@voxgig/sdkgen 4.30.0 → 4.30.1

package/bin/voxgig-sdkgen

@@ -8,7 +8,7 @@ const { Shape, One, Skip } = require('shape')
 
 const { SdkGen } = require('../dist/sdkgen.js')
 
-const VERSION = '4.30.0'
+const VERSION = '4.30.1'
 const KONSOLE = console
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/sdkgen",
-  "version": "4.30.0",
+  "version": "4.30.1",
   "main": "dist/sdkgen.js",
   "type": "commonjs",
   "engines": {

package/project/.sdk/src/cmp/go/PrepareAuth_go.ts

@@ -87,6 +87,8 @@ func prepareAuthUtil(ctx *core.Context) (*core.Spec, error) {
 import (
 ${withBasic ? `	"encoding/base64"
 
+` : ''}${'cookie' === spec.where ? `	"strings"
+
 ` : ''}	vs "${spec.gomodule}/utility/struct"
 
 	"${spec.gomodule}/core"
@@ -98,7 +100,7 @@ ${'cookie' === spec.where ? `const cookieHeader = "cookie"
 ${withBasic ? `const optionSecret = "secret"
 ` : ''}const notFound = "__NOTFOUND__"
 
-func prepareAuthUtil(ctx *core.Context) (*core.Spec, error) {
+${cookieHelper(spec.where)}func prepareAuthUtil(ctx *core.Context) (*core.Spec, error) {
 	spec := ctx.Spec
 	if spec == nil {
 		return nil, ctx.MakeError("auth_no_spec",
@@ -193,11 +195,52 @@ function bagField(where: string): string {
 }
 
 
+// A cookie has no header of its own: place() writes it into `cookie` as
+// `credName=value`, so clear() must free that slot, not credName.
 function clear(where: string): string {
+  if ('cookie' === where) {
+    return `cookieSet(headers, nil)`
+  }
+
   return `delete(${bagName(where)}, credName)`
 }
 
 
+function cookieHelper(where: string): string {
+  if ('cookie' !== where) {
+    return ''
+  }
+
+  return `func cookieSet(headers map[string]any, value any) {
+	kept := []string{}
+
+	if existing, ok := headers[cookieHeader].(string); ok && existing != "" {
+		for _, part := range strings.Split(existing, ";") {
+			piece := strings.TrimSpace(part)
+			if piece == "" || piece == credName ||
+				strings.HasPrefix(piece, credName+"=") {
+				continue
+			}
+			kept = append(kept, piece)
+		}
+	}
+
+	if value != nil {
+		valStr, _ := value.(string)
+		kept = append(kept, credName+"="+valStr)
+	}
+
+	if len(kept) == 0 {
+		delete(headers, cookieHeader)
+	} else {
+		headers[cookieHeader] = strings.Join(kept, "; ")
+	}
+}
+
+`
+}
+
+
 function place(where: string): string {
   if ('query' === where) {
     return `		apikeyVal := ""
@@ -212,16 +255,7 @@ function place(where: string): string {
 		if av, ok := apikey.(string); ok {
 			apikeyVal = av
 		}
-		pair := credName + "=" + apikeyVal
-		existing := ""
-		if ec, ok := headers[cookieHeader].(string); ok {
-			existing = ec
-		}
-		if existing == "" {
-			headers[cookieHeader] = pair
-		} else {
-			headers[cookieHeader] = existing + "; " + pair
-		}`
+		cookieSet(headers, apikeyVal)`
   }
 
   return `		authPrefix := ""

package/project/.sdk/src/cmp/js/PrepareAuth_js.ts

@@ -63,7 +63,9 @@ module.exports = {
 
   const preamble = `
 const CRED_name = '${jsstr(spec.name)}'
-
+${'cookie' === spec.where ? `
+const COOKIE_header = 'cookie'
+` : ''}
 const OPTION_apikey = 'apikey'${spec.basic && 'header' === spec.where ? `
 const OPTION_secret = 'secret'` : ''}
 
@@ -85,7 +87,7 @@ function prepareAuth(ctx) {
   }
 
   const ${bag(spec.where)} = spec.${bag(spec.where)}
-
+${cookieHelper(spec.where)}
   const options = client.options()
 
   // Public APIs that need no auth omit the options.auth block entirely.
@@ -148,8 +150,54 @@ function bag(where: string): string {
 }
 
