@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/zig/feature/secrets/plugins/onepassword.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/onepassword.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/onepassword.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! 1Password, through a Connect server - a sekreto plugin. Needs HTTPS.
 

package/project/.sdk/tm/zig/feature/secrets/plugins/secretspec.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/secretspec.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/secretspec.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! SecretSpec (https://secretspec.dev) - a sekreto plugin.
 //!

package/project/.sdk/tm/zig/feature/secrets/plugins/sigv4.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/sigv4.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/plugins/sigv4.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! AWS Signature Version 4, hand-rolled.
 //!

package/project/.sdk/tm/zig/feature/secrets/sekreto/addr.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/addr.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/addr.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! The address check every network provider makes before it sends a
 //! credential anywhere.

package/project/.sdk/tm/zig/feature/secrets/sekreto/builtins.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/builtins.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/builtins.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! THE BUILT-IN PROVIDER KINDS - the same four in every port.
 //!
@@ -255,5 +255,6 @@ pub const KINDS = struct {
     pub const plugin = [_][]const u8{
         "hashicorp",    "boru",        "awssecrets", "awsparams", "gcpsecrets",
         "azuresecrets", "onepassword", "doppler",    "infisical", "secretspec",
+        "minivault",
     };
 };

package/project/.sdk/tm/zig/feature/secrets/sekreto/provider.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/provider.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/provider.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! What a provider is, what its declarative form looks like, and how a
 //! provider kind becomes a voxgig/plugin definition.
@@ -160,6 +160,17 @@ pub const ProviderSpec = struct {
     /// infisical: the environment slug and secret path.
     environment: []const u8 = "",
     path: []const u8 = "",
+    /// minivault: the passphrase that unwraps `vaultkey`.
+    passphrase: []const u8 = "",
+    /// minivault: which key in the vault file to open with, defaulting to
+    /// `master`. Named apart from `keyid` because that already means an
+    /// AWS access key id.
+    vaultkey: []const u8 = "",
+    /// minivault: PBKDF2 rounds, used only when a key is created. Zero
+    /// means unset.
+    iterations: i64 = 0,
+    /// minivault: make the vault file if it is not there.
+    create: bool = false,
 };
 
 // ---- the provider ----------------------------------------------------
@@ -292,6 +303,10 @@ pub fn optionsof(spec: ProviderSpec) *pv.Value {
                 setstr(m, "secretid", auth.secretid);
                 pv.set(out, f.name, m);
             }
+        } else if (bool == f.type) {
+            if (value) {
+                pv.set(out, f.name, pv.vbool(true));
+            }
         } else if ([]const KeyValue == f.type) {
             if (0 != value.len) {
                 const m = pv.vmap();
@@ -336,6 +351,8 @@ pub fn specof(options: ?*const pv.Value) ProviderSpec {
                     .secretid = pv.asStr(pv.get(given, "secretid")),
                 };
             }
+        } else if (bool == f.type) {
+            @field(spec, f.name) = pv.isBool(given) and pv.asBool(given);
         } else if ([]const KeyValue == f.type) {
             if (pv.isMap(given)) {
                 const keys = pv.keys(given);

package/project/.sdk/tm/zig/feature/secrets/sekreto/sekreto.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/src/sekreto.zig)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (zig/src/sekreto.zig)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! sekreto: one interface for secrets, wherever they live.
 //!

