@voxgig/sdkgen 4.6.0 → 4.8.0

package/project/.sdk/tm/csharp/test/Runner.cs

@@ -153,6 +153,51 @@ public static class TestRunner
         return _testControl;
     }
 
+    // LiveClientOptions returns the extra SDK options every LIVE client is
+    // constructed with, read from sdk-test-control.json `test.client.options`.
+    //
+    // The generated live client knows two things: the base URL (from the
+    // spec) and the credential (from the environment). Everything else about
+    // how a particular API wants to be talked to - which features to switch
+    // on, and with what settings - is a property of THAT API, known to the
+    // project and to nothing in the toolchain.
+    //
+    // Merged UNDER the generated fields, so the suite's own
+    // base/apikey/server values win: this ADDS to the live client, it does
+    // not redirect it.
+    //
+    // Reserved fields are stripped HERE rather than at each merge site: the
+    // generated dictionary only names a field when the model calls for one,
+    // so a "base" in this block would face no competing value and would
+    // silently redirect the whole suite - credential included - to another
+    // host.
+    private static readonly string[] LiveReserved =
+        { "base", "prefix", "suffix", "server", "apikey", "secret" };
+
+    public static Dictionary<string, object?> LiveClientOptions()
+    {
+        var ctrl = LoadTestControl();
+        if (!ctrl.TryGetValue("test", out var testRaw) ||
+            testRaw is not Dictionary<string, object?> test ||
+            !test.TryGetValue("client", out var clientRaw) ||
+            clientRaw is not Dictionary<string, object?> client ||
+            !client.TryGetValue("options", out var optsRaw) ||
+            optsRaw is not Dictionary<string, object?> opts)
+        {
+            return new Dictionary<string, object?>();
+        }
+
+        var out_ = new Dictionary<string, object?>();
+        foreach (var kv in opts)
+        {
+            if (Array.IndexOf(LiveReserved, kv.Key) < 0)
+            {
+                out_[kv.Key] = kv.Value;
+            }
+        }
+        return out_;
+    }
+
     // IsControlSkipped checks sdk-test-control.json for a skip entry.
     // Returns (skip, reason).
     public static (bool, string) IsControlSkipped(string kind, string name, string mode)

package/project/.sdk/tm/dart/test/utility.dart

@@ -143,6 +143,45 @@ bool skipIfMissingIds(T t, Map setup, List<String> requiredKeys) {
 
 // Per-test live pacing delay (ms). Read from sdk-test-control.json
 // `test.live.delayMs`; defaults to 500ms if absent or invalid.
+// Extra SDK options every LIVE client is constructed with, read from
+// sdk-test-control.json `test.client.options`.
+//
+// The generated live client knows two things: the base URL (from the spec)
+// and the credential (from the environment). Everything else about how a
+// particular API wants to be talked to - which features to switch on, and
+// with what settings - is a property of THAT API, known to the project and
+// to nothing in the toolchain.
+//
+// Merged UNDER the generated fields, so the suite's own base/apikey/server
+// values win: this ADDS to the live client, it does not redirect it.
+//
+// Reserved fields are stripped HERE rather than at each merge site: the
+// generated map only names a field when the model calls for one, so a
+// 'base' in this block would face no competing value and would silently
+// redirect the whole suite - credential included - to another host.
+const List<String> liveReserved = [
+  'base', 'prefix', 'suffix', 'server', 'apikey', 'secret'
+];
+
+Map<String, dynamic> liveClientOptions() {
+  final ctrl = loadTestControl();
+  final t = ctrl['test'];
+  if (t is! Map) return <String, dynamic>{};
+  final c = t['client'];
+  if (c is! Map) return <String, dynamic>{};
+  final opts = c['options'];
+  if (opts is! Map) return <String, dynamic>{};
+
+  final out = <String, dynamic>{};
+  opts.forEach((k, v) {
+    if (!liveReserved.contains(k)) {
+      out['$k'] = v;
+    }
+  });
+  return out;
+}
+
+
 int liveDelayMs() {
   final ctrl = loadTestControl();
   final t = ctrl['test'];

