@voxgig/sdkgen 4.20.0 → 4.21.0

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Onepassword.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Onepassword.scala)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (scala/plugins/Onepassword.scala)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // 1Password Connect, as a voxgig/plugin definition.
 

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Secretspec.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Secretspec.scala)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (scala/plugins/Secretspec.scala)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // SecretSpec, as a voxgig/plugin definition.
 

package/project/.sdk/tm/scala/feature/secrets/sekreto/plugins/Sigv4.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (scala/plugins/Sigv4.scala)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (scala/plugins/Sigv4.scala)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled - AND UNDER `plugins/`.
 //

package/project/.sdk/tm/scala/sdktest/vendor/omni/Json.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (scala/src/Json.scala)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (scala/src/Json.scala)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The omni JSON value model, with a small in-tree parser.
 //

package/project/.sdk/tm/scala/sdktest/vendor/omni/Runner.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (scala/src/Runner.scala)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (scala/src/Runner.scala)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (Scala port).
 //

package/project/.sdk/tm/scala/sdktest/vendor/omni/Util.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (scala/src/Util.scala)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (scala/src/Util.scala)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/scala/utility/Make.scala

@@ -303,47 +303,18 @@ object MakeOptions {
     var cfgopts = Helpers.toMapAny(config.get("options"))
     if (cfgopts == null) cfgopts = new LinkedHashMap[String, Object]()
 
-    val optspec = Json.parse(
-      "{"
-        + "\"apikey\": \"\","
-        // The SECOND credential, for the HTTP Basic scheme
-        // (base64(apikey:secret)). Named by main.kit.optspec but missing
-        // here, and validate drops what it does not name - so a caller
-        // that supplied `secret` never had it reach prepareAuth.
-        + "\"secret\": \"\","
-        + "\"base\": \"http://localhost:8000\","
-        + "\"prefix\": \"\","
-        + "\"suffix\": \"\","
-        // WHERE the credential goes and under what name, plus the HTTP
-        // Basic switch. `Struct.validate` DROPS a key this spec does not
-        // name, so without these three the generated Config's auth block
-        // was trimmed back to `prefix` on the way in and the SDK could not
-        // see its own scheme - which made Config_scala's `in`/`name`
-        // emission inert. Mirrors main.kit.optspec.auth in
-        // @voxgig/sdkgen/model/sdkgen.aon, which ts builds its OPTSPEC from.
-        + "\"auth\": { \"prefix\": \"\", \"basic\": false,"
-        + "          \"in\": \"\", \"name\": \"\" },"
-        + "\"headers\": { \"`$CHILD`\": \"`$STRING`\" },"
-        + "\"allow\": {"
-        + "  \"method\": \"GET,PUT,POST,PATCH,DELETE,OPTIONS\","
-        + "  \"op\": \"create,update,load,list,remove,command,direct,graphql\""
-        + "},"
-        + "\"entity\": { \"`$CHILD`\": {"
-        + "  \"`$OPEN`\": true, \"active\": false, \"alias\": {} } },"
-        + "\"feature\": { \"`$CHILD`\": {"
-        + "  \"`$OPEN`\": true, \"active\": false } },"
-        + "\"utility\": {},"
-        // `extend` carries LIVE Feature objects a caller hands in, and an
-        // optspec with no entry for a key makes Struct.validate DROP it -
-        // silently, so `new Client(Map.of("extend", List.of(feature)))`
-        // built a client with no such feature and nothing said so. `$ANY`
-        // passes the list through untouched, which is what go's optspec
-        // does (tm/go/utility/make_options.go).
-        + "\"extend\": \"`$ANY`\","
-        + "\"system\": {},"
-        + "\"test\": { \"active\": false, \"entity\": { \"`$OPEN`\": true } },"
-        + "\"clean\": { \"keys\": \"key,token,id\" }"
-        + "}").asInstanceOf[JMap[String, Object]]
+    // THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+    //
+    // Built from the model: `main.kit.optspec` for the standard options, plus
+    // one entry per feature this target carries, from that feature's own
+    // `config.options` / `config.optspec`. Editing this file to add an option
+    // would put it back where it was - one of twenty hand-maintained copies of
+    // a schema nothing cross-checked - so add it to the model instead and
+    // every ported target validates it.
+    //
+    // Already parsed, and shared: makeOptions validates AGAINST the spec and
+    // writes into the options, never into the spec.
+    val optspec = Schema.optspec
 
