@voxgig/sdkgen 4.29.0 → 4.30.1

package/project/.sdk/tm/go/feature/secrets/plugin/point.go

@@ -1,16 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/point.go)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Extension points (§6). Three kinds, chosen because they are what the
- * two existing systems actually needed, and no more.
- *
- * A PLUGIN NEVER MUTATES THE HOST. That inversion is what makes
- * deactivation possible: sdkgen's `utility.fetcher = wrapped` is not
- * undoable, but "this instance holds slot 3 of the request chain" is
- * undoable in O(1). OSGi named it the whiteboard pattern in 2004, in a
- * paper called *Listeners Considered Harmful*, and for exactly this
- * reason. */
-
 package plugin
 
 import "sort"
@@ -23,11 +13,6 @@ const (
 	KindProvider Kind = "provider"
 )
 
-// Mode is §6.1: "fan-out" is not one answer but four. In a language with
-// asynchrony, "call every binding" hides a decision — start them all and
-// wait, await each in turn, or do not wait — and a design that leaves it
-// unsaid gets four different answers from four ports, in the concurrency
-// behaviour of production code no corpus entry happens to cover.
 type Mode string
 
 const (
@@ -37,22 +22,6 @@ const (
 	ModeBail     Mode = "bail"
 )
 
-/* BindFn IS ONE TYPE FOR ALL THREE KINDS, AND THAT IS A PORT DECISION
- * WORTH STATING.
- *
- * The canonical calls `fn(arg)` for a hook, `fn(next, ...args)` for a
- * chain and `fn(...args)` for a provider — three arities on one
- * untyped slot. Go could give each kind its own func type, but then
- * `bind` needs three spellings and a probe that binds the same
- * function to a hook point in one corpus entry and a provider point in
- * the next (which `point/bail` and `point/provider` do, with the same
- * `provider` probe) could not be written at all.
- *
- * So one variadic signature carries all three, and a chain's `next` is
- * simply its first argument — exactly as in the canonical.
- *
- * A BINDING CANNOT RAISE IN GO. It RETURNS an error value instead, and
- * §6.1's collecting modes gather those. */
 type BindFn func(args ...any) any
 
 type Spec struct {
@@ -61,24 +30,17 @@ type Spec struct {
 	// Base is `chain` only: the host owns the base, and a plugin cannot
 	// replace it (§6.2). One that wants to SUBSTITUTE rather than wrap
 	// binds innermost and simply does not call `next`.
-	Base BindFn `json:"-"`
-	// Exclusive is `provider` only: a second binding is an error rather
-	// than a shadow.
-	Exclusive bool `json:"exclusive,omitempty"`
-	// Default is `provider` only: the host's fallback.
-	Default any `json:"default,omitempty"`
-	Pin     Pin `json:"pin,omitempty"`
+	Base      BindFn `json:"-"`
+	Exclusive bool   `json:"exclusive,omitempty"`
+	Default   any    `json:"default,omitempty"`
+	Pin       Pin    `json:"pin,omitempty"`
 }
 
 type Bound struct {
 	Ref   string
 	Point string
 	Fn    BindFn
-	// Band: `provider` ranks by HIGHEST band, unlike hook and chain
-	// which run lowest first. Kept as declared so the two rules stay
-	// visibly different rather than one being derived from the other by
-	// a reader who then gets it backwards.
-	Band int
+	Band  int
 }
 
 // Emit is fan-out. Return values are ignored except in `bail`.
@@ -110,7 +72,6 @@ func Emit(bindings []Bound, mode Mode, arg any) (any, error) {
 		if !bad {
 			continue
 		}
-		// `emit` raises synchronously; the collecting modes gather.
 		if ModeEmit == mode {
 			return nil, err
 		}
@@ -122,13 +83,6 @@ func Emit(bindings []Bound, mode Mode, arg any) (any, error) {
 	return errors, nil
 }
 
