@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/c/tests/vendor/omni/json.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (c/src/json.c)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/json.c)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* The omni JSON value model, pool allocator, parser and printer.
  *

package/project/.sdk/tm/c/tests/vendor/omni/omni.h

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (c/src/omni.h)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/omni.h)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Omni: the shared multi-language test runner (C port).
  *

package/project/.sdk/tm/c/tests/vendor/omni/runner.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (c/src/runner.c)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/runner.c)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Omni: the shared multi-language test runner (C port).
  *

package/project/.sdk/tm/c/tests/vendor/omni/util.c

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (c/src/util.c)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (c/src/util.c)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Omni internal JSON utilities: clone, path lookup, deep equality, and
  * the regex bridge.

package/project/.sdk/tm/clojure/Makefile

@@ -5,6 +5,9 @@
 
 # Run the full test suite (pipeline, features, netsim, primary utility and the
 # vendored struct corpus) through a single tools.deps main entry point.
+# `clojure -M:test --sdk-only` runs the SDK's own suites without the shared
+# corpus (.sdk/test/test.json); the skip is printed, and it is what sdkgen's
+# own CI runs, having no corpus of its own.
 test:
 	clojure -M:test
 

package/project/.sdk/tm/clojure/feature/secrets/sdk/feature/secrets.clj

@@ -0,0 +1,530 @@
+;; ProjectName SDK secrets feature (generated by @voxgig/sdkgen).
+;;
+;; Secret access via a vendored @voxgig/sekreto provider chain, and the
+;; access-token exchange some APIs require on top of it. The clojure port
+;; of tm/ts/src/feature/secrets/SecretsFeature.ts and tm/go's
+;; secrets_feature.go - same contract, clojure idiom.
+;;
+;; The SDK's `apikey` option keeps exactly its old meaning: an explicit
+;; credential given in code. This feature makes it ONE SOURCE among several
+;; rather than the only one: when active, the apikey is resolved through a
+;; sekreto chain in which the explicit option (when set) is the FIRST
+;; provider - a `memory` store named `options` - so an explicit value always
+;; wins, by sekreto's own first-hit rule rather than by special-case logic.
+;;
+;; WHERE THIS NAMESPACE LIVES. `feature/secrets/sdk/feature/secrets.clj`,
+;; not `src/feature/...`: Clojure resolves a namespace to a file searched
+;; from each `:paths` root, so `feature/secrets` is itself a classpath root
+;; (Package_clojure adds it when the feature is active) and holds both this
+;; file and the vendored `voxgig/` tree. Keeping it INSIDE the feature
+;; container is what lets the feature trim take the whole thing away;
+;; keeping it OUTSIDE `voxgig/` is what keeps the vendoring guard's "no
+;; unlisted file in a vendored directory" walk true.
+;;
+;; RESOLUTION HAPPENS AT THE TRANSPORT SEAM, not in a PreSpec hook. Both
+;; raw paths - `client/direct` and `client/graphql` - run NO feature hooks
+;; at all (client.clj says so itself), yet both reach the wire through
+;; `(core/uget ctx :fetcher)`, the same slot the entity pipeline uses at
+;; core.clj's u-make-request. Wrapping the fetcher is therefore the ONE
+;; seam every request crosses, and it is late enough that the header
+;; `u-prepare-auth` already built can simply be rewritten in place.
+;;
+;; THE CREDENTIAL LIVES IN FEATURE STATE, never in the shared options map.
+;; The options map is read raw on every operation, and `client-options-map`
+;; hands out clones; a feature that wrote into it would both race
+;; concurrent operations and fail to reach the clones already taken. With
+;; the feature as sole holder the map is frozen after construction, and the
+;; header the wire sees is identical because the wrapper rebuilds it the
+;; way `u-prepare-auth` does, from the same `auth.prefix`, with the same
+;; `auth: nil` suppression.
+;;
+;; MISS vs ERROR (sekreto's invariant): a provider MISS falls through - the
+;; op proceeds, unauthenticated if nothing else supplies a credential. A
+;; provider ERROR (unreachable vault, bad creds) FAILS the op: `tryget`
+;; returns nil for a miss and THROWS for an error, and the wrapper turns a
+;; throw into `[nil err]`, which fails the request on both the raw path
+;; (client.clj) and the entity path (core.clj). A broken vault never
+;; degrades into an unauthenticated request.