     // Preserve system.fetch before merge/validate.
     var sysFetch = Struct.getpath(opts, java.util.List.of("system", "fetch"))

package/project/.sdk/tm/scala/utility/MakeSpec.scala

@@ -6,7 +6,14 @@ import SCALAPACKAGE.utility.struct.Struct
 
 object MakeSpec {
   def makeSpec(ctx: Context): Spec = {
-    ctx.out.get("spec") match { case s: Spec => ctx.spec = s; return ctx.spec; case _ => }
+    // A PreSpec feature hook (e.g. validate) may short-circuit by storing an
+    // error here; surface it before the request is built, the same way
+    // makePoint surfaces out["point"].
+    ctx.out.get("spec") match {
+      case e: RuntimeException => throw e
+      case s: Spec => ctx.spec = s; return ctx.spec
+      case _ =>
+    }
 
     val point = ctx.point
     val options = ctx.options

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/ValidateFeature.swift

@@ -0,0 +1,273 @@
+// Payload validation against the model's own field types. The swift port of
+// tm/ts/src/feature/validate/ValidateFeature.ts.
+//
+// The specs are NOT written here and not written in the model either: every
+// entity field already carries a canonical type sentinel (`$STRING`,
+// `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+// vocabulary `validate` speaks. The generator maps them once
+// (helpers/canonSpec) and emits `SdkSchema.entityspec`, so a field whose type
+// changes in the API spec changes what this feature enforces with no edit
+// anywhere.
+//
+// WHAT IS CHECKED
+//   outbound (preSpec)  the payload the caller asked to send, against
+//                       spec.op[opname] - the operation's request shape.
+//   inbound  (preDone)  each record the operation returned, against
+//                       spec.data - the entity's own field types.
+//
+// WHAT IS NOT. The model carries no array element types, no nested object
+// schemas, no enums, formats or bounds, so this checks the shape the model
+// knows and nothing more.
+
+import Foundation
+
+// `.noval` (TS undefined) and `.null` both read as "absent" for the checks
+// below; Value carries the two predicates separately, so this names the pair
+// once rather than at each call site.
+private extension Value {
+  var isAbsent: Bool { isNoval || isNull }
+}
+
+public final class ValidateFeature: BaseFeature {
+  private var client: ProjectNameSDK?
+  private var options: VMap?
+  private var spec: Value = .map(VMap())
+
+  private var request = true
+  private var response = false
+  private var mode = "throw"
+
+  // The `onInvalid` callback, set after construction: the model types it a
+  // `$FUNCTION` and an option VMap parsed out of JSON cannot carry one.
+  public var onInvalid: ((VMap) -> Void)?
+
+  public override init() {
+    super.init()
+    version = "0.0.1"
+    name = "validate"
+    active = true
+  }
+
+  public override func initFeature(_ ctx: Context, _ options: VMap) {
+    client = ctx.client
+    self.options = options
+    active = foptBool(options, "active", false)
+
+    // DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+    // `config.options` documents them and types them; it does not inject
+    // them, because each feature entry in the spec is optional and struct
+    // fills in nothing through an optional union. So every feature resolves
+    // its own.
+    request = foptBool(options, "request", true)
+    response = foptBool(options, "response", false)
+
+    // FAIL CLOSED. Only the exact string "report" selects report mode, so a
+    // typo (`mode: "thow"`) still rejects rather than silently turning
+    // enforcement off - the failure nobody would notice. The option spec
+    // rejects the typo outright; this is what happens if it ever does not.
+    mode = "report" == foptStr(options, "mode", "throw") ? "report" : "throw"
+
+    // `strict` is applied ONCE, here, by rebuilding the spec tree without the
+    // `$OPEN` markers - rather than per call, which would clone a spec for
+    // every request an SDK ever makes. REBUILT, not mutated: SdkSchema's
+    // entity spec is a static let every client in the process reads.
+    spec = foptBool(options, "strict", false)
+      ? ValidateFeature.close(SdkSchema.entityspec)
+      : SdkSchema.entityspec
+  }
+
+  // Outbound. makeSpecUtil throws an Error left in ctx.out["spec"], so storing
+  // the error here rejects the operation before the request is built - the
+  // same seam rbac uses one stage earlier through ctx.out["point"].
+  public override func preSpec(_ ctx: Context) {
+    if !active || !request {
+      return
+    }
+
+    let opname = ctx.op?.name ?? ""
+    let opspec = gp(gp(entitySpec(ctx), "op"), opname)
+    if opspec.isAbsent {
+      return
+    }
+
+    let errs = check(ctx, payload(ctx, opname), opspec, "request")
+    if errs.isEmpty || "report" == mode {
+      return
+    }
+
+    ctx.out["spec"] = ctx.makeError("validate_failed",
+      "Invalid " + opname + " request for entity \"" + entName(ctx) + "\": " +
+        errs.joined(separator: "; "))
+  }
+
+  // Inbound. preDone rather than preResult: the records are extracted from the
+  // response body by makeResult, which runs between the two, so at preResult
+  // there is nothing to check but the envelope.
+  //
+  // HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+  // preDone hooks fire in feature ADD order, which defaults to `test` first and
+  // then names sorted - and `validate` sorts last, after audit, cost, debug,
+  // metrics and telemetry. Those observers therefore record the operation as a
+  // success before this hook has looked at it. Activating features as an
+  // ORDERED LIST fixes it.
+  public override func preDone(_ ctx: Context) {
+    if !active || !response {
+      return
+    }
+
+    let dataspec = gp(entitySpec(ctx), "data")