package/project/.sdk/tm/zig/feature/validate.zig

@@ -0,0 +1,293 @@
+// Payload validation against the model's own field types (mirrors rust
+// feature/validate.rs and tm/ts/src/feature/validate/ValidateFeature.ts).
+//
+// The specs are NOT written here and not written in the model either: every
+// entity field already carries a canonical type sentinel (`$STRING`,
+// `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+// vocabulary vs.validate speaks. The generator maps them once
+// (helpers/canonSpec) and emits `core/schema.zig`, so a field whose type
+// changes in the API spec changes what this feature enforces with no edit
+// anywhere.
+//
+// WHAT IS CHECKED
+//   outbound (PreSpec)  the payload the caller asked to send, against
+//                       spec.op[opname] — the operation's request shape.
+//   inbound  (PreDone)  each record the operation returned, against
+//                       spec.data — the entity's own field types.
+//
+// WHAT IS NOT. The model carries no array element types, no nested object
+// schemas, no enums, formats or bounds, so this checks the shape the model
+// knows and nothing more.
+
+const std = @import("std");
+const h = @import("../core/helpers.zig");
+const types = @import("../core/types.zig");
+const schema = @import("../core/schema.zig");
+const sup = @import("support.zig");
+const vs = @import("voxgig-struct");
+
+const Value = h.Value;
+const Context = types.Context;
+const Feature = types.Feature;
+const OutVal = types.OutVal;
+
+// Built rather than written, so the backticks cannot be lost in an edit.
+const OPEN = [_]u8{96} ++ "$OPEN" ++ [_]u8{96};
+
+fn fmt(comptime f: []const u8, args: anytype) []const u8 {
+    return std.fmt.allocPrint(h.A(), f, args) catch "validate";
+}
+
+// The spec tree with every `$OPEN` marker removed, so an undeclared key is an
+// error rather than a pass. Rebuilt rather than mutated: shared_entityspec()
+// hands out a process-lifetime singleton every client reads.
+fn close_spec(node: Value) Value {
+    switch (node) {
+        .array => |l| {
+            const out = h.olist();
+            for (l.data.items) |item| out.array.append(close_spec(item)) catch {};
+            return out;
+        },
+        .object => |m| {
+            const out = h.omap();
+            var it = m.iterator();
+            while (it.next()) |e| {
+                if (std.mem.eql(u8, e.key_ptr.*, OPEN)) continue;
+                h.setp(out, e.key_ptr.*, close_spec(e.value_ptr.*));
+            }
+            return out;
+        },
+        else => return node,
+    }
+}
+
+pub const ValidateFeature = struct {
+    name: []const u8 = "validate",
+    active: bool = true,
+    add_opts: Value = .{ .null = {} },
+    options: Value = .{ .null = {} },
+    spec: Value = .{ .null = {} },
+
+    request: bool = true,
+    response: bool = false,
+    mode: []const u8 = "throw",
+
+    pub fn make() Feature {
+        const self = h.A().create(ValidateFeature) catch unreachable;
+        self.* = .{};
+        return .{ .ptr = @ptrCast(self), .vtable = &vtable };
+    }
+
+    fn self_of(p: *anyopaque) *ValidateFeature {
+        return @ptrCast(@alignCast(p));
+    }
+
+    fn entname(ctx: *Context) []const u8 {
+        if (ctx.entity) |e| {
+            const n = e.get_name();
+            if (n.len != 0) return n;
+        }
+        return ctx.op.entity;
+    }
+
+    fn entity_spec(self: *ValidateFeature, ctx: *Context) Value {
+        return h.getp(self.spec, entname(ctx));
+    }
+
+    // The payload an operation is about to send.
+    //
+    // TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+    // caller's argument in `reqdata` over the entity's `data`; a match op
+    // (load/list/remove) carries it in `reqmatch` over `mtch`. That is what
+    // the entity operations pass to the context and what make_point reads — so
+    // reading `reqdata` for every op would check a `load({id})` against the
+    // entity's STALE stored match and reject it for the id the caller had just
+    // supplied.
+    fn payload(ctx: *Context, opname: []const u8) Value {
+        const body = std.mem.eql(u8, opname, "create") or
+            std.mem.eql(u8, opname, "update") or
+            std.mem.eql(u8, opname, "patch");
+
+        const base = if (body) ctx.data else ctx.mtch;
+        const req = if (body) ctx.reqdata else ctx.reqmatch;
+
+        const out = h.omap();
+        for ([_]Value{ base, req }) |src| {
+            if (src != .object) continue;
+            var it = src.object.iterator();
+            while (it.next()) |e| h.setp(out, e.key_ptr.*, e.value_ptr.*);
+        }
+
+        // `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the
+        // record. make_point reads it off this same argument and the request
+        // transformer drops it before the body is built, so a spec built from
+        // the API's own fields will never name it — and under `strict` every
+        // custom-action call would be rejected for the one key that made it
+        // reachable.
+        _ = out.object.fetchOrderedRemove("$action");
+
+        return out;
+    }
+
+    // One validate call. THE JOINED MESSAGE, not a list: this port's
+    // vs.validate returns a single `err` string with the collected failures
+    // already joined by " | ", rather than filling an errs array the way the
+    // ts, go and JVM ports do. Nothing is lost — every failure is still in it
+    // — so the feature reports the one string.
+    fn check(self: *ValidateFeature, ctx: *Context, data: Value, spec: Value) ?[]const u8 {
+        _ = self;
+        _ = ctx;
+        const res = vs.validate(h.A(), data, spec) catch |e| {
+            // A spec this port cannot run at all (rather than a payload that
+            // fails it) must not take the operation down with it: report it
+            // like any other failure and let `mode` decide.
+            return fmt("{s}", .{@errorName(e)});
+        };
+        return res.err;
+    }
+
+    // Outbound. make_spec surfaces an `.err` left in out["spec"] before the
+    // request is built — the same seam rbac uses one stage earlier through
