String) && !name.empty?
+
+    entname = ctx.op.nil? ? nil : ctx.op.entity
+    entname.is_a?(String) ? entname : ""
+  end
+
+  # One validate call. Errors are COLLECTED, never raised: struct raises on the
+  # first failure unless given an errs array, and a caller fixing a payload
+  # wants every problem with it, not the first one.
+  def _check(ctx, data, spec, direction)
+    errs = []
+
+    begin
+      VoxgigStruct.validate(data, spec, { "errs" => errs })
+    rescue StandardError => e
+      # A spec this port cannot run at all (rather than a payload that fails
+      # it) must not take the operation down with it: report it like any other
+      # failure and let `mode` decide.
+      errs << e.message if errs.empty?
+    end
+
+    errs = errs.map(&:to_s)
+
+    if !errs.empty?
+      on_invalid = @options["onInvalid"]
+      if on_invalid.respond_to?(:call)
+        begin
+          on_invalid.call({
+            "entity" => _entname(ctx),
+            "op" => _opname(ctx),
+            "direction" => direction,
+            "errs" => errs,
+            "data" => data,
+          })
+        rescue StandardError
+          nil
+        end
+      end
+    end
+
+    errs
+  end
+
+  # A RESULT RECORD AS DATA.
+  #
+  # make_result turns every record of a LIST into an entity instance, so what
+  # reaches PreDone for a list is wrappers, not records - and a wrapper checked
+  # against a field spec fails on every required field while its actual data
+  # goes unchecked. A load returns the record itself, so this handles both.
+  def _unwrap(record)
+    if record.respond_to?(:data)
+      begin
+        data = record.data
+      rescue StandardError
+        return record
+      end
+      return data unless data.nil?
+    end
+    record
+  end
+
+  # The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+  # error rather than a pass. Rebuilt rather than mutated: ENTITYSPEC is a
+  # module constant shared by every client in the process.
+  def _close(node)
+    return node.map { |n| _close(n) } if node.is_a?(Array)
+
+    if node.is_a?(Hash)
+      out = {}
+      node.each { |k, v| out[k] = _close(v) unless k == OPEN }
+      return out
+    end
+
+    node
+  end
+end

package/project/.sdk/tm/rb/test/vendor/omni/runner.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (ruby/lib/voxgig_omni/runner.rb)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (ruby/lib/voxgig_omni/runner.rb)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni: the shared multi-language test runner.
 #

package/project/.sdk/tm/rb/test/vendor/omni/util.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (ruby/lib/voxgig_omni/util.rb)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (ruby/lib/voxgig_omni/util.rb)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni internal JSON utilities.
 #

package/project/.sdk/tm/rb/test/vendor/omni/voxgig_omni.rb

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260908-1556-0 (ruby/lib/voxgig_omni.rb)
-# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+# VENDORED: @voxgig/omni sdk-20260917-1242-0 (ruby/lib/voxgig_omni.rb)
+# Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # voxgig_omni - shared multi-language test runner.
 

package/project/.sdk/tm/rb/utility/make_options.rb

@@ -1,5 +1,6 @@
 # ProjectName SDK utility: make_options
 require_relative 'struct/voxgig_struct'
+require_relative '../schema'
 module ProjectNameUtilities
   MakeOptions = ->(ctx) {
     options = ctx.options || {}
@@ -80,38 +81,20 @@ module ProjectNameUtilities
     config = ctx.config || {}
     cfgopts = config["options"].is_a?(Hash) ? config["options"] : {}
 
-    optspec = {
-      "apikey" => "",
-      "base" => "http://localhost:8000",
-      "secret" => "",
-      "prefix" => "",
-      "suffix" => "",
-      # `basic` and `secret`: HTTP Basic Auth needs a second credential and
-      # a flag to say the pair is Basic rather than a single bearer token.
-      "auth" => { "prefix" => "", "basic" => false },
-      "headers" => { "`$CHILD`" => "`$STRING`" },
-      "allow" => {
-        "method" => "GET,PUT,POST,PATCH,DELETE,OPTIONS",
-        "op" => "create,update,load,list,remove,command,direct,graphql",
-      },
-      "entity" => { "`$CHILD`" => { "`$OPEN`" => true, "active" => false, "alias" => {} } },
-      "feature" => { "`$CHILD`" => { "`$OPEN`" => true, "active" => false } },
-      "utility" => {},
-      # Feature INSTANCES supplied at construction (the station adopt
-      # path): consumed by the constructor's feature_add loop, so they are
-      # class instances, not data — `$ANY` accepts them verbatim. Without
-      # this entry the seam is dead: the constructor reads
-      # options["extend"], but validate rejected the key.
-      "extend" => "`$ANY`",
-      "system" => {},
-      "test" => { "active" => false, "entity" => { "`$OPEN`" => true } },
-      "clean" => { "keys" => "key,token,id" },
-      # Server-variable values for a templated base URL (OpenAPI server
-      # variables): {name} placeholders in "base" are substituted from this
-      # map at construction. Spec defaults arrive via the generated config;
-      # user values override them.
-      "server" => { "`$CHILD`" => "" },
-    }
+    # THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+    #
+    # `ProjectNameSchema::OPTSPEC` is built from the model:
+    # `main.kit.optspec` for the standard options, plus one entry per
+    # feature this target carries, taken from that feature's own
+    # `config.options` / `config.optspec`. Editing this file to add an
+    # option would put it back where it was — one of twenty
+    # hand-maintained copies of a schema nothing cross-checked — so add
+    # it to the model instead and every ported target validates it.
+    #
+    # NOT MUTATED. It is a frozen module constant shared by every client
+    # this process constructs; anything defaulted below is applied to the
+    # RESULT, never to the spec.
+    optspec = ProjectNameSchema::OPTSPEC
 