+    if dataspec.isAbsent {
+      return
+    }
+
+    guard let result = ctx.result, !result.resdata.isAbsent else {
+      return
+    }
+
+    // A list op returns many records and a load returns one; both are checked
+    // against the same record spec, because they are the same entity.
+    let records: [Value] = result.resdata.asList.map { $0.items } ?? [result.resdata]
+
+    var errs: [String] = []
+    for record in records {
+      if record.isAbsent {
+        continue
+      }
+
+      // A NON-OBJECT IS A FAILURE, not something to skip. A load that answered
+      // 42 where the entity's spec wants a record must not pass this feature
+      // silently - struct rejects it with the field it could not find.
+      errs.append(contentsOf: check(ctx, ValidateFeature.unwrap(record), dataspec, "response"))
+    }
+
+    if errs.isEmpty || "report" == mode {
+      return
+    }
+
+    let err = ctx.makeError("validate_failed",
+      "Invalid response for entity \"" + entName(ctx) + "\": " +
+        errs.joined(separator: "; "))
+
+    // BOTH, and `ok` is the load-bearing half: done returns resdata whenever
+    // result.ok is true and never looks at err, so setting the error alone
+    // would hand the caller the very records that failed the spec.
+    result.ok = false
+    result.err = err
+
+    // AND THE DATA GOES. The load/update paths copy result.resdata into the
+    // entity's own state on any non-nil value, BEFORE done raises - so
+    // rejecting the operation while leaving the records in place would leave
+    // the caller holding an entity populated from a payload this feature had
+    // just declared invalid.
+    result.resdata = .noval
+  }
+
+  // The payload an operation is about to send.
+  //
+  // TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+  // caller's argument in `reqdata` over the entity's `data`; a match op
+  // (load/list/remove) carries it in `reqmatch` over `match`. That is what the
+  // entity operations pass to the context and what makePoint reads - so
+  // reading `reqdata` for every op would check a `load(["id": ...])` against
+  // the entity's STALE stored match and reject it for the id the caller had
+  // just supplied.
+  private func payload(_ ctx: Context, _ opname: String) -> Value {
+    let body = "create" == opname || "update" == opname || "patch" == opname
+
+    let base = body ? ctx.data : ctx.match
+    let req = body ? ctx.reqdata : ctx.reqmatch
+
+    let out = VMap()
+    for src in [base, req] {
+      for (k, v) in src.entries {
+        out.entries[k] = v
+      }
+    }
+
+    // `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record.
+    // makePoint reads it off this same argument and the request transformer
+    // drops it before the body is built, so a spec built from the API's own
+    // fields will never name it - and under `strict` every custom-action call
+    // would be rejected for the one key that made it reachable.
+    out.entries.removeValue(forKey: "$action")
+
+    return .map(out)
+  }
+
+  private func entitySpec(_ ctx: Context) -> Value {
+    gp(spec, entName(ctx))
+  }
+
+  private func entName(_ ctx: Context) -> String {
+    if let name = ctx.entity?.getName(), !name.isEmpty {
+      return name
+    }
+    return ctx.op?.entity ?? ""
+  }
+
+  // One validate call. Errors are COLLECTED, never thrown: `validate` raises
+  // on the first failure unless given an `errs` list, and a caller fixing a
+  // payload wants every problem with it, not the first one.
+  private func check(_ ctx: Context, _ data: Value, _ spec: Value,
+                     _ direction: String) -> [String] {
+    let inj = Injection(val: .noval, parent: .noval)
+    inj.errs = VList()
+    _ = validate(data, spec, inj)
+
+    let errs = inj.errs.items.map { $0.asString ?? stringify($0) }
+
+    if !errs.isEmpty, let cb = onInvalid {
+      // A callback receiving every failure, whatever `mode` does with it, so a
+      // client can log or count invalid payloads without changing what the SDK
+      // returns.
+      let report = VMap()
+      report.entries["entity"] = .string(entName(ctx))
+      report.entries["op"] = .string(ctx.op?.name ?? "")
+      report.entries["direction"] = .string(direction)
+      report.entries["errs"] = .list(errs.map { Value.string($0) })
+      report.entries["data"] = data
+      cb(report)
+    }
+
+    return errs
+  }
+
+  // Built rather than written, so the backticks cannot be lost in an edit.
+  private static let OPEN = String(UnicodeScalar(96)) + "$OPEN" + String(UnicodeScalar(96))
+
+  // A RESULT RECORD AS DATA.
+  //
+  // makeResult turns every record of a LIST into an entity instance held in a
+  // `.native` node, so what reaches preDone for a list is wrappers, not
+  // records - and a wrapper checked against a field spec fails on every
+  // required field while its actual data goes unchecked. A load returns the
+  // record itself, so this handles both.
+  private static func unwrap(_ record: Value) -> Value {
+    if let ent = record.asNative as? Entity {
+      let data = ent.data()
+      if !data.isAbsent {
+        return data
+      }
+    }
+    return record
+  }
+
+  // The spec tree with every `$OPEN` marker removed, so an undeclared key is
+  // an error rather than a pass. Rebuilt rather than mutated: SdkSchema's
+  // entity spec is shared by every client in the process.
+  private static func close(_ node: Value) -> Value {
+    if let list = node.asList {
+      return .list(list.items.map { close($0) })
+    }
+
+    if let map = node.asMap {
+      let out = VMap()
+      for (k, v) in map.entries where k != OPEN {
+        out.entries[k] = close(v)
+      }
+      return .map(out)
+    }
+
+    return node
+  }
+}

