@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/rust/utility/make_point.rs

@@ -15,12 +15,6 @@ fn parts_len(point: &Value) -> usize {
     }
 }
 
-// Does this point's path end in a parameter? A record route ends in the
-// record's identifier (/boards/{id}); a cross-reference that also returns
-// the entity ends in the relationship's name (/posts/{id}/author). That,
-// then fewest segments, is what tells the entity's own route from a
-// cross-reference. The same rule runs at generation time, in
-// helpers/opShape.ts — both sides must move together.
 fn terminal_param(point: &Value) -> bool {
     match getp(point, "parts") {
         Value::List(l) => {
@@ -127,12 +121,6 @@ pub fn make_point_util(ctx: &Rc<Context>) -> Result<Value, ProjectNameError> {
         // so nothing matches — fall back to the entity's own route rather
         // than whichever point came last.
         if !matched {
-            // A request naming an action reaches here only because that
-            // action's own point failed its exist test, so it is unbuildable
-            // whatever we pick. Refuse it BEFORE choosing a fallback: the
-            // guard below compares the chosen point's $action and would wave
-            // the request through whenever the fallback lands on the action
-            // point itself.
             let unmatched_action = getp(&reqselector, "$action");
             if !unmatched_action.is_noval() {
                 return Err(ctx.make_error(

package/project/.sdk/tm/rust/utility/make_spec.rs

@@ -9,9 +9,16 @@ use crate::core::types::OutVal;
 use crate::utility::voxgigstruct::Value;
 
 pub fn make_spec_util(ctx: &Rc<Context>) -> Result<Rc<RefCell<Spec>>, ProjectNameError> {
-    if let Some(OutVal::Spec(sp)) = ctx.out_get("spec") {
-        *ctx.spec.borrow_mut() = Some(sp.clone());
-        return Ok(sp);
+    match ctx.out_get("spec") {
+        // A PreSpec feature hook (e.g. validate) may short-circuit the
+        // operation by storing an error here; surface it before the request
+        // is built, the same way make_point surfaces out["point"].
+        Some(OutVal::Err(err)) => return Err(err),
+        Some(OutVal::Spec(sp)) => {
+            *ctx.spec.borrow_mut() = Some(sp.clone());
+            return Ok(sp);
+        }
+        _ => {}
     }
 
     let point = ctx.point.borrow().clone();
@@ -58,10 +65,6 @@ pub fn make_spec_util(ctx: &Rc<Context>) -> Result<Rc<RefCell<Spec>>, ProjectNam
     };
 
     if "graphql" == kind {
-        // GraphQL addresses one endpoint: no path parts, no query string,
-        // and the body carries the operation. prepare_body is skipped
-        // deliberately — it only emits a body for data-input ops, whereas
-        // every GraphQL op posts one, including load/list/remove.
         let body = crate::utility::graphql::graphql_body_util(ctx);
         spec.borrow_mut().body = body;
         spec.borrow_mut().path = String::new();

package/project/.sdk/tm/rust/utility/voxgigstruct/consts.rs

@@ -27,7 +27,6 @@ pub const S_DTOP: &str = "$TOP";
 pub const S_DERRS: &str = "$ERRS";
 pub const S_DSPEC: &str = "$SPEC";
 
-// general
 pub const S_base: &str = "base";
 pub const S_key: &str = "key";
 pub const S_nil: &str = "nil";
@@ -37,7 +36,6 @@ pub const S_object: &str = "object";
 pub const S_list: &str = "list";
 pub const S_map: &str = "map";
 
-// chars
 pub const S_BT: &str = "`";
 pub const S_CN: &str = ":";
 pub const S_DS: &str = "$";
@@ -49,9 +47,7 @@ pub const S_SP: &str = " ";
 pub const S_CM: &str = ",";
 pub const S_VIZ: &str = ": ";
 