-// Compose is b1(b2(b3(base))), FIRST BINDING OUTERMOST (§6.2).
-//
-// Recomputed by the host whenever the live set changes, and cached
-// between changes. Plugins receive `next` as an argument; they never see
-// or store the previous value of anything. A plugin that stashes `next`
-// and calls it after deactivation is a bug the host cannot prevent, and
-// this says so rather than pretending otherwise.
 func Compose(bindings []Bound, base BindFn) BindFn {
 	next := base
 	for i := len(bindings) - 1; 0 <= i; i-- {
@@ -146,9 +100,6 @@ type Picked struct {
 	Shadowed []string
 }
 
-// Provider selects at most one live implementation (§6.3). The winner is
-// the highest band, ties broken by ref sort, and THE LOSERS ARE VISIBLE
-// rather than silently ignored.
 func Provider(bindings []Bound, spec Spec) (Picked, error) {
 	if 0 == len(bindings) {
 		return Picked{Shadowed: []string{}}, nil
@@ -170,7 +121,7 @@ func Provider(bindings []Bound, spec Spec) (Picked, error) {
 	sort.SliceStable(ranked, func(i, j int) bool {
 		a, b := ranked[i], ranked[j]
 		if a.Band != b.Band {
-			return a.Band > b.Band // HIGHEST band wins
+			return a.Band > b.Band
 		}
 		return a.Ref < b.Ref
 	})

package/project/.sdk/tm/go/feature/secrets/plugin/ref.go

@@ -1,12 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/ref.go)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Identity: name+tag, written `name$tag` (§4).
- *
- * The four pure functions, and the whole of what `ref` pins. They are
- * the first thing a new port implements and the first corpus section it
- * passes. */
-
 package plugin
 
 import (
@@ -14,15 +8,8 @@ import (
 	"strings"
 )
 
-// §4: `^[a-zA-Z@][a-zA-Z0-9.~_\-/]*$`, max 1024.
 var nameRe = regexp.MustCompile(`^[a-zA-Z@][a-zA-Z0-9.~_\-/]*$`)
 
-// §4: `^[a-zA-Z0-9.~_-]+$`, max 1024, or empty.
-//
-// The asymmetry with a name is deliberate: a tag MAY start with a digit
-// because auto-tagging assigns integer tags (`stripe$1`), and a tag
-// admits neither `@` nor `/` because a name is a package specifier and a
-// tag is not.
 var tagRe = regexp.MustCompile(`^[a-zA-Z0-9.~_-]+$`)
 
 const refMax = 1024
@@ -46,13 +33,7 @@ func CheckTag(tag string) bool {
 	return tagRe.MatchString(tag)
 }
 
-// ParseRef turns `name$tag` into the pair. Canonicalizing: `stripe$` and
-// `stripe` both give tag "".
 func ParseRef(str string) (Ref, error) {
-	// Split on the FIRST `$`. Nothing in the grammar decides this — `$`
-	// is in neither character class — so the corpus is the arbiter (§4
-	// rule 5), and it picks the split that blames the part actually at
-	// fault: `a$b$c` is a good name with a bad tag, not the reverse.
 	name := str
 	tag := ""
 	if cut := strings.Index(str, "$"); -1 != cut {
@@ -72,10 +53,6 @@ func ParseRef(str string) (Ref, error) {
 	return Ref{Name: name, Tag: tag}, nil
 }
 
-// FormatRef turns the pair into `name$tag`. An empty tag NEVER writes
-// the separator, which is the half of canonicalization FormatRef owns:
-// parse tolerates `stripe$`, format never produces it, so a round trip
-// is idempotent.
 func FormatRef(name string, tag string) (string, error) {
 	if !CheckName(name) {
 		return "", Fail("plugin_bad_name", "invalid plugin name: "+name,

