@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/c/Makefile

@@ -4,24 +4,65 @@
 
 CC ?= gcc
 CFLAGS ?= -std=c11 -Wall -Wextra -Wno-unused-parameter -D_GNU_SOURCE -O0 -g
-INC := -I core -I utility/struct
+# -I feature: a feature's own header (feature/<name>.h), which a suite under
+# tests/feature/<name>/ includes by bare name the way every test includes
+# sdk.h. Then EVERY payload directory two levels under feature/: a feature
+# that carries a vendored library keeps it in feature/<name>/<lib>/, and
+# every quoted include inside such a port is a bare basename resolved
+# through these. Derived from the tree rather than listed, so the Makefile
+# names no feature; harmless when the feature trim has removed the
+# directories (the wildcard is then empty), and a payload's value.h /
+# point.h / types.h shadow nothing: the SDK's own value.h (utility/struct)
+# is reached by its neighbours through the including file's directory,
+# which a quoted include searches before any -I.
+PAYLOAD_DIRS := $(patsubst %/,%,$(wildcard feature/*/*/))
+INC := -I core -I utility/struct -I feature $(addprefix -I ,$(PAYLOAD_DIRS))
 # The vendored omni test runner (tests/vendor/omni) is TEST-ONLY: it is
 # reachable from tests/ alone, never from LIB_SRCS, so it cannot enter the
 # shipped libsdk.a. That is why it lives under tests/ and not utility/.
 OMNI_INC := -I tests -I tests/vendor/omni
+# The test harness headers (ctest.h, feature_harness.h) by bare name, for a
+# suite that lives BELOW tests/ (a gated feature's tests/feature/<name>/
+# suite) and so cannot reach them through its own directory as tests/*.c do.
+TEST_INC := -I tests
 LDLIBS := -lm
 
+# ---- gated feature payloads (model/feature/<name>.aon plugin groups) --------
+#
+# A gated feature's vendored payload sits two levels under feature/
+# (feature/<name>/<lib>/*.c) - out of reach of the feature/*/*.c glob below,
+# and deliberately so. What of it is built is decided by a GENERATED make
+# fragment, feature/<name>/kinds.mk, that Config_c emits beside the
+# feature's generated kinds.c only when the model activates the feature for
+# this target. The fragment appends the payload sources to FEATURE_SRCS, the
+# feature's suite to FEATURE_TEST_SRCS, and - only when a plugin group is
+# active - the plugin layer and the external libraries it brings to LDLIBS.
+# Nothing here names a feature: a tree whose model never activated one
+# carries its payload as inert source (as rust carries a module no parent
+# declares), links libc alone, and a project's `target add` trims it
+# outright. `ldd` on any test binary shows which case this tree is.
+FEATURE_SRCS :=
+FEATURE_TEST_SRCS :=
+-include $(wildcard feature/*/kinds.mk)
+
 # feature/*/*.c: a feature may carry a vendored library payload in its own
 # subdirectory (the station feature vendors voxgig_station there - C has no
 # package registry, so tier-C libraries ride the feature source; see
 # utility/struct/ for the same precedent at the utility level). Empty when
-# no feature ships one.
-LIB_SRCS := $(wildcard core/*.c utility/*.c utility/struct/*.c feature/*.c feature/*/*.c entity/*.c)
+# no feature ships one. A gated feature's own feature/<name>.c is in this
+# glob too and always compiles (its headers are on INC above); without its
+# kinds.mk nothing references it, so the archive member is never pulled
+# into a link.
+LIB_SRCS := $(wildcard core/*.c utility/*.c utility/struct/*.c feature/*.c feature/*/*.c entity/*.c) \
+  $(FEATURE_SRCS)
 LIB_OBJS := $(LIB_SRCS:.c=.o)
 
 # Single-level on purpose: the vendored omni sources under
-# tests/vendor/omni have no main() and must not become test binaries.
-TEST_SRCS := $(wildcard tests/*.c)
+# tests/vendor/omni have no main() and must not become test binaries. A
+# gated feature's suite under tests/feature/<name>/ is added by its
+# generated kinds.mk, so it is only ever built when the feature it links
+# against is wired in.
+TEST_SRCS := $(wildcard tests/*.c) $(FEATURE_TEST_SRCS)
 TEST_BINS := $(TEST_SRCS:.c=.out)
 