-// ---- type bit codes (u32) ---------------------------------------------
-// let t = 31; T_any = (1<<t--)-1; ... (see StructUtility.ts).
-pub const T_ANY: u32 = (1u32 << 31) - 1; // 0x7FFF_FFFF
+pub const T_ANY: u32 = (1u32 << 31) - 1;
 pub const T_NOVAL: u32 = 1 << 30; // property absent, undefined. NOT a scalar.
 pub const T_BOOLEAN: u32 = 1 << 29;
 pub const T_DECIMAL: u32 = 1 << 28;
@@ -65,29 +61,27 @@ pub const T_NULL: u32 = 1 << 22; // the actual JSON null value.
 pub const T_LIST: u32 = 1 << 14;
 pub const T_MAP: u32 = 1 << 13;
 pub const T_INSTANCE: u32 = 1 << 12;
-// t -= 4  => t = 7
 pub const T_SCALAR: u32 = 1 << 7;
 pub const T_NODE: u32 = 1 << 6;
 
-// TYPENAME indexed by Math.clz32(t). 26 entries (0..=25).
 pub const TYPENAME: [&str; 26] = [
-    "any",      // 0
+    "any",
     "nil",      // 1   clz32(T_noval=1<<30)
-    "boolean",  // 2   clz32(1<<29)
-    "decimal",  // 3   clz32(1<<28)
-    "integer",  // 4   clz32(1<<27)
-    "number",   // 5   clz32(1<<26)
-    "string",   // 6   clz32(1<<25)
-    "function", // 7   clz32(1<<24)
-    "symbol",   // 8   clz32(1<<23)
-    "null",     // 9   clz32(1<<22)
-    "", "", "", "", "", "", "",         // 10..=16
+    "boolean",
+    "decimal",
+    "integer",
+    "number",
+    "string",
+    "function",
+    "symbol",
+    "null",
+    "", "", "", "", "", "", "",
     "list",     // 17  clz32(1<<14)
     "map",      // 18  clz32(1<<13)
     "instance", // 19  clz32(1<<12)
-    "", "", "", "",       // 20..=23
-    "scalar", // 24  clz32(1<<7)
-    "node",   // 25  clz32(1<<6)
+    "", "", "", "",
+    "scalar",
+    "node",
 ];
 
 pub const MAXDEPTH: i64 = 32;

package/project/.sdk/tm/rust/utility/voxgigstruct/major.rs

@@ -626,7 +626,6 @@ pub fn get_path_inj(store: &Value, path: &Value, injdef: Option<&Inj>) -> Value
                         if ascends == 0 {
                             val = dparent.clone();
                         } else {
-                            // fullpath = slice(dpath, -ascends) ++ parts[p_i+1..]
                             let head = slice(
                                 Value::list(dpath.iter().cloned().map(Value::Str).collect()),
                                 Some(-ascends),
@@ -738,13 +737,7 @@ pub fn set_path(store: &Value, path: &Value, val: Value, injdef: Option<&InjectD
     parent
 }
 
-// ---------------------------------------------------------------------
-// inject / transform / validate / select — staged (see rs/PLAN.md, NOTES.md)
-// ---------------------------------------------------------------------
 
-/// Default inject handler (`_injecthandler`): if the value is a `$NAME`
-/// command function, call it; otherwise, in `val` mode for a full-string
-/// injection, write the value back into the parent.
 pub fn inject_handler_fn() -> NativeFn {
     Rc::new(inject_handler)
 }
@@ -766,7 +759,6 @@ fn inject_handler(inj: &Inj, val: &Value, r: &str, store: &Value) -> Value {
     val.clone()
 }
 
-/// `_injectstr` — substitute `` `path` `` references inside a string.
 fn injectstr(val: &str, store: &Value, inj: Option<&Inj>) -> Value {
     if val.is_empty() {
         return Value::str("");
@@ -1330,7 +1322,6 @@ fn transform_ref(inj: &Inj, val: &Value, _r: &str, store: &Value) -> Value {
         let keylen = inj.borrow().keys.borrow().len() as i64;
         inj.borrow_mut().key_i = keylen;
     }
-    // spec = ($SPEC)()
     let spec = {
         let sf = get_prop(store, &Value::str(S_DSPEC), Value::Noval);
         match &sf {
@@ -1816,7 +1807,6 @@ fn iso_now() -> String {
         .unwrap_or_default();
     let secs = dur.as_secs() as i64;
     let millis = dur.subsec_millis();
-    // days since 1970-01-01
     let days = secs.div_euclid(86_400);
     let tod = secs.rem_euclid(86_400);
     let (h, m, s) = (tod / 3600, (tod % 3600) / 60, tod % 60);
@@ -2169,8 +2159,6 @@ fn validate_exact(inj: &Inj, _v: &Value, _r: &str, _store: &Value) -> Value {
     Value::Noval
 }
 
