@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/go/feature/cost_feature.go

@@ -9,28 +9,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Cost tracking and spend budget. Uses BOTH seams, which is the point of
-// the feature: money is spent per HTTP ATTEMPT (a retried call is charged
-// again, because the upstream API charges it again), but it is owed by an
-// OPERATION. So the transport wrap prices each attempt, and PreDone
-// attributes the running total to `<entity>.<op>` and to the caller
-// (`ctrl.actor`, the same actor the audit feature records).
-//
-// The price of an attempt comes from the first source that answers: a
-// response header (`header` x `perUnit`), the rate table (`rates`, keyed
-// `<entity>.<op>` / `<op>` / `*`), then the flat `unit`. A body figure
-// (`path` x `perUnit`, e.g. "usage.total_tokens") is read at PreDone
-// instead, from the already-parsed result, and describes the whole call, so
-// it REPLACES the per-attempt estimate rather than adding to it.
-//
-// `budget` caps total spend. With `onBudget: "deny"` a further operation is
-// refused at PrePoint (via ctx.Out["point"], which MakePoint surfaces),
-// before an endpoint is resolved and before anything reaches the network.
-//
-// ORDER MATTERS. Cost must sit INSIDE the cache, or a response served from
-// cache is charged for money that was never spent. The default (map) order
-// puts cache innermost and cost outside it, so activate them in array form
-// with cost first.
 type CostFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK
@@ -124,8 +102,6 @@ func (f *CostFeature) PrePoint(ctx *core.Context) {
 		return
 	}
 
-	// Mark the context as running through the pipeline, so charge knows a
-	// PreDone is coming and does not commit the spend itself.
 	pending, ok := ctx.Out[costPendingKey].(*costPending)
 	if !ok || pending == nil {
 		pending = &costPending{source: "none"}
@@ -171,18 +147,6 @@ func (f *CostFeature) charge(ctx *core.Context, url string, fetchdef map[string]
 
 	pending.attempts++
 
-	// Accumulated here, committed once at PreDone. Adding each attempt to
-	// the running total and then subtracting it again when a body figure
-	// supersedes it loses precision to catastrophic cancellation.
-	//
-	// Reported and estimated are kept apart per ATTEMPT: a 503 priced from
-	// the rate table followed by a 200 carrying the cost header is part
-	// estimate, part reported, and collapsing both into the final attempt's
-	// category would corrupt the split.
-	//
-	// A failed transport is an error VALUE here, not a panic, so it already
-	// reaches this point and is priced from the table or unit — no separate
-	// rescue is needed, unlike the ts/js ports.
 	pending.amount += amount
 	if source == "header" || source == "body" {
 		pending.reported += amount
@@ -193,9 +157,6 @@ func (f *CostFeature) charge(ctx *core.Context, url string, fetchdef map[string]
 
 	f.Total.Attempts++
 
-	// direct() and graphql() reach the transport without dispatching any
-	// pipeline hooks, so there is no PrePoint to gate on and no PreDone to
-	// commit. Their spend is committed here, or it would never be counted.
 	if !pending.piped {
 		f.commit(ctx, pending, "_", "direct")
 		delete(ctx.Out, costPendingKey)
@@ -227,15 +188,6 @@ func (f *CostFeature) finish(ctx *core.Context, done bool) {
 	}
 	delete(ctx.Out, costPendingKey)
 
-	// A FAILED operation that made no attempt never reached the network:
-	// PrePoint creates the pending entry to mark the context as piped, and
-	// then the budget gate refuses the call (rbac, or an unresolvable
-	// endpoint, short-circuits just as early). Committing it would count a
-	// call that never happened and file a zero-amount record as Last.
-	//
-	// A SUCCEEDED operation that made no attempt is the opposite case: it was
-	// served from the cache. That is a real call, and the fact that it cost
-	// nothing is the whole point of ordering cost inside the cache.
 	if !done && pending.attempts == 0 {
 		return
 	}
@@ -250,9 +202,6 @@ func (f *CostFeature) finish(ctx *core.Context, done bool) {
 	f.commit(ctx, pending, entity, opname)
 }
 
-// commit records one operation's spend: totals, budget, per-op and per-actor
-// attribution, and the record. Shared by finish and the raw-request path in
-// charge, which has no PreDone to reach.
 func (f *CostFeature) commit(ctx *core.Context, pending *costPending, entity, opname string) {
 	amount := pending.amount
 	reported := pending.reported

package/project/.sdk/tm/go/feature/debug_feature.go

@@ -6,12 +6,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Request/response capture for debugging. Records a bounded ring buffer of
-// per-operation traces — method, URL, redacted headers, response status and
-// timing — on the feature's Entries. Sensitive header values (matching
-// `redact`, default authorization/cookie/api-key style names) are masked.
-// An optional `onEntry` callback receives each finished entry (e.g. to
-// stream to a console). `max` caps the buffer (default 100).
 type DebugFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/feature_options.go