 OMNI_SRCS := $(wildcard tests/vendor/omni/*.c)
@@ -36,7 +77,14 @@ build: libsdk.a
 %.o: %.c
 	$(CC) $(CFLAGS) $(INC) -c $< -o $@
 
+# `ar r` REPLACES a member by basename on an archive it finds, and this
+# archive carries duplicate basenames by construction: core/utility.o
+# beside utility/struct/utility.o, and a vendored payload's point.o,
+# config.o and value.o beside core's and utility/struct's. One cold
+# `ar rcs` keeps every member; an incremental one would silently drop
+# whichever came first, so the archive is deleted before it is written.
 libsdk.a: $(LIB_OBJS)
+	@rm -f $@
 	ar rcs $@ $(LIB_OBJS)
 
 # omni's util.c includes <regex.h>. CFLAGS is `?=`, so an operator override
@@ -50,6 +98,7 @@ tests/vendor/omni/%.o: tests/vendor/omni/%.c
 	$(CC) $(CFLAGS) -D_POSIX_C_SOURCE=200809L -D_DARWIN_C_SOURCE -c $< -o $@
 
 libomni.a: $(OMNI_OBJS)
+	@rm -f $@
 	ar rcs $@ $(OMNI_OBJS)
 
 # Only the corpus drivers and the smoke test reach for omni, and the generic
@@ -61,10 +110,10 @@ OMNI_TESTS := tests/struct_corpus_test.out tests/primary_corpus_test.out \
   tests/omni_smoke_test.out
 
 $(OMNI_TESTS): tests/%.out: tests/%.c libsdk.a libomni.a
-	$(CC) $(CFLAGS) $(INC) $(OMNI_INC) $< libsdk.a libomni.a -o $@ $(LDLIBS)
+	$(CC) $(CFLAGS) $(INC) $(TEST_INC) $(OMNI_INC) $< libsdk.a libomni.a -o $@ $(LDLIBS)
 
 tests/%.out: tests/%.c libsdk.a
-	$(CC) $(CFLAGS) $(INC) $< libsdk.a -o $@ $(LDLIBS)
+	$(CC) $(CFLAGS) $(INC) $(TEST_INC) $< libsdk.a -o $@ $(LDLIBS)
 
 # Build and run every test; aggregate pass/fail.
 test: libsdk.a libomni.a
@@ -72,7 +121,7 @@ test: libsdk.a libomni.a
 	for src in $(TEST_SRCS); do \
 	  bin=$${src%.c}.out; \
 	  case " $(OMNI_TESTS) " in *" $$bin "*) omni="libomni.a"; oinc="$(OMNI_INC)";; *) omni=""; oinc="";; esac; \
-	  $(CC) $(CFLAGS) $(INC) $$oinc $$src libsdk.a $$omni -o $$bin $(LDLIBS) || { echo "BUILD FAIL: $$src"; fail=1; continue; }; \
+	  $(CC) $(CFLAGS) $(INC) $(TEST_INC) $$oinc $$src libsdk.a $$omni -o $$bin $(LDLIBS) || { echo "BUILD FAIL: $$src"; fail=1; continue; }; \
 	  total=$$((total+1)); \
 	  if ./$$bin; then :; else echo "TEST FAIL: $$bin"; fail=1; fi; \
 	done; \
@@ -82,7 +131,7 @@ test: libsdk.a libomni.a
 
 clean:
 	rm -f $(LIB_OBJS) libsdk.a $(OMNI_OBJS) libomni.a $(TEST_BINS) tests/*.out \
-	  corpus-scoreboard.json
+	  tests/feature/*/*.out corpus-scoreboard.json
 
 # C has no central registry — publishing IS the git tag.
 VERSION := $(shell cat VERSION 2>/dev/null || echo 0.0.1)

package/project/.sdk/tm/c/core/sdk.h

@@ -448,6 +448,16 @@ voxgig_value* make_config(void);
 voxgig_value* shared_config(void);
 Feature* make_feature(const char* name);
 
