@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/c/feature/secrets/plugin/ref.c

@@ -0,0 +1,170 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/ref.c)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Identity: name+tag (§4). */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "ref.h"
+
+#define MAX_REF 1024
+
+static bool isnamehead(char c) {
+  return ('a' <= c && 'z' >= c) || ('A' <= c && 'Z' >= c) || '@' == c;
+}
+
+static bool isnamebody(char c) {
+  return ('a' <= c && 'z' >= c) || ('A' <= c && 'Z' >= c) ||
+         ('0' <= c && '9' >= c) ||
+         '.' == c || '~' == c || '_' == c || '-' == c || '/' == c;
+}
+
+static bool istagchar(char c) {
+  return ('a' <= c && 'z' >= c) || ('A' <= c && 'Z' >= c) ||
+         ('0' <= c && '9' >= c) ||
+         '.' == c || '~' == c || '_' == c || '-' == c;
+}
+
+static bool checkname_s(const char *name) {
+  if (NULL == name) return false;
+  size_t n = strlen(name);
+  if (0 == n || MAX_REF < n) return false;
+  if (!isnamehead(name[0])) return false;
+  for (size_t i = 1; i < n; i++) {
+    if (!isnamebody(name[i])) return false;
+  }
+  return true;
+}
+
+static bool checktag_s(const char *tag) {
+  if (NULL == tag) return false;
+  size_t n = strlen(tag);
+  /* The empty tag is an ordinary tag (§4 rule 2). The single-instance
+   * case writes no tag and never learns tags exist. */
+  if (0 == n) return true;
+  if (MAX_REF < n) return false;
+  for (size_t i = 0; i < n; i++) {
+    if (!istagchar(tag[i])) return false;
+  }
+  return true;
+}
+
+bool checkname(Value *name) {
+  /* A non-string is not a name. Every port has to answer this the same
+   * way, and `ref/name` pins it for numbers, nulls and maps alike. */
+  if (!visstr(name)) return false;
+  return checkname_s(vasstr(name));
+}
+
+bool checktag(Value *tag) {
+  if (!visstr(tag)) return false;
+  return checktag_s(vasstr(tag));
+}
+
+Value *parseref(Value *str) {
+  if (!visstr(str)) {
+    fail("plugin_bad_name", "ref must be a string", NULL);
+  }
+  const char *s = vasstr(str);
+
+  /* Split on the FIRST `$`. Nothing in the grammar decides this — `$` is
+   * in neither character class — so the corpus is the arbiter (§4 rule
+   * 5), and it picks the split that blames the part actually at fault:
+   * `a$b$c` is a good name with a bad tag, not the reverse. */
+  const char *cut = strchr(s, '$');
+  const char *name;
+  const char *tag;
+  if (NULL == cut) {
+    name = arena_strdup(s);
+    tag = "";
+  }
+  else {
+    name = arena_strndup(s, (size_t)(cut - s));
+    tag = arena_strdup(cut + 1);
+  }
+
+  if (!checkname_s(name)) {
+    char *text = (char *)arena_alloc(strlen(name) + 32);
+    snprintf(text, strlen(name) + 32, "invalid plugin name: %s", name);
+    fail("plugin_bad_name", text, details1("name", vstr(name)));
+  }
+  if (!checktag_s(tag)) {
+    char *text = (char *)arena_alloc(strlen(tag) + 32);
+    snprintf(text, strlen(tag) + 32, "invalid plugin tag: %s", tag);
+    fail("plugin_bad_tag", text,
+         details2("name", vstr(name), "tag", vstr(tag)));
+  }
+
+  Value *out = vmap();
+  vset(out, "name", vstr(name));
+  vset(out, "tag", vstr(tag));
+  return out;
+}
+
+const char *formatref(Value *name, Value *tag) {
+  const char *t = visnull(tag) ? "" : (visstr(tag) ? vasstr(tag) : NULL);
+
+  if (!checkname(name)) {
+    const char *n = visstr(name) ? vasstr(name) : "";
+    size_t sz = strlen(n) + 32;
+    char *text = (char *)arena_alloc(sz);
+    snprintf(text, sz, "invalid plugin name: %s", n);
+    fail("plugin_bad_name", text,
+         details1("name", visnull(name) ? vnull() : name));
+  }
+  if (NULL == t || !checktag_s(t)) {
+    const char *shown = NULL == t ? "" : t;
+    size_t sz = strlen(shown) + 32;
+    char *text = (char *)arena_alloc(sz);
+    snprintf(text, sz, "invalid plugin tag: %s", shown);
+    fail("plugin_bad_tag", text,
+         details2("name", name, "tag", visnull(tag) ? vstr("") : tag));
+  }
+
+  if ('\0' == t[0]) return arena_strdup(vasstr(name));
+
+  const char *n = vasstr(name);
+  size_t sz = strlen(n) + strlen(t) + 2;
+  char *out = (char *)arena_alloc(sz);
+  snprintf(out, sz, "%s$%s", n, t);
+  return out;
+}
+
+const char *canonref(Value *str) {
+  Value *r = parseref(str);
+  return formatref(vget(r, "name"), vget(r, "tag"));
+}
+
+const char *tryref(const char *str) {
+  if (NULL == str) return NULL;
+  const char *cut = strchr(str, '$');
+  const char *name;
+  const char *tag;
+  if (NULL == cut) {
+    name = str;
+    tag = "";
+  }
+  else {
+    name = arena_strndup(str, (size_t)(cut - str));
+    tag = cut + 1;
+  }
+  if (!checkname_s(name) || !checktag_s(tag)) return NULL;
+  if ('\0' == tag[0]) return arena_strdup(name);
+  size_t sz = strlen(name) + strlen(tag) + 2;
+  char *out = (char *)arena_alloc(sz);
+  snprintf(out, sz, "%s$%s", name, tag);
+  return out;
+}
+
+const char *canon(const char *str) {
+  const char *out = tryref(str);
+  return NULL == out ? str : out;
+}
+
+const char *refname(const char *str) {
+  if (NULL == str) return str;
+  const char *cut = strchr(str, '$');
+  const char *name = NULL == cut ? str : arena_strndup(str, (size_t)(cut - str));
+  return checkname_s(name) ? name : str;
+}