     sys_fetch = VoxgigStruct.getpath(opts, "system.fetch")
 

package/project/.sdk/tm/rb/utility/struct/voxgig_struct.rb

@@ -1740,7 +1740,30 @@ module VoxgigStruct
       end
 
       inj.keyI = size(inj.keys)
-      inj.setval(inj.dparent, 2)
+
+      # PATCH (optspec port, pending upstream fix): DELETE the `[$ONE, ...]`
+      # node when the data has no value there, as the ts reference does.
+      #
+      # setval carries a deliberate special case - "nil with ancestor: set to
+      # nil in grandparent (preserves key for $ONE/$EXACT)" - where ts deletes
+      # in BOTH branches. The consequence is that an OPTIONAL entry
+      # (`['`$ONE`', <spec>, '`$NIL`']`) the caller OMITTED comes back as a
+      # nil-valued key rather than staying absent, which is exactly what that
+      # encoding exists to prevent. In an SDK's option spec that put an entry
+      # in `options.feature` for every feature the model declares, and the
+      # feature ADD ORDER is derived from those keys.
+      #
+      # Confined to $ONE so $EXACT keeps the behaviour the special case was
+      # written for. ruby cannot tell an absent key from a stored nil here
+      # (getprop answers nil for both), so a stored nil under a $ONE is
+      # dropped too; ts would keep it. That is the narrower of the two
+      # divergences and the one nothing in this SDK relies on.
+      if inj.dparent.nil?
+        delprop(getelem(inj.nodes, -2), getelem(inj.path, -2))
+      else
+        inj.setval(inj.dparent, 2)
+      end
+
       inj.path = inj.path[0...-1]
       inj.key = getelem(inj.path, -1)
 

package/project/.sdk/tm/rust/core/mod.rs

@@ -1,7 +1,7 @@
 // ProjectName SDK core: the operation pipeline types.
 //
-// Static modules are templates (same for every API); `config` and `sdk`
-// are generated per-API by the sdkgen components.
+// Static modules are templates (same for every API); `config`, `schema` and
+// `sdk` are generated per-API by the sdkgen components.
 
 pub mod config;
 pub mod context;
@@ -12,6 +12,7 @@ pub mod operation;
 pub mod point;
 pub mod response;
 pub mod result;
+pub mod schema;
 pub mod sdk;
 pub mod spec;
 pub mod types;

package/project/.sdk/tm/rust/feature/secrets/plugin/capability.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/capability.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/capability.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Capabilities (§11.1).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/catalog.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/catalog.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/catalog.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The definition catalog (§10.1).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/config.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/config.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/config.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The declarative document (§9): normalization, and the ten-level
 //! precedence ladder.

package/project/.sdk/tm/rust/feature/secrets/plugin/depend.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/depend.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/depend.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dependency cardinality, policy, and the restart graph (§11.3).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/env.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/env.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/env.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Environment overrides (§9.5) - level 7 of the ladder.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/export.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/export.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/export.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Exports (§11).
 //!
@@ -26,7 +26,7 @@ pub struct Exported {
 }
 
 pub fn resolve_export(spec: &str, exported: &[Exported]) -> Result<Value, PluginError> {
-    let cut = match spec.find('/') {
+    let cut = match spec.rfind('/') {
         Some(c) => c,
         None => {
             return fail(

package/project/.sdk/tm/rust/feature/secrets/plugin/graph.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/graph.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/graph.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Whole-graph resolution (§11.4) - a phase, not a discovery.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/host.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/host.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/host.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The host: the lifecycle state machine (§5), extension points (§6), and
 //! resource capture (§8).
@@ -1530,6 +1530,28 @@ impl Inst {
             .insert(key.to_string(), value);
     }
 
+    /// WHICH provider this instance is bound to for `name` (§11.1), as a
+    /// ref, or None when nothing provides it.
+    ///
+    /// The host's own `capability` answers with the live providers
+    /// RANKED, not with the one THIS instance took; §11.4's reluctant
+    /// rebinding makes those differ. A REF, not the instance: every port
+    /// can return a string and a corpus entry can assert on one. The
+    /// selection is REMEMBERED, because this is the instance asking.
+    pub fn capability(&self, name: &str) -> Option<String> {
+        // THE BORROW ENDS BEFORE `chosen` DOES. `chosen` remembers the
+        // selection, which takes `borrow_mut` on the same entry -- so
+        // reading the requirements inline held a shared borrow across it
+        // and panicked at the write. Rust is the only port that says so.
+        let reqs = requirements(&self.entry.borrow().options);
+        for req in reqs {
+            if req.get("name").as_str() == Some(name) {
+                return self.host.chosen(&self.entry, &req, true);
+            }
+        }
+        None
+    }
+
     /// What this instance can do for others (§11.1).
     pub fn provides(&self, prov: Value) {
         self.entry.borrow_mut().provides.push(prov);

package/project/.sdk/tm/rust/feature/secrets/plugin/mod.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/lib.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/lib.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 pub mod value;
 pub mod types;

package/project/.sdk/tm/rust/feature/secrets/plugin/order.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/order.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/order.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Ordering (§7) - one rule, one place.
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/point.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/point.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/point.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Extension points (§6). Three kinds, chosen because they are what the
 //! two existing systems actually needed, and no more.

package/project/.sdk/tm/rust/feature/secrets/plugin/refs.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/refs.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/refs.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Identity: name+tag, written `name$tag` (§4).
 //!

package/project/.sdk/tm/rust/feature/secrets/plugin/resolve.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/resolve.rs)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/resolve.rs)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dynamic resolution (§10.2) - name to candidate module ids.
 //!