@voxgig/sdkgen-langpack 0.0.1

package/.sdk/tm/dart/lib/feature/secrets/plugin/env.dart

@@ -0,0 +1,144 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (dart/lib/env.dart)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/// Environment overrides (section 9.5) - level 7 of the ladder.
+///
+/// One prefix, so nothing drifts: `VOXGIG_PLUGIN_*`.
+///
+///   VOXGIG_PLUGIN_PROFILE            the profile name
+///   VOXGIG_PLUGIN_<REF>_<PATH>       one option
+///   VOXGIG_PLUGIN_ACTIVE/INACTIVE    comma-separated refs, INACTIVE wins
+///
+/// THE ENCODING IS LOSSY, AND THIS SAYS SO RATHER THAN PRETENDING
+/// OTHERWISE. Ref and path are upper-snake with `$` -> `__` and `.` -> `_`.
+/// But `_` is legal in a name and in a tag, and the mapping folds case, so
+/// `retry$fast` and `retry__fast` both encode to `RETRY__FAST`.
+///
+/// Rather than restrict a grammar the rest of the stack already uses, the
+/// host DETECTS THE COLLISION: it encodes every ref it holds, and a key two
+/// refs claim is `plugin_env_ambiguous`, naming both.
+library;
+
+import 'dart:convert';
+
+import 'types.dart' as t;
+import 'ref.dart' as r;
+
+const envPrefix = 'VOXGIG_PLUGIN_';
+
+/// `retry$fast` -> `RETRY__FAST`.
+String encodeRef(String ref) =>
+    ref.replaceAll(r'$', '__').replaceAll('.', '_').toUpperCase();
+
+/// Values parse as JSON, FALLING BACK TO STRING - so `8080` is a number,
+/// `true` is a boolean, `{"a":1}` is a map, and `hello` is the string it
+/// looks like rather than a parse error. `dart:convert` is the SDK's own
+/// library, not a package: section 16 bars a `pubspec.yaml` dependency
+/// list, which this port does not have.
+dynamic _parseValue(dynamic value) {
+  try {
+    return jsonDecode(value as String);
+  } catch (_) {
+    return value;
+  }
+}
+
+List<String> _split(dynamic value) => '$value'
+    .split(',')
+    .map((s) => s.trim())
+    .where((s) => s.isNotEmpty)
+    .toList();
+
+void _checkReserved(String ref, List reserved) {
+  if (!reserved.contains(r.refName(ref))) return;
+  t.fail('plugin_ref_reserved', 'ref is reserved by the host: $ref',
+      {'ref': ref});
+}
+
+Map<String, dynamic> applyEnv(dynamic input) {
+  final env = t.get(input, 'env') ?? {};
+  final refs = ((t.get(input, 'refs') ?? []) as List).map(r.canonRef).toList();
+  final reserved = (t.get(input, 'reserved') ?? []) as List;
+  final out = <String, dynamic>{
+    'options': <String, dynamic>{},
+    'active': <String>[],
+    'inactive': <String>[]
+  };
+
+  // Encode every ref the host holds, and refuse a key that two of them
+  // claim. Done up front so the collision is reported even when no
+  // environment variable exercises it - a latent ambiguity is still an
+  // ambiguity, and finding it at deploy time is the failure this exists to
+  // prevent.
+  final byencoded = <String, List<String>>{};
+  for (final ref in refs) {
+    byencoded.putIfAbsent(encodeRef(ref), () => []).add(ref);
+  }
+  for (final e in t.sortedKeys(byencoded)) {
+    if (byencoded[e]!.length <= 1) continue;
+    final pair = List<String>.from(byencoded[e]!)..sort();
+    t.fail(
+        'plugin_env_ambiguous',
+        'refs collide in the environment encoding as $e: ${pair.join(', ')}',
+        {'encoded': e, 'refs': pair});
+  }
+
+  // Longest encoded ref first, so `retry$fast` wins over `retry` on
+  // `RETRY__FAST_MIN`. Shortest-first would read the tag as a path.
+  final encoded =
+      t.stableSortBy(t.sortedKeys(byencoded), (e) => [-e.length]);
+
+  for (final key in t.sortedKeys(env)) {
+    if (!key.startsWith(envPrefix)) continue;
+    final rest = key.substring(envPrefix.length);
+
+    if (rest == 'PROFILE') {
+      out['profile'] = t.get(env, key);
+      continue;
+    }
+
+    if (rest == 'ACTIVE' || rest == 'INACTIVE') {
+      for (final raw in _split(t.get(env, key))) {
+        final ref = r.canonRef(raw);
+        // The reservation covers EVERY input layer (section 9.1).
+        // VOXGIG_PLUGIN_INACTIVE=station is easier to set than editing a
+        // config file, and INACTIVE has the final word - so guarding
+        // documents alone would leave the one lever this mechanism exists
+        // to deny wide open.
+        _checkReserved(ref, reserved);
+        (out[rest == 'ACTIVE' ? 'active' : 'inactive'] as List).add(ref);
+      }
+      continue;
+    }
+
+    final enc = encoded
+        .where((e) => rest == e || rest.startsWith('${e}_'))
+        .firstOrNull;
+    if (enc == null) continue; // not for any ref this host holds
+
+    final ref = byencoded[enc]![0];
+    _checkReserved(ref, reserved);
+
+    if (rest == enc) continue; // a ref with no path sets nothing
+
+    final path = rest.substring(enc.length + 1).toLowerCase().split('_');
+
+    final options = out['options'] as Map<String, dynamic>;
+    var node = options[ref];
+    if (node is! Map) {
+      node = <String, dynamic>{};
+      options[ref] = node;
+    }
+    for (var i = 0; i < path.length - 1; i++) {
+      var child = (node as Map)[path[i]];
+      if (child is! Map) {
+        child = <String, dynamic>{};
+        node[path[i]] = child;
+      }
+      node = child;
+    }
+    (node as Map)[path[path.length - 1]] = _parseValue(t.get(env, key));
+  }
+
+  return out;
+}

