@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/zig/feature/secrets/plugin/inst.zig

@@ -0,0 +1,126 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/inst.zig)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The instance and host records.
+//!
+//! THEY LIVE IN ONE FILE BECAUSE THE CYCLE IS REAL: a definition's
+//! callbacks take an instance, an instance points at its host, and a
+//! host holds a catalog of definitions. Zig resolves declarations
+//! lazily, so it would in fact tolerate the cycle across files — but
+//! `catalog.zig` importing `inst.zig` importing `catalog.zig` is a
+//! readability trap, and gathering the declarations here is the same
+//! shape `c` gets from a forward `typedef`, `ocaml` from `defs.ml` and
+//! `haskell` from `Defs.hs`.
+
+const std = @import("std");
+const v = @import("value.zig");
+const t = @import("types.zig");
+const point = @import("point.zig");
+
+/// A scope release. Zig has no closures, so a release is a function plus
+/// its context — the same pairing `point.zig` uses for bindings.
+pub const ReleaseFn = *const fn (?*anyopaque) void;
+
+pub const ScopeEntry = struct {
+    fn_: ?ReleaseFn = null,
+    ctx: ?*anyopaque = null,
+    done: bool = false,
+    /// `acquire` and `release` both count toward `open`; a nested host's
+    /// teardown does NOT — a teardown is not an acquisition, and the
+    /// inner host keeps its own counter (`nest/open`).
+    counts: bool = true,
+};
+
+pub const Inst = struct {
+    ref: []const u8,
+    def: *@import("catalog.zig").Definition,
+    status: []const u8 = "declared",
+    pos: f64 = 0,
+    seq: f64 = 0,
+    options: *v.Value,
+    state: *v.Value,
+    order: ?*v.Value = null,
+    /// §11.4's ALWAYS-RELUCTANT rebinding, made concrete: the provider
+    /// ref this instance's activation actually selected, per requirement
+    /// name. Recomputing the best candidate on every question silently
+    /// re-points a live consumer at any better-ranked newcomer, and then
+    /// losing the provider it was really using does not restart it.
+    selected: *v.Value,
+    /// §9.6's `active: false`. THE BAR OUTLIVES THE APPLY THAT SET IT: a
+    /// flag consulted only while `apply` ran let a later direct `ready`
+    /// bring the instance live, which is the config switch it exists to
+    /// be silently ignored.
+    barred: bool = false,
+    unmet: *v.Value,
+    scope: v.List(*ScopeEntry),
+    /// Declared in `define`, inserted only when activation SUCCEEDS
+    /// (§8.1). Holding them until then is what makes a failed activate
+    /// leave nothing behind.
+    bindings: v.List(point.Bound),
+    inner: ?*Host = null,
+    /// Declared in `define`, and VISIBLE while merely `loaded` (§11):
+    /// they are data, and hiding them would make the loaded state
+    /// useless for introspection.
+    exports: *v.Value,
+    provides: *v.Value,
+    owner: *Host,
+};
+
+pub const HostOptions = struct {
+    catalog: ?*@import("catalog.zig").Catalog = null,
+    reserved: ?*v.Value = null,
+    keys: ?*v.Value = null,
+    defaults: ?*v.Value = null,
+    profile: ?*v.Value = null,
+    points: ?*v.Value = null,
+    bases: []const BaseFn = &[_]BaseFn{},
+    /// §11.3. `restart` (the default) treats provider replacement as an
+    /// ordinary runtime operation. `hold` is the strict reading —
+    /// deactivating a required instance is `plugin_dependency_held`. NOT
+    /// the default, because a station that cannot swap a provider
+    /// without a restart has lost the argument for having a plugin
+    /// system.
+    dependency: []const u8 = "",
+};
+
+pub const BaseFn = struct {
+    point: []const u8,
+    func: *const fn (?*v.Value, ?*anyopaque) t.Err!?*v.Value,
+};
+
+pub const Host = struct {
+    catalog: *@import("catalog.zig").Catalog,
+    reserved: ?*v.Value,
+    keys: ?*v.Value,
+    defaults: ?*v.Value,
+    profile: ?*v.Value,
+    points: *v.Value,
+    bases: []const BaseFn,
+    dependency: []const u8,
+    /// Set for the duration of a bulk teardown, so `held` knows this is
+    /// a coordinated operation rather than an ad-hoc deactivation.