+    // out["point"].
+    fn pre_spec(self: *ValidateFeature, ctx: *Context) void {
+        if (!self.active or !self.request) return;
+
+        const opname = ctx.op.name;
+        const opspec = h.getp(h.getp(self.entity_spec(ctx), "op"), opname);
+        if (opspec == .null) return;
+
+        const errs = self.check(ctx, payload(ctx, opname), opspec) orelse return;
+        if (std.mem.eql(u8, self.mode, "report")) return;
+
+        const e = ctx.make_error("validate_failed", fmt(
+            "Invalid {s} request for entity \"{s}\": {s}",
+            .{ opname, entname(ctx), errs },
+        ));
+        ctx.out_set("spec", OutVal{ .err = e });
+    }
+
+    // Inbound. PreDone rather than PreResult: the records are extracted from
+    // the response body by make_result, which runs between the two, so at
+    // PreResult there is nothing to check but the envelope.
+    //
+    // HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+    // PreDone hooks fire in feature ADD order, which defaults to `test` first
+    // and then names sorted — and `validate` sorts last, after audit, cost,
+    // debug, metrics and telemetry. Those observers therefore record the
+    // operation as a success before this hook has looked at it. Activating
+    // features as an ORDERED LIST fixes it.
+    fn pre_done(self: *ValidateFeature, ctx: *Context) void {
+        if (!self.active or !self.response) return;
+
+        const dataspec = h.getp(self.entity_spec(ctx), "data");
+        if (dataspec == .null) return;
+
+        const result = ctx.result orelse return;
+        const resdata = result.resdata;
+        if (resdata == .null) return;
+
+        // A list op returns many records and a load returns one; both are
+        // checked against the same record spec, because they are the same
+        // entity.
+        //
+        // NO UNWRAP STEP, unlike the ts and go ports: make_result already
+        // stores a list entry as the item's own data Value rather than as the
+        // entity object, so what arrives here is records either way.
+        var msg: ?[]const u8 = null;
+        if (resdata == .array) {
+            for (resdata.array.data.items) |record| {
+                if (record == .null) continue;
+
+                // A NON-OBJECT IS A FAILURE, not something to skip. A load
+                // that answered 42 where the entity's spec wants a record must
+                // not pass this feature silently — struct rejects it with the
+                // field it could not find.
+                if (self.check(ctx, record, dataspec)) |e| {
+                    msg = if (msg) |prev| fmt("{s}; {s}", .{ prev, e }) else e;
+                }
+            }
+        } else if (self.check(ctx, resdata, dataspec)) |e| {
+            msg = e;
+        }
+
+        const errs = msg orelse return;
+        if (std.mem.eql(u8, self.mode, "report")) return;
+
+        const e = ctx.make_error("validate_failed", fmt(
+            "Invalid response for entity \"{s}\": {s}",
+            .{ entname(ctx), errs },
+        ));
+
+        // BOTH, and `ok` is the load-bearing half: done returns resdata
+        // whenever result.ok is true and never looks at err, so setting the
+        // error alone would hand the caller the very records that failed the
+        // spec.
+        result.ok = false;
+        result.err = e;
+
+        // AND THE DATA GOES. The load/update paths copy result.resdata into
+        // the entity's own state on any non-null value, BEFORE done raises —
+        // so rejecting the operation while leaving the records in place would
+        // leave the caller holding an entity populated from a payload this
+        // feature had just declared invalid.
+        result.resdata = .{ .null = {} };
+    }
+
+    fn vname(p: *anyopaque) []const u8 {
+        return self_of(p).name;
+    }
+    fn vactive(p: *anyopaque) bool {
+        return self_of(p).active;
+    }
+    fn vaddopts(p: *anyopaque) Value {
+        return self_of(p).add_opts;
+    }
+    fn vinit(p: *anyopaque, ctx: *Context, options: Value) void {
+        _ = ctx;
+        const self = self_of(p);
+        self.options = options;
+        self.active = sup.fopt_bool(options, "active", false);
+
+        // DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+        // `config.options` documents them and types them; it does not inject
+        // them, because each feature entry in the spec is optional and struct
+        // fills in nothing through an optional union. So every feature
+        // resolves its own.
+        self.request = sup.fopt_bool(options, "request", true);
+        self.response = sup.fopt_bool(options, "response", false);
+
+        // FAIL CLOSED. Only the exact string "report" selects report mode, so
+        // a typo (`mode: "thow"`) still rejects rather than silently turning
+        // enforcement off — the failure nobody would notice. The option spec
+        // rejects the typo outright; this is what happens if it ever does not.
+        self.mode = if (std.mem.eql(u8, sup.fopt_str(options, "mode", "throw"), "report"))
+            "report"
+        else
+            "throw";
+
+        // `strict` is applied ONCE, here, by rebuilding the spec tree without
+        // the `$OPEN` markers — rather than per call, which would clone a spec
+        // for every request an SDK ever makes.
+        const entityspec = schema.shared_entityspec();
+        self.spec = if (sup.fopt_bool(options, "strict", false))
+            close_spec(entityspec)
+        else
+            entityspec;
+    }
+    fn vdispatch(p: *anyopaque, name: []const u8, ctx: *Context) void {
+        const self = self_of(p);
+        if (std.mem.eql(u8, name, "PreSpec")) {
+            self.pre_spec(ctx);
+        } else if (std.mem.eql(u8, name, "PreDone")) {
+            self.pre_done(ctx);
+        }
+    }
+
+    const vtable = Feature.VTable{
+        .name = vname,
+        .active = vactive,
+        .add_options = vaddopts,
+        .init = vinit,
+        .dispatch = vdispatch,
+    };
+};