package/.sdk/tm/dart/lib/feature/secrets/plugin/export.dart

@@ -0,0 +1,58 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (dart/lib/export.dart)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/// Exports (section 11).
+///
+/// An instance publishes values for other plugins and for the application.
+/// Read with `host.exports('retry$fast/client')`.
+///
+/// THE UNQUALIFIED ALIAS IS THE INTERESTING PART. `retry/client` resolves
+/// to the UNTAGGED instance if one exists; if not, and exactly one tagged
+/// instance exports that key, it resolves to that one; if two do, it is
+/// `plugin_export_ambiguous` - deliberately diverging from seneca's silent
+/// last-wins, because with multi-instance as a headline feature an
+/// ambiguous alias is a defect waiting for production.
+library;
+
+import 'types.dart' as t;
+import 'ref.dart' as r;
+
+/// One published value. An internal shape, never a corpus value.
+class Exported {
+  final String ref;
+  final String key;
+  final dynamic value;
+  Exported(this.ref, this.key, this.value);
+}
+
+dynamic resolveExport(String spec, List<Exported> exported) {
+  final cut = spec.indexOf('/');
+  if (cut < 0) {
+    t.fail('plugin_export_ambiguous', 'export spec needs a key: $spec',
+        {'spec': spec});
+  }
+  final head = spec.substring(0, cut);
+  final key = spec.substring(cut + 1);
+
+  // A fully qualified ref: exactly one answer or none.
+  final want = r.canon(head);
+  for (final e in exported) {
+    if (e.ref == want && e.key == key) return e.value;
+  }
+
+  // An alias: the name, not a ref. Look at every instance of it.
+  final byname =
+      exported.where((e) => r.refName(e.ref) == head && e.key == key).toList();
+  if (byname.isEmpty) return null;
+
+  for (final e in byname) {
+    if ((r.parseRef(e.ref)['tag'] as String).isEmpty) return e.value;
+  }
+  if (byname.length == 1) return byname[0].value;
+
+  final refs = byname.map((e) => e.ref).toList()..sort();
+  t.fail(
+      'plugin_export_ambiguous',
+      'alias $spec matches ${refs.length} instances: ${refs.join(', ')}',
+      {'spec': spec, 'refs': refs});
+}

