@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/c/feature/secrets/plugin/depend.c

@@ -0,0 +1,264 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/depend.c)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Dependency cardinality, policy, and the restart graph (§11.3).
+ *
+ * TWO AXES, BOTH DECLARED BY THE DEFINITION THAT HAS THE REQUIREMENT,
+ * because only it knows what it can cope with:
+ *
+ *                | static (default)          | dynamic
+ *   -------------|---------------------------|--------------------------
+ *   mandatory    | unmet -> pending;         | unmet -> pending;
+ *   (default)    | lost  -> pending,         | lost  -> STAYS LIVE,
+ *                |          recursively      |          notified
+ *   -------------|---------------------------|--------------------------
+ *   optional:true| never gates activation;   | never gates activation;
+ *                | a change deactivates and  | a change is a
+ *                | reactivates               | notification, nothing else
+ *
+ * `dynamic` means the plugin has said, IN WRITING, that it can survive
+ * its provider being swapped underneath it. It is not the default
+ * because most plugins cannot, and the cost of wrongly assuming they
+ * can is a live instance holding a dead reference. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "depend.h"
+#include "ref.h"
+
+/* A bare string is shorthand for `{name}`. */
+Value *normrequire(Value *r) {
+  if (visstr(r)) {
+    Value *out = vmap();
+    vset(out, "name", r);
+    return out;
+  }
+  return vismap(r) ? r : vmap();
+}
+
+/* BOTH AXES ARE READ AT TWO LEVELS, AND THE PER-REQUIREMENT ONE WINS.
+ *
+ * The instance-level `policy` and `optional` list are how a DOCUMENT
+ * states the axis without editing the definition, and they apply to
+ * every requirement. The per-requirement form is strictly more
+ * expressive: an instance that is `static` on its store and `dynamic`
+ * on its metrics cannot be written at all at the instance level, and
+ * that is the ordinary case rather than an exotic one.
+ *
+ * `optional` UNIONS rather than overriding — both spellings say this
+ * requirement need not gate activation, and there is no reading under
+ * which one of them means "actually, mandatory". */
+Value *requirements(Value *options) {
+  Value *raw = vget(options, "requires");
+  Value *marked = vget(options, "optional");
+  Value *fallback = vget(options, "policy");
+
+  Value *out = vlist();
+  for (size_t i = 0; i < vlen(raw); i++) {
+    Value *r = normrequire(vat(raw, i));
+    Value *o = vmap();
+    const char **keys;
+    size_t n = vkeys(r, &keys);
+    for (size_t j = 0; j < n; j++) vset(o, keys[j], vget(r, keys[j]));
+
+    bool opt = vtruthy(vget(r, "optional"));
+    if (!opt && vislist(marked)) {
+      for (size_t j = 0; j < vlen(marked); j++) {
+        if (vsame(vat(marked, j), vget(r, "name"))) { opt = true; break; }
+      }
+    }
+    if (opt) vset(o, "optional", vbool(true));
+
+    if (visnull(vget(o, "policy")) && !visnull(fallback)) {
+      vset(o, "policy", fallback);
+    }
+    vpush(out, o);
+  }
+  return out;
+}
+
+/* Does losing this requirement's SELECTED provider restart the
+ * consumer? The mandatory ones under `static`, and the `static`
+ * optional ones — both make a capability change deactivate and
+ * reactivate. `dynamic` never restarts. */
+bool restartsonloss(Value *r) {
+  Value *p = vget(r, "policy");
+  const char *policy = visstr(p) ? vasstr(p) : "static";
+  return 0 != strcmp(policy, "dynamic");
+}
+
+/* Does an unmet requirement keep the consumer out of `live`?