package/project/.sdk/tm/go/feature/secrets/plugin/resolve.go

@@ -1,19 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/resolve.go)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Dynamic resolution (§10.2) — name to candidate module ids.
- *
- * PURE. It returns the ids a host WOULD try, in order; it does not load
- * anything. That separation is what lets the corpus pin resolution in
- * every language including those with no dynamic loading at all, and it
- * is why §15.4 puts real module loading in per-port integration tests
- * rather than here.
- *
- * GO IS TIER S (§10.3): static-only, registration through `init()` or
- * an explicit list handed to MakeHost. That changes nothing here —
- * candidate generation is what the corpus pins, and a port with no
- * dynamic loading at all still answers it identically. */
-
 package plugin
 
 import "strings"
@@ -64,16 +51,6 @@ var defaultSources = []Source{
 	{Kind: "module", Prefix: []string{"@voxgig/plugin-", "voxgig-plugin-", "plugin-", ""}},
 }
 
-// ResolveFrom: A MODULE PATH IS NOT A NAME (§10.2). The ref grammar
-// starts a name with a letter or `@`, so `./local/thing` is not a ref
-// and never reaches candidate generation — seneca allows a path where a
-// plugin name goes, and this design deliberately does not, because a ref
-// is an ADDRESS WITHIN A HOST and a path is a LOCATION ON A DISK.
-//
-// Loading from an explicit location is a separate field that bypasses
-// candidate generation entirely: `from` is passed to the resolver
-// verbatim, and a resolver that cannot honour a location raises
-// plugin_resolve_failed.
 func ResolveFrom(from string) []string {
 	return []string{from}
 }

package/project/.sdk/tm/go/feature/secrets/plugin/types.go

@@ -1,18 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/types.go)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Shared types. Deliberately small: the design's §19 budget says the
- * library owns naming, configuration, lifecycle, ordering, binding and
- * teardown, and nothing else.
- *
- * GO IS THE FIRST PORT AND IT CHANGES ONE THING ON PURPOSE (§18, P4):
- * errors are RETURNED, not raised. The canonical raises, and every
- * signature that could fail here returns `error` instead. That is the
- * point of porting Go first — "static-only + typed extension points +
- * explicit errors will find every TypeScript-shaped assumption in the
- * model" — and the corpus compares by CODE, which survives the change
- * intact. */
-
 package plugin
 
 import (
@@ -21,17 +9,11 @@ import (
 	"fmt"
 )
 
-// Ref is the two halves of an identity (§4). Tag is "" when absent —
-// never nil and never missing, because a port returning three shapes
-// for two states makes every downstream comparison a special case.
 type Ref struct {
 	Name string `json:"name"`
 	Tag  string `json:"tag"`
 }
 
-// Status is one of §5.1's seven statuses, and no more. A port that adds
-// an eighth is diverging. `loading` and `closing` are observable only
-// from inside a callback or from another thread.
 type Status string
 
 const (
@@ -44,20 +26,12 @@ const (
 	StatusClosing  Status = "closing"
 )
 
-// OrderBlock is §4.4 of DOCS.md — `band` rather than a nested `order`,
-// because `order.order` needs explaining every time it is read.
 type OrderBlock struct {
 	Before OrderRef `json:"before,omitempty"`
 	After  OrderRef `json:"after,omitempty"`
 	Band   *int     `json:"band,omitempty"`
 }
 
-// MarshalJSON omits an unstated constraint entirely.
-//
-// `omitempty` does not apply to a struct, so without this an absent
-// `before` serialized as `"before": null` while canonical simply has no
-// key - the same language-dependent shape divergence as emitting a list
-// for an authored scalar, one level up.
 func (block OrderBlock) MarshalJSON() ([]byte, error) {
 	out := map[string]any{}
 	if block.Before.Stated() {
@@ -70,47 +44,15 @@ func (block OrderBlock) MarshalJSON() ([]byte, error) {
 		out["band"] = *block.Band
 	}
 
-	// `marshal` for the same reason as OrderRef.MarshalJSON above.
 	return marshal(out)
 }
 
