@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/ts/test/pipeline.test.ts

@@ -1,10 +1,4 @@
 
-// Direct unit tests for the operation-pipeline utilities. The generated
-// entity tests exercise the happy path; these drive the error and edge
-// branches (missing spec/response/result, 4xx handling, transport
-// failures, feature ordering, auth header shaping) that a normal
-// success-path op never reaches. All utilities are reached through
-// `stdutil`, so this suite is API-agnostic.
 
 import { test, describe } from 'node:test'
 import { strictEqual, ok, deepStrictEqual } from 'node:assert'
@@ -325,43 +319,66 @@ describe('pipeline:feature order', () => {
 
 describe('pipeline:prepareAuth', () => {
 
-  // Fake client so the exact options.auth / apikey shape is controlled.
-  function authCtx(options: any, headers: any) {
-    return base({ client: { options: () => options }, spec: headers == null ? null : { headers } })
+  function authCtx(options: any, spec: any) {
+    return base({ client: { options: () => options }, spec })
+  }
+
+  function bags(): any {
+    return { headers: {} as any, query: {} as any }
+  }
+
+  // Run prepareAuth with both containers present and see which one the
+  // generated utility writes to, and under what name. Null means this SDK
+  // places no credential at all — a public API — which is a legitimate
+  // shape, and the tests below assert exactly that instead.
+  const CRED = (() => {
+    const ctx = authCtx({ apikey: 'K', auth: { prefix: 'Bearer' } }, bags())
+    ;(stdutil as any).prepareAuth(ctx)
+    for (const where of ['headers', 'query'] as const) {
+      const name = Object.keys(ctx.spec[where] as any)[0]
+      if (null != name) return { where, name, value: ctx.spec[where][name] }
+    }
+    return null
+  })()
+
+  function placed(options: any, seed?: any) {
+    const spec: any = bags()
+    if (null != CRED && null != seed) spec[CRED.where][CRED.name] = seed
+    const ctx = authCtx(options, spec)
+    ;(stdutil as any).prepareAuth(ctx)
+    return null == CRED ? undefined : ctx.spec[CRED.where][CRED.name]
   }
 
   test('guards a missing spec', () => {
     strictEqual((stdutil as any).prepareAuth(authCtx({ auth: { prefix: '' }, apikey: 'K' }, null)).code, 'auth_no_spec')
   })
 
-  test('an apikey with a prefix is space-joined', () => {
-    const ctx = authCtx({ apikey: 'K', auth: { prefix: 'Bearer' } }, {})
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, 'Bearer K')
+  test('the apikey is placed where this API puts it', () => {
+    if (null == CRED) {
+      // A public API places nothing, and that is the whole assertion.
+      strictEqual(placed({ apikey: 'K', auth: { prefix: 'Bearer' } }), undefined)
+      return
+    }
+    ok('headers' === CRED.where || 'query' === CRED.where)
+    // A header credential is prefix-joined; a query credential is the raw
+    // key, because a query parameter has nowhere to put a scheme name.
+    strictEqual(CRED.value, 'headers' === CRED.where ? 'Bearer K' : 'K')
   })
 
   test('a raw apikey (empty prefix) goes in as-is', () => {
-    const ctx = authCtx({ apikey: 'K', auth: { prefix: '' } }, {})
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, 'K')
+    strictEqual(placed({ apikey: 'K', auth: { prefix: '' } }), null == CRED ? undefined : 'K')
   })
 
-  test('an empty apikey drops the header', () => {
-    const ctx = authCtx({ apikey: '', auth: { prefix: 'Bearer' } }, { authorization: 'stale' })
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('an empty apikey drops the credential', () => {
+    strictEqual(placed({ apikey: '', auth: { prefix: 'Bearer' } }, 'stale'), undefined)
   })
 