+    coordinated: bool = false,
+    instances: v.List(*Inst),
+    log: *v.Value,
+    events: *v.Value,
+    seqn: f64 = 0,
+    open: f64 = 0,
+    intransition: bool = false,
+    /// WHICH callback is running, not merely that one is. §8.1 puts
+    /// resource capture in `activate` and §8.3 says `release` outside
+    /// `activate` is `plugin_release_scope` — and a boolean alone cannot
+    /// tell `activate` from `define`, so it admitted an acquire in
+    /// `define` whose scope `unload` would never unwind.
+    phase: []const u8 = "",
+};
+
+pub const DeclareSpec = struct {
+    definition: []const u8 = "",
+    options: ?*v.Value = null,
+    order: ?*v.Value = null,
+    pos: ?f64 = null,
+    tag: []const u8 = "",
+    /// §9.1: set ONLY by `hostdeclare` — "the host declares those
+    /// instances itself, after the user merge, and always wins".
+    hostowned: bool = false,
+};

package/project/.sdk/tm/zig/feature/secrets/plugin/order.zig

@@ -0,0 +1,228 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/order.zig)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Ordering (§7) — one rule, one place.
+//!
+//! sdkgen grew two special cases in `makeOptions` (`test`, then
+//! `station`) and the third was not far off. This sort is the whole
+//! replacement, and the tiers are in this order for a reason:
+//!
+//!   1 constraints   before/after edges, by ref or by name
+//!   2 bands         integer, lower first, default 0
+//!   3 declaration   ties break by `pos`
+//!
+//! CONSTRAINTS BEAT BANDS precisely so the correct tool wins when both
+//! are present. A band expresses a genuine cross-cutting layer; a
+//! constraint expresses a relationship between two specific things; and
+//! a band chosen by trial and error to fix an ordering bug is a bug
+//! wearing a number.
+
+const std = @import("std");
+const v = @import("value.zig");
+const t = @import("types.zig");
+const ref = @import("ref.zig");
+
+/// A NUMBER, not a numeric string. `order.band` accepting "1" was a
+/// surviving mutation in more than one port: the corpus pins the type
+/// because two ports disagreeing about whether "1" is a band is exactly
+/// the divergence a shared corpus exists to remove.
+fn bandof(b: ?*v.Value) f64 {
+    const band = v.get(v.get(b, "order"), "band");
+    return if (v.isNum(band)) v.asNum(band) else 0;
+}
+
+fn posof(b: ?*v.Value) f64 {
+    const p = v.get(b, "pos");
+    return if (v.isNum(p)) v.asNum(p) else 0;
+}
+
+/// Band first (lower runs first), then `pos` — the position the DOCUMENT
+/// visibly states, not the order instances happened to load and not the
+/// incarnation `seq`.
+fn lessRank(_: void, a: *v.Value, b: *v.Value) bool {
+    const ab = bandof(a);
+    const bb = bandof(b);
+    if (ab != bb) return ab < bb;
+    return posof(a) < posof(b);
+}
+
+/// Was a constraint actually declared? An ABSENT one and an EMPTY LIST
+/// are both "no constraint"; only a non-empty spelling is an edge.
+fn declared(spec: ?*v.Value) bool {
+    if (v.isList(spec)) return v.len(spec) > 0;
+    if (v.isStr(spec)) return v.asStr(spec).len > 0;
+    return false;
+}
+
+/// Matching is by REF, or by NAME across all of that definition's
+/// instances (§7) — which is the whole reason the two spellings exist.