+;;
+;; EXCHANGE: some APIs will not take a long-lived credential at all. What
+;; the chain resolves is then a REFRESH token, which buys a short-lived
+;; ACCESS token from a token endpoint (`exchange.path`, relative to
+;; options.base); the access token is what every request carries, and when
+;; a response status in `exchange.statuses` (401) says it is spent the
+;; wrapper buys another and retries the same request once.
+
+(ns sdk.feature.secrets
+  (:require [clojure.string :as str]
+            [sdk.core :as core]
+            [voxgig.struct :as vs]
+            [voxgig.sekreto :as sekreto]
+            [voxgig.sekreto.provider :as provider]))
+
+
+(def ^:private ERROR-CODE "secrets_provider")
+
+
+;; ---------------------------------------------------------------------------
+;; Option reading. Options arrive as vendored struct nodes (LinkedHashMap /
+;; ArrayList with STRING keys), so every read goes through vs/getprop.
+;; ---------------------------------------------------------------------------
+
+(defn- sopt [m k d]
+  (let [v (vs/getprop m k)] (if (and (string? v) (seq v)) v d)))
+
+
+;; A struct node as plain Clojure data, with every map key as a STRING.
+;;
+;; Walked through the Java ENTRY SET rather than vs/keysof, which stringifies
+;; a key before handing it back (a keyword `:kind` comes back as the string
+;; ":kind") and would then look the value up under a name the map does not
+;; hold - reading every value as nil. Reading the entries directly cannot
+;; drift from the keys.
+(defn- keyname [k] (if (keyword? k) (name k) (str k)))
+
+(defn- plain [v]
+  (cond
+    (vs/ismap v)
+    (into {} (map (fn [^java.util.Map$Entry e]
+                    [(keyname (.getKey e)) (plain (.getValue e))])
+                  (.entrySet ^java.util.Map v)))
+    (vs/islist v) (mapv plain (vec v))
+    :else v))
+
+
+;; One `providers` entry, as sekreto wants it.
+;;
+;; A LIVE provider (anything satisfying the Provider protocol) is handed
+;; over untouched - sekreto's chain checks `satisfies?` first. Everything
+;; else is a declarative SPEC, and sekreto reads a spec with KEYWORD keys
+;; (`(:kind spec)`), while the SDK's option pipeline delivers string-keyed
+;; struct maps. So the top level is keywordized here, and `:values` alone
+;; keeps its string keys, because a memory store is addressed by the
+;; env-key name.
+;;
+;; WHAT SURVIVES SDK OPTION VALIDATION, AND WHAT DOES NOT. `u-make-options`
+;; runs the options through `vs/merge` and `vs/validate`, which deep-copy
+;; every java.util.Map they meet and stringify its keys. So:
+;;
+;;   {"kind" "env"}       a string-keyed spec map        - SURVIVES.
+;;   (reify Provider ...)  not a Map, held by reference  - SURVIVES.
+;;   {:kind "env"}        a KEYWORD-keyed map - DOES NOT: it arrives as
+;;                         {":kind" nil}, keys renamed and values dropped.
+;;   (defrecord ...)       IS a java.util.Map, so it arrives as a plain
+;;                         LinkedHashMap with the protocol gone.
+;;
+;; The last two are checked for below rather than left to fail deep inside
+;; the chain as "unknown provider kind: " with an empty kind, which is a
+;; baffling error to debug. They fail the CHAIN BUILD, which the transport
+;; gate turns into a refused request - fail closed, never a silent
+;; unauthenticated send.
+(defn- spec-of [p]
+  (cond
+    (satisfies? provider/Provider p) p
+    (vs/ismap p) (into {} (map (fn [[k v]] [(keyword k) v]) (plain p)))
+    :else p))
+
+
+(defn- checkspec [p]
+  (when-not (or (satisfies? provider/Provider p)
+                (and (map? p) (string? (:kind p)) (seq (:kind p))))
+    (throw (sekreto/sekretoerror
+            (str "secrets: unusable provider chain entry: " (pr-str p)
+                 " - an entry is either a spec map with STRING keys"
+                 " ({\"kind\" \"env\"}) or a live provider made with"
+                 " `reify`. A keyword-keyed map and a defrecord provider do"
+                 " not survive SDK option validation."))))
+  p)
+
+
+;; ---------------------------------------------------------------------------
+;; Feature state.