+ *
+ * CARDINALITY ALONE DECIDES THIS, NOT POLICY. `dynamic` is a statement
+ * about surviving a SWAP, not about starting without the thing at all —
+ * a mandatory-dynamic consumer still waits in `pending` for its first
+ * provider. Conflating the two would let a plugin that declared it can
+ * cope with replacement activate with nothing to call. */
+bool gatesactivation(Value *r) {
+  return true != vasbool(vget(r, "optional"));
+}
+
+/* Edges that can cause a restart, which is exactly the set a cycle must
+ * be detected over (§11.3): the mandatory requirements AND THE `static`
+ * OPTIONAL ONES, because both make a capability change deactivate and
+ * reactivate the consumer — and a cycle of restarts does not settle.
+ *
+ * ONLY `dynamic` OPTIONAL EDGES ARE EXCLUDED, and they are the ones the
+ * exclusion was for. An earlier draft of §11.3 excluded EVERY optional
+ * edge and thereby admitted the non-terminating case it was trying to
+ * permit. */
+bool restartcausing(Value *r) {
+  return gatesactivation(r) || restartsonloss(r);
+}
+
+static int bytewise(const void *a, const void *b) {
+  return strcmp(*(const char *const *)a, *(const char *const *)b);
+}
+
+static bool listhas(Value *l, const char *s) {
+  for (size_t i = 0; i < vlen(l); i++) {
+    if (0 == strcmp(vasstr(vat(l, i)), s)) return true;
+  }
+  return false;
+}
+
+Value *dependencycycle(Value *nodes) {
+  /* TWO INDEXES, NOT ONE MERGED MAP. Capability names and refs are
+   * matched differently — a capability by its exact name, a ref through
+   * the canonical spelling (§4 rule 5) — and one map keyed by both can
+   * only do one of them. Keyed by both and looked up raw, a cycle
+   * spelled `a$`/`b$` finds no providers and EVADES the load-time check
+   * that exists to catch a non-terminating reconcile. */
+  Value *bycap = vmap();
+  Value *isref = vmap();
+  for (size_t i = 0; i < vlen(nodes); i++) {
+    Value *n = vat(nodes, i);
+    const char *nref = vasstr(vget(n, "ref"));
+    vset(isref, nref, vbool(true));
+    Value *provides = vget(n, "provides");
+    for (size_t j = 0; j < vlen(provides); j++) {
+      const char *cap = vasstr(vat(provides, j));
+      Value *l = vget(bycap, cap);
+      if (visnull(l)) { l = vlist(); vset(bycap, cap, l); }
+      vpush(l, vstr(nref));
+    }
+  }
+
+  Value *edges = vmap();
+  for (size_t i = 0; i < vlen(nodes); i++) {
+    Value *n = vat(nodes, i);
+    const char *nref = vasstr(vget(n, "ref"));
+    Value *out = vlist();
+    Value *reqs = vget(n, "requires");
+    for (size_t j = 0; j < vlen(reqs); j++) {
+      Value *r = vat(reqs, j);
+      if (!restartcausing(r)) continue;
+      const char *rname = visstr(vget(r, "name")) ? vasstr(vget(r, "name")) : "";
+      Value *from = vlist();
+      Value *caps = vget(bycap, rname);
+      for (size_t k = 0; k < vlen(caps); k++) vpush(from, vat(caps, k));
+      /* A node satisfies its own name AS A REF (§11.1), canonically —
+       * exactly what `providersof` does at runtime, so the load-time
+       * graph and the running one agree about what an edge is. */
+      const char *asref = tryref(rname);
+      if (NULL != asref && vhas(isref, asref) && !listhas(from, asref)) {
+        vpush(from, vstr(asref));
+      }
+      for (size_t k = 0; k < vlen(from); k++) {
+        const char *p = vasstr(vat(from, k));
+        if (0 != strcmp(p, nref) && !listhas(out, p)) vpush(out, vstr(p));
+      }
+    }
+    size_t on = vlen(out);
+    const char **sorted = (const char **)arena_alloc(sizeof(char *) * (on + 1));
+    for (size_t k = 0; k < on; k++) sorted[k] = vasstr(vat(out, k));
+    if (1 < on) qsort((void *)sorted, on, sizeof(char *), bytewise);
+    Value *sortedlist = vlist();
+    for (size_t k = 0; k < on; k++) vpush(sortedlist, vstr(sorted[k]));
+    vset(edges, nref, sortedlist);
+  }
+
+  /* Iterative DFS with an explicit stack: twenty ports, and several of