package/project/.sdk/tm/c/feature/secrets/plugin/ref.h

@@ -0,0 +1,52 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/ref.h)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Identity: name+tag, written `name$tag` (§4).
+ *
+ * The four pure functions, and the whole of what `ref` pins. They are
+ * the first thing a new port implements and the first corpus section it
+ * passes. */
+
+#ifndef VOXGIG_PLUGIN_REF_H
+#define VOXGIG_PLUGIN_REF_H
+
+#include <stdbool.h>
+
+#include "types.h"
+#include "value.h"
+
+/* §4: `^[a-zA-Z@][a-zA-Z0-9.~_\-/]*$`, max 1024. */
+bool checkname(Value *name);
+/* §4: `^[a-zA-Z0-9.~_-]+$`, max 1024, or empty.
+ *
+ * The asymmetry with a name is deliberate: a tag MAY start with a digit
+ * because auto-tagging assigns integer tags (`stripe$1`), and a tag
+ * admits neither `@` nor `/` because a name is a package specifier and
+ * a tag is not. */
+bool checktag(Value *tag);
+
+/* `name$tag` -> {name, tag}. Canonicalizing: `stripe$` and `stripe`
+ * both give tag ''. Raises plugin_bad_name / plugin_bad_tag. */
+Value *parseref(Value *str);
+/* {name, tag} -> `name$tag`. An empty tag NEVER writes the separator,
+ * which is the half of canonicalization formatref owns: parse tolerates
+ * `stripe$`, format never produces it, so a round trip is idempotent. */
+const char *formatref(Value *name, Value *tag);
+/* The canonical spelling. §4 rule 5: canonicalize before comparison. */
+const char *canonref(Value *str);
+
+/* The canonical ref this string denotes, or NULL if it denotes none —
+ * the TOLERANT half of `canonref`, and the one a requirement name needs
+ * (§11.1). Capability names are free-form, so `2fa` is a good one and
+ * no ref could be called that; `canonref` RAISES on those, and asking it
+ * "is this a ref?" made a legal document kill the host. */
+const char *tryref(const char *str);
+
+/* `canonref` for internal callers that want the input back unchanged
+ * when it is not well formed. NEVER use where a bad ref must be
+ * reported — the corpus pins plugin_bad_name at every public entry. */
+const char *canon(const char *str);
+/* The name half, for internal callers that only compare. */
+const char *refname(const char *str);
+
+#endif