-/// `_validation` — the modify hook installed by `validate` (runs after the
-/// per-key special commands).
 fn validation_modify(pval: &Value, key: &Value, parent: &Value, inj: &Inj, _store: &Value) {
     if pval.is_skip() {
         return;
@@ -2278,7 +2266,6 @@ fn validation_modify(pval: &Value, key: &Value, parent: &Value, inj: &Inj, _stor
     }
 }
 
-/// `_validatehandler` — `getpath`/`_injectstr` handler installed by `validate`.
 fn validatehandler(inj: &Inj, val: &Value, r: &str, store: &Value) -> Value {
     if let Some(caps) = R_META_PATH.captures(r) {
         if &caps[2] == "=" {

package/project/.sdk/tm/rust/utility/voxgigstruct/mini.rs

@@ -92,8 +92,6 @@ pub fn is_func(val: &Value) -> bool {
     matches!(val, Value::Func(_))
 }
 
-/// `size(val)` — length for lists/strings, key count for maps, integer
-/// part for numbers, 1/0 for booleans, 0 otherwise.
 pub fn size(val: &Value) -> i64 {
     match val {
         Value::List(l) => l.borrow().len() as i64,
@@ -170,7 +168,6 @@ pub fn slice(val: Value, start: Option<i64>, end: Option<i64>, mutate: bool) ->
                     }
                 }
                 Value::Str(st) => {
-                    // substring by UTF-16 units to match JS .substring
                     let units: Vec<u16> = st.encode_utf16().collect();
                     let sub: Vec<u16> = units[s as usize..e as usize].to_vec();
                     return Value::Str(String::from_utf16_lossy(&sub));
@@ -320,12 +317,6 @@ pub fn get_prop(val: &Value, key: &Value, alt: Value) -> Value {
     }
 }
 
-/// Internal raw lookup that PRESERVES a stored JSON null (Group B). Mirrors the
-/// canonical TS `_lookup` (StructUtility.ts:477): Group B callers — validate /
-/// transform commands / builders / inject internals — use this when they need
-/// the raw stored value at a slot regardless of whether it is null. The public
-/// `get_prop` / `get_elem` / `has_key` APIs treat null as absent (Group A) per
-/// UNDEF_SPEC.md. Returns `Noval` only when the key is genuinely absent.
 pub fn lookup(val: &Value, key: &Value) -> Value {
     if val.is_noval() || key.is_noval() {
         return Value::Noval;
@@ -523,7 +514,6 @@ pub fn re_find_all(pattern: &str, input: &str) -> Vec<Vec<String>> {
         .collect()
 }
 
-/// Replace every match. Supports `$&` (whole match) and `$1`..`$9` (captures).
 pub fn re_replace(pattern: &str, input: &str, replacement: &str) -> String {
     let re = match Regex::new(pattern) {
         Ok(r) => r,
@@ -826,10 +816,6 @@ pub fn stringify(val: &Value, maxlen: Option<i64>, pretty: bool) -> String {
     valstr
 }
 
-/// Compact JSON with object keys sorted (used by `stringify`). Functions and
-/// `undefined` map values are dropped. Cycles are not detected -> caller maps
-/// the failure to `__STRINGIFY_FAILED__` only if recursion overflows (which
-/// would actually panic); we approximate with a depth guard.
 fn human_json(val: &Value) -> Option<String> {
     human_json_depth(val, 0)
 }

package/project/.sdk/tm/rust/utility/voxgigstruct/mod.rs

@@ -53,8 +53,6 @@ impl std::fmt::Display for StructError {
 
 impl std::error::Error for StructError {}
 
-/// Bundle of all functions, mirroring the TS `StructUtility` class. Useful
-/// for the test harness (which looks subjects up by name).
 pub struct StructUtility;
 
