@voxgig/sdkgen 4.8.3 → 4.10.0

package/project/.sdk/tm/elixir/test/vendor/omni/json.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260904-1610-0 (elixir/lib/json.ex)
-# Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/json.ex)
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # The omni JSON parser.
 #

package/project/.sdk/tm/elixir/test/vendor/omni/runner.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260904-1610-0 (elixir/lib/runner.ex)
-# Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/runner.ex)
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni: the shared multi-language test runner (Elixir port).
 #

package/project/.sdk/tm/elixir/test/vendor/omni/util.ex

@@ -1,5 +1,5 @@
-# VENDORED: @voxgig/omni sdk-20260904-1610-0 (elixir/lib/util.ex)
-# Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+# VENDORED: @voxgig/omni sdk-20260908-1556-0 (elixir/lib/util.ex)
+# Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 # License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 # Omni internal JSON utilities.
 #

package/project/.sdk/tm/go/feature/secrets/plugin/capability.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/capability.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Capabilities (§11.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/catalog.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/catalog.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The definition catalog (§10.1).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/config.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/config.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The declarative document (§9): normalization, and the ten-level
  * precedence ladder.

package/project/.sdk/tm/go/feature/secrets/plugin/depend.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/depend.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dependency cardinality, policy, and the restart graph (§11.3).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/env.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/env.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Environment overrides (§9.5) — level 7 of the ladder.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/export.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/export.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Exports (§11).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/graph.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/graph.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Whole-graph resolution (§11.4) — a phase, not a discovery.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/host.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/host.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The host: the lifecycle state machine (§5), extension points (§6), and
  * resource capture (§8).

package/project/.sdk/tm/go/feature/secrets/plugin/order.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/order.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Ordering (§7) — one rule, one place.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/point.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/point.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Extension points (§6). Three kinds, chosen because they are what the
  * two existing systems actually needed, and no more.

package/project/.sdk/tm/go/feature/secrets/plugin/ref.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/ref.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Identity: name+tag, written `name$tag` (§4).
  *

package/project/.sdk/tm/go/feature/secrets/plugin/resolve.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/resolve.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Dynamic resolution (§10.2) — name to candidate module ids.
  *

package/project/.sdk/tm/go/feature/secrets/plugin/types.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/types.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Shared types. Deliberately small: the design's §19 budget says the
  * library owns naming, configuration, lifecycle, ordering, binding and

package/project/.sdk/tm/go/feature/secrets/plugin/util.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/util.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The handful of helpers the port needs that the canonical gets from
  * JavaScript for free: sorted map keys (Object.keys(x).sort()), a

package/project/.sdk/tm/go/feature/secrets/plugin/version.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/plugin 0.1.6 (go/plugin/version.go)
-// Source: https://github.com/voxgig/plugin @ 8d8968afc0a2008fbd795b41ab166307d989f02a  [tag: sdk-20260904-1610-0]
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Versions and ranges (§11.2).
  *

package/project/.sdk/tm/go/feature/secrets/plugins/aws/aws.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/aws/aws.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/aws/aws.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The aws plugin: Secrets Manager and SSM Parameter Store, with requests
 // SigV4-signed in-tree (sigv4.go, beside this file). Needs HTTPS and
@@ -155,7 +155,7 @@ func (provider *SecretsProvider) Lookup(name string) (string, bool, error) {
 		return "", false, err
 	}
 
-	payload, _ := json.Marshal(struct {
+	payload, _ := sekreto.WriteJSON(struct {
 		SecretID string `json:"SecretId"`
 	}{SecretID: ref.Path})
 
@@ -236,7 +236,7 @@ func (provider *ParamsProvider) Lookup(name string) (string, bool, error) {
 		return "", false, err
 	}
 
-	payload, _ := json.Marshal(struct {
+	payload, _ := sekreto.WriteJSON(struct {
 		Name           string `json:"Name"`
 		WithDecryption bool   `json:"WithDecryption"`
 	}{Name: param, WithDecryption: true})

package/project/.sdk/tm/go/feature/secrets/plugins/aws/sigv4.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/aws/sigv4.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/aws/sigv4.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/go/feature/secrets/plugins/azuresecrets/azuresecrets.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/azuresecrets/azuresecrets.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/azuresecrets/azuresecrets.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The azuresecrets plugin: Azure Key Vault. Needs HTTPS. A port of
 // typescript/plugins/azuresecrets.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/boru/boru.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/boru/boru.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/boru/boru.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The boru plugin: a boru vault through its CLI, or over `boru vault
 // serve`. Needs a child process, or HTTPS in wire mode. A port of