-// OrderRef is ONE spelling or a LIST of them.
-//
-// plugin used to type this as a bare string, so a list matched nothing and
-// was SILENTLY DROPPED - the sort came out as if no constraint had been
-// declared. Go could not even represent the input.
-//
-// `raw` is THE AUTHORED VALUE, kept so normalization can hand the block
-// back exactly as written; `List` is the parsed form the sort consumes,
-// and `set` says whether the key was stated at all. Canonical does not
-// need any of this: it never decodes the block, it assigns it (`ent.order
-// = ord`), so every spelling survives untouched. Go is the only port that
-// decodes and rebuilds, and a rebuild silently loses whatever it does not
-// model. That single cause produced four separate parity breaks - the
-// list form, scalar-vs-one-element-list, an authored empty list, an
-// authored null - and the corpus could see none of them until
-// `config/normorder` was written to assert the block's own shape.
-//
-// `set` is deliberately not `0 < len(list)`: an authored `[]` states a
-// constraint that names nothing, which is NOT the same document as an
-// absent key.
-//
-// `raw` is the ONE source of truth and `list` is a derived cache, both
-// unexported. An earlier round exported `List`, which made the value
-// mutable from outside and gave it two sources that could disagree: a
-// caller mutating the slice it passed in changed what marshalled while
-// ResolveOrder kept the old constraint, and editing `List` directly did
-// the reverse. A persisted-then-reloaded config could then order
-// differently from the live one. NewOrderRef is now the only way to build
-// one, it copies what it is given, and Refs() hands back a copy.
 type OrderRef struct {
 	raw  any
 	list []string
 	set  bool
 }
 
-// Refs is the parsed spellings this ref names, as a copy. Callers get no
-// handle on the ref's own state.
 func (ref OrderRef) Refs() []string {
 	out := make([]string, len(ref.list))
 	copy(out, ref.list)
@@ -118,15 +60,6 @@ func (ref OrderRef) Refs() []string {
 	return out
 }
 
-// UnmarshalJSON decodes to `any` first and then goes through the SAME
-// decoder the in-memory path uses.
-//
-// It used to try `string` and then `[]string` directly. That is wrong
-// twice over: json.Unmarshal into a string is a documented NO-OP on JSON
-// null and returns a nil error, so `{"after":null}` took the string
-// branch and came back as `{"after":""}` - an empty-string constraint
-// nobody wrote; and having two decoders for one rule let them drift, so
-// this path hard-failed on values the in-memory path quietly accepted.
 func (ref *OrderRef) UnmarshalJSON(data []byte) error {
 	var authored any
 
@@ -139,30 +72,10 @@ func (ref *OrderRef) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// Stated reports whether this ref says anything at all - because a
-// document stated it, or because a Go caller built it by hand.
-//
-// It is NOT `0 < len(List)`: an authored `[]` states a constraint that
-// names nothing, and an absent key states nothing, and those are
-// different documents.
 func (ref OrderRef) Stated() bool {
 	return ref.set
 }
 
-// MarshalJSON replays the AUTHORED value.
-//
-// A ref that was never stated marshals as `null`, and OrderBlock omits
-// the key rather than emitting that. There is no `List` fallback and no
-// way to build a ref outside NewOrderRef: an earlier round had both, and
-// carrying two ways to construct one value is exactly what let them
-// desync.
-//
-// `marshal`, not `json.Marshal`. The latter escapes `<`, `>` and `&` as
-// \u00XX, which canonical's JSON.stringify does not, and an outer encoder
-// cannot undo an escape its input already carries - so a spelling holding
-// any of those three came back with different bytes from every other
-// port. go/AGENTS.md states this rule outright and both marshallers here
-// broke it.
 func (ref OrderRef) MarshalJSON() ([]byte, error) {
 	if ref.set {
 		return marshal(ref.raw)
@@ -180,22 +93,12 @@ func NewOrderRef(spelling any) OrderRef {
 	return asorderref(spelling, true)
 }
 