+   * them have no recursion budget worth relying on. */
+  enum { WHITE = 0, GREY = 1, BLACK = 2 };
+  Value *colour = vmap();
+  for (size_t i = 0; i < vlen(nodes); i++) {
+    vset(colour, vasstr(vget(vat(nodes, i), "ref")), vnum(WHITE));
+  }
+
+  const char **starts;
+  size_t sn = vsortedkeys(edges, &starts);
+  for (size_t si = 0; si < sn; si++) {
+    if (WHITE != (int)vasnum(vget(colour, starts[si]))) continue;
+
+    Value *path = vlist();
+    /* stack of {ref, i} */
+    Value *stack = vlist();
+    Value *frame = vmap();
+    vset(frame, "ref", vstr(starts[si]));
+    vset(frame, "i", vnum(0));
+    vpush(stack, frame);
+    vset(colour, starts[si], vnum(GREY));
+    vpush(path, vstr(starts[si]));
+
+    while (0 < vlen(stack)) {
+      Value *top = vat(stack, vlen(stack) - 1);
+      const char *tref = vasstr(vget(top, "ref"));
+      size_t idx = (size_t)vasnum(vget(top, "i"));
+      Value *tos = vget(edges, tref);
+
+      if (idx >= vlen(tos)) {
+        vset(colour, tref, vnum(BLACK));
+        Value *popped = vlist();
+        for (size_t k = 0; k + 1 < vlen(stack); k++) vpush(popped, vat(stack, k));
+        stack = popped;
+        Value *shorter = vlist();
+        for (size_t k = 0; k + 1 < vlen(path); k++) vpush(shorter, vat(path, k));
+        path = shorter;
+        continue;
+      }
+
+      vset(top, "i", vnum((double)(idx + 1)));
+      const char *next = vasstr(vat(tos, idx));
+      int c = (int)vasnum(vget(colour, next));
+
+      if (GREY == c) {
+        /* Report the cycle itself, not the walk that found it. */
+        Value *cycle = vlist();
+        bool started = false;
+        for (size_t k = 0; k < vlen(path); k++) {
+          if (!started && 0 == strcmp(vasstr(vat(path, k)), next)) started = true;
+          if (started) vpush(cycle, vat(path, k));
+        }
+        vpush(cycle, vstr(next));
+        return cycle;
+      }
+      if (BLACK == c) continue;
+
+      vset(colour, next, vnum(GREY));
+      vpush(path, vstr(next));
+      Value *nf = vmap();
+      vset(nf, "ref", vstr(next));
+      vset(nf, "i", vnum(0));
+      vpush(stack, nf);
+    }
+  }
+
+  return NULL;
+}
+
+void checkcycle(Value *nodes) {
+  Value *cycle = dependencycycle(nodes);
+  if (NULL == cycle) return;
+  size_t sz = 64;
+  for (size_t i = 0; i < vlen(cycle); i++) sz += strlen(vasstr(vat(cycle, i))) + 6;
+  char *text = (char *)arena_alloc(sz);
+  size_t used = (size_t)snprintf(text, sz, "requirements cycle: ");
+  for (size_t i = 0; i < vlen(cycle); i++) {
+    used += (size_t)snprintf(text + used, sz - used, "%s%s",
+                             0 < i ? " -> " : "", vasstr(vat(cycle, i)));
+  }
+  fail("plugin_dependency_cycle", text, details1("cycle", cycle));
+}

package/project/.sdk/tm/c/feature/secrets/plugin/depend.h

@@ -0,0 +1,29 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/depend.h)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Dependency cardinality, policy, and the restart graph (§11.3). Two
+ * axes, both declared by the definition that has the requirement,
+ * because only it knows what it can cope with. See depend.c. */
+
+#ifndef VOXGIG_PLUGIN_DEPEND_H
+#define VOXGIG_PLUGIN_DEPEND_H
+
+#include <stdbool.h>
+
+#include "types.h"
+#include "value.h"
+
+Value *normrequire(Value *r);
+Value *requirements(Value *options);
+
+bool restartsonloss(Value *r);
+bool gatesactivation(Value *r);
+bool restartcausing(Value *r);
+
+/* [{ref, provides:[name], requires:[req]}] -> the cycle, or NULL. */
+Value *dependencycycle(Value *nodes);
+/* Raise on a cycle, naming it. Separate from the detector so the
+ * detector stays pure and corpus-testable. */
+void checkcycle(Value *nodes);
+
+#endif

package/project/.sdk/tm/c/feature/secrets/plugin/env.c

@@ -0,0 +1,220 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/env.c)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Environment overrides (§9.5) — level 7 of the ladder.
