@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/net.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/net.lua)
--- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (lua/src/sekreto/plugins/net.lua)
+-- Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- The bridge to the transport helper - a PLUGIN module, never the core.
 --

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/onepassword.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/onepassword.lua)
--- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (lua/src/sekreto/plugins/onepassword.lua)
+-- Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- The onepassword plugin: 1Password through a Connect server, over
 -- HTTPS.

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/secretspec.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/secretspec.lua)
--- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (lua/src/sekreto/plugins/secretspec.lua)
+-- Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- The secretspec plugin: SecretSpec, through its CLI. Needs a child
 -- process, so it is not a built-in kind.

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/sigv4.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/sigv4.lua)
--- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (lua/src/sekreto/plugins/sigv4.lua)
+-- Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- AWS Signature Version 4, hand-rolled.
 --

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/support.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/support.lua)
--- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (lua/src/sekreto/plugins/support.lua)
+-- Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- The pure helpers every store client shares, and nothing else.
 --

package/project/.sdk/tm/lua/feature/secrets/sekreto/providers.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/providers.lua)
--- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (lua/src/sekreto/providers.lua)
+-- Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- What a provider is, how a provider kind becomes a voxgig/plugin
 -- definition - and the four BUILT-IN kinds.
@@ -340,6 +340,7 @@ M.KINDS = {
   plugin = {
     'hashicorp', 'boru', 'awssecrets', 'awsparams', 'gcpsecrets',
     'azuresecrets', 'onepassword', 'doppler', 'infisical', 'secretspec',
+    'minivault',
   },
 }
 

package/project/.sdk/tm/lua/feature/secrets/sekreto.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto.lua)
--- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (lua/src/sekreto.lua)
+-- Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- sekreto: one interface for secrets, wherever they live.
 --