+// The plugin DEFINITIONS the model selected for one feature's chain - the c
+// peer of go's core.FeaturePlugins(name). Each entry is a `Definition*` from
+// the vendored voxgig/plugin (feature/secrets/plugin/catalog.h), typed void*
+// here because core/ must never name a gated feature's types: the accessor
+// exists in every generated config.c, and answers *n = 0 / NULL for a
+// feature with no plugins or an SDK that never selected the feature. A
+// feature casts the array back at the one place it hands the list to the
+// vendored library.
+void** feature_plugins(const char* name, size_t* n);
+
 // ===========================================================================
 // Utility builder prototypes (utility/*.c). Fallible ones take PNError** err.
 // ===========================================================================

package/project/.sdk/tm/c/feature/secrets/plugin/capability.c

@@ -0,0 +1,133 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/capability.c)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Capabilities (§11.1). */
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "capability.h"
+#include "version.h"
+
+bool capmatchvalue(Value *want, Value *got) {
+  /* THIS FUNCTION IS WHAT "EVERY LEAF" MEANS, and an earlier draft of
+   * the canonical did not have it: the check was a scalar compare,
+   * which for any compound value is reference identity in JavaScript. A
+   * requirement and a capability are declared in different places and
+   * are never the same object, so `match: {limits: {max: 5}}` could not
+   * be satisfied by ANY provider — including one declaring exactly
+   * that. Invisible while every corpus entry is scalar, which is why
+   * the go port found it and P2 did not. */
+  if (vismap(want)) {
+    if (!vismap(got)) return false;
+    const char **keys;
+    size_t n = vkeys(want, &keys);
+    for (size_t i = 0; i < n; i++) {
+      if (!vhas(got, keys[i])) return false;
+      if (!capmatchvalue(vget(want, keys[i]), vget(got, keys[i]))) return false;
+    }
+    return true;
+  }
+  if (vislist(want)) {
+    if (!vislist(got) || vlen(want) != vlen(got)) return false;
+    for (size_t i = 0; i < vlen(want); i++) {
+      if (!capmatchvalue(vat(want, i), vat(got, i))) return false;
+    }
+    return true;
+  }
+  return vsame(want, got);
+}
+
+bool capmatches(Value *req, Value *prov) {
+  Value *rname = vget(req, "name");
+  Value *pname = vget(prov, "name");
+  if (!vsame(rname, pname)) return false;
+
+  Value *range = vget(req, "range");
+  if (!visnull(range)) {
+    Value *version = vget(prov, "version");
+    if (visnull(version)) return false;
+    if (!satisfiesq(version, range)) return false;
+  }
+
+  /* `match` is checked against the provider's `attrs`, key by key. A
+   * key the provider does not carry is a MISS, not a pass: a
+   * requirement asking for `transactional: true` must not be satisfied
+   * by a provider that never said. */
+  Value *match = vget(req, "match");
+  if (!visnull(match)) {
+    Value *attrs = vget(prov, "attrs");
+    if (visnull(attrs)) attrs = vmap();
+    const char **keys;
+    size_t n = vkeys(match, &keys);
+    for (size_t i = 0; i < n; i++) {
+      if (!vhas(attrs, keys[i])) return false;
+      if (!capmatchvalue(vget(match, keys[i]), vget(attrs, keys[i]))) {
+        return false;
+      }
+    }
+  }
+
+  return true;
+}
+
+/* The rank, as a comparison over two candidates. Ordering is a total
+ * rank on purpose: without one, "any provider satisfies" is true of the
+ * GRAPH and useless to the PLUGIN — two ports could bind different
+ * `store` instances, both resolve green, and behave differently, which
+ * is precisely the divergence a shared corpus exists to catch. */
+static int rank(const void *pa, const void *pb) {
+  Value *a = *(Value *const *)pa;
+  Value *b = *(Value *const *)pb;
+  Value *ap = vget(a, "provides");
+  Value *bp = vget(b, "provides");
+
+  Value *av = vget(ap, "version");
+  Value *bv = vget(bp, "version");
+  bool ahas = !visnull(av), bhas = !visnull(bv);
+  if (ahas != bhas) return ahas ? -1 : 1;   /* a version beats none */
+  if (ahas && bhas) {
+    /* HIGHEST version first, so the comparison is reversed. */
+    CatchFrame f;
+    int c = 0;
+    if (0 == PLUGIN_TRY(&f)) {
+      c = vercmp(parseversion(bv), parseversion(av));
+      PLUGIN_END(&f);
+    }
+    else {
+      c = 0;
+    }
+    if (0 != c) return c;
+  }
+
+  double apri = visnum(vget(ap, "priority")) ? vasnum(vget(ap, "priority")) : 0.0;
+  double bpri = visnum(vget(bp, "priority")) ? vasnum(vget(bp, "priority")) : 0.0;
+  if (apri != bpri) return apri < bpri ? -1 : 1;   /* LOWEST priority first */
+
+  double apos = visnum(vget(a, "pos")) ? vasnum(vget(a, "pos")) : 0.0;
+  double bpos = visnum(vget(b, "pos")) ? vasnum(vget(b, "pos")) : 0.0;
+  if (apos != bpos) return apos < bpos ? -1 : 1;
+  return 0;
+}
+
+Value *resolvecapability(Value *req, Value *candidates) {
+  size_t n = vlen(candidates);
+  Value **hits = (Value **)arena_alloc(sizeof(Value *) * (n + 1));
+  size_t count = 0;
+  for (size_t i = 0; i < n; i++) {
+    Value *c = vat(candidates, i);
+    if (capmatches(req, vget(c, "provides"))) hits[count++] = c;
+  }
+
+  /* A STABLE SORT. `qsort` is not stable, and §6.3's tie rules make the
+   * order observable — so `rank` is a TOTAL order (it falls through to
+   * `pos`, which is unique) and stability is not relied on. An earlier
+   * reading that stopped at `priority` would have left ties to qsort's
+   * discretion, which is exactly the per-port divergence the ranking
+   * exists to remove. */
+  if (1 < count) qsort(hits, count, sizeof(Value *), rank);
+
+  Value *out = vlist();
+  for (size_t i = 0; i < count; i++) vpush(out, hits[i]);
+  return out;
+}