-  test('a public API (no auth block) drops the header', () => {
-    const ctx = authCtx({ apikey: 'K' }, { authorization: 'stale' })
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('a public API (no auth block) drops the credential', () => {
+    strictEqual(placed({ apikey: 'K' }, 'stale'), undefined)
   })
 
-  test('a missing apikey option drops the header', () => {
-    const ctx = authCtx({ auth: { prefix: 'Bearer' } }, { authorization: 'stale' })
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('a missing apikey option drops the credential', () => {
+    strictEqual(placed({ auth: { prefix: 'Bearer' } }, 'stale'), undefined)
   })
 })
 

package/project/.sdk/tm/ts/test/utility/Corpus.test.ts

@@ -6,19 +6,6 @@ import { join } from 'node:path'
 import { TEST_JSON_FILE } from './index'
 
 
-// Guards the shared corpus AS A WHOLE, which the per-section guard in the
-// language runners cannot do.
-//
-// That guard only fires for a section some test actually runs. Seven sections
-// — fetcher, makeFetchDef, makePoint, makeResult, featureAdd, featureHook and
-// featureInit — had no test calling them at all, so they sat at `set: []`
-// through two reviews reporting nothing. A fixture nobody runs is
-// indistinguishable from a fixture that passes.
-//
-// Deferral is therefore DATA (`basic.pending`), not a comment: comments do not
-// survive compilation to test.json, so a marker written only in the .aon
-// source cannot be checked by the thing that consumes it. Being data, these
-// invariants hold for every port, not just this one.
 describe('Corpus', () => {
 
   // Resolved the same way runner.ts resolves it — from dist-test/, one level

package/project/.sdk/tm/ts/test/utility/PrimaryUtility.test.ts

@@ -31,23 +31,11 @@ describe('PrimaryUtility', async () => {
   }
 
 
-  // Sections deliberately left empty in the shared corpus
-  // (.sdk/test/primary/<name>.aon carries a PENDING header). Everything
-  // else MUST contribute cases.
   const PENDING = new Set([
     'fetcher', 'makeFetchDef', 'makeResult',
     'featureAdd', 'featureHook', 'featureInit',
   ])
 
-  // Run one corpus section, failing loudly when it would run ZERO cases.
-  // A renamed section or a fixture that compiled to an empty `set` used to
-  // pass silently, which defeats the point of a shared oracle. (The guard
-  // lives here rather than in runner.ts, which is vendored verbatim from
-  // @voxgig/struct and must stay byte-identical to upstream.)
-  //
-  // EVERY corpus-backed test goes through here — a guard that only some
-  // sections opt into leaves the rest able to run zero assertions, which is
-  // the exact hole it was added to close.
   async function runsection(name: string, subject: Function) {
     const section = spec[name]
     ok(null != section,
@@ -70,10 +58,6 @@ describe('PrimaryUtility', async () => {
     spec = run.spec
     runset = run.runset
     runsetflags = run.runsetflags
-    // Under the old hand-vendored runner, run.client WAS the SDK; under
-    // omni it is the provider wrapping it. This suite treats the client as
-    // the SDK — including ASSIGNING to client._features, which prototype
-    // delegation cannot forward — so unwrap the real instance.
     client = (run.client as any).sdk
     utility = client.utility()
     struct = utility.struct
@@ -111,14 +95,65 @@ describe('PrimaryUtility', async () => {
   })
 