package/project/.sdk/tm/go/feature/secrets/plugins/doppler/doppler.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/doppler/doppler.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/doppler/doppler.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The doppler plugin: Doppler, one bulk download per config. Needs
 // HTTPS. A port of typescript/plugins/doppler.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/gcpsecrets/gcpsecrets.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/gcpsecrets/gcpsecrets.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/gcpsecrets/gcpsecrets.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The gcpsecrets plugin: GCP Secret Manager. Needs HTTPS. A port of
 // typescript/plugins/gcpsecrets.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/hashicorp/hashicorp.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/hashicorp/hashicorp.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/hashicorp/hashicorp.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The hashicorp plugin: HashiCorp Vault, and OpenBao. Needs HTTPS, and
 // the filesystem for a kubernetes service-account JWT. A port of
@@ -7,7 +7,6 @@
 package hashicorp
 
 import (
-	"encoding/json"
 	"net/http"
 	"os"
 	"strconv"
@@ -91,12 +90,12 @@ func (provider *Provider) login() (string, error) {
 			}
 			jwt = strings.TrimSpace(string(raw))
 		}
-		payload, _ = json.Marshal(struct {
+		payload, _ = sekreto.WriteJSON(struct {
 			Role string `json:"role"`
 			Jwt  string `json:"jwt"`
 		}{Role: auth.Role, Jwt: jwt})
 	case "approle":
-		payload, _ = json.Marshal(struct {
+		payload, _ = sekreto.WriteJSON(struct {
 			RoleID   string `json:"role_id"`
 			SecretID string `json:"secret_id"`
 		}{RoleID: auth.RoleID, SecretID: auth.SecretID})

package/project/.sdk/tm/go/feature/secrets/plugins/httpjson/httpjson.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/httpjson/httpjson.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/httpjson/httpjson.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The HTTP half of every plugin that speaks to a store over the wire, in
 // one place and OUTSIDE the core: a chain of built-ins never links this
@@ -207,7 +207,7 @@ func ToString(value any) string {
 	case float64:
 		return strconv.FormatFloat(typed, 'f', -1, 64)
 	default:
-		text, err := json.Marshal(typed)
+		text, err := sekreto.WriteJSON(typed)
 		if nil != err {
 			return ""
 		}

package/project/.sdk/tm/go/feature/secrets/plugins/infisical/infisical.go

@@ -1,12 +1,11 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/infisical/infisical.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/infisical/infisical.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The infisical plugin: Infisical. Needs HTTPS. A port of
 // typescript/plugins/infisical.ts.
 package infisical
 
 import (
-	"encoding/json"
 	"net/http"
 	"strconv"
 	"strings"
@@ -48,7 +47,7 @@ func (provider *Provider) login(addr string) (string, error) {
 		return "", sekreto.Fail("sekreto: infisical: no token and no client credentials")
 	}
 
-	payload, _ := json.Marshal(struct {
+	payload, _ := sekreto.WriteJSON(struct {
 		ClientID     string `json:"clientId"`
 		ClientSecret string `json:"clientSecret"`
 	}{ClientID: provider.ClientID, ClientSecret: provider.ClientSecret})

package/project/.sdk/tm/go/feature/secrets/plugins/onepassword/onepassword.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/onepassword/onepassword.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/onepassword/onepassword.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The onepassword plugin: 1Password, through a Connect server. Needs
 // HTTPS. A port of typescript/plugins/onepassword.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/secretspec/secretspec.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/secretspec/secretspec.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/secretspec/secretspec.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The secretspec plugin: SecretSpec, through its CLI. Needs a child
 // process. A port of typescript/plugins/secretspec.ts.

package/project/.sdk/tm/go/feature/secrets/sekreto/addr.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/sekreto/addr.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/addr.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The plaintext-address guard, in the core because it is pure - a
 // handful of string steps, no socket - and because it is on the spec:

package/project/.sdk/tm/go/feature/secrets/sekreto/providers.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/sekreto/providers.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/providers.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, how a provider
 // kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.
@@ -368,6 +368,9 @@ func ProviderPlugin(kind string, make func(spec *ProviderSpec) (Provider, error)
 // the JSON shape OptionsOf produced, and the shape a config document
 // would.
 func SpecOf(options map[string]any) (*ProviderSpec, error) {
+	// json.Marshal, not WriteJSON: these bytes are unmarshalled on the next
+	// line and never leave the process, so HTML escaping cannot be observed
+	// - Unmarshal reads \u003c back as <. WriteJSON is for what is emitted.
 	text, err := json.Marshal(options)
 	if nil != err {
 		return nil, Fail("sekreto: unreadable provider options: " + err.Error())

package/project/.sdk/tm/go/feature/secrets/sekreto/sekreto.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/sekreto/sekreto.go)
-// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/sekreto.go)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //
@@ -15,6 +15,8 @@
 package sekreto
 
 import (
+	"bytes"
+	"encoding/json"
 	"regexp"
 	"sort"
 	"strings"
@@ -39,6 +41,33 @@ func Fail(message string) error {
 	return &SekretoError{Message: message}
 }
 