+;; ---------------------------------------------------------------------------
+
+(defn- st [fa k] (clojure.core/get (deref fa) k))
+
+
+;; The LIVE options map (the root context's validated options), which this
+;; feature only ever READS. `client-options-map` would hand back a clone,
+;; and a clone cannot answer "did the caller suppress auth" for the map the
+;; pipeline is actually using.
+(defn- liveopts [fa] (st fa :liveopts))
+
+
+;; `auth`, exactly as u-prepare-auth reads it: nil means SUPPRESSED (or
+;; never set), and either way no credential goes out.
+(defn- auth-of [fa]
+  (let [o (liveopts fa)] (when (vs/ismap o) (vs/getprop o "auth"))))
+
+
+;; The resolved credential ("" when none). Callers and tests read it here
+;; rather than from the options map, which this feature never mutates.
+(defn credential [fa] (or (st fa :cred) ""))
+
+
+;; The LIVE Sekreto instance, for callers who want arbitrary secrets or
+;; redaction. Never a clone: sekreto holds provider state (caches, vault
+;; leases) that has to stay live to be worth anything.
+;;
+;;   (require '[sdk.feature.secrets :as secrets] '[voxgig.sekreto :as sekreto])
+;;   (sekreto/get (secrets/sek (secrets/of client)) "db.password")
+;;   (sekreto/redact (secrets/sek (secrets/of client)) logline)
+(defn sek [fa] (st fa :sek))
+
+
+;; This client's secrets feature, or nil when it has none. The clojure
+;; spelling of ts's `sdk.secrets()` accessor: the generated client keeps
+;; features in a vector rather than as named members, so the lookup lives
+;; here with the feature rather than being written out at each call site.
+(defn of [client]
+  (when client
+    (first (filter (fn [f] (= "secrets" (core/feature-get-name f)))
+                   (deref (core/client-features client))))))
+
+
+;; ---------------------------------------------------------------------------
+;; The access-token exchange.
+;; ---------------------------------------------------------------------------
+
+(defn- buy-once [fa]
+  (let [x (st fa :exchange)
+        refresh (st fa :refresh)]
+
+    (when (or (nil? refresh) (= "" refresh))
+      (throw (sekreto/sekretoerror
+              (str "secrets: no refresh token: the provider chain has no '"
+                   (st fa :secretname)
+                   "', and feature.secrets.exchange.refresh is unset"))))
+
+    (let [options (core/client-options-map (st fa :client))
+          ;; The token endpoint is RELATIVE to the base, which already
+          ;; carries whatever account or tenant segment the server URL
+          ;; declares.
+          base0 (let [b (vs/getprop options "base")] (if (string? b) b ""))
+          base (str/replace base0 #"/+$" "")
+          url (str base "/" (str/replace (:path x) #"^/+" ""))
+          sysfetch (vs/getpath options "system.fetch")
+          ;; Deliberately NOT the SDK transport. The transport is what this
+          ;; feature wraps, so sending the token request back through it
+          ;; would recurse on the first expiry - and would route the
+          ;; purchase through the test mock, which knows nothing about it.
+          ;; `system.fetch` is honoured because that is the seam a caller
+          ;; uses to supply a transport at all; otherwise core's own raw
+          ;; HTTP path, which returns the same [res err] shape.
+          fetch (if (vs/isfunc sysfetch) sysfetch core/default-http-fetch)
+          ;; The body is MARSHALLED, never concatenated: a refresh token (or
+          ;; a configured request-field name) carrying a quote, backslash or
+          ;; newline must arrive as that literal value, not as broken JSON.
+          body (vs/jsonify (vs/jm (:request x) refresh) (vs/jm "indent" 0))
+          [res err] (fetch url (vs/jm "method" (:method x)
+                                      "headers" (vs/jm "content-type" "application/json")
+                                      "body" body))]
+
+      (when (some? err)
+        (throw (sekreto/sekretoerror
+                (str "secrets: token exchange failed: " (core/err-msg err) " from " url))))
+
+      ;; core/default-http-fetch NEVER returns an err - a connection failure
+      ;; comes back as status 0 with the exception in statusText - so the
+      ;; STATUS is what decides, not a nil error.