 
+  function credential() {
+    const ctx: any = {
+      utility,
+      client: { options: () => ({ apikey: 'PROBE', auth: { prefix: '' } }) },
+      spec: { headers: {}, query: {} },
+      error: (code: string, msg: string) => Object.assign(new Error(msg), { code }),
+    }
+    try { utility.prepareAuth(ctx) } catch (e) { return null }
+    for (const where of ['headers', 'query']) {
+      const name = Object.keys(ctx.spec[where] || {})[0]
+      if (null != name) return { where, name }
+    }
+    return null
+  }
+
+  // Rename the corpus's `headers` bag to the real container, and the
+  // `authorization` key inside it to the real credential name. Applied only
+  // to the prepareAuth section, so real header assertions elsewhere are
+  // untouched.
+  function retarget(node: any, cred: { where: string, name: string }): any {
+    if (null == node || 'object' !== typeof node) return node
+    if (Array.isArray(node)) return node.map((n) => retarget(n, cred))
+    const out: any = {}
+    for (const key of Object.keys(node)) {
+      if ('headers' === key) {
+        const bag: any = {}
+        for (const bk of Object.keys(node[key] || {})) {
+          bag['authorization' === bk ? cred.name : bk] = retarget(node[key][bk], cred)
+        }
+        out[cred.where] = bag
+      }
+      else out[key] = retarget(node[key], cred)
+    }
+    return out
+  }
+
   test('auth-basic', async () => {
     const sdkopts = spec.prepareAuth?.DEF?.setup?.a || {}
     const authClient = SDK.test({}, sdkopts)
-    await runsection('prepareAuth', (ctx: any) => {
-      ctx.client = authClient
-      fixctx(ctx)
-      return utility.prepareAuth(ctx)
-    })
+
+    const cred = credential()
+    ok(null != cred, 'prepareAuth placed no credential in headers or query')
+
+    const section = spec.prepareAuth
+    const original = section.basic
+    if ('headers' !== cred!.where || 'authorization' !== cred!.name) {
+      section.basic = retarget(original, cred!)
+    }
+
+    try {
+      await runsection('prepareAuth', (ctx: any) => {
+        ctx.client = authClient
+        fixctx(ctx)
+        return utility.prepareAuth(ctx)
+      })
+    }
+    finally {
+      section.basic = original
+    }
   })
 
 
@@ -233,7 +268,6 @@ describe('PrimaryUtility', async () => {
       body: 'present',
     })
     const reqClient = new (SDK as any)({
-      // Concrete base: a live construction must satisfy any server variables a templated base URL declares; a literal base sidesteps the requirement.
       base: 'http://localhost:8080',
       system: { fetch: mockFetch }
     })
@@ -283,13 +317,6 @@ describe('PrimaryUtility', async () => {
   })
 
 
-  // Was one hand-written case (the single-point path) covering one of this
-  // utility's seven branches, which is how the corpus fixture came to be
-  // marked deferred as "needs a real client". It does not: Context rebuilds
-  // `op` from opname + entity + config, and `options` can be supplied
-  // literally, so allow.op, the empty-points error, exist-selection,
-  // $action selection and the invalid-$action error are all expressible.
-  // Driven from the corpus now, so every port asserts the same branches.
   test('makePoint-basic', async () => {
     await runsection('makePoint', utility.makePoint)
   })

package/project/.sdk/tm/ts/test/utility/StructUtility.test.ts

@@ -315,12 +315,6 @@ describe('struct', async () => {
   })
 
 
-  // The struct.nullsem section: does a PRESENT key holding a JSON null
-  // read as "no value"? Opt-in per target (create-sdkgen ships it; an
-  // older project corpus may predate it - the skip below says so OUT
-  // LOUD rather than passing vacuously). All lanes run {null: false}:
-  // without the flag the runner rewrites every null to '__NULL__' and
-  // the section asserts nothing about null at all.
   test('nullsem', async (t) => {
     const nullsem = spec.nullsem
     if (null == nullsem) {
@@ -822,7 +816,6 @@ describe('struct', async () => {
     const extra = {
       $INTEGER: (inj: any) => {
         const { key } = inj
-        // let out = getprop(current, key)
         let out = struct.getprop(inj.dparent, key)
 
         let t = typeof out

package/project/.sdk/tm/ts/test/utility.ts

@@ -1,15 +1,8 @@
-/**
- * Shared utility functions for unit tests
- *
- * This module provides common helper functions used across unit tests
- * for creating test data, transformations, validations, and environment overrides.
- */
 
 import * as Fs from 'node:fs'
 import * as Path from 'node:path'
 