 
+// A cookie has no header of its own: place() writes it into `cookie` as
+// `CRED_name=value`, so clear() must free that slot, not CRED_name.
 function clear(where: string): string {
-  return 'query' === where ? 'delprop(query, CRED_name)' : 'delprop(headers, CRED_name)'
+  if ('query' === where) {
+    return 'delprop(query, CRED_name)'
+  }
+
+  if ('cookie' === where) {
+    return 'cookieSet(headers, null)'
+  }
+
+  return 'delprop(headers, CRED_name)'
+}
+
+
+// Splicing keeps the caller's other cookies and makes placement idempotent.
+function cookieHelper(where: string): string {
+  if ('cookie' !== where) {
+    return ''
+  }
+
+  return `
+  function cookieSet(headers, value) {
+    const existing = getprop(headers, COOKIE_header, '')
+    const kept = []
+
+    if ('string' === typeof existing && '' !== existing) {
+      for (const part of existing.split(';')) {
+        const piece = part.trim()
+        if ('' === piece || piece === CRED_name || piece.startsWith(CRED_name + '=')) {
+          continue
+        }
+        kept.push(piece)
+      }
+    }
+
+    if (null != value) {
+      kept.push(CRED_name + '=' + value)
+    }
+
+    if (0 === kept.length) {
+      delprop(headers, COOKIE_header)
+    }
+    else {
+      setprop(headers, COOKIE_header, kept.join('; '))
+    }
+  }
+`
 }
 
 
@@ -159,9 +207,7 @@ function place(where: string): string {
   }
 
   if ('cookie' === where) {
-    return `    const existing = getprop(headers, 'cookie', '')
-    const pair = CRED_name + '=' + apikey
-    setprop(headers, 'cookie', existing ? existing + '; ' + pair : pair)`
+    return `    cookieSet(headers, apikey)`
   }
 
   return `    // Empty prefix (raw apiKey credential) must not add a leading space.

package/project/.sdk/src/cmp/php/PrepareAuth_php.ts

@@ -86,7 +86,7 @@ class ${Name}PrepareAuth
 
   return head + `class ${Name}PrepareAuth
 {
-${constants(spec)}
+${constants(spec)}${cookieHelper(spec)}
     public static function call(${Name}Context $ctx): array
     {
         $spec = $ctx->spec;
@@ -139,17 +139,53 @@ ${secretConst}    private const NOT_FOUND = '__NOTFOUND__';
 }
 
 
+// A spec reaching prepare_auth may already carry the credential pair, and
+// leaving it sends a withdrawn credential.
 function suppressed(where: string): string {
   if ('cookie' === where) {
-    // NOTHING TO CLEAR. The cookie header may carry the caller's own
-    // cookies, and this SDK has not written a pair of its own into this
-    // spec, so removing the header would throw away someone else's state.
-    return ''
+    return `            self::applyCookie($headers, null);\n`
   }
   return `            unset($${bagVar(where)}[self::${credConst(where)}]);\n`
 }
 
 
+// Splicing keeps the caller's other cookies and makes placement idempotent.
+function cookieHelper(spec: AuthSpec): string {
+  if ('cookie' !== spec.where) {
+    return ''
+  }
+
+  return `
+    private static function applyCookie(array &$headers, ?string $value): void
+    {
+        $kept = [];
+        $existing = $headers[self::HEADER_COOKIE] ?? '';
+
+        if (is_string($existing) && '' !== $existing) {
+            foreach (explode(';', $existing) as $part) {
+                $piece = trim($part);
+                if ('' === $piece || $piece === self::COOKIE_AUTH
+                    || str_starts_with($piece, self::COOKIE_AUTH . '=')) {
+                    continue;
+                }
+                $kept[] = $piece;
+            }
+        }
+
+        if (null !== $value) {
+            $kept[] = self::COOKIE_AUTH . '=' . $value;
+        }
+
+        if ([] === $kept) {
+            unset($headers[self::HEADER_COOKIE]);
+        } else {
+            $headers[self::HEADER_COOKIE] = implode('; ', $kept);
+        }
+    }
+`
+}
+
+
 // HTTP Basic is header-only by definition: the scheme is
 // `Authorization: Basic base64(user:pass)`. It cannot be expressed as a
 // query parameter or a cookie, so the branch is emitted only where it can
@@ -197,15 +233,11 @@ function placeBlock(spec: AuthSpec): string {
     return `
         $missing = ${missing};
 
