@voxgig/sdkgen 4.30.0 → 4.30.1

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Point.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Point.swift)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (swift/src/Point.swift)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Extension points (section 6). Three kinds, chosen because they are what the
 /// two existing systems actually needed, and no more.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Refs.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Refs.swift)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (swift/src/Refs.swift)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Identity: name+tag, written `name$tag` (section 4).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Resolve.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Resolve.swift)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (swift/src/Resolve.swift)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Dynamic resolution (section 10.2) - name to candidate module ids.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Types.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Types.swift)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (swift/src/Types.swift)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The error type, the sort key, and the handful of helpers every module needs.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Value.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Value.swift)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (swift/src/Value.swift)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// The JSON value, and the only parser this port has.
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugin/Version.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (swift/src/Version.swift)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (swift/src/Version.swift)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /// Versions and ranges (section 11.2).
 ///

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Aws.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Aws.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `awssecrets` and `awsparams` provider kinds: AWS Secrets Manager and
 // SSM Parameter Store.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Azuresecrets.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Azuresecrets.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Azuresecrets.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `azuresecrets` provider kind: Azure Key Vault.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Boru.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Boru.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Boru.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `boru` provider kind: a boru vault, through its CLI or its wire
 // protocol.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Crypto.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Crypto.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Crypto.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // SHA-256 and HMAC-SHA256, hand-rolled.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Doppler.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Doppler.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Doppler.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `doppler` provider kind: Doppler.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Gcpsecrets.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Gcpsecrets.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Gcpsecrets.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `gcpsecrets` provider kind: GCP Secret Manager.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Hashicorp.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Hashicorp.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Hashicorp.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `hashicorp` provider kind: HashiCorp Vault over its HTTP API.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Httpjson.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Httpjson.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Httpjson.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The shared HTTP-JSON round-trip, and the small helpers every remote
 // store needs.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Infisical.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Infisical.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Infisical.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `infisical` provider kind: Infisical.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Onepassword.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Onepassword.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Onepassword.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `onepassword` provider kind: 1Password Connect.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Proc.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Proc.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Proc.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Running a child process, for the two provider kinds that read a vault
 // through its own CLI.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Secretspec.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Secretspec.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Secretspec.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `secretspec` provider kind: SecretSpec, through its CLI.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Sigv4.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Sigv4.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/plugins/Sigv4.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Addr.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Addr.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/src/Addr.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Refusing to send a secret-bearing credential in the clear.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Json.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Json.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/src/Json.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON support for sekreto.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Provider.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Provider.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/src/Provider.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // A source of secrets.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Providers.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Providers.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/src/Providers.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, how a provider
 // kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Sekreto.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Sekreto.swift)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (swift/src/Sekreto.swift)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/swift/Tests/vendor/omni/Json.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Json.swift)
-// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/omni sdk-20260925-1316-0 (swift/Sources/Omni/Json.swift)
+// Source: https://github.com/voxgig/omni @ b909ff51fc644e4955c850e30cc65e74be076df2  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The omni JSON value model, with a small in-tree parser.
 //

package/project/.sdk/tm/swift/Tests/vendor/omni/Runner.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Runner.swift)
-// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/omni sdk-20260925-1316-0 (swift/Sources/Omni/Runner.swift)
+// Source: https://github.com/voxgig/omni @ b909ff51fc644e4955c850e30cc65e74be076df2  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (Swift port).
 //

package/project/.sdk/tm/swift/Tests/vendor/omni/Util.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Util.swift)
-// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/omni sdk-20260925-1316-0 (swift/Sources/Omni/Util.swift)
+// Source: https://github.com/voxgig/omni @ b909ff51fc644e4955c850e30cc65e74be076df2  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Capability.ts