+ *
+ * One prefix, so nothing drifts: `VOXGIG_PLUGIN_*`.
+ *
+ *   VOXGIG_PLUGIN_PROFILE            the profile name
+ *   VOXGIG_PLUGIN_<REF>_<PATH>       one option
+ *   VOXGIG_PLUGIN_ACTIVE/INACTIVE    comma-separated refs, INACTIVE wins
+ *
+ * THE ENCODING IS LOSSY, AND THIS SAYS SO RATHER THAN PRETENDING
+ * OTHERWISE. Ref and path are upper-snake with `$` -> `__` and `.` ->
+ * `_`. But `_` is legal in a name and in a tag, and the mapping folds
+ * case, so `retry$fast` and `retry__fast` both encode to `RETRY__FAST`.
+ *
+ * Rather than restrict a grammar the rest of the stack already uses,
+ * the host DETECTS THE COLLISION: it encodes every ref it holds, and a
+ * key two refs claim is `plugin_env_ambiguous`, naming both.
+ *
+ * Pure: a function over a string map and a ref set, so the corpus tests
+ * it without touching a real environment. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "env.h"
+#include "ref.h"
+
+#define PREFIX "VOXGIG_PLUGIN_"
+
+const char *encoderef(const char *ref) {
+  size_t n = strlen(ref);
+  char *out = (char *)arena_alloc(n * 2 + 1);
+  size_t j = 0;
+  for (size_t i = 0; i < n; i++) {
+    char c = ref[i];
+    if ('$' == c) { out[j++] = '_'; out[j++] = '_'; }
+    else if ('.' == c) { out[j++] = '_'; }
+    else if ('a' <= c && 'z' >= c) { out[j++] = (char)(c - 'a' + 'A'); }
+    else { out[j++] = c; }
+  }
+  out[j] = '\0';
+  return out;
+}
+
+static void checkreserved(const char *ref, Value *reserved) {
+  if (!vislist(reserved) || 0 == vlen(reserved)) return;
+  const char *name = refname(ref);
+  for (size_t i = 0; i < vlen(reserved); i++) {
+    Value *r = vat(reserved, i);
+    if (visstr(r) && 0 == strcmp(vasstr(r), name)) {
+      size_t sz = strlen(ref) + 48;
+      char *text = (char *)arena_alloc(sz);
+      snprintf(text, sz, "ref is reserved by the host: %s", ref);
+      fail("plugin_ref_reserved", text, details1("ref", vstr(ref)));
+    }
+  }
+}
+
+/* Values parse as JSON, FALLING BACK TO STRING — so `8080` is a number,
+ * `true` is a boolean, `{"a":1}` is a map, and `hello` is the string it
+ * looks like rather than a parse error. */
+static Value *parsevalue(const char *v) {
+  const char *err = NULL;
+  Value *parsed = vparse(v, &err);
+  return NULL == parsed ? vstr(v) : parsed;
+}
+
+static int bylen_desc(const void *a, const void *b) {
+  const char *x = *(const char *const *)a;
+  const char *y = *(const char *const *)b;
+  size_t lx = strlen(x), ly = strlen(y);
+  if (lx != ly) return lx > ly ? -1 : 1;
+  return strcmp(x, y);
+}
+
+Value *applyenv(Value *input) {
+  Value *env = vget(input, "env");
+  if (!vismap(env)) env = vmap();
+  Value *refsin = vget(input, "refs");
+  Value *reserved = vget(input, "reserved");
+
+  Value *out = vmap();
+  Value *options = vmap();
+  Value *active = vlist();
+  Value *inactive = vlist();
+  vset(out, "options", options);
+  vset(out, "active", active);
+  vset(out, "inactive", inactive);
+