+// WriteJSON is json.Marshal with Go's HTML escaping turned OFF.
+//
+// encoding/json escapes <, > and & as \u003c, \u003e and \u0026 unless
+// told otherwise. That is a defence for JSON pasted into an HTML page,
+// which this library never does, and it made go the only port whose bytes
+// differed: every other port emits those three characters raw. The
+// writer's output is part of what the ports agree on - the CLI line is
+// compared byte for byte across all of them - so go matches the rest
+// rather than the rest matching go.
+//
+// Encode appends a newline, which a JSON document does not carry, so it
+// is trimmed. Use this for every value that LEAVES the process: a request
+// body, a returned secret, the CLI's line. A marshal whose bytes are
+// unmarshalled again without ever being emitted needs no such care.
+func WriteJSON(value any) ([]byte, error) {
+	var buf bytes.Buffer
+
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+
+	if err := enc.Encode(value); nil != err {
+		return nil, err
+	}
+
+	return bytes.TrimRight(buf.Bytes(), "\n"), nil
+}
+
 var namepart = regexp.MustCompile(`^[a-z0-9_]+$`)
 
 // ValidName reports whether this is a well-formed secret name.

package/project/.sdk/tm/go/feature/secrets_feature.go

@@ -2,6 +2,7 @@ package feature
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"strconv"
@@ -207,6 +208,21 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 				continue
 			}
 			specs = append(specs, spec)
+		default:
+			// ANYTHING ELSE is refused, fail-closed - a bare kind name
+			// ("hashicorp"), a nil, a number. DELIBERATE DIVERGENCE from
+			// ts/kotlin: those push every entry through to Sekreto's
+			// constructor, whose dynamic providers list refuses it with this
+			// message. Go's Options.Providers is a typed slice, so there is
+			// nothing to push a string through; the feature raises the
+			// library's own error here instead, via sekreto.Fail with the
+			// constructor's own wording, and the transport gate below refuses
+			// to send. A switch without this arm silently DROPPED the entry,
+			// which SHORTENED the chain instead of failing it - a
+			// misconfigured providers list then sent ordinary unauthenticated
+			// requests, the exact fail-open the gate exists to prevent.
+			f.initerr = sekreto.Fail(
+				"sekreto: not a provider or a provider spec: " + fmt.Sprint(v))
 		}
 	}
 