@@ -1,16 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Capability.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Capabilities (§11.1).
- *
- * A DEPENDENCY IS ON A CAPABILITY, NOT ON A REF — because it is a
- * dependency on something that can do the job, and which instance is
- * doing it is exactly the configuration detail a plugin must not care
- * about.
- *
- * But A BINDING IS TO AN INSTANCE, not to a capability, which is what
- * decides behaviour when the bound provider leaves while another match
- * remains. */
 
 import { satisfies } from './Version'
 
@@ -40,19 +30,6 @@ export type Candidate = {
   provides: Provided
 }
 
-/** Rank the matching live providers and return them best-first:
- * highest `version`, then LOWEST `priority` (default 0), then
- * declaration position `pos` ascending.
- *
- * `priority` is a field on the capability rather than §7's `order`
- * band, because bands live on POINT BINDINGS: a provider may have
- * several bindings with different bands, or none at all, so a rank
- * reaching for one would be undefined in the common case.
- *
- * Without a total rank, "any provider satisfies" is true of the GRAPH
- * and useless to the PLUGIN — two ports could bind different `store`
- * instances, both resolve green, and behave differently, which is
- * precisely the divergence a shared corpus exists to catch. */
 export function resolvecapability(req: Required, candidates: Candidate[]): Candidate[] {
   const hits = candidates.filter((c) => matches(req, c.provides))
   hits.sort((a, b) => {
@@ -79,10 +56,6 @@ export function matches(req: Required, prov: Provided): boolean {
     if (!satisfies(prov.version, req.range)) return false
   }
 
-  // `match` is checked against the provider's `attrs`, key by key. A
-  // key the provider does not carry is a miss, not a pass: a
-  // requirement asking for `transactional: true` must not be satisfied
-  // by a provider that never said.
   if (undefined !== req.match) {
     const attrs: any = prov.attrs || {}
     for (const k of Object.keys(req.match)) {
@@ -94,26 +67,6 @@ export function matches(req: Required, prov: Provided): boolean {
   return true
 }
 
-/** PARTIAL MATCH, RECURSING INTO MAPS (§11.1).
- *
- * §11.1 defines `match` as "a partial match against `attrs`, with
- * exactly the semantics voxgig/struct and the omni corpus already
- * define for `match` — every leaf in the requirement must be present
- * and equal in the capability, keys not mentioned are not checked."
- *
- * THIS FUNCTION IS WHAT "EVERY LEAF" MEANS, and an earlier draft did
- * not have it: the check was `attrs[k] !== req.match[k]`, which for any
- * compound value is JavaScript REFERENCE IDENTITY. A requirement and a
- * capability are declared in different places and are never the same
- * object, so `match: {limits: {max: 5}}` could not be satisfied by any
- * provider at all — including one declaring exactly that. The flat
- * reading is invisible while every corpus entry is scalar, which is why
- * the go port found it and P2 did not.
- *
- * A LIST IS COMPARED LEAF-WISE AT THE SAME LENGTH, not as a subset.
- * "the first two of your three regions" is not something `match` can
- * say, and inventing a spelling for it would be inventing the filter
- * language §11.1 explicitly declines to add. */
 export function matchvalue(want: any, got: any): boolean {
   if (isMap(want)) {
     if (!isMap(got)) return false

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Catalog.ts

@@ -1,12 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Catalog.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* The definition catalog (§10.1).
- *
- * A definition is registered once and may back many instances. Option
- * shapes are validated AT REGISTRATION, not when a document happens to
- * exercise a key — so a malformed shape fails once, and in the same
- * place everywhere (§9.4). */
 
 import { fail } from './Types'
 import { checkname } from './Ref'