 impl StructUtility {

package/project/.sdk/tm/rust/utility/voxgigstruct/ordered_map.rs

@@ -1,21 +1,3 @@
-// Minimal in-tree insertion-ordered map.
-//
-// Rust's `std::collections::HashMap` doesn't preserve insertion order, and
-// the canonical contract requires that JSON object key order survive every
-// operation. Other ports either get this for free (Python 3.7+ dict,
-// Ruby Hash, PHP array, JS object), or hand-roll an OrderedMap
-// (C / C++ / Zig). This is the Rust equivalent — keeps the port
-// dependency-free.
-//
-// Only the operations the rest of voxgig-struct uses are implemented:
-// `new`, `insert`, `get`, `contains_key`, `shift_remove`, `iter`,
-// `iter_mut`, `keys`, `values`, `len`, `is_empty`, indexing by `&str`,
-// `Clone`, `IntoIterator` and `FromIterator`.
-//
-// Parallel keys + values vectors preserve insertion order; a separate
-// `HashMap<String, usize>` indexes key -> position for O(1) lookup.
-// `shift_remove` is O(n) on a vec-shift plus an O(n) index rebuild; the
-// corpus's map sizes are modest so this is the right complexity trade.
 
 use std::collections::HashMap;
 use std::ops::Index;

package/project/.sdk/tm/rust/utility/voxgigstruct/re.rs

@@ -294,7 +294,6 @@ impl<'a> Parser<'a> {
                 && self.src[self.pos + 1] == b'P'
                 && self.src[self.pos + 2] == b'<'
             {
-                // Named group — consume name; we don't expose names but still capture.
                 self.pos += 3;
                 while self.pos < self.src.len() && self.src[self.pos] != b'>' {
                     self.pos += 1;
@@ -431,7 +430,6 @@ impl<'a> Parser<'a> {
                 // L0: SPLIT L1 L2; atom; JMP L0; L2:
                 self.code.insert(start, Insn::new(Op::Split(0, 0)));
                 self.shift_targets_after(start, 1);
-                // We've inserted one before start; compute after the atom (now end+1).
                 let after_atom = self.code.len(); // before JMP emit
                 self.emit(Op::Jmp(start as i32));
                 let exit = self.code.len();
@@ -452,7 +450,6 @@ impl<'a> Parser<'a> {
                 );
             }
             b'{' => {
-                // Emit n_lo mandatory copies (we already have one — the original atom).
                 for _ in 1..n_lo {
                     self.code_clone(start, end);
                 }
@@ -852,14 +849,6 @@ impl ThreadList {
     }
 
     fn add(&mut self, re: &Regex, input: &[u8], pc: usize, slots: &[i32], sp: usize) {
-        // Iterative epsilon-closure: we walk Jmp/Split/Save/Bol/Eol/Wb/Nwb
-        // until we hit a char-consuming op or Match. A recursive version
-        // overflows the stack on long Thompson chains (e.g. `a{0,10000}`
-        // unrolls into 10000 chained Splits — `cargo test` aborted with
-        // SIGABRT on the pathological-regex panel before this loop landed).
-        //
-        // The stack mirrors the recursive order: Split pushes y first then
-        // x, so x is processed first (priority preserved).
         let mut stack: Vec<(usize, Vec<i32>)> = vec![(pc, slots.to_vec())];
         while let Some((cur_pc, cur_slots)) = stack.pop() {
             if cur_pc >= re.code.len() {

package/project/.sdk/tm/rust/utility/voxgigstruct/value.rs

@@ -173,9 +173,6 @@ impl Value {
     }
 }
 
-// Deep, order-independent (for maps) equality — matches `deepStrictEqual`
-// semantics used by the corpus runner and the JSON-string fallback used by
-// `validate_EXACT`. Functions are never equal (pointer-eq would also do).
 impl PartialEq for Value {
     fn eq(&self, other: &Value) -> bool {
         match (self, other) {