package/project/.sdk/tm/lua/feature/validate_feature.lua

@@ -0,0 +1,333 @@
+-- ProjectName SDK validate feature
+--
+-- Payload validation against the model's own field types (the lua port of
+-- tm/ts/src/feature/validate/ValidateFeature.ts).
+--
+-- The specs are NOT written here and not written in the model either: every
+-- entity field already carries a canonical type sentinel (`$STRING`,
+-- `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
+-- vocabulary vs.validate speaks. The generator maps them once
+-- (helpers/canonSpec) and emits `schema.ENTITYSPEC`, so a field whose type
+-- changes in the API spec changes what this feature enforces with no edit
+-- anywhere.
+--
+-- WHAT IS CHECKED
+--   outbound (PreSpec)  the payload the caller asked to send, against
+--                       spec.op[opname] -- the operation's request shape.
+--   inbound  (PreDone)  each record the operation returned, against
+--                       spec.data -- the entity's own field types.
+--
+-- WHAT IS NOT. The model carries no array element types, no nested object
+-- schemas, no enums, formats or bounds, so this checks the shape the model
+-- knows and nothing more.
+--
+-- Short-circuit mechanism: the failure error is placed in `ctx.out["spec"]`;
+-- `make_spec` recognises an SDK error there and returns it as the operation
+-- error before the request is built -- the same seam rbac uses one stage
+-- earlier through `ctx.out["point"]`.
+
+local BaseFeature = require("feature.base_feature")
+local schema = require("schema")
+local vs = require("utility.struct.struct")
+
+-- Built rather than written, so the backticks cannot be lost in an edit.
+local OPEN = string.char(96) .. "$OPEN" .. string.char(96)
+
+local ValidateFeature = {}
+ValidateFeature.__index = ValidateFeature
+setmetatable(ValidateFeature, { __index = BaseFeature })
+
+
+-- The spec tree with every `$OPEN` marker removed, so an undeclared key is
+-- an error rather than a pass. Rebuilt rather than mutated: schema.ENTITYSPEC
+-- is parsed once at require and shared by every client in the process.
+--
+-- The source metatable is CARRIED OVER: dkjson marks an array with
+-- `__jsontype`, and a `$ONE` union that lost the mark would be read back as a
+-- map and stop being a union at all.
+local function close_spec(node)
+  if type(node) ~= "table" then
+    return node
+  end
+
+  local out = {}
+  for k, v in pairs(node) do
+    if k ~= OPEN then
+      out[k] = close_spec(v)
+    end
+  end
+
+  return setmetatable(out, getmetatable(node))
+end
+
+
+-- A RESULT RECORD AS DATA.
+--
+-- make_result turns every record of a LIST into an entity instance
+-- (`entity:make()` then `ent:data_set(entry)`), so what reaches PreDone for a
+-- list is wrappers, not records -- and a wrapper checked against a field spec
+-- fails on every required field while its actual data goes unchecked. A load
+-- returns the record itself, so this has to handle both.
+local function unwrap(record)
+  if type(record) == "table" and type(record.data_get) == "function" then
+    local data = record:data_get()
+    if data ~= nil then
+      return data
+    end
+  end
+  return record
+end
+
+
+function ValidateFeature.new()
+  local self = setmetatable(BaseFeature.new(), ValidateFeature)
+  self.version = "0.0.1"
+  self.name = "validate"
+  self.active = true
+  self.client = nil
+  self.options = nil
+  self.spec = {}
+  self.request = true
+  self.response = false
+  self.mode = "throw"
+  return self
+end
+
+
+function ValidateFeature:init(ctx, options)
+  self.client = ctx.client
+  self.options = options or {}
+  self.active = self.options["active"] == true
+
+  -- DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+  -- `config.options` documents them and types them; it does not inject them,
+  -- because each feature entry in the spec is optional and struct fills in
+  -- nothing through an optional union. So every feature resolves its own.
+  self.request = self.options["request"] ~= false
+  self.response = self.options["response"] == true
+
+  -- FAIL CLOSED. Only the exact string "report" selects report mode, so a
+  -- typo (`mode = "thow"`) still rejects rather than silently turning
+  -- enforcement off -- the failure nobody would notice. The option spec
+  -- rejects the typo outright; this is what happens if it ever does not.
+  self.mode = self.options["mode"] == "report" and "report" or "throw"
+
+  -- `strict` is applied ONCE, here, by rebuilding the spec tree without the
+  -- `$OPEN` markers -- rather than per call, which would clone a spec for
+  -- every request an SDK ever makes.
+  if self.options["strict"] == true then
+    self.spec = close_spec(schema.ENTITYSPEC)
+  else
+    self.spec = schema.ENTITYSPEC
+  end
+end
+
+
+function ValidateFeature:PreSpec(ctx)
+  if not self.active or not self.request then
+    return
+  end
+
+  local opname = self:_opname(ctx)
+  local espec = self:_entity_spec(ctx)
+  local opspec = nil
+  if type(espec) == "table" and type(espec["op"]) == "table" then
+    opspec = espec["op"][opname]
+  end
+
+  if opspec == nil then
+    return
+  end
+
+  local errs = self:_check(ctx, self:_payload(ctx, opname), opspec, "request")
+  if #errs == 0 or self.mode == "report" then
+    return
+  end
+
+  local err = ctx:make_error("validate_failed",
+    'Invalid ' .. opname .. ' request for entity "' .. self:_entname(ctx) ..
+    '": ' .. table.concat(errs, "; "))
+  ctx.out["spec"] = err
+  return err
+end
+
+
+-- Inbound. PreDone rather than PreResult: the records are extracted from the
+-- response body by make_result, which runs between the two, so at PreResult
+-- there is nothing to check but the envelope.
+--