-// Instance is a normalized instance entry. Option data is NOT merged
-// here — see OptionLayers.
 type Instance struct {
-	Pos    int         `json:"pos"`
-	Active bool        `json:"active"`
-	Start  string      `json:"start"`
-	Order  *OrderBlock `json:"order,omitempty"`
-	// OptionLayers holds levels 3-6 that are present, IN LADDER ORDER
-	// (§9.3).
-	//
-	// Normalization does not merge these, and cannot: §9.4 makes merge
-	// behaviour a property of the definition's option shape, which
-	// normalization has never seen. Flattening them here would make
-	// `$MERGE: append` unimplementable at load time, because the layers
-	// it must concatenate would already be collapsed.
-	OptionLayers []any `json:"optionlayers"`
+	Pos          int         `json:"pos"`
+	Active       bool        `json:"active"`
+	Start        string      `json:"start"`
+	Order        *OrderBlock `json:"order,omitempty"`
+	OptionLayers []any       `json:"optionlayers"`
 }
 
 type Normalized struct {
@@ -204,12 +107,6 @@ type Normalized struct {
 	Default  map[string]any       `json:"default"`
 }
 
-// DetailOrder is §12's detail fields, IN THIS FIXED ORDER.
-//
-// The order is part of the contract, not a formatting preference. An
-// earlier draft named six fields while other sections promised
-// diagnostics that had nowhere to go, which would have left each port
-// inventing its own order and breaking message parity.
 var DetailOrder = []string{
 	"host", "ref", "name", "tag", "point", "key", "capability",
 	"range", "version", "match", "candidates", "cycle", "holders",
@@ -257,11 +154,6 @@ func FormatError(code string, text string, details map[string]any) string {
 	return "plugin/" + code + ": " + text + tail
 }
 
-// PluginError carries a §12 code. Ports compare by CODE and never by
-// message: wording is a port's own business, and pinning the words would
-// make every translation a corpus change. The FORMAT, however, is
-// pinned — a parseable message is what makes a log searchable across
-// twenty languages.
 type PluginError struct {
 	Code    string
 	Text    string
@@ -271,8 +163,6 @@ type PluginError struct {
 
 func (e *PluginError) Error() string { return e.message }
 
-// Fail builds the error the canonical would have thrown. Go RETURNS it;
-// every caller in this port propagates rather than unwinding.
 func Fail(code string, text string, details map[string]any) *PluginError {
 	if nil == details {
 		details = map[string]any{}

package/project/.sdk/tm/go/feature/secrets/plugin/util.go

@@ -1,16 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/util.go)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* The handful of helpers the port needs that the canonical gets from
- * JavaScript for free: sorted map keys (Object.keys(x).sort()), a
- * JSON.stringify-equivalent marshal, and deep clone.
- *
- * `each(...) in sorted-key order` is a house rule across voxgig
- * because it makes output BYTE-STABLE. Go's map iteration is
- * deliberately randomized, so every traversal here goes through
- * sortedkeys — an unsorted `for k := range m` is a bug that passes its
- * own tests most of the time. */
-
 package plugin
 
 import (

package/project/.sdk/tm/go/feature/secrets/plugin/version.go

@@ -1,20 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/version.go)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Versions and ranges (§11.2).
- *
- * TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
- * concrete version. A requirement declares `range`. A requirement is
- * satisfied when the names match, the `match` passes, and:
- *
- *   the provider's `version` falls inside the requirement's `range`.
- *
- * That is the whole rule. There is no third field and no second
- * comparison — an earlier draft added a provider-side `compat` range,
- * which left three values and no statement of how they combine, and
- * three defensible readings of one declaration is worse than the
- * ambiguity it was introduced to fix. */
-
 package plugin
 
 import (
@@ -30,21 +16,8 @@ type Range struct {
 
 var versionRe = regexp.MustCompile(`^(\d+)(?:\.(\d+))?(?:\.(\d+))?$`)
 