package/project/.sdk/tm/scala/feature/ValidateFeature.scala

@@ -0,0 +1,286 @@
+package SCALAPACKAGE.feature
+
+import java.util.{ArrayList, LinkedHashMap, List => JList, Map => JMap}
+import SCALAPACKAGE.core.{Context, Entity, Schema, SdkClient}
+import SCALAPACKAGE.utility.struct.Struct
+
+// Payload validation against the model's own field types. The scala port of
+// tm/ts/src/feature/validate/ValidateFeature.ts.
+//
+// The specs are NOT written here and not written in the model either: every
+// entity field already carries a canonical type sentinel (`$STRING`,
+// `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+// vocabulary Struct.validate speaks. The generator maps them once
+// (helpers/canonSpec) and emits `Schema.entityspec`, so a field whose type
+// changes in the API spec changes what this feature enforces with no edit
+// anywhere.
+//
+// WHAT IS CHECKED
+//   outbound (preSpec)  the payload the caller asked to send, against
+//                       spec.op[opname] - the operation's request shape.
+//   inbound  (preDone)  each record the operation returned, against
+//                       spec.data - the entity's own field types.
+//
+// WHAT IS NOT. The model carries no array element types, no nested object
+// schemas, no enums, formats or bounds, so this checks the shape the model
+// knows and nothing more.
+class ValidateFeature extends BaseFeature("validate", "0.0.1", true) {
+
+  private var client: SdkClient = null
+  private var options: JMap[String, Object] = null
+  private var spec: JMap[String, Object] = new LinkedHashMap[String, Object]()
+
+  private var request: Boolean = true
+  private var response: Boolean = false
+  private var mode: String = "throw"
+
+  // The `onInvalid` callback, set after construction: the model types it a
+  // `$FUNCTION` and an option map parsed out of JSON cannot carry one.
+  var onInvalid: JMap[String, Object] => Unit = null
+
+  override def init(ctx: Context, options: JMap[String, Object]): Unit = {
+    this.client = ctx.client
+    this.options = options
+    this.active = FeatureOptions.foptBool(options, "active", false)
+
+    // DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+    // `config.options` documents them and types them; it does not inject
+    // them, because each feature entry in the spec is optional and struct
+    // fills in nothing through an optional union. So every feature resolves
+    // its own.
+    this.request = FeatureOptions.foptBool(options, "request", true)
+    this.response = FeatureOptions.foptBool(options, "response", false)
+
+    // FAIL CLOSED. Only the exact string "report" selects report mode, so a
+    // typo (`mode: "thow"`) still rejects rather than silently turning
+    // enforcement off - the failure nobody would notice. The option spec
+    // rejects the typo outright; this is what happens if it ever does not.
+    this.mode =
+      if ("report" == FeatureOptions.foptStr(options, "mode", "throw")) "report" else "throw"
+
+    // `strict` is applied ONCE, here, by rebuilding the spec tree without the
+    // `$OPEN` markers - rather than per call, which would clone a spec for
+    // every request an SDK ever makes. REBUILT, not mutated: Schema.entityspec
+    // is a lazy val every client in the process reads.
+    this.spec =
+      if (FeatureOptions.foptBool(options, "strict", false))
+        ValidateFeature.close(Schema.entityspec).asInstanceOf[JMap[String, Object]]
+      else Schema.entityspec
+  }
+
+  // Outbound. makeSpec throws a RuntimeException left in ctx.out["spec"], so
+  // storing the error here rejects the operation before the request is built -
+  // the same seam rbac uses one stage earlier through ctx.out["point"].
+  override def preSpec(ctx: Context): Unit = {
+    if (!this.active || !this.request) return
+
+    val opname = opName(ctx)
+    val opspec = opSpec(entitySpec(ctx), opname)
+    if (opspec == null) return
+
+    val errs = check(ctx, payload(ctx, opname), opspec, "request")
+    if (errs.isEmpty || "report" == this.mode) return
+
+    ctx.out.put("spec", ctx.makeError("validate_failed",
+      "Invalid " + opname + " request for entity \"" + entName(ctx) + "\": " +
+        errs.mkString("; ")))
+  }
+
+  // Inbound. preDone rather than preResult: the records are extracted from the
+  // response body by makeResult, which runs between the two, so at preResult
+  // there is nothing to check but the envelope.
+  //
+  // HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+  // preDone hooks fire in feature ADD order, which defaults to `test` first and
+  // then names sorted - and `validate` sorts last, after audit, cost, debug,