+fn targets(spec: ?*v.Value, nodes: ?*v.Value) [][]const u8 {
+    var hit = v.List([]const u8).init(v.arena());
+    const specs: []*v.Value = if (v.isList(spec)) v.items(spec) else blk: {
+        const one = v.arena().alloc(*v.Value, 1) catch @panic("oom");
+        one[0] = spec orelse v.vnull();
+        break :blk one;
+    };
+    for (specs) |oneval| {
+        if (!v.isStr(oneval)) continue;
+        const one = v.asStr(oneval);
+        for (v.items(nodes)) |node| {
+            const r = v.asStr(v.get(node, "ref"));
+            var already = false;
+            for (hit.items) |x| {
+                if (std.mem.eql(u8, x, r)) {
+                    already = true;
+                    break;
+                }
+            }
+            if (already) continue;
+            if (std.mem.eql(u8, r, one) or std.mem.eql(u8, ref.refname(r), one)) {
+                hit.append(r) catch @panic("oom");
+            }
+        }
+    }
+    return hit.items;
+}
+
+/// A PIN IS NOT A CONSTRAINT (§7).
+///
+/// Constraints and bands are negotiable by definition — they are what
+/// plugins and documents say they want, and the sort's job is to satisfy
+/// them all. A pin is the host stating a structural invariant of its own
+/// architecture, which is a different kind of claim and must not lose a
+/// tie to a document.
+///
+/// So a pin PLACES the binding at the named end, and an ordering that
+/// would move it away is `plugin_order_pinned` — rejected, not honoured
+/// into a broken wrap.
+fn applypin(order: *v.Value, edges: *v.Value, pin: ?*v.Value) t.Err!*v.Value {
+    if (!v.isMap(pin)) return order;
+
+    var out = v.List([]const u8).init(v.arena());
+    for (v.items(order)) |x| out.append(v.asStr(x)) catch @panic("oom");
+
+    // SORTED, not insertion order. A pin map is data — it can arrive
+    // from a host's own construction options in any order, and two names
+    // pinned to the same end are order-sensitive. Sorted is the one
+    // order every language agrees on, and `order/pin#two-names` pins it.
+    for (v.sortedKeys(pin)) |name| {
+        const want = v.asStr(v.get(pin, name));
+        var idx: ?usize = null;
+        for (out.items, 0..) |r, j| {
+            if (std.mem.eql(u8, ref.refname(r), name)) {
+                idx = j;
+                break;
+            }
+        }
+        const i = idx orelse continue;
+
+        // `first`/`outermost` is index 0; `last`/`innermost` is the end.
+        // §6.2 makes the first chain binding outermost, which is why the
+        // vocabulary is positional and why the two spellings pair this
+        // way.
+        const wantfirst = std.mem.eql(u8, want, "first") or std.mem.eql(u8, want, "outermost");
+        const r = out.orderedRemove(i);
+        if (wantfirst) out.insert(0, r) catch @panic("oom") else out.append(r) catch @panic("oom");
+    }
+
+    // Now check that the placement did not break a constraint. This is
+    // the half that makes a pin a rejection rather than an override: the
+    // host wins on position, but it does not get to silently discard a
+    // relationship a plugin declared.
+    const index = v.vmap();
+    for (out.items, 0..) |r, i| v.set(index, r, v.vnum(@floatFromInt(i)));
+    for (v.sortedKeys(edges)) |from| {
+        for (v.items(v.get(edges, from))) |tov| {
+            const to = v.asStr(tov);
+            if (v.asNum(v.get(index, from)) > v.asNum(v.get(index, to))) {
+                const d = v.vmap();
+                v.set(d, "before", v.vstr(from));
+                v.set(d, "after", v.vstr(to));
+                return t.fail("plugin_order_pinned", v.print("a pin would move a binding an ordering constrains: {s} must precede {s}", .{ from, to }), d);
+            }
+        }
+    }
+
+    const result = v.vlist();
+    for (out.items) |r| v.push(result, v.vstr(r));
+    return result;
+}
+
+pub fn resolveorder(bindings: ?*v.Value, pin: ?*v.Value) t.Err!*v.Value {
+    const n = v.len(bindings);
+
+    const byref = v.vmap();
+    for (v.items(bindings)) |b| v.set(byref, v.asStr(v.get(b, "ref")), b);
+
+    // Constraints are edges. A constraint naming an ABSENT binding is
+    // satisfied VACUOUSLY (§7) — a plugin ordered `after: 'test'` must
+    // load in a host with no test plugin. That is sdkgen's __after__
+    // behaviour, kept.