 
-// Creates a new step data structure within the data model
 function makeStepData(dm: Record<string, any>, stepname: string): Record<string, any> {
   dm.s[stepname] = {
     entity: undefined,
@@ -41,7 +34,6 @@ function makeReqdata(
 }
 
 
-// Validates data against validation rules and returns the result
 function makeValid(
   dm: Record<string, any>,
   validate: Function,
@@ -53,13 +45,10 @@ function makeValid(
 }
 
 
-// Creates a control object for test explanations when enabled
 function makeCtrl(explain: boolean) {
   return explain ? { explain: {} } : undefined
 }
-// CLAUDE: add a full stop to each function comment
 
-// Overrides configuration values with environment variables if available
 function envOverride(m: Record<string, any>) {
   if (
     'TRUE' === process.env.PROJECTENV_TEST_LIVE ||
@@ -167,35 +156,6 @@ function skipIfMissingIds(t: any, setup: any, requiredKeys: string[]): boolean {
 }
 
 
-// Extra SDK options every LIVE client is constructed with, from
-// sdk-test-control.json `test.client.options`.
-//
-// The generated live client knows two things: the base URL (from the spec)
-// and the credential (from the environment). Everything else about how a
-// particular API wants to be talked to — which features to switch on, and
-// with what settings — is a property of THAT API, known to the project and
-// to nothing in the toolchain.
-//
-// The concrete case: an API that issues short-lived access tokens needs the
-// `secrets` feature's exchange turned on and pointed at its token endpoint,
-// or the live suite gets a handful of calls in and then fails 401 with
-// nothing explaining why. There was no seam for that, so the suite could
-// not be run at all.
-//
-// A committed FILE rather than an environment variable, because it is
-// configuration, not a secret: it belongs in the repo next to the API it
-// describes, where it can be read and reviewed. Secrets still come from the
-// environment (the providers this block names read them).
-//
-// Merged UNDER the generated fields, so the suite's own base/apikey/server
-// values win — this adds to the live client, it does not redirect it.
-//
-// That contract is enforced HERE rather than left to each merge site: the
-// generated object only names a field when the model calls for one, so a
-// `base` in this block would face no competing value and would silently
-// redirect the whole suite — credential included — to another host. The
-// reserved fields are stripped once, where the block is read, so every
-// caller gets the same guarantee whether or not it happens to emit them.
 const LIVE_RESERVED = ['base', 'prefix', 'suffix', 'server', 'apikey', 'secret']
 
 function liveClientOptions(): Record<string, any> {
@@ -237,20 +197,6 @@ function liveDelay(liveEnvVar: string): () => Promise<void> {
 }
 
 
-// Load a .env.local file into process.env, replacing the `dotenv`
-// devDependency — the SDK's last non-tooling package.
-//
-// Same semantics dotenv gave these tests: a missing file is fine, and a key
-// already present in the environment is never overridden, so an explicit
-// export still beats the file.
-//
-// WHY NOT sekreto's parsedotenv, which does the same job and is already
-// vendored: sekreto lives INSIDE the secrets feature container, so `target
-// add` removes it whenever a project does not select that feature — while
-// these entity tests need the loader either way. Importing it here would
-// couple every generated test suite to an optional feature. The parser is
-// small enough that a second, independent copy is cheaper than that
-// coupling; it deliberately handles only what a .env.local holds.
 function loadEnvLocal(file: string): void {
   let text: string
   try {
@@ -266,7 +212,6 @@ function loadEnvLocal(file: string): void {
   for (const raw of text.split(/\r?\n/)) {
     const line = raw.trim()
 
-    // Blank and comment lines. A '#' INSIDE a value is not a comment.
     if ('' === line || line.startsWith('#')) {
       continue
     }

package/project/.sdk/tm/ts/test/vendor/omni/Runner.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Runner.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/ts/test/vendor/omni/Util.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Util.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/ts/test/vendor/omni/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/omni - shared multi-language test runner.
 