+      (let [status (core/to-int (vs/getprop res "status"))]
+        (when (or (< status 200) (>= status 300))
+          (throw (sekreto/sekretoerror
+                  (str "secrets: token exchange failed: " status " from " url))))
+
+        (let [jf (vs/getprop res "json")
+              parsed (if (vs/isfunc jf) (jf) (vs/getprop res "body"))
+              token (when (vs/ismap parsed) (vs/getprop parsed (:response x)))]
+          (when-not (and (string? token) (seq token))
+            (throw (sekreto/sekretoerror
+                    (str "secrets: token exchange returned no '" (:response x)
+                         "' field from " url))))
+          token)))))
+
+
+;; Buy an access token with the refresh token. Concurrent callers share the
+;; ONE in-flight purchase (the buy monitor), so four operations expiring at
+;; once open one token request rather than four.
+(defn- buy [fa]
+  ;; TEST MODE BUYS NOTHING. The test feature replaces the transport so no
+  ;; request leaves the process; an exchange here would be the one HTTP
+  ;; call it could not stop, and it would need a live token endpoint for a
+  ;; suite whose whole point is not needing one. A deterministic,
+  ;; obviously-fake token instead - the same answer make-options gives a
+  ;; required server variable, for the same reason.
+  (if (not= "live" (core/client-mode (st fa :client)))
+    (let [token (str "test-" (:response (st fa :exchange)))]
+      (swap! fa assoc :cred token)
+      token)
+    (locking (st fa :buylock)
+      (let [token (buy-once fa)]
+        ;; Published under the monitor: the purchasing thread is the only
+        ;; writer, so a burst of expired requests cannot race it.
+        (swap! fa assoc :cred token)
+        token))))
+
+
+;; ---------------------------------------------------------------------------
+;; Resolution.
+;; ---------------------------------------------------------------------------
+
+;; Resolve once, answering whether a credential came out of it. That
+;; boolean is the whole of what resolve! needs to tell a cacheable HIT from
+;; a miss it must not keep.
+(defn- resolve-once [fa]
+  (if-let [s (st fa :sek)]
+    ;; tryget: nil for a MISS, THROWS for a provider ERROR.
+    (let [found (sekreto/tryget s (st fa :secretname))]
+      (if (nil? (st fa :exchange))
+        ;; An UNCACHED miss after an earlier hit is a revocation: the chain
+        ;; now says no provider has the secret, so the value must not keep
+        ;; going out on the wire. (An explicit apikey OPTION is never lost
+        ;; here - it seats FIRST in the chain as a memory store, so the
+        ;; chain HITS while one is set and this branch is unreachable.)
+        (do
+          (swap! fa assoc :cred (if (string? found) found ""))
+          (string? found))
+
+        ;; Exchanging: what the chain resolved is the REFRESH token, kept
+        ;; for every later purchase. A miss is not fatal - an explicit
+        ;; `apikey` may already hold a usable access token, and the API is
+        ;; what gets to say whether it does.
+        (do
+          (swap! fa assoc :refresh (if (string? found) found ""))
+          (let [held (credential fa)
+                apikey (if (seq held)
+                         held
+                         (let [k (vs/getprop (liveopts fa) "apikey")]
+                           (if (string? k) k "")))]
+            (swap! fa assoc :cred apikey)
+            (cond
+              (seq apikey) true
+
+              ;; `auth: nil` is the documented way to send NO credential,
+              ;; and a purchase is a credential-bearing call: the refresh
+              ;; token goes to the token endpoint in the request body.
+              ;; with-refresh honours suppression for the RETRY, but it runs
+              ;; after this - by then the refresh token has already left the
+              ;; process, and no later check can call it back. The
+              ;; suppression has to be honoured here, before the first
+              ;; purchase, or it only ever half-held.
+              (nil? (auth-of fa)) false
+
+              :else
+              ;; No starting access token: buy one now. A failure here is a
+              ;; failure of the operation - fail closed.
+              (do (buy fa) true))))))
+    false))
+
+
+;; One resolution, shared by every concurrent caller.
+;;
+;; Returns nil on success, or the Throwable that failed it. A settled HIT is
+;; kept only when caching is on (`cache: false` means every request asks the
+;; chain again); a FAILURE is NEVER kept, so a transient vault outage cannot
+;; poison the client permanently - the next operation asks the chain again
+;; and recovers.