+    const edges = v.vmap();
+    for (v.items(bindings)) |b| v.set(edges, v.asStr(v.get(b, "ref")), v.vlist());
+
+    for (v.items(bindings)) |b| {
+        const bref = v.asStr(v.get(b, "ref"));
+        const o = v.get(b, "order");
+        if (declared(v.get(o, "after"))) {
+            for (targets(v.get(o, "after"), bindings)) |x| v.push(v.get(edges, x), v.vstr(bref));
+        }
+        if (declared(v.get(o, "before"))) {
+            for (targets(v.get(o, "before"), bindings)) |x| v.push(v.get(edges, bref), v.vstr(x));
+        }
+    }
+
+    // Stable topological sort.
+    const indeg = v.vmap();
+    for (v.items(bindings)) |b| v.set(indeg, v.asStr(v.get(b, "ref")), v.vnum(0));
+    for (v.keys(edges)) |from| {
+        for (v.items(v.get(edges, from))) |tov| {
+            const to = v.asStr(tov);
+            v.set(indeg, to, v.vnum(v.asNum(v.get(indeg, to)) + 1));
+        }
+    }
+
+    var ready = v.List(*v.Value).init(v.arena());
+    for (v.items(bindings)) |b| {
+        if (v.asNum(v.get(indeg, v.asStr(v.get(b, "ref")))) == 0) ready.append(b) catch @panic("oom");
+    }
+
+    var out = v.List([]const u8).init(v.arena());
+    while (ready.items.len > 0) {
+        std.mem.sort(*v.Value, ready.items, {}, lessRank);
+        const next = ready.orderedRemove(0);
+        const nref = v.asStr(v.get(next, "ref"));
+        out.append(nref) catch @panic("oom");
+        for (v.items(v.get(edges, nref))) |tov| {
+            const to = v.asStr(tov);
+            const d = v.asNum(v.get(indeg, to)) - 1;
+            v.set(indeg, to, v.vnum(d));
+            if (d == 0) ready.append(v.get(byref, to)) catch @panic("oom");
+        }
+    }
+
+    if (out.items.len != n) {
+        const stuck = v.vlist();
+        var text = v.List(u8).init(v.arena());
+        text.appendSlice("before/after constraints cycle: ") catch @panic("oom");
+        for (v.items(bindings)) |b| {
+            const r = v.asStr(v.get(b, "ref"));
+            var placed = false;
+            for (out.items) |x| {
+                if (std.mem.eql(u8, x, r)) {
+                    placed = true;
+                    break;
+                }
+            }
+            if (placed) continue;
+            if (v.len(stuck) > 0) text.appendSlice(" -> ") catch @panic("oom");
+            text.appendSlice(r) catch @panic("oom");
+            v.push(stuck, v.vstr(r));
+        }
+        return t.fail("plugin_order_cycle", text.items, t.details1("cycle", stuck));
+    }
+
+    const ordered = v.vlist();
+    for (out.items) |r| v.push(ordered, v.vstr(r));
+    return applypin(ordered, edges, pin);
+}

package/project/.sdk/tm/zig/feature/secrets/plugin/plugin.zig

@@ -0,0 +1,34 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/plugin.zig)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! THE ROOT A CONSUMER IMPORTS.
+//!
+//! Zig restricts a module's imports to the directory of its root source
+//! file, so a host that takes this port as a named module
+//! (`--dep plugin ... -Mplugin=<checkout>/zig/src/plugin.zig`) reaches
+//! every file in `src/` through this one and through nothing else. The
+//! test driver in `../test/` imports the files directly, because it
+//! lives beside them; a consumer cannot, and this is what it gets
+//! instead — the same role `index.ts` plays for the typescript port.
+//!
+//! EVERY MODULE, not the handful the first host happened to need: the
+//! canonical surface is the whole of it (AGENTS.md, api parity), and a
+//! root that exposed part of it would make the rest unreachable by
+//! construction. A new file under `src/` is one line here.