+  // metrics and telemetry. Those observers therefore record the operation as a
+  // success before this hook has looked at it. Activating features as an
+  // ORDERED LIST fixes it.
+  override def preDone(ctx: Context): Unit = {
+    if (!this.active || !this.response) return
+
+    val espec = entitySpec(ctx)
+    if (espec == null) return
+    val dataspec = espec.get("data")
+    if (dataspec == null) return
+
+    if (ctx.result == null || ctx.result.resdata == null) return
+
+    // A list op returns many records and a load returns one; both are checked
+    // against the same record spec, because they are the same entity.
+    val records = new ArrayList[Object]()
+    ctx.result.resdata match {
+      case l: JList[_] => records.addAll(l.asInstanceOf[JList[Object]])
+      case v => records.add(v)
+    }
+
+    val errs = new ArrayList[String]()
+    val it = records.iterator()
+    while (it.hasNext) {
+      val record = it.next()
+      if (record != null) {
+        // A NON-OBJECT IS A FAILURE, not something to skip. A load that
+        // answered 42 where the entity's spec wants a record must not pass this
+        // feature silently - struct rejects it with the field it could not find.
+        check(ctx, ValidateFeature.unwrap(record), dataspec, "response")
+          .foreach(e => errs.add(e))
+      }
+    }
+
+    if (errs.isEmpty || "report" == this.mode) return
+
+    val err = ctx.makeError("validate_failed",
+      "Invalid response for entity \"" + entName(ctx) + "\": " +
+        String.join("; ", errs))
+
+    // BOTH, and `ok` is the load-bearing half: done returns resdata whenever
+    // result.ok is true and never looks at err, so setting the error alone
+    // would hand the caller the very records that failed the spec.
+    ctx.result.ok = false
+    ctx.result.err = err
+
+    // AND THE DATA GOES. The load/update paths copy result.resdata into the
+    // entity's own state on any non-null value, BEFORE done raises - so
+    // rejecting the operation while leaving the records in place would leave
+    // the caller holding an entity populated from a payload this feature had
+    // just declared invalid.
+    ctx.result.resdata = null
+  }
+
+  // The payload an operation is about to send.
+  //
+  // TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+  // caller's argument in reqdata over the entity's data; a match op
+  // (load/list/remove) carries it in reqmatch over matchData. That is what the
+  // entity operations pass to the context and what makePoint reads - so
+  // reading reqdata for every op would check a load against the entity's STALE
+  // stored match and reject it for the id the caller had just supplied.
+  private def payload(ctx: Context, opname: String): JMap[String, Object] = {
+    val body = "create" == opname || "update" == opname || "patch" == opname
+
+    val base = if (body) ctx.data else ctx.matchData
+    val req = if (body) ctx.reqdata else ctx.reqmatch
+
+    val out = new LinkedHashMap[String, Object]()
+    if (base != null) out.putAll(base)
+    if (req != null) out.putAll(req)
+
+    // `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record.
+    // makePoint reads it off this same argument and the request transformer
+    // drops it before the body is built, so a spec built from the API's own
+    // fields will never name it - and under `strict` every custom-action call
+    // would be rejected for the one key that made it reachable.
+    out.remove("$action")
+
+    out
+  }
+
+  private def entitySpec(ctx: Context): JMap[String, Object] = {
+    if (this.spec == null) return null
+    this.spec.get(entName(ctx)) match {
+      case m: JMap[_, _] => m.asInstanceOf[JMap[String, Object]]
+      case _ => null
+    }
+  }
+
+  private def opSpec(espec: JMap[String, Object], opname: String): Object = {
+    if (espec == null) return null
+    espec.get("op") match {
+      case m: JMap[_, _] => m.asInstanceOf[JMap[String, Object]].get(opname)
+      case _ => null
+    }
+  }
+
+  private def opName(ctx: Context): String =
+    if (ctx.op == null || ctx.op.name == null) "" else ctx.op.name
+
+  private def entName(ctx: Context): String = {
+    if (ctx.entity != null) {
+      val name = ctx.entity.getName()
+      if (name != null && name.nonEmpty) return name
+    }
+    if (ctx.op != null && ctx.op.entity != null) ctx.op.entity else ""
+  }
+
+  // One validate call. Errors are COLLECTED, never thrown: Struct.validate
+  // throws on the first failure unless given an `errs` list, and a caller
+  // fixing a payload wants every problem with it, not the first one.
+  private def check(ctx: Context, data: Object, spec: Object,
+                    direction: String): Seq[String] = {