package/.sdk/tm/dart/lib/feature/secrets/plugin/graph.dart

@@ -0,0 +1,160 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (dart/lib/graph.dart)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/// Whole-graph resolution (section 11.4) - a phase, not a discovery.
+///
+/// "Activate, and wait in `pending` if you must" is correct and, on its own,
+/// produces a terrible experience: apply twenty instances against a registry
+/// missing one thing and you get NINETEEN pending rows and no statement of
+/// what is actually wrong.
+///
+/// `resolveGraph` is a PURE FUNCTION of the registry and the intended
+/// activation set. No callbacks run, no state changes, nothing is touched.
+/// It answers for the whole graph at once which instances can be live, and
+/// for each blocked one THE SPECIFIC REQUIREMENT that is unmet, and why.
+///
+/// The failure mode being designed against is a famous one: OSGi's resolver
+/// is correct and its diagnostics are legendarily unusable. A resolver that
+/// says "blocked" without saying WHY has moved the problem rather than
+/// solved it, so `why` is part of the contract and the corpus pins its
+/// shape.
+library;
+
+import 'types.dart' as t;
+import 'ref.dart' as r;
+import 'capability.dart' as cap;
+import 'version.dart' as v;
+
+Map<String, dynamic> resolveGraph(dynamic nodes) {
+  final byref = <String, dynamic>{};
+  for (final n in nodes as List) {
+    byref[t.get(n, 'ref') as String] = n;
+  }
+
+  final resolved = <String>{};
+
+  // Fixed point: a node resolves when every mandatory requirement is met by
+  // an ALREADY-RESOLVED provider. Iterating to a fixed point is what makes a
+  // provider that is itself blocked propagate, rather than each node being
+  // judged against the raw registry.
+  var moved = true;
+  while (moved) {
+    moved = false;
+    for (final n in nodes) {
+      final ref = t.get(n, 'ref') as String;
+      if (resolved.contains(ref)) continue;
+      if (firstUnmet(n, byref, resolved) != null) continue;
+      resolved.add(ref);
+      moved = true;
+    }
+  }
+
+  final blocked = <String, dynamic>{};
+  for (final n in nodes) {
+    final ref = t.get(n, 'ref') as String;
+    if (resolved.contains(ref)) continue;
+    final why = firstUnmet(n, byref, resolved);
+    if (why != null) blocked[ref] = why;
+  }
+
+  return {
+    'resolved': resolved.toList()..sort(),
+    'blocked': (blocked.keys.toList()..sort()).map((r) => blocked[r]).toList(),
+  };
+}
+
+/// The FIRST unmet requirement, with the most specific explanation
+/// available. Order matters: "no provider at all" and "a provider at the
+/// wrong version" are different problems and a reader must not have to guess
+/// which they have.
+Map<String, dynamic>? firstUnmet(
+    dynamic node, Map<String, dynamic> byref, Set<String> resolved) {
+  for (final req in (t.get(node, 'requires') ?? []) as List) {
+    if (t.truthy(t.get(req, 'optional'))) continue;
+    final name = t.get(req, 'name') as String;
+
+    final all = graphCandidates(byref, name);
+    if (all.isEmpty) return _why(node, name, {'kind': 'absent'});
+
+    final ok = cap.resolveCapability(req, all);
+    if (ok.isNotEmpty) {
+      // A provider exists and matches - but if none of them is itself
+      // resolved, this node is blocked BEHIND it, and the chain is the
+      // useful answer rather than "unmet".
+      if (ok.any((c) => resolved.contains(t.get(c, 'ref')))) continue;
+      final chain = ok.map((c) => t.get(c, 'ref') as String).toList()..sort();
+      return _why(node, name, {'kind': 'blocked', 'chain': chain});
+    }
+
+    // Providers exist and none matched. Say which test failed.
+    final range = t.get(req, 'range');
+    if (range != null) {
+      final versions = all
+          .map((c) => t.get(t.get(c, 'provides'), 'version'))
+          .where((ver) => ver == null || !v.satisfiesq(ver, range))
+          .map((ver) => (ver ?? '(none)') as String)
+          .toList();
+      if (versions.isNotEmpty) {
+        return _why(node, name,
+            {'kind': 'version', 'range': range, 'found': versions..sort()});
+      }
+    }
+
+    final match = t.get(req, 'match');
+    if (match != null) {
+      for (final c in all) {
+        final attrs = t.get(t.get(c, 'provides'), 'attrs') ?? {};
+        for (final k in t.sortedKeys(match)) {
+          if (t.has(attrs, k) &&
+              cap.matchValue(t.get(match, k), t.get(attrs, k))) {
+            continue;
+          }
+          return _why(node, name, {
+            'kind': 'match',
+            'failing': k,
+            'want': t.get(match, k),
+            'found': t.get(attrs, k)
+          });
+        }
+      }
+    }
+
+    return _why(node, name, {'kind': 'absent'});
+  }
+  return null;
+}
+
+Map<String, dynamic> _why(dynamic node, String name, dynamic reason) =>
+    {'ref': t.get(node, 'ref'), 'unmet': name, 'why': reason};
+
+List<dynamic> graphCandidates(Map<String, dynamic> byref, String name) {
+  final out = <dynamic>[];
+  // A NODE SATISFIES ITS OWN REF (section 11.1), and the graph learned it
+  // here. Considering only declared capabilities made `resolve` answer
+  // `absent` about a provider sitting right there and live - section
+  // 11.4's job is explaining the graph the runtime reconciles, and it was
+  // explaining a different one.
+  final asref = r.canon(name);
+  for (final ref in t.sortedKeys(byref)) {
+    final node = byref[ref];
+    // The ref match WINS OUTRIGHT for that node, as at runtime: one
+    // candidate, not two, for a node both named `b` and providing `b`.
+    if (ref == asref) {
+      out.add({
+        'ref': t.get(node, 'ref'),
+        'pos': t.get(node, 'pos') ?? 0,
+        'provides': {'name': name}
+      });
+      continue;
+    }
+    for (final prov in (t.get(node, 'provides') ?? []) as List) {
+      if (t.get(prov, 'name') != name) continue;
+      out.add({
+        'ref': t.get(node, 'ref'),
+        'pos': t.get(node, 'pos') ?? 0,
+        'provides': prov
+      });
+    }
+  }
+  return out;
+}