+
+pub const value = @import("value.zig");
+pub const types = @import("types.zig");
+pub const ref = @import("ref.zig");
+pub const version = @import("version.zig");
+pub const capability = @import("capability.zig");
+pub const resolve = @import("resolve.zig");
+pub const env = @import("env.zig");
+pub const config = @import("config.zig");
+pub const graph = @import("graph.zig");
+pub const depend = @import("depend.zig");
+pub const order = @import("order.zig");
+pub const point = @import("point.zig");
+pub const @"export" = @import("export.zig");
+pub const catalog = @import("catalog.zig");
+pub const inst = @import("inst.zig");
+pub const host = @import("host.zig");

package/project/.sdk/tm/zig/feature/secrets/plugin/point.zig

@@ -0,0 +1,166 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/point.zig)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Extension points (§6). Three kinds, chosen because they are what the
+//! two existing systems actually needed, and no more.
+//!
+//! A PLUGIN NEVER MUTATES THE HOST. That inversion is what makes
+//! deactivation possible: sdkgen's `utility.fetcher = wrapped` is not
+//! undoable, but "this instance holds slot 3 of the request chain" is
+//! undoable in O(1). OSGi named it the whiteboard pattern in 2004, in a
+//! paper called *Listeners Considered Harmful*, and for exactly this
+//! reason.
+//!
+//! A CLOSURE IN ZIG IS A FUNCTION POINTER PLUS A CONTEXT, exactly as in
+//! `c`. Zig has no closures: a function literal that captures is not a
+//! value you can store. So `chain` gets an explicit `Chain *` to call
+//! back into, and a binding's `ctx` is its instance — the same shape the
+//! `c` port has, for the same reason, in a language forty years newer.
+
+const std = @import("std");
+const v = @import("value.zig");
+const t = @import("types.zig");
+
+/// The remaining composition, as seen by one chain binding. A binding
+/// may CALL it and must not store it — a plugin that stashes `next` and
+/// calls it after deactivation is a bug the host cannot prevent, and
+/// saying so is better than pretending otherwise (§6.2).
+pub const Chain = struct {
+    bindings: []Bound,
+    i: usize,
+    base: ?*const fn (?*v.Value, ?*anyopaque) t.Err!?*v.Value,
+    basectx: ?*anyopaque,
+};
+
+/// A binding answers with an optional: null DECLINES, a value answers.
+pub const HookFn = *const fn (?*v.Value, ?*anyopaque) t.Err!?*v.Value;
+pub const ChainFn = *const fn (*Chain, ?*v.Value, ?*anyopaque) t.Err!?*v.Value;
+
+pub const Bound = struct {
+    ref: []const u8,
+    point: []const u8,
+    /// `provider` ranks by HIGHEST band, unlike hook and chain which run
+    /// lowest first. Kept as declared so the two rules stay visibly
+    /// different rather than one being derived from the other by a
+    /// reader who then gets it backwards.
+    band: f64 = 0,
+    hook: ?HookFn = null,
+    chain: ?ChainFn = null,
+    ctx: ?*anyopaque = null,
+};
+
+/// Call the rest of the composition.
+pub fn chainNext(c: *Chain, arg: ?*v.Value) t.Err!?*v.Value {
+    if (c.i >= c.bindings.len) {
+        if (c.base) |b| return b(arg, c.basectx);
+        return arg;
+    }
+    const b = c.bindings[c.i];
+    var rest = Chain{ .bindings = c.bindings, .i = c.i + 1, .base = c.base, .basectx = c.basectx };
+    return b.chain.?(&rest, arg, b.ctx);
+}
+
+/// Composition: b1(b2(b3(base))), FIRST BINDING OUTERMOST (§6.2).
+pub fn pointcall(
+    bindings: []Bound,
+    base: ?*const fn (?*v.Value, ?*anyopaque) t.Err!?*v.Value,
+    basectx: ?*anyopaque,
+    arg: ?*v.Value,
+) t.Err!?*v.Value {
+    var c = Chain{ .bindings = bindings, .i = 0, .base = base, .basectx = basectx };
+    return chainNext(&c, arg);
+}
+
+pub const EmitResult = struct { value: ?*v.Value, errors: *v.Value };
+
+/// Fan-out. Return values are ignored except in `bail`.