+-- HOOK ORDER MATTERS HERE, and the default order is not the one you want.
+-- PreDone hooks fire in feature ADD order, which defaults to `test` first and
+-- then names sorted -- and `validate` sorts last, after audit, cost, debug,
+-- metrics and telemetry. Those observers therefore record the operation as a
+-- success before this hook has looked at it. Activating features as an
+-- ORDERED LIST fixes it.
+function ValidateFeature:PreDone(ctx)
+  if not self.active or not self.response then
+    return
+  end
+
+  local espec = self:_entity_spec(ctx)
+  if type(espec) ~= "table" or espec["data"] == nil then
+    return
+  end
+
+  local result = ctx.result
+  if result == nil or result.resdata == nil then
+    return
+  end
+
+  -- A list op returns many records and a load returns one; both are checked
+  -- against the same record spec, because they are the same entity.
+  local records = {}
+  if type(result.resdata) == "table" and #result.resdata > 0 then
+    records = result.resdata
+  else
+    records = { result.resdata }
+  end
+
+  local errs = {}
+  for _, record in ipairs(records) do
+    if record ~= nil then
+      -- A NON-OBJECT IS A FAILURE, not something to skip. A load that
+      -- answered 42 where the entity's spec wants a record must not pass this
+      -- feature silently -- struct rejects it with the field it could not
+      -- find.
+      for _, e in ipairs(self:_check(ctx, unwrap(record), espec["data"], "response")) do
+        table.insert(errs, e)
+      end
+    end
+  end
+
+  if #errs == 0 or self.mode == "report" then
+    return
+  end
+
+  local err = ctx:make_error("validate_failed",
+    'Invalid response for entity "' .. self:_entname(ctx) .. '": ' ..
+    table.concat(errs, "; "))
+
+  -- BOTH, and `ok` is the load-bearing half: `done` returns `resdata`
+  -- whenever `result.ok` is true and never looks at `err`, so setting the
+  -- error alone would hand the caller the very records that failed the spec.
+  result.ok = false
+  result.err = err
+
+  -- AND THE DATA GOES. The load/update paths copy `result.resdata` into the
+  -- entity's own state on any non-nil value, BEFORE `done` raises -- so
+  -- rejecting the operation while leaving the records in place would leave
+  -- the caller holding an entity populated from a payload this feature had
+  -- just declared invalid.
+  result.resdata = nil
+
+  return err
+end
+
+
+-- The payload an operation is about to send.
+--
+-- TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries the
+-- caller's argument in `reqdata` over the entity's `data`; a match op
+-- (load/list/remove) carries it in `reqmatch` over `match`. That is what the
+-- entity operations pass to the context and what make_point reads -- so
+-- reading `reqdata` for every op would check a `load({id=...})` against the
+-- entity's STALE stored match and reject it for the id the caller had just
+-- supplied.
+function ValidateFeature:_payload(ctx, opname)
+  local body = opname == "create" or opname == "update" or opname == "patch"
+
+  local base = body and ctx.data or ctx.match
+  local req = body and ctx.reqdata or ctx.reqmatch
+
+  local out = {}
+  for _, src in ipairs({ base or {}, req or {} }) do
+    if type(src) == "table" then
+      for k, v in pairs(src) do
+        out[k] = v
+      end
+    end
+  end
+
+  -- `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the record.
+  -- make_point reads it off this same argument and the request transformer
+  -- drops it before the body is built, so a spec built from the API's own
+  -- fields will never name it -- and under `strict` every custom-action call
+  -- would be rejected for the one key that made it reachable.
+  out["$action"] = nil
+
+  return out
+end
+
+
+function ValidateFeature:_entity_spec(ctx)
+  if type(self.spec) ~= "table" then
+    return nil
+  end
+  return self.spec[self:_entname(ctx)]
+end
+
+
+function ValidateFeature:_opname(ctx)
+  if ctx.op ~= nil and type(ctx.op.name) == "string" then
+    return ctx.op.name
+  end
+  return ""
+end
+
+
+function ValidateFeature:_entname(ctx)
+  local entity = ""
+  if ctx.entity ~= nil then
+    if type(ctx.entity.get_name) == "function" then
+      entity = ctx.entity:get_name()
+    elseif type(ctx.entity.name) == "string" then
+      entity = ctx.entity.name
+    end
+  end
+  if entity == "" and ctx.op ~= nil and type(ctx.op.entity) == "string" then
+    entity = ctx.op.entity
+  end
+  return entity
+end
+
+
+-- One validate call. Errors are COLLECTED, never raised: vs.validate raises
+-- on the first failure unless given an `errs` table, and a caller fixing a
+-- payload wants every problem with it, not the first one.
+function ValidateFeature:_check(ctx, data, spec, direction)
+  local errs = {}
+
+  local ok, e = pcall(function()
+    vs.validate(data, spec, { errs = errs })
+  end)
+
+  -- A spec this port cannot run at all (rather than a payload that fails it)
+  -- must not take the operation down with it: report it like any other
+  -- failure and let `mode` decide.
+  if not ok and #errs == 0 then
+    table.insert(errs, tostring(e))
+  end
+
+  local messages = {}
+  for _, m in ipairs(errs) do
+    table.insert(messages, tostring(m))
+  end
+
+  if #messages > 0 and type(self.options["onInvalid"]) == "function" then
+    -- A callback receiving every failure, whatever `mode` does with it, so a
+    -- client can log or count invalid payloads without changing what the SDK
+    -- returns.
+    pcall(self.options["onInvalid"], {
+      entity = self:_entname(ctx),
+      op = self:_opname(ctx),
+      direction = direction,
+      errs = messages,
+      data = data,
+    })
+  end
+
+  return messages
+end
+
+
+return ValidateFeature