@@ -1,16 +1,16 @@
 package feature
 
 import (
+	"encoding/json"
+	"reflect"
 	"strconv"
 	"strings"
 	"time"
 )
 
-// Shared option readers for the feature implementations. Feature options
-// arrive as map[string]any (from SDK options or test harnesses), so numeric
-// values may be int, int64 or float64 and callbacks arrive as typed Go
-// funcs. These helpers normalise access and supply defaults, mirroring the
-// `null == opts.x ? def : opts.x` pattern of the ts features.
+// Shared option readers for the feature implementations. Options arrive as
+// map[string]any, so a numeric value may be any numeric type; `json.Number` is
+// what encoding/json produces under UseNumber().
 
 func foptBool(options map[string]any, key string, def bool) bool {
 	if options == nil {
@@ -22,19 +22,113 @@ func foptBool(options map[string]any, key string, def bool) bool {
 	return def
 }
 
+// Integers do not route through float64, which cannot hold large ones exactly.
+func fnumInt(v any) (int, bool) {
+	switch n := v.(type) {
+	case int:
+		return n, true
+	case int8:
+		return int(n), true
+	case int16:
+		return int(n), true
+	case int32:
+		return int(n), true
+	case int64:
+		return int(n), true
+	case uint:
+		return int(n), true
+	case uint8:
+		return int(n), true
+	case uint16:
+		return int(n), true
+	case uint32:
+		return int(n), true
+	case uint64:
+		return int(n), true
+	case float32:
+		return int(n), true
+	case float64:
+		return int(n), true
+	case json.Number:
+		if i, err := n.Int64(); err == nil {
+			return int(i), true
+		}
+		if f, err := n.Float64(); err == nil {
+			return int(f), true
+		}
+	}
+	return rnumInt(v)
+}
+
+// A DEFINED numeric type (`type Retries int`) matches no type-switch arm, yet
+// the option validator classifies it by reflect.Kind and passes it through.
+// Reader and validator must agree on what counts as a number.
+func rnumInt(v any) (int, bool) {
+	rv := reflect.ValueOf(v)
+	switch rv.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return int(rv.Int()), true
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return int(rv.Uint()), true
+	case reflect.Float32, reflect.Float64:
+		return int(rv.Float()), true
+	}
+	return 0, false
+}
+
+func fnumFloat(v any) (float64, bool) {
+	switch n := v.(type) {
+	case int:
+		return float64(n), true
+	case int8:
+		return float64(n), true
+	case int16:
+		return float64(n), true
+	case int32:
+		return float64(n), true
+	case int64:
+		return float64(n), true
+	case uint:
+		return float64(n), true
+	case uint8:
+		return float64(n), true
+	case uint16:
+		return float64(n), true
+	case uint32:
+		return float64(n), true
+	case uint64:
+		return float64(n), true
+	case float32:
+		return float64(n), true
+	case float64:
+		return n, true
+	case json.Number:
+		if f, err := n.Float64(); err == nil {
+			return f, true
+		}
+	}
+	return rnumFloat(v)
+}
+
+func rnumFloat(v any) (float64, bool) {
+	rv := reflect.ValueOf(v)
+	switch rv.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return float64(rv.Int()), true
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return float64(rv.Uint()), true
+	case reflect.Float32, reflect.Float64:
+		return rv.Float(), true
+	}
+	return 0, false
+}
+
 func foptInt(options map[string]any, key string, def int) int {
 	if options == nil {
 		return def
 	}
-	switch n := options[key].(type) {
-	case int:
+	if n, ok := fnumInt(options[key]); ok {
 		return n
-	case int64:
-		return int(n)
-	case float64:
-		return int(n)
-	case float32:
-		return int(n)
 	}
 	return def
 }
@@ -43,15 +137,8 @@ func foptNum(options map[string]any, key string, def float64) float64 {
 	if options == nil {
 		return def
 	}
-	switch n := options[key].(type) {
-	case int:
-		return float64(n)
-	case int64:
-		return float64(n)
-	case float64:
+	if n, ok := fnumFloat(options[key]); ok {
 		return n
-	case float32:
-		return float64(n)
 	}
 	return def
 }

package/project/.sdk/tm/go/feature/idempotency_feature.go

@@ -8,12 +8,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Idempotency keys for mutating operations. Adds an `Idempotency-Key`
-// header (name configurable via `header`) to unsafe requests so a server
-// can de-duplicate retried writes. The key is set once, at PreRequest,
-// before the request is built — so it is stable across transport-level
-// retries of the same call. A caller-supplied header is never overwritten
-// (case-insensitive). The key generator is injectable (`keygen`).
 type IdempotencyFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/metrics_feature.go