+  /* Encode every ref the host holds, and refuse a key that two of them
+   * claim. Done UP FRONT so the collision is reported even when no
+   * environment variable exercises it — a latent ambiguity is still an
+   * ambiguity, and finding it at deploy time is the failure this exists
+   * to prevent. */
+  Value *byencoded = vmap();
+  if (vislist(refsin)) {
+    for (size_t i = 0; i < vlen(refsin); i++) {
+      const char *r = canonref(vat(refsin, i));
+      const char *e = encoderef(r);
+      Value *list = vget(byencoded, e);
+      if (visnull(list)) { list = vlist(); vset(byencoded, e, list); }
+      vpush(list, vstr(r));
+    }
+  }
+
+  const char **encs;
+  size_t nenc = vsortedkeys(byencoded, &encs);
+  for (size_t i = 0; i < nenc; i++) {
+    Value *claims = vget(byencoded, encs[i]);
+    if (1 < vlen(claims)) {
+      const char *a = vasstr(vat(claims, 0));
+      const char *b = vasstr(vat(claims, 1));
+      const char *lo = 0 <= strcmp(a, b) ? b : a;
+      const char *hi = 0 <= strcmp(a, b) ? a : b;
+      Value *pair = vlist();
+      vpush(pair, vstr(lo));
+      vpush(pair, vstr(hi));
+      size_t sz = strlen(encs[i]) + strlen(lo) + strlen(hi) + 64;
+      char *text = (char *)arena_alloc(sz);
+      snprintf(text, sz, "refs collide in the environment encoding as %s: %s, %s",
+               encs[i], lo, hi);
+      Value *details = vmap();
+      vset(details, "encoded", vstr(encs[i]));
+      vset(details, "refs", pair);
+      fail("plugin_env_ambiguous", text, details);
+    }
+  }
+
+  /* LONGEST encoded ref first, so `retry$fast` wins over `retry` on
+   * `RETRY__FAST_MIN`. Shortest-first would read the tag as a path. */
+  const char **order = (const char **)arena_alloc(sizeof(char *) * (nenc + 1));
+  for (size_t i = 0; i < nenc; i++) order[i] = encs[i];
+  if (1 < nenc) qsort((void *)order, nenc, sizeof(char *), bylen_desc);
+
+  const char **keys;
+  size_t nk = vsortedkeys(env, &keys);
+  size_t plen = strlen(PREFIX);
+
+  for (size_t ki = 0; ki < nk; ki++) {
+    const char *key = keys[ki];
+    if (0 != strncmp(key, PREFIX, plen)) continue;
+    const char *rest = key + plen;
+    Value *raw = vget(env, key);
+    const char *val = visstr(raw) ? vasstr(raw) : "";
+
+    if (0 == strcmp(rest, "PROFILE")) {
+      vset(out, "profile", vstr(val));
+      continue;
+    }
+
+    if (0 == strcmp(rest, "ACTIVE") || 0 == strcmp(rest, "INACTIVE")) {
+      bool isactive = 0 == strcmp(rest, "ACTIVE");
+      const char *p = val;
+      while ('\0' != *p) {
+        while (' ' == *p || '\t' == *p) p++;
+        const char *start = p;
+        while ('\0' != *p && ',' != *p) p++;
+        const char *end = p;
+        while (end > start && (' ' == end[-1] || '\t' == end[-1])) end--;
+        if (end > start) {
+          const char *piece = arena_strndup(start, (size_t)(end - start));
+          const char *c = canonref(vstr(piece));
+          /* The reservation covers EVERY input layer (§9.1).