-// componentMax bounds a version component, like §4's 1024 bounds a ref.
-//
-// The grammar admits an unbounded digit sequence and every language then
-// disagrees past its integer range: JavaScript silently loses precision,
-// Go's Atoi errors (and this port was ignoring that, yielding 0), C
-// overflows. `Satisfies("0", "9223372036854775808")` was false in the
-// canonical and TRUE here, from the same corpus.
-//
-// 2^31-1, because every port has a signed 32-bit integer.
 const componentMax = 2147483647
 
-// ParseRange accepts two forms and no more (§11.2):
-//
-//	'2.1'    >= 2.1.0 and < 3.0.0
-//	'~2.1'   >= 2.1.0 and < 2.2.0
 func ParseRange(rng string) (Range, error) {
 	bad := func() (Range, error) {
 		return Range{}, Fail("plugin_bad_range", "invalid range: "+rng,
@@ -157,5 +130,3 @@ func at(l []int, i int) int {
 	}
 	return 0
 }
-
-

package/project/.sdk/tm/go/feature/secrets/plugins/aws/aws.go

@@ -1,11 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/aws/aws.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/aws/aws.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// The aws plugin: Secrets Manager and SSM Parameter Store, with requests
-// SigV4-signed in-tree (sigv4.go, beside this file). Needs HTTPS and
-// HMAC-SHA256 - the one cryptographic dependency in the library, which is
-// why this is a plugin and why the core never imports crypto. A port of
-// typescript/plugins/aws.ts.
 package aws
 
 import (
@@ -21,12 +16,10 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// awsnow is the YYYYMMDDTHHMMSSZ timestamp SigV4 wants, for now.
 func awsnow() string {
 	return time.Now().UTC().Format("20060102T150405Z")
 }
 
-// awscreds is a resolved set of AWS credentials.
 type awscreds struct {
 	region  string
 	keyid   string
@@ -67,7 +60,6 @@ func awsauth(region string, keyid string, secret string, session string) (*awscr
 	return &awscreds{region: region, keyid: keyid, secret: secret, session: session}, nil
 }
 
-// awscall makes one signed call to an AWS JSON-1.1 API.
 func awscall(
 	region string, keyid string, secret string, session string, addr string,
 	service string, target string, payload string,
@@ -134,13 +126,6 @@ func awsmiss(body any, types []string) bool {
 	return false
 }
 
-// SecretsProvider reads AWS Secrets Manager.
-//
-// api.token reads the secret named `api` (the vaultref path, so
-// db.pass.main reads db/pass) and takes the `token` field of its JSON
-// SecretString - the AWS idiom of one JSON map per secret. A SecretString
-// that is not JSON is the value itself, under the conventional field
-// `value`. Requests are SigV4-signed in-tree; see sigv4.go.
 type SecretsProvider struct {
 	Region  string
 	KeyID   string

package/project/.sdk/tm/go/feature/secrets/plugins/aws/sigv4.go

@@ -1,22 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/aws/sigv4.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/aws/sigv4.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// AWS Signature Version 4, hand-rolled.
-//
-// The AWS providers need exactly one thing from the AWS SDK - request
-// signing - and taking the SDK for it would break the no-dependency rule
-// that keeps ten ports honest. SigV4 is a stable, published algorithm
-// built from HMAC-SHA256, which the standard library already has.
-//
-// SigV4 is pure: the caller passes the timestamp, so the same input yields
-// the same signature everywhere. That is what lets the shared spec carry
-// known-answer cases that all ten ports must reproduce bit-for-bit, and
-// lets the integration mock recompute the signature server-side.
-//
-// A port of typescript/plugins/sigv4.ts, which is canonical. It lives
-// with the aws plugin because it is the one place the library needs
-// HMAC-SHA256, and a built-in must not.
-
 package aws
 
 import (
@@ -35,11 +19,8 @@ import (
 // Sigv4Input is one request to sign. The JSON tags match the shared
 // spec's sigv4 group, so a spec case decodes straight into it.
 type Sigv4Input struct {
-	Method string `json:"method"`
-	// URL is the full request URL; the host, path and query are signed.
-	URL string `json:"url"`
-	// Headers are extra headers to sign, e.g. content-type and
-	// x-amz-target.
+	Method  string            `json:"method"`
+	URL     string            `json:"url"`
 	Headers map[string]string `json:"headers"`
 	Body    string            `json:"body"`
 	Service string            `json:"service"`
@@ -130,12 +111,6 @@ func SigV4(input *Sigv4Input) (map[string]string, error) {
 	}
 	body := input.Body
 