package/project/.sdk/tm/js/test/sdk-test-control.json

@@ -0,0 +1,19 @@
+{
+  "version": 1,
+  "_doc": "Per-SDK test control. Lists tests/operations to skip in unit and live modes; tunes per-test pacing. Edit by hand. Loaded by js/test/utility.js.",
+  "test": {
+    "skip": {
+      "live": {
+        "direct": [],
+        "entityOp": []
+      },
+      "unit": {
+        "direct": [],
+        "entityOp": []
+      }
+    },
+    "live": {
+      "delayMs": 500
+    }
+  }
+}

package/project/.sdk/tm/js/test/utility.js

@@ -5,6 +5,10 @@
  * for creating test data, transformations, validations, and environment overrides.
  */
 
+const Fs = require('node:fs')
+const Path = require('node:path')
+
+
 // Creates a new step data structure within the data model
 function makeStepData(dm, stepname) {
   dm.s[stepname] = {
@@ -62,11 +66,97 @@ function envOverride(m) {
 }
 
 
+// Loads sdk-test-control.json (cached). Returns an empty-skip object if
+// the file is missing or unparsable so tests never crash on a bad config.
+let _testControlCache = null
+
+function loadTestControl() {
+  if (_testControlCache) return _testControlCache
+  const ctrlPath = Path.resolve(__dirname, '../test/sdk-test-control.json')
+  try {
+    _testControlCache = JSON.parse(Fs.readFileSync(ctrlPath, 'utf8'))
+  }
+  catch {
+    _testControlCache = {
+      version: 1,
+      test: { skip: { live: { direct: [], entityOp: [] }, unit: { direct: [], entityOp: [] } } }
+    }
+  }
+  return _testControlCache
+}
+
+
+// Extra SDK options every LIVE client is constructed with, read from
+// sdk-test-control.json `test.client.options`.
+//
+// The generated live client knows two things: the base URL (from the spec)
+// and the credential (from the environment). Everything else about how a
+// particular API wants to be talked to - which features to switch on, and
+// with what settings - is a property of THAT API, known to the project and
+// to nothing in the toolchain. So it lives in the file the project owns and
+// describes, where it can be read and reviewed. Secrets still come from the
+// environment (the providers this block names read them).
+//
+// Merged UNDER the generated fields, so the suite's own base/apikey/server
+// values win - this adds to the live client, it does not redirect it.
+//
+// That contract is enforced HERE rather than left to each merge site: the
+// generated object only names a field when the model calls for one, so a
+// `base` in this block would face no competing value and would silently
+// redirect the whole suite - credential included - to another host. The
+// reserved fields are stripped once, where the block is read, so every
+// caller gets the same guarantee whether or not it happens to emit them.
+const LIVE_RESERVED = ['base', 'prefix', 'suffix', 'server', 'apikey', 'secret']
+
+function liveClientOptions() {
+  const ctrl = loadTestControl()
+  const opts = ctrl && ctrl.test && ctrl.test.client && ctrl.test.client.options
+
+  if (null == opts || 'object' !== typeof opts) {
+    return {}
+  }
+
+  const out = {}
+  for (const key of Object.keys(opts)) {
+    if (!LIVE_RESERVED.includes(key)) {
+      out[key] = opts[key]
+    }
+  }
+
+  return out
+}
+
+
+// Per-test live pacing delay (ms). Read from sdk-test-control.json
+// `test.live.delayMs`; defaults to 500ms if absent or invalid.
+function liveDelayMs() {
+  const ctrl = loadTestControl()
+  const v = ctrl && ctrl.test && ctrl.test.live && ctrl.test.live.delayMs
+  return ('number' === typeof v && v >= 0) ? v : 500
+}
+
+
+
+// afterEach hook helper for live pacing. Generated tests register this via
+// `afterEach(liveDelay(<envVar>))`; it sleeps `liveDelayMs()` only when the
+// SDK's *_TEST_LIVE env var is set.
+function liveDelay(liveEnvVar) {
+  return async () => {
+    if ('TRUE' === process.env[liveEnvVar]) {
+      await new Promise(r => setTimeout(r, liveDelayMs()))
+    }
+  }
+}
+
 module.exports = {
   makeStepData,
   makeMatch,
   makeReqdata,
   makeValid,
   makeCtrl,
-  envOverride
+  envOverride,
+  loadTestControl,
+  liveClientOptions,
+  liveDelayMs,
+  liveDelay
 }