+///
+/// §6.1: "fan-out" is not one answer but four. In a language with
+/// asynchrony, "call every binding" hides a decision — start them all
+/// and wait, await each in turn, or do not wait — and a design that
+/// leaves it unsaid gets four different answers from four ports, in the
+/// concurrency behaviour of production code no corpus entry happens to
+/// cover. Zig has no asynchrony here, so all four modes are sequential
+/// and only the ERROR and RETURN handling distinguishes them.
+pub fn pointemit(bindings: []Bound, mode: []const u8, arg: ?*v.Value) t.Err!EmitResult {
+    const errors = v.vlist();
+
+    if (std.mem.eql(u8, mode, "bail")) {
+        // Stops at the first binding that RETURNS A VALUE — the
+        // "handled, stop" case. A null, AND A JSON NULL, BOTH DECLINE.
+        //
+        // JavaScript can tell null from undefined and almost nothing
+        // else in the target set can — Go, Python, Ruby, PHP, Lua, Java
+        // and C# each have exactly one way to say nothing, and zig has
+        // one too. Making the distinction load-bearing would cost every
+        // one of them a wrapper type carried through the whole dispatch
+        // path, to express a difference their plugin authors cannot
+        // write. §18's budget settles it (§6.1).
+        for (bindings) |b| {
+            const x = try b.hook.?(arg, b.ctx);
+            if (!v.isNull(x)) return .{ .value = x, .errors = errors };
+        }
+        return .{ .value = null, .errors = errors };
+    }
+
+    const raising = std.mem.eql(u8, mode, "emit");
+    for (bindings) |b| {
+        if (raising) {
+            // `emit` raises synchronously; the collecting modes gather.
+            _ = try b.hook.?(arg, b.ctx);
+            continue;
+        }
+        _ = b.hook.?(arg, b.ctx) catch {
+            const e = t.take();
+            const rec = v.vmap();
+            v.set(rec, "code", v.vstr(e.code));
+            v.set(rec, "message", v.vstr(e.message));
+            v.push(errors, rec);
+        };
+    }
+    return .{ .value = null, .errors = errors };
+}
+
+fn lessProv(_: void, a: Bound, b: Bound) bool {
+    // HIGHEST band wins, unlike hook and chain; ties break by ref sort,
+    // which is a TOTAL order.
+    if (a.band != b.band) return a.band > b.band;
+    return std.mem.order(u8, a.ref, b.ref) == .lt;
+}
+
+fn lessStr(_: void, a: []const u8, b: []const u8) bool {
+    return std.mem.order(u8, a, b) == .lt;
+}
+
+pub const ProviderResult = struct { winner: ?Bound, shadowed: *v.Value };
+
+/// At most one live implementation (§6.3). The winner is the highest
+/// band, ties broken by ref sort, and THE LOSERS ARE VISIBLE rather than
+/// silently ignored.
+pub fn pointprovider(bindings: []Bound, exclusive: bool) t.Err!ProviderResult {
+    const shadowed = v.vlist();
+    if (bindings.len == 0) return .{ .winner = null, .shadowed = shadowed };
+
+    if (exclusive and bindings.len > 1) {
+        const refs = v.arena().alloc([]const u8, bindings.len) catch @panic("oom");
+        for (bindings, 0..) |b, i| refs[i] = b.ref;
+        // Sorted, so the message names the same pair whatever order the
+        // bindings arrived in.
+        std.mem.sort([]const u8, refs, {}, lessStr);
+        const list = v.vlist();
+        var names = v.List(u8).init(v.arena());
+        for (refs, 0..) |r, i| {
+            if (i > 0) names.appendSlice(", ") catch @panic("oom");
+            names.appendSlice(r) catch @panic("oom");
+            v.push(list, v.vstr(r));
+        }
+        return t.fail("plugin_point_exclusive", v.print("point is exclusive and has {d} bindings: {s}", .{ bindings.len, names.items }), t.details1("refs", list));
+    }
+
+    const ranked = v.arena().alloc(Bound, bindings.len) catch @panic("oom");
+    @memcpy(ranked, bindings);
+    std.mem.sort(Bound, ranked, {}, lessProv);
+
+    for (ranked[1..]) |b| v.push(shadowed, v.vstr(b.ref));
+    return .{ .winner = ranked[0], .shadowed = shadowed };
+}