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Capability.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Capability.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Capability.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Capabilities (section 11.1).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Catalog.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Catalog.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Catalog.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The definition catalog (section 10.1).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Config.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Config.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Config.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The declarative document (section 9): normalization, and the ten-level
 /// precedence ladder.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Depend.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Depend.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Depend.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Dependency cardinality, policy, and the restart graph (section 11.3).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Env.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Env.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Env.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Environment overrides (section 9.5) - level 7 of the ladder.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Export.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Export.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Export.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Exports (section 11).
 ///
@@ -28,7 +28,7 @@ public enum Export {
     }
 
     public static func resolveExport(_ spec: String, _ exported: [Exported]) throws -> Value {
-        guard let cut = spec.firstIndex(of: "/") else {
+        guard let cut = spec.lastIndex(of: "/") else {
             throw Types.fail(
                 "plugin_export_ambiguous", "export spec needs a key: \(spec)",
                 ["spec": .str(spec)]

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Graph.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Graph.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Graph.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Whole-graph resolution (section 11.4) - a phase, not a discovery.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Host.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Host.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Host.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The host: the lifecycle state machine (section 5), extension points
 /// (section 6), and resource capture (section 8).
@@ -170,6 +170,21 @@ public final class Inst {
         entry.exports[key] = value
     }
 
+    /// WHICH provider this instance is bound to for `name` (section
+    /// 11.1), as a ref, or nil when nothing provides it.
+    ///
+    /// The host's own `capability` answers with the live providers
+    /// RANKED, not with the one THIS instance took; section 11.4's
+    /// reluctant rebinding makes those differ. A REF, not the instance.
+    /// The selection is REMEMBERED, because this is the instance asking.
+    public func capability(_ name: String) -> String? {
+        for req in Depend.requirements(entry.options)
+        where req.at("name").asString == name {
+            return host.chosen(entry, req, true)
+        }
+        return nil
+    }
+
     /// What this instance can do for others (section 11.1).
     public func provides(_ prov: Value) {
         entry.provides.append(prov)

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Json.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Json.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Json.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The JSON parser.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Order.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Order.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Order.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Ordering (section 7) - one rule, one place.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Point.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Point.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Point.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Extension points (section 6). Three kinds, chosen because they are what the
 /// two existing systems actually needed, and no more.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Refs.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Refs.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Refs.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Identity: name+tag, written `name$tag` (section 4).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Resolve.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Resolve.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Resolve.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Dynamic resolution (section 10.2) - name to candidate module ids.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Types.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Types.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Types.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The error type, the sort key, and the handful of helpers every module needs.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Value.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Value.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Value.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The JSON value, and the only parser this port has.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Version.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (swift/src/Version.swift)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Version.swift)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Versions and ranges (section 11.2).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Aws.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Aws.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `awssecrets` and `awsparams` provider kinds: AWS Secrets Manager and
 // SSM Parameter Store.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Azuresecrets.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Azuresecrets.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Azuresecrets.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `azuresecrets` provider kind: Azure Key Vault.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Boru.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Boru.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Boru.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `boru` provider kind: a boru vault, through its CLI or its wire
 // protocol.