package/project/.sdk/tm/lua/test/vendor/omni/json.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260908-1556-0 (lua/src/json.lua)
--- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/omni sdk-20260917-1242-0 (lua/src/json.lua)
+-- Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- The omni JSON value model and parser.
 --

package/project/.sdk/tm/lua/test/vendor/omni/regex.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260908-1556-0 (lua/src/regex.lua)
--- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/omni sdk-20260917-1242-0 (lua/src/regex.lua)
+-- Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- A small backtracking regex engine.
 --

package/project/.sdk/tm/lua/test/vendor/omni/runner.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260908-1556-0 (lua/src/runner.lua)
--- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/omni sdk-20260917-1242-0 (lua/src/runner.lua)
+-- Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Omni: the shared multi-language test runner (Lua port).
 --

package/project/.sdk/tm/lua/test/vendor/omni/util.lua

@@ -1,5 +1,5 @@
--- VENDORED: @voxgig/omni sdk-20260908-1556-0 (lua/src/util.lua)
--- Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+-- VENDORED: @voxgig/omni sdk-20260917-1242-0 (lua/src/util.lua)
+-- Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Omni internal JSON utilities.
 --

package/project/.sdk/tm/lua/utility/make_options.lua

@@ -1,6 +1,52 @@
 -- ProjectName SDK utility: make_options
 
 local vs = require("utility.struct.struct")
+local schema = require("schema")
+
+-- See the call site in make_options for why this exists.
+local function densify_lists(v, seen)
+  if type(v) ~= 'table' then
+    return v
+  end
+
+  seen = seen or {}
+  if seen[v] then
+    return v
+  end
+  seen[v] = true
+
+  local count, max, intonly = 0, 0, true
+  for k in pairs(v) do
+    count = count + 1
+    if math.type(k) == 'integer' and 0 < k then
+      if k > max then
+        max = k
+      end
+    else
+      intonly = false
+    end
+  end
+
+  -- A hole is the only case worth rebuilding for: every key an integer, and
+  -- a highest key past the number of entries.
+  if intonly and 0 < count and max > count then
+    local out = {}
+    for i = 1, max do
+      local e = v[i]
+      if e == nil then
+        out[i] = false
+      else
+        out[i] = densify_lists(e, seen)
+      end
+    end
+    return out
+  end
+
+  for k, e in pairs(v) do
+    v[k] = densify_lists(e, seen)
+  end
+  return v
+end
 
 local function make_options_util(ctx)
   local options = ctx.options or {}
@@ -73,61 +119,20 @@ local function make_options_util(ctx)
     cfgopts = co
   end
 