-        if (!$missing) {
-            // A COOKIE IS APPENDED, NEVER ASSIGNED: the header may already
-            // carry the caller's own cookies, and one \`Cookie:\` header
-            // holds all of them, separated by '; '.
-            $apikey_val = is_string($apikey) ? $apikey : '';
-            $existing = $headers[self::HEADER_COOKIE] ?? '';
-            $pair = self::COOKIE_AUTH . '=' . $apikey_val;
-            $headers[self::HEADER_COOKIE] = $existing === ''
-                ? $pair : "{$existing}; {$pair}";
+        if ($missing) {
+            self::applyCookie($headers, null);
+        } else {
+            // One \`Cookie:\` header holds every cookie, separated by '; '.
+            self::applyCookie($headers, is_string($apikey) ? $apikey : '');
         }
 `
   }

package/project/.sdk/src/cmp/ts/PrepareAuth_ts.ts

@@ -64,7 +64,9 @@ export {
 
   const preamble = `
 const CRED_name = '${jsstr(spec.name)}'
-
+${'cookie' === spec.where ? `
+const COOKIE_header = 'cookie'
+` : ''}
 const OPTION_apikey = 'apikey'
 const OPTION_secret = 'secret'
 
@@ -87,7 +89,7 @@ function prepareAuth(ctx: Context): Spec | Error {
   }
 
   const ${target(spec.where)} = spec.${target(spec.where)}
-
+${cookieHelper(spec.where)}
   const options = client.options()
 
   // Public APIs that need no auth omit the options.auth block entirely.
@@ -150,8 +152,53 @@ function target(where: string): string {
 }
 
 
+// A cookie has no header of its own: place() writes it into `cookie` as
+// `CRED_name=value`, so clear() must free that slot, not CRED_name.
 function clear(where: string): string {
-  return 'query' === where ? 'delprop(query, CRED_name)' : 'delprop(headers, CRED_name)'
+  if ('query' === where) {
+    return 'delprop(query, CRED_name)'
+  }
+
+  if ('cookie' === where) {
+    return 'cookieSet(headers, null)'
+  }
+
+  return 'delprop(headers, CRED_name)'
+}
+
+
+function cookieHelper(where: string): string {
+  if ('cookie' !== where) {
+    return ''
+  }
+
+  return `
+  function cookieSet(headers: any, value: any) {
+    const existing = getprop(headers, COOKIE_header, '')
+    const kept: string[] = []
+
+    if ('string' === typeof existing && '' !== existing) {
+      for (const part of existing.split(';')) {
+        const piece = part.trim()
+        if ('' === piece || piece === CRED_name || piece.startsWith(CRED_name + '=')) {
+          continue
+        }
+        kept.push(piece)
+      }
+    }
+
+    if (null != value) {
+      kept.push(CRED_name + '=' + value)
+    }
+
+    if (0 === kept.length) {
+      delprop(headers, COOKIE_header)
+    }
+    else {
+      setprop(headers, COOKIE_header, kept.join('; '))
+    }
+  }
+`
 }
 
 
@@ -161,9 +208,7 @@ function place(where: string): string {
   }
 
   if ('cookie' === where) {
-    return `    const existing = getprop(headers, 'cookie', '')
-    const pair = CRED_name + '=' + apikey
-    setprop(headers, 'cookie', existing ? existing + '; ' + pair : pair)`
+    return `    cookieSet(headers, apikey)`
   }
 