package/project/.sdk/tm/zig/test/vendor/omni/omni.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (zig/src/omni.zig)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (zig/src/omni.zig)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! Omni: the shared multi-language test runner (Zig port).
 //!

package/project/.sdk/tm/zig/test/vendor/omni/regex.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (zig/src/regex.zig)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (zig/src/regex.zig)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 //! A small backtracking regex engine.
 //!

package/project/.sdk/tm/zig/utility/voxgigstruct/regex.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/struct sdk-20260908-1556-0 (zig/src/regex.zig)
-// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/struct sdk-20260917-1242-0 (zig/src/regex.zig)
+// Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 //

package/project/.sdk/tm/zig/utility/voxgigstruct/struct.zig

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/struct sdk-20260908-1556-0 (zig/src/struct.zig)
-// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/struct sdk-20260917-1242-0 (zig/src/struct.zig)
+// Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 

package/project/sdkgen-package.json

@@ -3,7 +3,7 @@
     "package": 1
   },
   "name": "@voxgig/sdkgen",
-  "version": "4.20.0",
+  "version": "4.22.0",
   "provides": {
     "target": [
       "c",

package/src/action/action.ts

@@ -12,38 +12,9 @@ import type {
 } from '../types'
 
 
-// `./` — aontu 0.65 reads a bare single-segment include as a PACKAGE name
-// (ADR-039), so `@"go.aon"` resolves against the package stores and is
-// refused: "local files need a ./ prefix". A sibling file has to say so.
 const indexEntry = (name: string) => `@"./${name}.aon"`
 