package/project/.sdk/tm/go/test/feature/secrets/secrets_feature_test.go

@@ -732,6 +732,129 @@ func TestSecretsDirectPath(t *testing.T) {
 	}
 }
 
+// FAIL CLOSED ON A CONSTRUCTION FAILURE. The chain a project configures
+// can be wrong before a single lookup happens, and Init cannot fail the
+// client construction the way ts's throwing init does - so it HOLDS the
+// error (initerr) and the transport gate refuses to send.
+//
+// The entry pinned here is a bare kind name where a spec belongs. Init's
+// type switch over the providers list had cases for a *ProviderSpec, a
+// Provider and a map, and no default - so the entry was silently DROPPED,
+// the chain got SHORTER rather than broken, and every request went out
+// unauthenticated while the gate had nothing to refuse. That is fail-open
+// by omission, and it survived every other case in this file because each
+// of them configures the chain correctly.
+//
+// Both wire paths - the entity pipeline and Direct - each with a CONTROL
+// leg through the SAME live transport, so a zero means REFUSED and not
+// UNWIRED. The refusal is matched on sekreto's OWN message, so an
+// unrelated failure cannot stand in for it.
+func TestSecretsMalformedProviderEntry(t *testing.T) {
+	// A kind NAME where a provider or spec belongs.
+	malformed := []any{"hashicorp"}
+	const notaprovider = "not a provider or a provider spec"
+
+	workingchain := func(value string) map[string]any {
+		return map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						if "apikey" == name {
+							return value, true, nil
+						}
+						return "", false, nil
+					},
+				},
+			},
+		}}
+	}
+	malformedchain := map[string]any{"secrets": map[string]any{
+		"active":    true,
+		"providers": malformed,
+	}}
+
+	t.Run("fails the entity op and nothing reaches the wire", func(t *testing.T) {
+		// CONTROL FIRST, so the zero below is known to be observable at all.
+		control := makewire()
+		ok := secretsClient(control, map[string]any{"feature": workingchain("INITKEY01")})
+		driveEntityOp(t, ok, control)
+		if 1 != len(control.api()) {
+			t.Fatalf("the control operation did not reach system.fetch exactly once,"+
+				" so this test cannot observe a request going out at all: got %d",
+				len(control.api()))
+		}
+		credentialIs(t, control.api()[0].auth, "INITKEY01")
+
+		// THE RULE.
+		w := makewire()
+		client := secretsClient(w, map[string]any{"feature": malformedchain})
+
+		// The feature must still be INSTALLED: a construction failure that
+		// silently uninstalled it would be the same fail-open by another
+		// route, with nothing downstream gating anything.
+		if nil == secretsFeatureOf(client) {
+			t.Fatal("the secrets feature must stay installed on a construction failure")
+		}
+
+		// Every op the control leg could have taken: the gate sits at the
+		// transport, so an op that never reached it proves nothing either way.
+		driveEntityOpUntil(t, client, "was driven", func() bool { return true })
+
+		if 0 != len(w.api()) {
+			t.Fatalf("a malformed providers entry was DROPPED and the shortened chain"+
+				" sent an UNAUTHENTICATED request: %d calls went out, first %q auth=%q",
+				len(w.api()), w.api()[0].url, w.api()[0].auth)
+		}
+	})
+
+	t.Run("fails Direct rather than sending, with sekreto's own message", func(t *testing.T) {
+		// CONTROL FIRST.
+		control := makewire()
+		res, err := secretsClient(control, map[string]any{
+			"allow":   map[string]any{"op": "direct"},
+			"feature": workingchain("INITKEY01"),
+		}).Direct(map[string]any{"path": "/thing"})
+		if nil != err {
+			t.Fatalf("the control request failed: %v", err)
+		}
+		if ok, _ := res["ok"].(bool); !ok {
+			t.Fatalf("the control request was refused: %v", res["err"])
+		}
+		if 1 != len(control.api()) {
+			t.Fatalf("the control request did not reach system.fetch exactly once,"+
+				" so this test cannot observe a request going out at all: got %d",
+				len(control.api()))
+		}
+		credentialIs(t, control.api()[0].auth, "INITKEY01")
+
+		// THE RULE. Direct runs no feature hook at all, so the ONLY thing
+		// that can refuse it is the transport gate.
+		w := makewire()
+		out, err := secretsClient(w, map[string]any{
+			"allow":   map[string]any{"op": "direct"},
+			"feature": malformedchain,
+		}).Direct(map[string]any{"path": "/thing"})
+		if nil != err {
+			t.Fatalf("direct must report the refusal in-band: %v", err)
+		}
+
+		if 0 != len(w.api()) {
+			t.Fatalf("a malformed providers entry was DROPPED and the shortened chain"+
+				" sent an UNAUTHENTICATED direct request: %d calls went out, first %q auth=%q",
+				len(w.api()), w.api()[0].url, w.api()[0].auth)
+		}
+		if ok, _ := out["ok"].(bool); ok {
+			t.Fatal("a chain that could not be built must refuse the raw path fail-closed")
+		}
+		msg := fmt.Sprint(out["err"])
+		if !strings.Contains(msg, notaprovider) {
+			t.Fatalf("the refusal must carry sekreto's own message (%s), got: %s",
+				notaprovider, msg)
+		}
+	})
+}
+
 // A provider failure closes the transport gate; a later retry that
 // SUCCEEDS reopens it and every waiting operation goes out with the FRESH
 // credential - never the stale pre-failure header, and never nothing.

package/project/.sdk/tm/go/test/omni/omni.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260904-1610-0 (go/omni.go)
-// Source: https://github.com/voxgig/omni @ 8c3e1b573a8d35796f7fc45e3226b977023cabf7  [tag: sdk-20260904-1610-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (go/omni.go)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //
@@ -638,7 +638,12 @@ func handleerror(flags Flags, index int, entry map[string]any, err error, provid
 // Match checks that every leaf of `check` is present, and matches, in
 // `base`.
 func Match(flags Flags, index int, entry map[string]any, check any, base any) error {
-	cbase := Clone(base)
+	// Read the base DIRECTLY. The clone bought nothing - the walk below
+	// only reads, via GetPath - and it blows the stack on a cyclic base. A
+	// port driving entries with live objects rather than pure JSON produces
+	// those routinely (voxgig/sdkgen's corpus matches a live client context
+	// whose root context reaches the client again).
+	cbase := base
 	var failure error
 
 	Walk(Clone(check), func(_key any, val any, _parent any, path []any) any {