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Config.ts

@@ -1,20 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Config.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* The declarative document (§9): normalization, and the ten-level
- * precedence ladder.
- *
- * TWO FUNCTIONS, AND THE SPLIT BETWEEN THEM IS FORCED.
- *
- * `normalizeconfig` normalizes STRUCTURE and ENTRY KEYS. It does not
- * merge options, and cannot: §9.4 makes merge behaviour a property of
- * the definition's option SHAPE, which normalization has never seen. A
- * normalizer that flattened the option layers would make
- * `$MERGE: append` unimplementable at load time, because the layers it
- * must concatenate would already be collapsed.
- *
- * `resolveoptions` applies the ladder, and it is the only place that
- * knows the shape. */
 
 import { Normalized, Instance, fail } from './Types'
 import { canonref, parseref } from './Ref'
@@ -26,10 +12,7 @@ import { canonref, parseref } from './Ref'
 export type NormalizeInput = {
   doc: any
   profile?: string
-  /** §9.1: a host may rename `instance` and `default` into its own
-   * vocabulary. */
   keys?: { instance?: string, default?: string }
-  /** §9.1: refs the host declares itself and always wins on. */
   reserved?: string[]
 }
 
@@ -41,11 +24,6 @@ export function normalizeconfig(input: NormalizeInput): Normalized {
   const reserved = (input && input.reserved) || []
   const profile = input && input.profile
 
-  // The rename is applied at TWO PLACES AND NO OTHERS: the document
-  // root, and every profile.<name> overlay root (§9.1). A rename applied
-  // only at the root would leave `profile.prod.sdk` untranslated and
-  // silently drop every environment override the host depends on.
-  // Recursing further would be worse: option data is the definition's.
   const baseinst = doc[ikey]
   const basedef = doc[dkey] || {}
 
@@ -53,8 +31,6 @@ export function normalizeconfig(input: NormalizeInput): Normalized {
   const overinst = overlay ? overlay[ikey] : undefined
   const overdef = (overlay && overlay[dkey]) || {}
 
-  // Entry layers, base then overlay, each as {ref -> entry} plus the
-  // order the form implies.
   const base = entries(baseinst)
   const over = entries(overinst)
 
@@ -82,16 +58,10 @@ export function normalizeconfig(input: NormalizeInput): Normalized {
     const b = base.map[ref]
     const o = over.map[ref]
 
-    // MERGE THE ENTRIES AS AUTHORED, THEN APPLY DEFAULTS TO THE RESULT
-    // (§9.3). A safety rule, not a tidiness one: if the overlay had its
-    // defaults filled in before merging it would carry a synthesized
-    // active:true and overwrite a base's false — silently re-enabling a
-    // deliberately disabled integration in production.
     const active = pick(o, 'active', pick(b, 'active', true))
     const start = pick(o, 'start', pick(b, 'start', 'eager'))
     const ord = pick(o, 'order', pick(b, 'order', undefined))
 
-    // Option layers, levels 3-6, IN LADDER ORDER. Never merged here.
     const layers: any[] = []
     const nm = parseref(ref).name
     if (basedef[nm] && undefined !== basedef[nm].options) layers.push(basedef[nm].options)
@@ -126,9 +96,6 @@ function pick(src: any, key: string, dflt: any): any {
   return src && undefined !== src[key] ? src[key] : dflt
 }
 
-/** Both document forms reduce to {ref -> entry} plus the order the form
- * implies: array POSITION for the array form, sorted refs for the map
- * form. */
 function entries(src: any): { map: { [ref: string]: any }, order: string[] } {
   const map: { [ref: string]: any } = {}
   const order: string[] = []
@@ -142,8 +109,6 @@ function entries(src: any): { map: { [ref: string]: any }, order: string[] } {
     }
   }
   else {
-    // Map-form refs arrive as KEYS, through a different path than an
-    // array element's `ref` field — and must canonicalize the same way.
     for (const key of Object.keys(src)) {
       map[canonref(key)] = src[key]
     }
@@ -163,22 +128,17 @@ function checkreserved(ref: string, reserved: string[]): void {
   }
 }
 