package/project/.sdk/tm/c/feature/secrets/plugin/capability.h

@@ -0,0 +1,39 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/capability.h)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Capabilities (§11.1).
+ *
+ * A DEPENDENCY IS ON A CAPABILITY, NOT ON A REF — because it is a
+ * dependency on something that can do the job, and which instance is
+ * doing it is exactly the configuration detail a plugin must not care
+ * about. (§11.1 makes one narrow exception for a ref, and `host.c`
+ * implements it; the ranking here is capabilities only.)
+ *
+ * But A BINDING IS TO AN INSTANCE, not to a capability, which is what
+ * decides behaviour when the bound provider leaves while another match
+ * remains. */
+
+#ifndef VOXGIG_PLUGIN_CAPABILITY_H
+#define VOXGIG_PLUGIN_CAPABILITY_H
+
+#include <stdbool.h>
+
+#include "types.h"
+#include "value.h"
+
+/* Rank the matching providers best-first: highest `version`, then
+ * LOWEST `priority` (default 0), then declaration position `pos`
+ * ascending. `candidates` is a list of {ref, pos, provides}. */
+Value *resolvecapability(Value *req, Value *candidates);
+
+/* Does one provider satisfy one requirement? */
+bool capmatches(Value *req, Value *prov);
+
+/* PARTIAL MATCH, RECURSING INTO MAPS (§11.1): every leaf in the
+ * requirement must be present and equal in the capability, keys not
+ * mentioned are not checked. A LIST IS COMPARED LEAF-WISE AT THE SAME
+ * LENGTH, not as a subset — "the first two of your three regions" is
+ * not something `match` can say. */
+bool capmatchvalue(Value *want, Value *got);
+
+#endif