package/project/.sdk/tm/lua/test/runner.lua

@@ -146,6 +146,46 @@ function runner.is_control_skipped(kind, name, mode)
 end
 
 
+-- Extra SDK options every LIVE client is constructed with, read from
+-- sdk-test-control.json `test.client.options`.
+--
+-- The generated live client knows two things: the base URL (from the spec)
+-- and the credential (from the environment). Everything else about how a
+-- particular API wants to be talked to - which features to switch on, and
+-- with what settings - is a property of THAT API, known to the project and
+-- to nothing in the toolchain.
+--
+-- Merged UNDER the generated fields, so the suite's own base/apikey/server
+-- values win: this ADDS to the live client, it does not redirect it.
+--
+-- Reserved fields are stripped HERE rather than at each merge site: the
+-- generated table only names a field when the model calls for one, so a
+-- "base" in this block would face no competing value and would silently
+-- redirect the whole suite - credential included - to another host.
+local LIVE_RESERVED = {
+  base = true, prefix = true, suffix = true,
+  server = true, apikey = true, secret = true,
+}
+
+function runner.live_client_options()
+  local ctrl = runner.load_test_control()
+  local test = ctrl.test
+  if type(test) ~= "table" then return {} end
+  local client = test.client
+  if type(client) ~= "table" then return {} end
+  local opts = client.options
+  if type(opts) ~= "table" then return {} end
+
+  local out = {}
+  for k, v in pairs(opts) do
+    if not LIVE_RESERVED[k] then
+      out[k] = v
+    end
+  end
+  return out
+end
+
+
 -- Per-test live pacing delay (ms); default 500.
 function runner.live_delay_ms()
   local ctrl = runner.load_test_control()

package/project/.sdk/tm/ocaml/test/harness.ml

@@ -93,14 +93,24 @@ let make_client ?(server : server option) ?(mode = "test") ?(base = "http://api.
   rootctx.c_op <- new_operation (jo [("name", Str "root"); ("entity", Str "_")]);
   client.cl_rootctx <- Some rootctx;
   List.iter (fun (name, opts) ->
-      if has_feature name then begin
-        let ftr = Sdk_config.make_feature name in
+      (* `netsim` is a test-only network simulator implemented in
+         Sdk_features, not a model feature, so it never appears in the
+         generated config and has_feature rejects it. Construct it directly:
+         without this every netsim-driven test (retry backoff, timeout,
+         and the metrics/telemetry/audit error paths) silently runs against
+         an unsimulated transport and sees a plain 200. *)
+      let ftr =
+        if name = "netsim" then Some (Sdk_features.netsim_feature ())
+        else if has_feature name then Some (Sdk_config.make_feature name)
+        else None in
+      match ftr with
+      | None -> ()
+      | Some ftr ->
         let fopts = jo [("active", Bool true)] in
         (match opts with Map _ -> List.iter (fun k -> setp fopts k (getp opts k)) (keysof opts) | _ -> ());
         setp (getp client.cl_options "feature") name fopts;
         ftr.f_init rootctx fopts;
-        client.cl_features <- client.cl_features @ [ftr]
-      end) features;
+        client.cl_features <- client.cl_features @ [ftr]) features;
   feature_hook_util rootctx "PostConstruct";
   { h_base = base; h_headers = hheaders; h_client = client; h_utility = utility; h_rootctx = rootctx }
 