+;;
+;; A MISS is not kept either, however caching is set. That rule is
+;; sekreto's, not this feature's: `A miss is never cached: the next read
+;; asks again`, in sekreto's own source. Keeping a settled miss here would
+;; override that from the layer above, and a secret provisioned after
+;; startup - a mounted file, a policy granted a minute late - would never be
+;; picked up for the life of the client. `cache` is about caching a HIT; it
+;; was never a promise to keep saying no.
+(defn- resolve! [fa]
+  (if-let [e (st fa :initerr)]
+    e
+    (locking (st fa :lock)
+      (if (and (st fa :cache) (st fa :resolved))
+        nil
+        (try
+          (let [hit (resolve-once fa)]
+            (swap! fa assoc :resolved (boolean hit)))
+          nil
+          (catch Throwable e
+            (swap! fa assoc :resolved false)
+            e))))))
+
+
+;; ---------------------------------------------------------------------------
+;; The transport seam.
+;; ---------------------------------------------------------------------------
+
+;; Write the credential into THIS request's header, the way u-prepare-auth
+;; builds it - same prefix, same suppression - so the two cannot drift. The
+;; fetchdef's "headers" IS the spec's headers map u-prepare-auth wrote, so
+;; this is an in-place rewrite of the value that was already there.
+(defn- reauth! [fa fetchdef token]
+  (let [headers (vs/getprop fetchdef "headers")]
+    (when (vs/ismap headers)
+      (if (nil? (auth-of fa))
+        ;; Suppressed auth means NO header, the same answer u-prepare-auth
+        ;; gives. Reached defensively - nothing calls this with auth
+        ;; suppressed - but this is the function that writes the
+        ;; credential, so it is where the rule has to hold.
+        (vs/delprop headers core/HEADER-AUTH)
+        (let [prefix (let [p (vs/getpath (liveopts fa) "auth.prefix")]
+                       (if (string? p) p ""))]
+          (.put ^java.util.Map headers core/HEADER-AUTH
+                (if (= "" prefix) token (str prefix " " token))))))))
+
+
+(defn- spent? [fa res]
+  (and (vs/ismap res)
+       (let [s (vs/getprop res "status")]
+         (and (number? s)
+              (boolean (some (fn [x] (= (long x) (long s)))
+                             (:statuses (st fa :exchange))))))))
+
+
+;; Buy a token and try the request again when the API says the current one
+;; is spent.
+(defn- with-refresh [fa ctx url fetchdef inner]
+  ;; `auth: nil` is the documented way to send NO credential. A refusal of
+  ;; a deliberately unauthenticated request is not an expired token and
+  ;; cannot be fixed by buying one - retrying would transmit exactly the
+  ;; credential the caller withheld.
+  (if (nil? (auth-of fa))
+    (inner ctx url fetchdef)
+    (let [max (:retries (st fa :exchange))]
+      (loop [attempt 0]
+        ;; The credential THIS attempt goes out with, captured before it
+        ;; leaves: it is what tells a stale refusal apart from a fresh one.
+        (let [used (credential fa)
+              [res err] (inner ctx url fetchdef)]
+          (if (or (some? err) (>= attempt max) (not (spent? fa res)))
+            [res err]
+            ;; Another request may have bought a token while this one was
+            ;; in flight. Concurrent expiries share the in-flight purchase,
+            ;; but STAGGERED ones do not - so spend what is current before
+            ;; buying: a second exchange for a token that is already fresh
+            ;; is wasted, and on a provider that invalidates the previous
+            ;; credential on issuance it breaks the first request's own
+            ;; retry.
+            (let [current (credential fa)
+                  token (if (and (seq current) (not= current used))
+                          current
+                          ;; The purchase failed: answer with the API's own
+                          ;; refusal rather than this one. The caller asked
+                          ;; for data, and the refusal is the more useful of
+                          ;; the two - the exchange error is a symptom.
+                          (try (buy fa) (catch Throwable _ nil)))]
+              (if (nil? token)
+                [res err]
+                (do (reauth! fa fetchdef token)
+                    (recur (inc attempt)))))))))))
+
+
+(defn- transport [fa ctx url fetchdef inner]
+  ;; FAIL-CLOSED, at the ONE seam every wire path crosses. Entity ops,
+  ;; direct, graphql and the exchange retries all come through here, so
+  ;; resolving HERE is what gives the raw paths - which run no feature
+  ;; hooks at all - the same credential the entity pipeline gets. A
+  ;; provider ERROR refuses the request with the provider's own message,
+  ;; and never an unauthenticated send.