package/project/.sdk/tm/c/feature/secrets/plugin/catalog.c

@@ -0,0 +1,83 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/catalog.c)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The definition catalog (§10.1). */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "catalog.h"
+#include "config.h"
+#include "ref.h"
+
+typedef struct CatEntry {
+  const char *name;
+  Definition *def;
+  struct CatEntry *next;
+} CatEntry;
+
+struct Catalog {
+  CatEntry *first;
+};
+
+Catalog *makecatalog(void) {
+  Catalog *c = (Catalog *)arena_alloc(sizeof(Catalog));
+  c->first = NULL;
+  return c;
+}
+
+void catalog_add(Catalog *c, Definition *def) {
+  if (NULL == def || !checkname(vstr(NULL == def->name ? "" : def->name))) {
+    const char *shown = (NULL == def || NULL == def->name) ? "" : def->name;
+    size_t sz = strlen(shown) + 48;
+    char *text = (char *)arena_alloc(sz);
+    snprintf(text, sz, "invalid definition name: %s", shown);
+    fail("plugin_definition_name", text, NULL);
+  }
+
+  /* Validate the shape HERE. Deferring it to resolution time means a
+   * malformed shape surfaces at a different moment in every host that
+   * loads it, which is the divergence the stated domain exists to
+   * prevent. */
+  if (!visnull(def->shape)) checkshape(def->shape);
+
+  for (CatEntry *e = c->first; NULL != e; e = e->next) {
+    if (0 == strcmp(e->name, def->name)) { e->def = def; return; }
+  }
+  CatEntry *e = (CatEntry *)arena_alloc(sizeof(CatEntry));
+  e->name = arena_strdup(def->name);
+  e->def = def;
+  e->next = c->first;
+  c->first = e;
+}
+
+Definition *catalog_get(Catalog *c, const char *name) {
+  if (NULL == c || NULL == name) return NULL;
+  for (CatEntry *e = c->first; NULL != e; e = e->next) {
+    if (0 == strcmp(e->name, name)) return e->def;
+  }
+  return NULL;
+}
+
+bool catalog_has(Catalog *c, const char *name) {
+  return NULL != catalog_get(c, name);
+}
+
+Value *catalog_names(Catalog *c) {
+  Value *m = vmap();
+  for (CatEntry *e = c->first; NULL != e; e = e->next) vset(m, e->name, vbool(true));
+  const char **keys;
+  size_t n = vsortedkeys(m, &keys);
+  Value *out = vlist();
+  for (size_t i = 0; i < n; i++) vpush(out, vstr(keys[i]));
+  return out;
+}
+
+LifecycleFn definition_callback(Definition *d, const char *at) {
+  if (NULL == d) return NULL;
+  if (0 == strcmp(at, "define")) return d->define;
+  if (0 == strcmp(at, "activate")) return d->activate;
+  if (0 == strcmp(at, "deactivate")) return d->deactivate;
+  if (0 == strcmp(at, "close")) return d->close;
+  return NULL;
+}

package/project/.sdk/tm/c/feature/secrets/plugin/catalog.h

@@ -0,0 +1,48 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/catalog.h)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The definition catalog (§10.1).
+ *
+ * A definition is registered once and may back many instances. Option
+ * shapes are validated AT REGISTRATION, not when a document happens to
+ * exercise a key — so a malformed shape fails once, and in the same
+ * place everywhere (§9.4). `declare/shape` pins that timing. */
+
+#ifndef VOXGIG_PLUGIN_CATALOG_H
+#define VOXGIG_PLUGIN_CATALOG_H
+
+#include <stdbool.h>
+
+#include "types.h"
+#include "value.h"
+
+typedef struct Inst Inst;
+
+/* A DEFINITION IS DATA WITH FUNCTIONS IN IT, not a class to extend. A
+ * document could produce one, which is the property that makes a
+ * catalog a data structure rather than a compile-time registry. */
+typedef void (*LifecycleFn)(Inst *inst);
+typedef void (*ReconfigureFn)(Inst *inst, Value *now, Value *previous);
+
+typedef struct Definition {
+  const char *name;
+  Value *shape;
+  LifecycleFn define;
+  LifecycleFn activate;
+  LifecycleFn deactivate;
+  LifecycleFn close;
+  ReconfigureFn reconfigure;
+} Definition;
+
+typedef struct Catalog Catalog;
+
+Catalog *makecatalog(void);
+void catalog_add(Catalog *c, Definition *def);
+Definition *catalog_get(Catalog *c, const char *name);
+bool catalog_has(Catalog *c, const char *name);
+Value *catalog_names(Catalog *c);
+
+/* The callback for a phase, by the name the log and the corpus use. */
+LifecycleFn definition_callback(Definition *d, const char *at);
+
+#endif