package/project/.sdk/tm/zig/core/utility.zig

@@ -19,6 +19,9 @@ const result_mod = @import("result.zig");
 const operation_mod = @import("operation.zig");
 const jsonparse = @import("../utility/jsonparse.zig");
 const sdk = @import("sdk.zig");
+// The GENERATED option spec make_options validates against. A leaf module
+// (it imports only helpers and jsonparse), so this closes no cycle.
+const schema = @import("schema.zig");
 
 const Value = h.Value;
 const Context = ctxmod.Context;
@@ -367,50 +370,18 @@ pub fn make_options_util(ctx: *Context) Value {
         else => h.omap(),
     };
 
-    const optspec = h.jo(&.{
-        .{ "apikey", h.vstr("") },
-        .{ "base", h.vstr("http://localhost:8000") },
-        .{ "prefix", h.vstr("") },
-        .{ "suffix", h.vstr("") },
-        // CLOSED - validate REJECTS any key this spec does not declare - so
-        // without `in` and `name` an apiKey-in-query SDK fails validation on
-        // its OWN generated config (Config_zig emits them whenever the
-        // scheme is not the header/Authorization default), and the whole
-        // merged options object is discarded. '' means "take what the spec
-        // said", which is what the generated prepare_auth was built from.
-        .{ "auth", h.jo(&.{
-            .{ "prefix", h.vstr("") },
-            .{ "basic", h.vbool(false) },
-            .{ "in", h.vstr("") },
-            .{ "name", h.vstr("") },
-        }) },
-        .{ "headers", h.jo(&.{.{ "`$CHILD`", h.vstr("`$STRING`") }}) },
-        .{ "allow", h.jo(&.{
-            .{ "method", h.vstr("GET,PUT,POST,PATCH,DELETE,OPTIONS") },
-            .{ "op", h.vstr("create,update,load,list,remove,command,direct,graphql") },
-        }) },
-        .{ "entity", h.jo(&.{.{ "`$CHILD`", h.jo(&.{
-            .{ "`$OPEN`", h.vbool(true) },
-            .{ "active", h.vbool(false) },
-            .{ "alias", h.omap() },
-        }) }}) },
-        .{ "feature", h.jo(&.{.{ "`$CHILD`", h.jo(&.{
-            .{ "`$OPEN`", h.vbool(true) },
-            .{ "active", h.vbool(false) },
-        }) }}) },
-        .{ "utility", h.omap() },
-        .{ "system", h.omap() },
-        .{ "test", h.jo(&.{
-            .{ "active", h.vbool(false) },
-            .{ "entity", h.jo(&.{.{ "`$OPEN`", h.vbool(true) }}) },
-        }) },
-        .{ "clean", h.jo(&.{.{ "keys", h.vstr("key,token,id") }}) },
-        // Server-variable values for a templated base URL (OpenAPI server
-        // variables): {name} placeholders in "base" are substituted from this
-        // map at construction. Spec defaults arrive via the generated config;
-        // user values override them. Mirrors go's make_options optspec.
-        .{ "server", h.jo(&.{.{ "`$CHILD`", h.vstr("") }}) },
-    });
+    // THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+    //
+    // Built from the model: `main.kit.optspec` for the standard options, plus
+    // one entry per feature this target carries, from that feature's own
+    // `config.options` / `config.optspec`. Editing this file to add an option
+    // would put it back where it was - one of twenty hand-maintained copies of
+    // a schema nothing cross-checked - so add it to the model instead and
+    // every ported target validates it.
+    //
+    // Parsed once and shared: make_options validates AGAINST the spec and
+    // writes into the options, never into the spec.
+    const optspec = schema.shared_optspec();
 