-	// Every header that will be signed: the caller's extras, plus host and
-	// x-amz-date (and the session token when present), lower-cased and
-	// trimmed the way the canonical form requires.
-	// Canonical header values are trimmed AND internally collapsed -
-	// AWS folds sequential whitespace to one space before signing, so a
-	// header like "a  b" must sign as "a b" or the service refuses it.
 	headers := map[string]string{}
 	for key, value := range input.Headers {
 		headers[strings.ToLower(key)] = whitespace.ReplaceAllString(strings.TrimSpace(value), " ")

package/project/.sdk/tm/go/feature/secrets/plugins/azuresecrets/azuresecrets.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/azuresecrets/azuresecrets.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/azuresecrets/azuresecrets.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The azuresecrets plugin: Azure Key Vault. Needs HTTPS. A port of
 // typescript/plugins/azuresecrets.ts.
@@ -19,17 +19,6 @@ import (
 // azureresource is the audience Azure Key Vault tokens are scoped to.
 const azureresource = "https://vault.azure.net"
 
-// Provider reads Azure Key Vault.
-//
-// api.token reads secret api-token (dots flattened to `-`; Key Vault names
-// allow nothing else), current version. The token comes from config, then
-// a client-credentials login when tenant/clientid/clientsecret are given,
-// then the IMDS managed-identity endpoint - so on Azure's own platform no
-// credential configuration is needed.
-//
-// As with GCP, the IMDS call is plain http to a link-local host by
-// platform design and carries no credential; the login and vault addresses
-// are checkaddr-guarded.
 type Provider struct {
 	Vault        string
 	Token        string

package/project/.sdk/tm/go/feature/secrets/plugins/boru/boru.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/boru/boru.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/boru/boru.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The boru plugin: a boru vault through its CLI, or over `boru vault
 // serve`. Needs a child process, or HTTPS in wire mode. A port of
@@ -19,28 +19,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// Provider reads a boru vault (https://github.com/boru-lang/boru).
-//
-// Two ways in, both boru's own.
-//
-// With no Addr, the CLI: `boru vault get --reveal <alias>` prints the
-// secret on stdout, and nothing else. The passphrase is read by boru itself
-// from BORU_VAULT_PASSPHRASE; sekreto never accepts it as config and never
-// puts it on a command line, where it would show up in the process table.
-//
-// With an Addr, boru's wire protocol: `boru vault serve` publishes a
-// read-only, HashiCorp-shaped provision API (boru's
-// design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
-// from `boru vault grant`. A sekreto name is already a valid boru alias,
-// and boru aliases keep their dots, so api.token is the single path segment
-// api.token - not the api/token split a HashiCorp KV gets. The value is the
-// `value` field. A 404 is a miss; anything else the server refuses (a
-// revoked capability, a sealed vault) is an error.
-//
-// boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
-// credential *broker*, built precisely so the caller never receives the
-// credential. `vault serve` is the provision endpoint, built to hand the
-// value back - that is the one sekreto uses.
 type Provider struct {
 	Command   string
 	Namespace string
@@ -165,8 +143,6 @@ func (provider *Provider) Describe() string {
 	return "boru"
 }
 
-// borumiss reports whether a boru failure means "no such secret" rather than
-// "I could not answer". Matched on boru's own wording for a missing alias.
 func borumiss(why string) bool {
 	return strings.Contains(why, "no alias named")
 }