package/project/.sdk/tm/perl/t/runner.pm

@@ -129,6 +129,36 @@ sub is_control_skipped {
   return (0, undef);
 }
 
+# Extra SDK options every LIVE client is constructed with, read from
+# sdk-test-control.json `test.client.options`.
+#
+# The generated live client knows two things: the base URL (from the spec)
+# and the credential (from the environment). Everything else about how a
+# particular API wants to be talked to - which features to switch on, and
+# with what settings - is a property of THAT API, known to the project and
+# to nothing in the toolchain.
+#
+# Merged UNDER the generated fields, so the suite's own base/apikey/server
+# values win: this ADDS to the live client, it does not redirect it.
+#
+# Reserved fields are stripped HERE rather than at each merge site: the
+# generated hash only names a field when the model calls for one, so a
+# "base" in this block would face no competing value and would silently
+# redirect the whole suite - credential included - to another host.
+my %LIVE_RESERVED = map { $_ => 1 }
+  qw(base prefix suffix server apikey secret);
+
+sub live_client_options {
+  my $ctrl = load_test_control();
+  my $opts = ProjectNameHelpers::gpath($ctrl, 'test.client.options');
+  return {} unless Voxgig::Struct::ismap($opts);
+  my %out;
+  for my $k (keys %$opts) {
+    $out{$k} = $opts->{$k} unless $LIVE_RESERVED{$k};
+  }
+  return \%out;
+}
+
 # Per-test live pacing delay (ms); default 500.
 sub live_delay_ms {
   my $ctrl = load_test_control();

package/project/.sdk/tm/php/test/Runner.php

@@ -138,6 +138,42 @@ class ProjectNameTestRunner
         return [false, null];
     }
 
+    /**
+     * Extra SDK options every LIVE client is constructed with, read from
+     * sdk-test-control.json `test.client.options`.
+     *
+     * The generated live client knows two things: the base URL (from the
+     * spec) and the credential (from the environment). Everything else
+     * about how a particular API wants to be talked to - which features to
+     * switch on, and with what settings - is a property of THAT API, known
+     * to the project and to nothing in the toolchain.
+     *
+     * Merged UNDER the generated fields, so the suite's own
+     * base/apikey/server values win: this ADDS to the live client, it does
+     * not redirect it.
+     *
+     * Reserved fields are stripped HERE rather than at each merge site: the
+     * generated array only names a field when the model calls for one, so a
+     * "base" in this block would face no competing value and would silently
+     * redirect the whole suite - credential included - to another host.
+     */
+    public static function live_client_options(): array
+    {
+        $ctrl = self::load_test_control();
+        $opts = $ctrl['test']['client']['options'] ?? null;
+        if (!is_array($opts)) {
+            return [];
+        }
+        $reserved = ['base', 'prefix', 'suffix', 'server', 'apikey', 'secret'];
+        $out = [];
+        foreach ($opts as $k => $v) {
+            if (!in_array($k, $reserved, true)) {
+                $out[$k] = $v;
+            }
+        }
+        return $out;
+    }
+
     /** Per-test live pacing delay (ms); default 500. */
     public static function live_delay_ms(): int
     {

package/project/.sdk/tm/rb/test/runner.rb

@@ -101,6 +101,31 @@ module ProjectNameTestRunner
     [false, nil]
   end
 
+  # Extra SDK options every LIVE client is constructed with, read from
+  # sdk-test-control.json `test.client.options`.
+  #
+  # The generated live client knows two things: the base URL (from the spec)
+  # and the credential (from the environment). Everything else about how a
+  # particular API wants to be talked to - which features to switch on, and
+  # with what settings - is a property of THAT API, known to the project and
+  # to nothing in the toolchain.
+  #
+  # Merged UNDER the generated fields, so the suite's own base/apikey/server
+  # values win: this ADDS to the live client, it does not redirect it.
+  #
+  # Reserved fields are stripped HERE rather than at each merge site: the
+  # generated hash only names a field when the model calls for one, so a
+  # "base" in this block would face no competing value and would silently
+  # redirect the whole suite - credential included - to another host.
+  LIVE_RESERVED = %w[base prefix suffix server apikey secret].freeze
+
+  def self.live_client_options
+    ctrl = load_test_control
+    opts = ctrl.dig('test', 'client', 'options')
+    return {} unless opts.is_a?(Hash)
+    opts.reject { |k, _v| LIVE_RESERVED.include?(k) }
+  end
+
   # Per-test live pacing delay (ms); default 500.
   def self.live_delay_ms
     ctrl = load_test_control