@@ -4,12 +4,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Statistics capture. Records per-operation counters and latency for every
-// call: totals plus a breakdown keyed by `<entity>.<op>`. Timing starts at
-// endpoint resolution (PrePoint) and stops when the call returns (PreDone)
-// or fails (PreUnexpected); each operation is recorded exactly once (the
-// per-context start marker in ctx.Out is consumed on record). The clock is
-// injectable (`now`) for deterministic tests.
 type MetricsFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/netsim_feature.go

@@ -6,14 +6,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Network behaviour simulation. Wraps the active transport (the live
-// net/http fetch or the `test` feature's in-memory mock) and injects
-// realistic network conditions so offline unit tests can exercise slowness,
-// transient failures, rate limiting and outages deterministically.
-//
-// Every injection mode is counter-driven (per client instance) so tests
-// are reproducible without mocking timers. `failRate` adds optional
-// pseudo-random failures via a seeded LCG for coverage-style testing.
 type NetsimFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/paging_feature.go

@@ -8,15 +8,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Pagination support for list operations. On the way out (PreRequest) it
-// stamps page/limit (or a cursor) into the request query; on the way back
-// (PreResult) it reads the server's pagination signals — a `Link:
-// rel="next"` header, `X-Page`/`X-Next-Page`/`X-Total-Count` headers, or
-// `next`/`cursor`/`nextCursor`/`hasMore` fields in the body — and records
-// them on `ctx.Result.Paging`. A per-call cursor/page from ctrl takes
-// priority (used by auto-iteration). Parameter names (`pageParam`,
-// `limitParam`, `cursorParam`), the page size (`limit`) and the start page
-// (`startPage`, default 1) are configurable.
 type PagingFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/proxy_feature.go

@@ -8,13 +8,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Outbound HTTP(S) proxy support. Wraps the active transport and annotates
-// each request's fetch definition with the proxy target (`fetchdef.proxy`).
-// The default net/http transport honours the annotation by routing the
-// request through an http.Transport with Proxy set (see utility/fetcher.go);
-// custom transports can do the same. The proxy target comes from options
-// (`url`) or, when `fromEnv` is set, the standard HTTPS_PROXY / HTTP_PROXY /
-// NO_PROXY environment variables. Hosts matching `noProxy` bypass the proxy.
 type ProxyFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/ratelimit_feature.go

@@ -6,12 +6,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Client-side rate limiting via a token bucket. Each request consumes a
-// token; when the bucket is empty the request waits until the bucket
-// refills at `rate` tokens per second (with capacity `burst`, default:
-// rate). This keeps the client under a server's published quota rather
-// than discovering it via 429s. The clock (`now`) and the wait (`sleep`)
-// are injectable so the accounting can be tested deterministically.
 type RatelimitFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/rbac_feature.go

@@ -4,15 +4,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Client-side role/permission enforcement. Before an operation resolves its
-// endpoint, the required permission for that entity+operation is checked
-// against the permissions the client holds; a disallowed call is
-// short-circuited with an `rbac_denied` error (via ctx.Out["point"], which
-// MakePoint surfaces) and never touches the network. Required permissions
-// come from `rules` (keyed by `<entity>.<op>`, `<op>`, or `*`); the default
-// when no rule matches is controlled by `deny` (default: allow when
-// unspecified). Held permissions are the `permissions` list (a `*` grants
-// everything).
 type RbacFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK
@@ -53,7 +44,6 @@ func (f *RbacFeature) PrePoint(ctx *core.Context) {
 
 	required, has := f.required(ctx)
 	if !has {
-		// No rule: honour the default policy.
 		if foptBool(f.options, "deny", false) {
 			f.reject(ctx, "<default-deny>")
 		}

package/project/.sdk/tm/go/feature/retry_feature.go

@@ -7,12 +7,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Automatic retry of transient failures with exponential backoff and
-// jitter. Wraps the active transport so a single operation call may make
-// several HTTP attempts. A failure is retryable when the transport returns
-// an error, or responds with a status in `statuses`
-// (default: 408, 425, 429, 500, 502, 503, 504). An HTTP 429/503 with a
-// `Retry-After` header overrides the computed backoff.
 type RetryFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/secrets/plugin/capability.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/capability.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/catalog.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/catalog.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/config.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/config.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/go/feature/secrets/plugin/depend.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/depend.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/env.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/env.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/export.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/export.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *
@@ -28,7 +28,7 @@ type Exported struct {
 }
 
 func ResolveExport(spec string, exported []Exported) (any, error) {
-	cut := strings.Index(spec, "/")
+	cut := strings.LastIndex(spec, "/")
 	if -1 == cut {
 		return nil, Fail("plugin_export_ambiguous", "export spec needs a key: "+spec,
 			map[string]any{"spec": spec})

package/project/.sdk/tm/go/feature/secrets/plugin/graph.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/graph.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/host.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/host.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The host: the lifecycle state machine (§5), extension points (§6), and
  * resource capture (§8).
@@ -393,6 +393,30 @@ func (i *Inst) Export(key string, value any) { i.e.exports[key] = value }
 // Provides declares what this instance can do for others (§11.1).
 func (i *Inst) Provides(p Provided) { i.e.provides = append(i.e.provides, p) }
 