+  (let [failed (resolve! fa)]
+    (if (some? failed)
+      [nil (core/ctx-error ctx ERROR-CODE (str "secrets: " (core/err-msg failed)))]
+      (do
+        (let [token (credential fa)]
+          (when (seq token) (reauth! fa fetchdef token)))
+        (if (nil? (st fa :exchange))
+          (inner ctx url fetchdef)
+          (with-refresh fa ctx url fetchdef inner))))))
+
+
+;; ---------------------------------------------------------------------------
+;; Construction.
+;; ---------------------------------------------------------------------------
+
+(defn- read-exchange [options]
+  (let [xopts (core/to-map (vs/getprop options "exchange"))]
+    (when (and xopts (= true (vs/getprop xopts "active")))
+      {:path (sopt xopts "path" "auth/token")
+       :method (sopt xopts "method" "POST")
+       :request (sopt xopts "request" "refresh_token")
+       :response (sopt xopts "response" "access_token")
+       :statuses (let [s (vs/getprop xopts "statuses")]
+                   (if (and (vs/islist s) (pos? (vs/size s)))
+                     (mapv (fn [v] (core/to-int v)) (vec s))
+                     [401]))
+       :retries (let [r (vs/getprop xopts "retries")] (if (number? r) (long r) 1))})))
+
+
+(defn- init! [fa ctx options]
+  (let [options (if (vs/ismap options) options (vs/jm))]
+    (swap! fa assoc
+           :client (core/oget ctx :client)
+           :options options
+           :liveopts (core/oget ctx :options)
+           :active (= true (vs/getprop options "active")))
+
+    (when (st fa :active)
+      (let [secretname (sopt options "name" "apikey")
+            cache (not= false (vs/getprop options "cache"))
+            exchange (read-exchange options)
+            xopts (core/to-map (vs/getprop options "exchange"))
+
+            ;; The explicit credential, when set, is the first store in the
+            ;; chain.
+            ;;
+            ;; WHICH option that is depends on the exchange. Without one,
+            ;; the secret being resolved IS the credential the transport
+            ;; sends, so `apikey` is it. With one, the secret is a REFRESH
+            ;; token and `apikey` means the opposite thing - an access
+            ;; token the caller already holds - so the explicit seat
+            ;; belongs to `exchange.refresh`, and apikey is left alone to
+            ;; serve as the starting access token (see resolve-once).
+            explicit (if (nil? exchange)
+                       (let [k (vs/getprop (core/oget ctx :options) "apikey")]
+                         (if (string? k) k ""))
+                       (sopt xopts "refresh" ""))
+
+            given (vec (or (vs/getprop options "providers") []))]
+
+        (swap! fa assoc :secretname secretname :cache cache :exchange exchange)
+
+        ;; The plugin DEFINITIONS the model selected, handed in by the
+        ;; generated sdk.config. Upstream sekreto's contract since the
+        ;; registry was retired: a kind not passed in is unknown to this
+        ;; Sekreto, so the model's choice of plugin groups IS the SDK's
+        ;; provider vocabulary.
+        (try
+          (let [specs (into (if (seq explicit)
+                              [{:kind "memory" :name "options"
+                                :values {(sekreto/envkey secretname) explicit}}]
+                              [])
+                            (map (fn [p] (checkspec (spec-of p))) given))]
+            (swap! fa assoc :sek (sekreto/sekreto specs {:plugins (st fa :plugins)
+                                                         :cache cache})))
+          (catch Throwable e
+            ;; Init cannot fail the construction (the feature contract is
+            ;; sync and returns nothing), so the transport gate refuses to
+            ;; send instead - a misconfigured chain stays fail-closed
+            ;; rather than silently unauthenticated.
+            (swap! fa assoc :initerr e)))
+
+        ;; Wrap the transport WHENEVER the feature is active: the
+        ;; fail-closed gate needs the seam on every path, and the exchange
+        ;; (when on) additionally needs to SEE responses - expiry is only
+        ;; ever discovered from one.
+        (let [utility (core/oget ctx :utility)
+              inner (core/oget utility :fetcher)]
+          (core/oset! utility :fetcher
+                      (fn [fctx furl ffd] (transport fa fctx furl ffd inner))))))))
+
+
+;; The feature atom. `plugins` is the vector of voxgig/plugin definitions
+;; the generated sdk.config selected for this feature.