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -93,6 +93,38 @@ pub fn is_control_skipped(kind: &str, name: &str, mode: &str) -> (bool, String)
     (false, String::new())
 }
 
+/// Extra SDK options every LIVE client is constructed with, read from
+/// sdk-test-control.json `test.client.options`.
+///
+/// The generated live client knows two things: the base URL (from the spec)
+/// and the credential (from the environment). Everything else about how a
+/// particular API wants to be talked to - which features to switch on, and
+/// with what settings - is a property of THAT API, known to the project and
+/// to nothing in the toolchain.
+///
+/// Merged UNDER the generated fields, so the suite's own base/apikey/server
+/// values win: this ADDS to the live client, it does not redirect it.
+///
+/// Reserved fields are stripped HERE rather than at each merge site: the
+/// generated map only names a field when the model calls for one, so a
+/// "base" in this block would face no competing value and would silently
+/// redirect the whole suite - credential included - to another host.
+pub const LIVE_RESERVED: [&str; 6] =
+    ["base", "prefix", "suffix", "server", "apikey", "secret"];
+
+pub fn live_client_options() -> Value {
+    let ctrl = load_test_control();
+    let out = Value::empty_map();
+    if let Value::Map(m) = get_spec(&ctrl, &["test", "client", "options"]) {
+        for (k, v) in m.borrow().iter() {
+            if !LIVE_RESERVED.contains(&k.as_str()) {
+                setp(&out, k, v.clone());
+            }
+        }
+    }
+    out
+}
+
 /// Configured per-test live delay in ms; default 500.
 pub fn live_delay_ms() -> i64 {
     let ctrl = load_test_control();

package/project/.sdk/tm/rust/utility/make_options.rs

@@ -78,7 +78,7 @@ pub fn make_options_util(ctx: &Rc<Context>) -> Value {
         ("base", Value::str("http://localhost:8000")),
         ("prefix", Value::str("")),
         ("suffix", Value::str("")),
-        ("auth", jo(vec![("prefix", Value::str(""))])),
+        ("auth", jo(vec![("prefix", Value::str("")), ("basic", Value::Bool(false))])),
         ("headers", jo(vec![("`$CHILD`", Value::str("`$STRING`"))])),
         (
             "allow",

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sekreto.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/Sekreto.ts)
-// Source: https://github.com/voxgig/sekreto @ a8c293be1b6c33d65223b2b2275797c241b1a1f1
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //
@@ -11,7 +11,13 @@
 // This file is CANONICAL. Every other port is a translation of it, and
 // spec/sekreto.json is the behavioural contract they all run.
 
-import { Provider, ProviderSpec, makeprovider } from './Providers'
+// The REGISTRY, never './Providers'. Importing the barrel here is what
+// made every provider kind reachable from the core: the chain needs
+// `makeprovider`, and the barrel's edge dragged AWS request signing and
+// seven HTTP clients in behind it. The registry knows only the kinds
+// something actually imported. See docs/design/plugin-providers.md.
+import { Provider, ProviderSpec } from './provider/support'
+import { makeprovider } from './provider/Registry'
 
 /** A secret name: dot-separated lowercase segments, e.g. `api.token`. */
 export type Name = string

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/Sigv4.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/Sigv4.ts)
-// Source: https://github.com/voxgig/sekreto @ a8c293be1b6c33d65223b2b2275797c241b1a1f1
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //
@@ -14,7 +14,28 @@
 // carry known-answer cases that all ten ports must reproduce bit-for-bit,
 // and lets the integration mock recompute the signature server-side.
 