+// Capability is WHICH provider this instance is bound to for name
+// (§11.1), as a ref, or "" when nothing provides it.
+//
+// §11.1 says "the first is bound, and inst.capability(name) returns it",
+// and §11.3 gives the case that needs it: a plugin that works without
+// metrics and uses metrics when it is there has to be able to ask.
+// Host.Capability answers with the live providers RANKED -- not with the
+// one THIS instance took, and §11.4's reluctant rebinding makes those
+// differ: a better-ranked newcomer tops the ranking while the consumer
+// keeps what it had.
+//
+// A REF, not the instance: every port can return a string and a corpus
+// entry can assert on one. The selection is REMEMBERED, because this is
+// the instance asking; `remember` is false only for questions asked
+// ABOUT an instance, where answering must not create a binding.
+func (i *Inst) Capability(name string) string {
+	for _, req := range Requirements(i.e.Options) {
+		if req.Name == name {
+			return i.h.chosen(i.e, req, true)
+		}
+	}
+	return ""
+}
+
 type Position struct {
 	Index     int  `json:"index"`
 	Count     int  `json:"count"`

package/project/.sdk/tm/go/feature/secrets/plugin/order.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/order.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Ordering (§7) — one rule, one place.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/point.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/point.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Extension points (§6). Three kinds, chosen because they are what the
  * two existing systems actually needed, and no more.

package/project/.sdk/tm/go/feature/secrets/plugin/ref.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/ref.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag, written `name$tag` (§4).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/resolve.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/resolve.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dynamic resolution (§10.2) — name to candidate module ids.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/types.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/types.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Shared types. Deliberately small: the design's §19 budget says the
  * library owns naming, configuration, lifecycle, ordering, binding and

package/project/.sdk/tm/go/feature/secrets/plugin/util.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/util.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The handful of helpers the port needs that the canonical gets from
  * JavaScript for free: sorted map keys (Object.keys(x).sort()), a

package/project/.sdk/tm/go/feature/secrets/plugin/version.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/version.go)
-// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Versions and ranges (§11.2).
  *

package/project/.sdk/tm/go/feature/secrets/plugins/aws/aws.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/aws/aws.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/aws/aws.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The aws plugin: Secrets Manager and SSM Parameter Store, with requests
 // SigV4-signed in-tree (sigv4.go, beside this file). Needs HTTPS and

package/project/.sdk/tm/go/feature/secrets/plugins/aws/sigv4.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/aws/sigv4.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/aws/sigv4.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/go/feature/secrets/plugins/azuresecrets/azuresecrets.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/azuresecrets/azuresecrets.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/azuresecrets/azuresecrets.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The azuresecrets plugin: Azure Key Vault. Needs HTTPS. A port of
 // typescript/plugins/azuresecrets.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/boru/boru.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/boru/boru.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/boru/boru.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The boru plugin: a boru vault through its CLI, or over `boru vault
 // serve`. Needs a child process, or HTTPS in wire mode. A port of

package/project/.sdk/tm/go/feature/secrets/plugins/doppler/doppler.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/doppler/doppler.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/doppler/doppler.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The doppler plugin: Doppler, one bulk download per config. Needs
 // HTTPS. A port of typescript/plugins/doppler.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/gcpsecrets/gcpsecrets.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/gcpsecrets/gcpsecrets.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/gcpsecrets/gcpsecrets.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The gcpsecrets plugin: GCP Secret Manager. Needs HTTPS. A port of
 // typescript/plugins/gcpsecrets.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/hashicorp/hashicorp.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/hashicorp/hashicorp.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/hashicorp/hashicorp.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The hashicorp plugin: HashiCorp Vault, and OpenBao. Needs HTTPS, and
 // the filesystem for a kubernetes service-account JWT. A port of

package/project/.sdk/tm/go/feature/secrets/plugins/httpjson/httpjson.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/httpjson/httpjson.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/httpjson/httpjson.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The HTTP half of every plugin that speaks to a store over the wire, in
 // one place and OUTSIDE the core: a chain of built-ins never links this