+    val collected = new ArrayList[Object]()
+    val opts = new LinkedHashMap[String, Object]()
+    opts.put("errs", collected)
+
+    try {
+      Struct.validate(data, spec, opts)
+    } catch {
+      case e: RuntimeException =>
+        // A spec this port cannot run at all (rather than a payload that fails
+        // it) must not take the operation down with it: report it like any
+        // other failure and let `mode` decide.
+        if (collected.isEmpty) {
+          collected.add(if (e.getMessage == null) e.toString else e.getMessage)
+        }
+    }
+
+    val errs = new ArrayList[String]()
+    val it = collected.iterator()
+    while (it.hasNext) errs.add(String.valueOf(it.next()))
+
+    if (!errs.isEmpty && this.onInvalid != null) {
+      // A callback receiving every failure, whatever `mode` does with it, so a
+      // client can log or count invalid payloads without changing what the SDK
+      // returns.
+      val report = new LinkedHashMap[String, Object]()
+      report.put("entity", entName(ctx))
+      report.put("op", opName(ctx))
+      report.put("direction", direction)
+      report.put("errs", errs)
+      report.put("data", data)
+      try { this.onInvalid(report) }
+      catch { case _: RuntimeException => /* a reporting callback must not fail the operation */ }
+    }
+
+    import scala.jdk.CollectionConverters._
+    errs.asScala.toSeq
+  }
+}
+
+object ValidateFeature {
+
+  // Built rather than written, so the backticks cannot be lost in an edit.
+  private val OPEN: String = 96.toChar.toString + "$OPEN" + 96.toChar.toString
+
+  // A RESULT RECORD AS DATA.
+  //
+  // makeResult turns every record of a LIST into an entity instance, so what
+  // reaches preDone for a list is wrappers, not records - and a wrapper checked
+  // against a field spec fails on every required field while its actual data
+  // goes unchecked. A load returns the record itself, so this handles both.
+  private def unwrap(record: Object): Object = record match {
+    case e: Entity =>
+      val data = e.data()
+      if (data != null) data else record
+    case _ => record
+  }
+
+  // The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+  // error rather than a pass. Rebuilt rather than mutated: Schema's entity spec
+  // is shared by every client in the process.
+  private def close(node: Object): Object = node match {
+    case l: JList[_] =>
+      val out = new ArrayList[Object]()
+      val it = l.asInstanceOf[JList[Object]].iterator()
+      while (it.hasNext) out.add(close(it.next()))
+      out
+    case m: JMap[_, _] =>
+      val out = new LinkedHashMap[String, Object]()
+      val it = m.asInstanceOf[JMap[String, Object]].entrySet().iterator()
+      while (it.hasNext) {
+        val e = it.next()
+        if (OPEN != e.getKey) out.put(e.getKey, close(e.getValue))
+      }
+      out
+    case v => v
+  }
+}

package/project/.sdk/tm/scala/feature/secrets/plugin/Capability.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (scala/src/Capability.scala)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (scala/src/Capability.scala)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package voxgig.plugin
 

package/project/.sdk/tm/scala/feature/secrets/plugin/Config.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (scala/src/Config.scala)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (scala/src/Config.scala)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package voxgig.plugin
 

package/project/.sdk/tm/scala/feature/secrets/plugin/Depend.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (scala/src/Depend.scala)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (scala/src/Depend.scala)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package voxgig.plugin
 

package/project/.sdk/tm/scala/feature/secrets/plugin/Env.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (scala/src/Env.scala)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (scala/src/Env.scala)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package voxgig.plugin
 

package/project/.sdk/tm/scala/feature/secrets/plugin/Export.scala

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (scala/src/Export.scala)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (scala/src/Export.scala)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package voxgig.plugin
 
@@ -21,7 +21,7 @@ object Export {
   final case class Exported(ref: String, key: String, value: Value)
 
   def resolveExport(spec: String, exported: List[Exported]): Value = {
-    val cut = spec.indexOf('/')
+    val cut = spec.lastIndexOf('/')
     if (cut < 0) {
       Types.fail(
         "plugin_export_ambiguous", "export spec needs a key: " + spec,