+(defn secrets-feature
+  ([] (secrets-feature nil))
+  ([plugins]
+   (let [fa (atom {:name "secrets" :active false :version "0.1.0" :_options nil
+                   :client nil :options (vs/jm) :liveopts nil
+                   :plugins (vec (or plugins []))
+                   :secretname "apikey" :cache true :sek nil
+                   :exchange nil :refresh "" :cred "" :initerr nil :resolved false
+                   :lock (Object.) :buylock (Object.)})]
+     (swap! fa assoc "init" (fn [ctx options] (init! fa ctx options)))
+     fa)))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/capability.clj

@@ -0,0 +1,84 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/capability.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin.capability
+  "Capabilities (section 11.1).
+
+  A DEPENDENCY IS ON A CAPABILITY, NOT ON A REF - because it is a
+  dependency on something that can do the job, and which instance is doing
+  it is exactly the configuration detail a plugin must not care about.
+
+  But A BINDING IS TO AN INSTANCE, not to a capability, which is what
+  decides behaviour when the bound provider leaves while another match
+  remains."
+  (:require [voxgig.plugin.types :as t]
+            [voxgig.plugin.version :as v]))
+
+(defn match-value
+  "PARTIAL MATCH, RECURSING INTO MAPS (section 11.1).
+
+  Every leaf in the requirement must be present and equal in the
+  capability; keys not mentioned are not checked. Equality is by JSON TYPE
+  as well as value: `transactional: 1` does not satisfy
+  `transactional: true`. CLOJURE NEEDS NO GUARD FOR THAT - `(= true 1)` is
+  false, because Boolean and Long are different classes with no coercion.
+  Python, PHP, Perl and Lua all need one, and `capability/match` pins the
+  behaviour for every port rather than trusting each language's equality.
+
+  A LIST IS COMPARED LEAF-WISE AT THE SAME LENGTH, not as a subset."
+  [want got]
+  (cond
+    (map? want) (and (map? got)
+                     (every? (fn [[k w]] (and (contains? got k) (match-value w (got k))))
+                             want))
+    (sequential? want) (and (sequential? got)
+                            (= (count want) (count got))
+                            (every? identity (map match-value want got)))
+    :else (t/same want got)))
+
+(defn matches? [req prov]
+  (and (= (t/get req "name") (t/get prov "name"))
+       (or (nil? (t/get req "range"))
+           (and (some? (t/get prov "version"))
+                (v/satisfies-q? (t/get prov "version") (t/get req "range"))))
+       ;; `match` is checked against the provider's `attrs`, key by key. A
+       ;; key the provider does not carry is a miss, not a pass: a
+       ;; requirement asking for `transactional: true` must not be
+       ;; satisfied by a provider that never said.
+       (or (nil? (t/get req "match"))
+           (let [attrs (or (t/get prov "attrs") {})]
+             (every? (fn [k] (and (contains? attrs k)
+                                  (match-value (t/get (t/get req "match") k) (attrs k))))
+                     (t/sorted-keys (t/get req "match")))))))
+
+(defn rank-key
+  "An ABSENT version sorts LAST, whatever the other is - \"no version\"
+  loses to every version rather than being read as 0.0.0. The leading flag
+  is what expresses that in a sort KEY rather than a comparator."
+  [cand]
+  (let [prov (or (t/get cand "provides") {})
+        version (t/get prov "version")]
+    [(if (nil? version) 1 0)
+     (if (nil? version) [0 0 0] (mapv - (v/version-parts version)))
+     (or (t/get prov "priority") 0)
+     (or (t/get cand "pos") 0)]))
+
+(defn resolve-capability
+  "Rank the matching live providers and return them best-first: highest
+  `version`, then LOWEST `priority` (default 0), then declaration position
+  `pos` ascending.
+
+  `priority` is a field on the capability rather than section 7's `order`
+  band, because bands live on POINT BINDINGS: a provider may have several
+  bindings with different bands, or none at all, so a rank reaching for
+  one would be undefined in the common case.
+
+  Without a total rank, \"any provider satisfies\" is true of the GRAPH
+  and useless to the PLUGIN - two ports could bind different `store`
+  instances, both resolve green, and behave differently, which is
+  precisely the divergence a shared corpus exists to catch."
+  [req candidates]
+  (->> candidates
+       (filter #(matches? req (or (t/get % "provides") {})))
+       (t/stable-sort-by rank-key)
+       vec))