   return `    // A raw credential (empty prefix, e.g. an apiKey scheme) must go in

package/project/.sdk/src/cmp/ts/ReadmeQuick_ts.ts

@@ -173,17 +173,24 @@ try {
       }
 
       const dataFields: any[] = exampleEntity.fields ? each(exampleEntity.fields) : []
-      const dataIdType = dataIdF
-        ? (dataFields.find((f: any) => f && f.n === dataIdF) || {}).type
+
+      // A model field spells its type `t`; `type` is the older model shape.
+      const dataIdField: any = dataIdF
+        ? dataFields.find((f: any) => f && f.n === dataIdF)
         : null
+      const dataIdType = dataIdField ? (dataIdField.t ?? dataIdField.type) : null
+
+      // An unknown type is not evidence of compatibility: chain only on a
+      // known match, since the literal example type-checks by construction.
       const usesCreatedId = (opname: string): boolean => {
         if (null == dataIdF || !opnames.includes('create')) {
           return false
         }
         const matchItem = opRequestShape(exampleEntity, opname).items
           .find((it: any) => it.name === idF)
+        // OpShapeItem spells it `type`; only the raw model field uses `t`.
         const matchType = matchItem ? matchItem.type : null
-        return null == matchType || null == dataIdType || matchType === dataIdType
+        return null != matchType && null != dataIdType && matchType === dataIdType
       }
       const idValueFor = (opname: string): string => usesCreatedId(opname)
         ? `created.data().${dataIdF}!`

package/project/.sdk/tm/c/feature/secrets/plugin/capability.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/capability.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/capability.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1). */
 

package/project/.sdk/tm/c/feature/secrets/plugin/capability.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/capability.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/capability.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/c/feature/secrets/plugin/catalog.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/catalog.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/catalog.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1). */
 

package/project/.sdk/tm/c/feature/secrets/plugin/catalog.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/catalog.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/catalog.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/c/feature/secrets/plugin/config.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/config.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/config.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/c/feature/secrets/plugin/config.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/config.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/config.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder. See config.c for why the two functions are split. */

package/project/.sdk/tm/c/feature/secrets/plugin/depend.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/depend.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/depend.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/c/feature/secrets/plugin/depend.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/depend.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/depend.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3). Two
  * axes, both declared by the definition that has the requirement,

package/project/.sdk/tm/c/feature/secrets/plugin/env.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/env.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/env.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/c/feature/secrets/plugin/env.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/env.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/env.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder. Pure: a
  * function over a string map and a ref set, so the corpus tests it

package/project/.sdk/tm/c/feature/secrets/plugin/export.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/export.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/export.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *

package/project/.sdk/tm/c/feature/secrets/plugin/export.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/export.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/export.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11). An instance publishes values for other plugins and for
  * the application. THE UNQUALIFIED ALIAS IS THE INTERESTING PART; see

package/project/.sdk/tm/c/feature/secrets/plugin/graph.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/graph.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/graph.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *

package/project/.sdk/tm/c/feature/secrets/plugin/graph.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/graph.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/graph.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a pure function of the registry that
  * answers which instances can be live, and for each blocked one THE

package/project/.sdk/tm/c/feature/secrets/plugin/host.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/host.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/host.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The host: the lifecycle state machine (§5), extension points (§6),
  * and resource capture (§8). See host.h for the two rules that shape

package/project/.sdk/tm/c/feature/secrets/plugin/host.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/host.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/host.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The host: the lifecycle state machine (§5), extension points (§6),
  * and resource capture (§8).

package/project/.sdk/tm/c/feature/secrets/plugin/order.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/order.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/order.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Ordering (§7) — one rule, one place.
  *

package/project/.sdk/tm/c/feature/secrets/plugin/order.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/order.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/order.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Ordering (§7) — constraints, then bands, then declaration position.
  * CONSTRAINTS BEAT BANDS so the correct tool wins when both are

package/project/.sdk/tm/c/feature/secrets/plugin/point.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/point.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/point.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Extension points (§6). See point.h for the closure representation. */
 

package/project/.sdk/tm/c/feature/secrets/plugin/point.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/point.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/point.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Extension points (§6). Three kinds, chosen because they are what the
  * two existing systems actually needed, and no more.

package/project/.sdk/tm/c/feature/secrets/plugin/ref.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/ref.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/ref.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag (§4). */
 

package/project/.sdk/tm/c/feature/secrets/plugin/ref.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/ref.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/ref.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag, written `name$tag` (§4).
  *

package/project/.sdk/tm/c/feature/secrets/plugin/resolve.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/resolve.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/resolve.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dynamic resolution (§10.2) — name to candidate module ids.
  *

package/project/.sdk/tm/c/feature/secrets/plugin/resolve.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/resolve.h)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/resolve.h)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dynamic resolution (§10.2) — name to candidate module ids. Pure: it
  * returns the ids a host WOULD try, in order, and loads nothing. That

package/project/.sdk/tm/c/feature/secrets/plugin/types.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (c/src/types.c)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (c/src/types.c)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Errors and the raise mechanism. See types.h for why longjmp. */