     // Preserve system.fetch before merge/validate (validation strips it).
     const sys_fetch = h.getpath(&.{ "system", "fetch" }, opts);
@@ -711,6 +682,11 @@ pub fn make_point_util(ctx: *Context) E!Value {
 pub fn make_spec_util(ctx: *Context) E!*Spec {
     if (ctx.out_get("spec")) |ov| {
         switch (ov) {
+            // A PreSpec feature hook (e.g. validate) may short-circuit the
+            // operation by storing an error here; surface it before the
+            // request is built, the same way make_point surfaces
+            // out["point"].
+            .err => |e| return ctx.fail_err(e),
             .spec => |sp| {
                 ctx.spec = sp;
                 return sp;

package/project/.sdk/tm/zig/feature/secrets/plugin/capability.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/capability.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/capability.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Capabilities (§11.1).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/catalog.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/catalog.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/catalog.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The definition catalog (§10.1).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/config.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/config.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/config.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The declarative document (§9): normalization, and the ten-level
 //! precedence ladder.

package/project/.sdk/tm/zig/feature/secrets/plugin/depend.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/depend.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/depend.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Dependency cardinality, policy, and the restart graph (§11.3).
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/env.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/env.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/env.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Environment overrides (§9.5) — level 7 of the ladder.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/export.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/export.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/export.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Exports (§11).
 //!
@@ -24,7 +24,7 @@ fn lessStr(_: void, a: []const u8, b: []const u8) bool {
 /// rather than a null Value.
 pub fn resolveexport(spec: ?*v.Value, exported: ?*v.Value) t.Err!?*v.Value {
     const s = if (v.isStr(spec)) v.asStr(spec) else "";
-    const cut = std.mem.indexOfScalar(u8, s, '/') orelse
+    const cut = std.mem.lastIndexOfScalar(u8, s, '/') orelse
         return t.fail("plugin_export_ambiguous", v.print("export spec needs a key: {s}", .{s}), t.details1("spec", v.vstr(s)));
     const head = s[0..cut];
     const key = s[cut + 1 ..];

package/project/.sdk/tm/zig/feature/secrets/plugin/graph.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/graph.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/graph.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Whole-graph resolution (§11.4) — a phase, not a discovery.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/host.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/host.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/host.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The host: the lifecycle state machine (§5), extension points (§6),
 //! and resource capture (§8).
@@ -424,6 +424,22 @@ fn chosen(h: *Host, e: *Inst, req: ?*v.Value, remember: bool) ?[]const u8 {
     return first;
 }
 
+/// WHICH provider this instance is bound to for `name` (§11.1), as a
+/// ref, or null when nothing provides it.
+///
+/// The host's own `capability` answers with the live providers RANKED,
+/// not with the one THIS instance took; §11.4's reluctant rebinding
+/// makes those differ. A REF, not the instance. The selection is
+/// REMEMBERED, because this is the instance asking.
+pub fn instcapability(e: *Inst, name: []const u8) ?[]const u8 {
+    for (v.items(dep.requirements(e.options))) |r| {
+        const rn = v.get(r, "name");
+        if (!v.isStr(rn) or !std.mem.eql(u8, v.asStr(rn), name)) continue;
+        return chosen(e.owner, e, r, true);
+    }
+    return null;
+}
+
 /// The instance currently SELECTED for each of this one's
 /// restart-causing requirements. A BINDING IS TO AN INSTANCE, not to a
 /// capability (§11.1): the selected one going away restarts a `static`

package/project/.sdk/tm/zig/feature/secrets/plugin/inst.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/inst.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/inst.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The instance and host records.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/order.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/order.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/order.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Ordering (§7) — one rule, one place.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/plugin.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/plugin.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/plugin.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! THE ROOT A CONSUMER IMPORTS.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugin/point.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/point.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/point.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Extension points (§6). Three kinds, chosen because they are what the
 //! two existing systems actually needed, and no more.

package/project/.sdk/tm/zig/feature/secrets/plugin/ref.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/ref.zig)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (zig/src/ref.zig)
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Identity: name+tag, written `name$tag` (§4).
 //!