+           * VOXGIG_PLUGIN_INACTIVE=station is easier to set than
+           * editing a config file, and INACTIVE has the final word — so
+           * guarding documents alone would leave the one lever this
+           * mechanism exists to deny wide open. */
+          checkreserved(c, reserved);
+          vpush(isactive ? active : inactive, vstr(c));
+        }
+        if (',' == *p) p++;
+      }
+      continue;
+    }
+
+    const char *enc = NULL;
+    for (size_t i = 0; i < nenc; i++) {
+      size_t el = strlen(order[i]);
+      if (0 == strcmp(rest, order[i]) ||
+          (0 == strncmp(rest, order[i], el) && '_' == rest[el])) {
+        enc = order[i];
+        break;
+      }
+    }
+    if (NULL == enc) continue;   /* not for any ref this host holds */
+
+    const char *ref = vasstr(vat(vget(byencoded, enc), 0));
+    checkreserved(ref, reserved);
+
+    if (0 == strcmp(rest, enc)) continue;   /* a ref with no path sets nothing */
+
+    const char *pathtext = rest + strlen(enc) + 1;
+    Value *node = vget(options, ref);
+    if (visnull(node)) { node = vmap(); vset(options, ref, node); }
+
+    const char *seg = pathtext;
+    for (;;) {
+      const char *dot = strchr(seg, '_');
+      if (NULL == dot) break;
+      char *piece = arena_strndup(seg, (size_t)(dot - seg));
+      for (char *q = piece; '\0' != *q; q++) {
+        if ('A' <= *q && 'Z' >= *q) *q = (char)(*q - 'A' + 'a');
+      }
+      Value *next = vget(node, piece);
+      if (!vismap(next)) { next = vmap(); vset(node, piece, next); }
+      node = next;
+      seg = dot + 1;
+    }
+    char *leaf = arena_strdup(seg);
+    for (char *q = leaf; '\0' != *q; q++) {
+      if ('A' <= *q && 'Z' >= *q) *q = (char)(*q - 'A' + 'a');
+    }
+    vset(node, leaf, parsevalue(val));
+  }
+
+  return out;
+}

package/project/.sdk/tm/c/feature/secrets/plugin/env.h

@@ -0,0 +1,19 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/env.h)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Environment overrides (§9.5) — level 7 of the ladder. Pure: a
+ * function over a string map and a ref set, so the corpus tests it
+ * without touching a real environment. */
+
+#ifndef VOXGIG_PLUGIN_ENV_H
+#define VOXGIG_PLUGIN_ENV_H
+
+#include "types.h"
+#include "value.h"
+
+/* `retry$fast` -> `RETRY__FAST`. Lossy on purpose; see env.c. */
+const char *encoderef(const char *ref);
+
+Value *applyenv(Value *input);
+
+#endif

package/project/.sdk/tm/c/feature/secrets/plugin/export.c

@@ -0,0 +1,97 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/export.c)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Exports (§11).
+ *
+ * THE UNQUALIFIED ALIAS IS THE INTERESTING PART. `retry/client`
+ * resolves to the UNTAGGED instance if one exists; if not, and exactly
+ * one tagged instance exports that key, it resolves to that one; if two
+ * do, it is `plugin_export_ambiguous` — deliberately diverging from
+ * seneca's silent last-wins, because with multi-instance as a headline
+ * feature an ambiguous alias is a defect waiting for production. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "export.h"
+#include "ref.h"
+
+static int bytewise(const void *a, const void *b) {
+  return strcmp(*(const char *const *)a, *(const char *const *)b);
+}
+
+Value *resolveexport(Value *spec, Value *exported) {
+  const char *s = visstr(spec) ? vasstr(spec) : "";
+  const char *cut = strchr(s, '/');
+  if (NULL == cut) {
+    size_t sz = strlen(s) + 40;
+    char *text = (char *)arena_alloc(sz);
+    snprintf(text, sz, "export spec needs a key: %s", s);
+    fail("plugin_export_ambiguous", text, details1("spec", vstr(s)));
+  }
+  const char *head = arena_strndup(s, (size_t)(cut - s));
+  const char *key = cut + 1;
+
+  /* A fully qualified ref: exactly one answer or none.