-import { createHash, createHmac } from 'node:crypto'
+// node:crypto is loaded ON FIRST USE, not at import time.
+//
+// Providers.ts imports sigv4 for the AWS providers, and Sekreto.ts imports
+// Providers — so a top-level `node:crypto` here put it in the module graph
+// of every sekreto consumer, including one that never signs anything.
+// Deferring keeps this module pure until an AWS provider actually runs.
+//
+// require(), not `await import()`: these helpers are synchronous and are
+// called from synchronous signing code. The package is CommonJS.
+function crypto(): typeof import('node:crypto') {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('node:crypto')
+  } catch (err: any) {
+    throw new Error(
+      'sekreto: AWS request signing needs node:crypto, which this runtime ' +
+        'does not provide: ' +
+        err.message,
+      { cause: err },
+    )
+  }
+}
 
 export type Sigv4Input = {
   method: string
@@ -39,11 +60,11 @@ export type Sigv4Input = {
 export type Sigv4Output = Record<string, string>
 
 function sha256hex(text: string): string {
-  return createHash('sha256').update(text, 'utf8').digest('hex')
+  return crypto().createHash('sha256').update(text, 'utf8').digest('hex')
 }
 
 function hmac(key: Buffer | string, text: string): Buffer {
-  return createHmac('sha256', key).update(text, 'utf8').digest()
+  return crypto().createHmac('sha256', key).update(text, 'utf8').digest()
 }
 
 /** RFC 3986 escaping, which is stricter than encodeURIComponent: AWS
@@ -128,7 +149,10 @@ export function sigv4(input: Sigv4Input): Sigv4Output {
   const kregion = hmac(kdate, input.region)
   const kservice = hmac(kregion, input.service)
   const ksigning = hmac(kservice, 'aws4_request')
-  const signature = createHmac('sha256', ksigning).update(stringtosign, 'utf8').digest('hex')
+  const signature = crypto()
+    .createHmac('sha256', ksigning)
+    .update(stringtosign, 'utf8')
+    .digest('hex')
 
   const out: Sigv4Output = {
     authorization:

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/sekreto @ a8c293be1b6c33d65223b2b2275797c241b1a1f1
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/sekreto - one interface for secrets, wherever they live.
 
@@ -18,25 +18,34 @@ export {
 
 export type { Name, SekretoOptions } from './Sekreto'
 
-export {
-  awsparamsprovider,
-  awssecretsprovider,
-  azuresecretsprovider,
-  boruprovider,
-  checkaddr,
-  dopplerprovider,
-  dotenvprovider,
-  envprovider,
-  fileprovider,
-  gcpsecretsprovider,
-  hashicorpprovider,
-  infisicalprovider,
-  makeprovider,
-  memoryprovider,
-  onepasswordprovider,
-} from './Providers'
+// THE CORE SURFACE. Deliberately does NOT re-export the eleven provider
+// kinds that need something of their runtime: pulling one through this
+// file would make all of them reachable and put AWS request signing in
+// every build, which is the thing the split removes.
+//
+// `env` and `memory` are here because they import nothing at all, and a
+// chain with nowhere to read from is not usable or testable.
+//
+// Everything else registers itself when its module is imported:
+//
+//     import '@voxgig/sekreto/provider/dotenv'
+//
+// or, for the old all-in behaviour, `from '@voxgig/sekreto/Providers'`.
+// See docs/design/plugin-providers.md.
+export { envprovider } from './provider/env'
+export { memoryprovider } from './provider/memory'
+
+// A pure validator, no platform dependency - kept on the core surface
+// because callers validate an address before configuring a provider.
+export { checkaddr } from './provider/addr'
+
+export { makeprovider, register, registered, kinds } from './provider/Registry'
+export type { ProviderDefinition } from './provider/Registry'
 
-export type { Provider, ProviderSpec } from './Providers'
+export type { Provider, ProviderSpec } from './provider/support'
 
-export { sigv4 } from './Sigv4'
-export type { Sigv4Input, Sigv4Output } from './Sigv4'
+// `sigv4` is NOT on the core surface: it is the node:crypto edge, and
+// only the two aws providers use it. Import it from the module that
+// needs it - `@voxgig/sekreto/provider/aws` - or from the full-set
+// barrel. Re-exporting it here would put request signing in every
+// build again, which is the thing the split removes.