-  local optspec = {
-    apikey = "",
-    secret = "",
-    base = "http://localhost:8000",
-    prefix = "",
-    suffix = "",
-    auth = {
-      prefix = "",
-      basic = false,
-    },
-    headers = {
-      ["`$CHILD`"] = "`$STRING`",
-    },
-    allow = {
-      method = "GET,PUT,POST,PATCH,DELETE,OPTIONS",
-      op = "create,update,load,list,remove,command,direct,graphql",
-    },
-    entity = {
-      ["`$CHILD`"] = {
-        ["`$OPEN`"] = true,
-        active = false,
-        alias = {},
-      },
-    },
-    feature = {
-      ["`$CHILD`"] = {
-        ["`$OPEN`"] = true,
-        active = false,
-      },
-    },
-    utility = {},
-    -- Feature INSTANCES supplied at construction (the station adopt
-    -- path): consumed by the constructor's feature_add loop, so they are
-    -- class instances, not data -- `$ANY` accepts them verbatim. Without
-    -- this entry the seam is dead: the constructor reads
-    -- options.extend, but validate rejected the key.
-    extend = "`$ANY`",
-    system = {},
-    test = {
-      active = false,
-      entity = {
-        ["`$OPEN`"] = true,
-      },
-    },
-    clean = {
-      keys = "key,token,id",
-    },
-    -- Server-variable values for a templated base URL (OpenAPI server
-    -- variables): {name} placeholders in `base` are substituted from this
-    -- map at construction. Spec defaults arrive via the generated config;
-    -- user values override them.
-    server = {
-      ["`$CHILD`"] = "",
-    },
-  }
+  -- THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+  --
+  -- `schema.OPTSPEC` is built from the model: `main.kit.optspec` for
+  -- the standard options, plus one entry per feature this target
+  -- carries, taken from that feature's own `config.options` /
+  -- `config.optspec`. Editing this file to add an option would put it
+  -- back where it was — one of twenty hand-maintained copies of a
+  -- schema nothing cross-checked — so add it to the model instead and
+  -- every ported target validates it.
+  --
+  -- NOT MUTATED. It is a module-level table shared by every client this
+  -- Lua state constructs; anything defaulted below is applied to the
+  -- RESULT, never to the spec.
+  local optspec = schema.OPTSPEC
 
   -- Preserve system.fetch before merge/validate.
   local sys_fetch = vs.getpath(opts, "system.fetch")
@@ -146,6 +151,20 @@ local function make_options_util(ctx)
   -- tables as merge TARGETS — one instance's options (server, headers, ...)
   -- would contaminate every instance constructed after it.
   local merged = vs.merge({ {}, vs.clone(cfgopts), opts })
+
+  -- LUA CANNOT STORE NIL, so `{ a, nil, b }` is a table holding keys 1 and 3
+  -- and no 2 -- not a sequence. struct classifies it as a MAP and refuses it
+  -- against a `list` spec, so a caller's sparse list became an uncatchable
+  -- construction error naming the whole option shape, instead of the feature's
+  -- own message about the one entry that is wrong.
+  --
+  -- Densify first: a table whose keys are ALL positive integers is meant as a
+  -- list, so walk 1..max and fill each hole with `false`. The hole stays
+  -- PRESENT -- dropping it would silently shorten a provider chain, which is
+  -- the failure the secrets suite pins -- and `false` is not a table, so the
+  -- feature reading it refuses it by its own rule, with its own message.
+  merged = densify_lists(merged)
+
   local validated = vs.validate(merged, optspec)
   if type(validated) ~= "table" then
     validated = {}