+   *
+   * VALIDATING, not tolerant. The canonical calls `canonref(head)`,
+   * which RAISES — so `retry$bad!/client` is `plugin_bad_tag` and
+   * `2fa/client` is `plugin_bad_name`. Reading it with `tryref` turned
+   * a configuration typo into an ordinary missing export, which is the
+   * error the caller most needs to see, silently swallowed. */
+  const char *want = canonref(vstr(head));
+  {
+    for (size_t i = 0; i < vlen(exported); i++) {
+      Value *e = vat(exported, i);
+      if (0 == strcmp(vasstr(vget(e, "ref")), want) &&
+          0 == strcmp(vasstr(vget(e, "key")), key)) {
+        return vget(e, "value");
+      }
+    }
+  }
+
+  /* An alias: the NAME, not a ref. Look at every instance of it. */
+  Value *byname = vlist();
+  for (size_t i = 0; i < vlen(exported); i++) {
+    Value *e = vat(exported, i);
+    const char *eref = vasstr(vget(e, "ref"));
+    if (0 == strcmp(refname(eref), head) &&
+        0 == strcmp(vasstr(vget(e, "key")), key)) {
+      vpush(byname, e);
+    }
+  }
+  if (0 == vlen(byname)) return NULL;
+
+  /* The untagged instance wins outright when there is one. */
+  for (size_t i = 0; i < vlen(byname); i++) {
+    Value *e = vat(byname, i);
+    const char *eref = vasstr(vget(e, "ref"));
+    if (NULL == strchr(eref, '$')) return vget(e, "value");
+  }
+
+  if (1 == vlen(byname)) return vget(vat(byname, 0), "value");
+
+  size_t n = vlen(byname);
+  const char **refs = (const char **)arena_alloc(sizeof(char *) * (n + 1));
+  size_t sz = strlen(s) + 64;
+  for (size_t i = 0; i < n; i++) {
+    refs[i] = vasstr(vget(vat(byname, i), "ref"));
+    sz += strlen(refs[i]) + 4;
+  }
+  if (1 < n) qsort((void *)refs, n, sizeof(char *), bytewise);
+  Value *list = vlist();
+  for (size_t i = 0; i < n; i++) vpush(list, vstr(refs[i]));
+
+  char *text = (char *)arena_alloc(sz);
+  size_t used = (size_t)snprintf(text, sz, "alias %s matches %zu instances: ", s, n);
+  for (size_t i = 0; i < n; i++) {
+    used += (size_t)snprintf(text + used, sz - used, "%s%s",
+                             0 < i ? ", " : "", refs[i]);
+  }
+  Value *d = vmap();
+  vset(d, "spec", vstr(s));
+  vset(d, "refs", list);
+  fail("plugin_export_ambiguous", text, d);
+  return NULL;
+}

package/project/.sdk/tm/c/feature/secrets/plugin/export.h

@@ -0,0 +1,19 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/export.h)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Exports (§11). An instance publishes values for other plugins and for
+ * the application. THE UNQUALIFIED ALIAS IS THE INTERESTING PART; see
+ * export.c. */
+
+#ifndef VOXGIG_PLUGIN_EXPORT_H
+#define VOXGIG_PLUGIN_EXPORT_H
+
+#include "types.h"
+#include "value.h"
+
+/* `retry$fast/client` or the alias `retry/client`, against a list of
+ * {ref, key, value}. Answers NULL for "no such export", which is not an
+ * error — `export/missing` pins that. */
+Value *resolveexport(Value *spec, Value *exported);
+
+#endif