 
-// An index line that is an ACTIVE include, and the name it includes — or
-// undefined for a blank line, a comment, or anything else.
-//
-// Parsed rather than compared as a string, because both spellings around an
-// include are legal aontu and mean opposite things:
-//
-//   @"./go.aon"               -> active, name 'go'
-//   @"go.aon"                 -> active, name 'go'  (pre-0.65 spelling)
-//   @"./go.aon"  # pinned     -> active, name 'go'  (trailing comment)
-//     @"./go.aon"             -> active, name 'go'  (indented)
-//   # @"./go.aon"             -> NOT active
-//
-// A substring test (what this used to be) reads the commented-out form as
-// present, so `target add go` on a project that had switched the target off
-// by hand appended nothing and reported success while the target stayed
-// absent from the model. A whole-line equality test fixes that but then
-// misses the trailing-comment form, and appends a SECOND active include.
-//
-// BOTH SPELLINGS, and the `./` is not part of the name. Every index in every
-// already-generated SDK carries the bare form, and those files are the
-// project's own -- they change when the project regenerates, not when sdkgen
-// releases. Reading only the new spelling would make `target add go` on any
-// existing repo believe `go` was absent and append a second include; reading
-// only the old one would do the same the other way round once the index is
-// rewritten. Capturing the name WITHOUT the prefix is what lets the two
-// spellings compare equal, which is the whole point.
 const INDEX_ENTRY_RE = /^\s*@"(?:\.\/)?([^"]+)\.aon"\s*(?:#.*)?$/
 
 function indexEntryName(line: string): string | undefined {
@@ -75,12 +46,6 @@ function appendIndexEntries(content: string, names: string[]): string {
 }
 
 
-// Drop the `@"<name>.aon"` line for each name — the inverse of
-// appendIndexEntries, matching line-exact for the same reasons.
-//
-// Nothing calls this yet: a `remove` action is the fast-follow this exists
-// for (see docs/design/sdkgen-packages.md), and it is written here beside its
-// inverse so the two cannot drift on how an entry is recognised.
 function removeIndexEntries(content: string, names: string[]): string {
   const drop = new Set(names)
 
@@ -99,10 +64,6 @@ const UpdateIndex = cmp(function UpdateIndex(props: any) {
 })
 
 
-// Names given to an `add` action: every positional after the subcommand is
-// a name, each possibly comma-separated — `target add ts,py,go` and
-// `target add ts py go` are equivalent (space-separated extras used to be
-// silently dropped).
 function parseAddNames(args: any[]): string[] {
   return args.slice(2)
     .flatMap((a: any) => 'string' === typeof a ? a.split(',') : a)
@@ -110,17 +71,6 @@ function parseAddNames(args: any[]): string[] {
 }
 
 
-// The current index file for each kind, which `UpdateIndex` appends to.
-//
-// `seed` IS THE UPGRADE PATH. A project scaffolded before a kind existed has
-// no `model/<kind>/<kind>-index.aon` — every project alive today is in
-// exactly that position for `docs` — and reading it unguarded made the FIRST
-// `edition add` in any existing project fail on ENOENT before it wrote anything.
-//
-// Seeded per call rather than defaulted for every kind: a missing
-// `target-index.aon` in a scaffolded project is a broken project, and
-// quietly recreating it would hide that. A kind the project has never used is
-// a different thing, and only its own action knows which case it is in.
 function loadContent(
   actx: ActionContext, which: string | string[], seed?: Record<string, string>,
 ) {
@@ -143,21 +93,6 @@ function loadContent(
 
 
 
-// ENSURE THE PROJECT'S OWN MODEL INCLUDES A KIND'S INDEX.
-//
-// `model/sdk.aontu` is written once, by create-sdkgen, and includes the
-// indexes of the kinds that existed then. So a project scaffolded before a
-// kind existed — which is every project alive today, for `docs` — never
-// includes its index, and the item's model file is an orphan: it is on disk,
-// `<kind>-index.aon` includes it, and NOTHING includes that. `main.kit.doc.edition`
-// is then absent from the compiled model, so `package list`, `package update`
-// and `doctor` cannot see the item at all.
-//
-// Appending one include line is additive and idempotent, and it is the only
-// way an existing project can adopt a new kind without hand-editing. The
-// entry is parsed, not substring-matched, for the reason `hasIndexEntry`
-// documents: a commented-out include means the project switched it OFF, and
-// re-adding it would override that.
 function ensureModelInclude(actx: ActionContext, kind: string): boolean {
   const fs = actx.fs()
   const url = actx.url