package/project/.sdk/tm/lua/utility/make_spec.lua

@@ -6,7 +6,14 @@ local Spec = require("core.spec")
 
 local function make_spec_util(ctx)
   if ctx.out["spec"] ~= nil then
-    ctx.spec = ctx.out["spec"]
+    local preset = ctx.out["spec"]
+    -- PreSpec short-circuit: a feature (e.g. validate) may place an SDK
+    -- error in ctx.out["spec"] to abort the operation before the request is
+    -- built. The same seam make_point offers one stage earlier.
+    if type(preset) == "table" and preset.is_sdk_error == true then
+      return nil, preset
+    end
+    ctx.spec = preset
     return ctx.spec, nil
   end
 

package/project/.sdk/tm/lua/utility/struct/regex.lua

@@ -1,5 +1,5 @@
 -- VENDORED: @voxgig/struct 0.1.1 (lua/src/regex.lua)
--- Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+-- Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 --

package/project/.sdk/tm/lua/utility/struct/struct.lua

@@ -1,5 +1,5 @@
 -- VENDORED: @voxgig/struct 0.1.1 (lua/src/struct.lua)
--- Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
+-- Source: https://github.com/voxgig/struct @ 3110e839a3f35b2fbdb047bf0c24f29d144027ea  [tag: sdk-20260917-1242-0]
 -- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 -- Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE.
 

package/project/.sdk/tm/ocaml/Makefile

@@ -60,17 +60,22 @@ CORPUS = ../.sdk/test/test.json
 # A gated feature's modules come AFTER sdk_features.ml (a feature module
 # opens it) and BEFORE sdk_config.ml (the generated factory names them).
 #
+# TWO GENERATED MODULES sit in this list rather than beside sdk_config.ml,
+# because ocaml links a FIXED order and compiles a module before anything
+# that calls it — there is no link-time reordering.
+#
+# sdk_schema.ml is the model's option spec and entity specs; sdk_runtime.ml's
+# make_options reads it, and the validate feature reads its entity specs.
+#
 # sdk_prepare_auth.ml is GENERATED (src/cmp/ocaml/PrepareAuth_ocaml.ts), not
 # copied from the template tree: WHERE the credential goes - a header, a query
 # parameter or a cookie, and under what name - is a fact about the API, and a
-# template can hold only one answer. Its position is STATED here because
-# ocamlc compiles a module before anything that uses it and has no link-time
-# reordering: after sdk_helpers.ml, whose client/value accessors it uses, and
-# before sdk_runtime.ml, which binds `prepare_auth_util` to it and registers
-# that in the utility record.
+# template can hold only one answer. It goes after sdk_helpers.ml, whose
+# client/value accessors it uses, and before sdk_runtime.ml, which binds
+# `prepare_auth_util` to it and registers that in the utility record.
 RUNTIME = utility/vregex.ml utility/voxgig_struct.ml sdk_json.ml \
-  sdk_types.ml sdk_helpers.ml sdk_prepare_auth.ml sdk_runtime.ml \
-  sdk_features.ml $(FEATURE_SRC)
+  sdk_types.ml sdk_helpers.ml sdk_schema.ml sdk_prepare_auth.ml \
+  sdk_runtime.ml sdk_features.ml $(FEATURE_SRC)
 
 # The vendored corpus engine plus the adapter that drives it. Order matters:
 # the adapter references the vendored module.

package/project/.sdk/tm/ocaml/feature/secrets/plugin/capability.ml

@@ -1,5 +1,5 @@
-(* VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ocaml/src/capability.ml) *)
-(* Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0] *)
+(* VENDORED: @voxgig/plugin sdk-20260917-1242-0 (ocaml/src/capability.ml) *)
+(* Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0] *)
 (* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
 (* Capabilities (§11.1).