-// ---------------------------------------------------------------------
-// resolveoptions — §9.3's ten levels, and §9.4's merge directives
-// ---------------------------------------------------------------------
 
 export type ResolveInput = {
   ref: string
-  /** Level 1 — the definition's option shape. Also carries the $MERGE
-   * directives, which is why merging cannot happen without it. */
   shape?: any
-  hostdefaults?: any       // 2
-  doc?: any                // 3-6
+  hostdefaults?: any
+  doc?: any
   profile?: string
-  env?: any                // 7
-  hostoptions?: any        // 8
-  loadoptions?: any        // 9
-  patch?: any              // 10
+  env?: any
+  hostoptions?: any
+  loadoptions?: any
+  patch?: any
 }
 
 export function resolveoptions(input: ResolveInput): any {
@@ -190,22 +150,17 @@ export function resolveoptions(input: ResolveInput): any {
   const doc = input.doc || {}
   const overlay = input.profile && doc.profile && doc.profile[input.profile]
 
-  // ONE ordered merge, lowest to highest. Levels 3-6 are not two
-  // namespaces collapsed separately and composed afterwards: that
-  // inverts the rule that PROFILE SPECIFICITY OUTRANKS DEFINITION
-  // SPECIFICITY, so a prod per-definition default would lose to a base
-  // instance value.
   const layers = [
-    defaultsof(shape),                          // 1
-    input.hostdefaults,                         // 2
-    optsof(doc.default, name),                  // 3
-    optsof(doc.instance, ref),                  // 4
-    optsof(overlay && overlay.default, name),   // 5
-    optsof(overlay && overlay.instance, ref),   // 6
-    input.env,                                  // 7
-    input.hostoptions,                          // 8
-    input.loadoptions,                          // 9
-    input.patch,                                // 10
+    defaultsof(shape),
+    input.hostdefaults,
+    optsof(doc.default, name),
+    optsof(doc.instance, ref),
+    optsof(overlay && overlay.default, name),
+    optsof(overlay && overlay.instance, ref),
+    input.env,
+    input.hostoptions,
+    input.loadoptions,
+    input.patch,
   ]
 
   let out: any = {}
@@ -216,7 +171,6 @@ export function resolveoptions(input: ResolveInput): any {
   return out
 }
 
-/** The shape's non-directive values are the level-1 defaults. */
 function defaultsof(shape: any): any {
   const out: any = {}
   for (const k of Object.keys(shape)) {
@@ -229,7 +183,6 @@ function defaultsof(shape: any): any {
 
 function optsof(src: any, key: string): any {
   if (null == src) return undefined
-  // The array form is equivalent to the map form (§9.1).
   if (Array.isArray(src)) {
     for (const item of src) {
       if (canonref(item.ref) === key) return item.options
@@ -242,10 +195,6 @@ function optsof(src: any, key: string): any {
   return undefined
 }
 
-/** Merge ONE layer onto the accumulator, honouring the shape's
- * directives. The directive holds at EVERY precedence level, not only
- * between document levels — §9.4 makes it a property of the shape,
- * which does not know which layer a value arrived from. */
 function mergeone(base: any, over: any, shape: any): any {
   if (null == over) return base
   if (!isMap(base) || !isMap(over)) return clone(over)
@@ -280,7 +229,6 @@ function mergeone(base: any, over: any, shape: any): any {
   return out
 }
 
-/** Merge N levels below this key, replace below that. */
 function deepto(base: any, over: any, n: number): any {
   if (n <= 0) return clone(over)
   if (!isMap(base) || !isMap(over)) return clone(over)
@@ -292,14 +240,6 @@ function deepto(base: any, over: any, n: number): any {
   return out
 }
 
-/** §9.4: N is an integer of at least 1, and everything else is an error.
- *
- * `{"deep": 0}` is rejected DESPITE having an obvious reading, because
- * "replace at this key" already has a spelling and two spellings for one
- * behaviour is the defect class this repo exists to avoid. Without the
- * stated domain each port picks its own reading — reject, replace,
- * unlimited merge, or clamp to 1 — and the same document resolves
- * differently per language. */
 const MERGE_WORDS = ['replace', 'append']
 
 export function checkshape(shape: any): void {