package/project/.sdk/tm/c/feature/secrets/plugin/resolve.c

@@ -0,0 +1,98 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/resolve.c)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Dynamic resolution (§10.2) — name to candidate module ids.
+ *
+ * PURE. It returns the ids a host WOULD try, in order; it does not load
+ * anything. That separation is what lets the corpus pin resolution in
+ * every language including those with no dynamic loading at all — c
+ * among them — and it is why §15.4 puts real module loading in per-port
+ * integration tests rather than here. */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "resolve.h"
+
+static void pushuniq(Value *out, const char *id) {
+  for (size_t i = 0; i < vlen(out); i++) {
+    if (0 == strcmp(vasstr(vat(out, i)), id)) return;
+  }
+  vpush(out, vstr(id));
+}
+
+Value *resolvecandidates(Value *name, Value *sources) {
+  Value *out = vlist();
+  const char *n = visstr(name) ? vasstr(name) : "";
+
+  /* A SCOPED NAME RESOLVES VERBATIM ONLY (§10.2). `@acme/thing` is
+   * already a package id; prefixing it produces
+   * `@voxgig/plugin-@acme/thing`, which is not a thing that can exist. */
+  if ('@' == n[0]) {
+    vpush(out, vstr(n));
+    return out;
+  }
+
+  static const char *DEFAULT_PREFIX[] = {
+    "@voxgig/plugin-", "voxgig-plugin-", "plugin-", "", NULL
+  };
+
+  bool given = vislist(sources) && 0 < vlen(sources);
+  if (!given) {
+    for (int i = 0; NULL != DEFAULT_PREFIX[i]; i++) {
+      size_t sz = strlen(DEFAULT_PREFIX[i]) + strlen(n) + 1;
+      char *id = (char *)arena_alloc(sz);
+      snprintf(id, sz, "%s%s", DEFAULT_PREFIX[i], n);
+      pushuniq(out, id);
+    }
+    return out;
+  }
+
+  for (size_t si = 0; si < vlen(sources); si++) {
+    Value *src = vat(sources, si);
+    const char *kind = visstr(vget(src, "kind")) ? vasstr(vget(src, "kind")) : "";
+
+    if (0 == strcmp(kind, "module")) {
+      Value *prefix = vget(src, "prefix");
+      if (vislist(prefix) && 0 < vlen(prefix)) {
+        for (size_t pi = 0; pi < vlen(prefix); pi++) {
+          const char *p = visstr(vat(prefix, pi)) ? vasstr(vat(prefix, pi)) : "";
+          size_t sz = strlen(p) + strlen(n) + 1;
+          char *id = (char *)arena_alloc(sz);
+          snprintf(id, sz, "%s%s", p, n);
+          pushuniq(out, id);
+        }
+      }
+      else {
+        pushuniq(out, n);
+      }
+    }
+    else if (0 == strcmp(kind, "path")) {
+      const char *dir = visstr(vget(src, "dir")) ? vasstr(vget(src, "dir")) : "";
+      /* Trailing slashes are trimmed, so `lib/` and `lib` give one id
+       * rather than two spellings of it. */
+      size_t dl = strlen(dir);
+      while (0 < dl && '/' == dir[dl - 1]) dl--;
+      size_t sz = dl + strlen(n) + 2;
+      char *id = (char *)arena_alloc(sz);
+      snprintf(id, sz, "%.*s/%s", (int)dl, dir, n);
+      pushuniq(out, id);
+    }
+  }
+
+  return out;
+}
+
+/* A MODULE PATH IS NOT A NAME (§10.2). The ref grammar starts a name
+ * with a letter or `@`, so `./local/thing` is not a ref and never
+ * reaches candidate generation — seneca allows a path where a plugin
+ * name goes, and this design deliberately does not, because a ref is an
+ * ADDRESS WITHIN A HOST and a path is a LOCATION ON A DISK.
+ *
+ * Loading from an explicit location bypasses candidate generation
+ * entirely: `from` is passed to the resolver verbatim. */
+Value *resolvefrom(Value *from) {
+  Value *out = vlist();
+  vpush(out, visnull(from) ? vnull() : from);
+  return out;
+}

package/project/.sdk/tm/c/feature/secrets/plugin/resolve.h

@@ -0,0 +1,18 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/resolve.h)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Dynamic resolution (§10.2) — name to candidate module ids. Pure: it
+ * returns the ids a host WOULD try, in order, and loads nothing. That
+ * is what lets the corpus pin resolution in a language with no dynamic
+ * loading at all. */
+
+#ifndef VOXGIG_PLUGIN_RESOLVE_H
+#define VOXGIG_PLUGIN_RESOLVE_H
+
+#include "types.h"
+#include "value.h"
+
+Value *resolvecandidates(Value *name, Value *sources);
+Value *resolvefrom(Value *from);
+
+#endif

package/project/.sdk/tm/c/feature/secrets/plugin/types.c

@@ -0,0 +1,150 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/types.c)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Errors and the raise mechanism. See types.h for why longjmp. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "types.h"
+
+static CatchFrame *current = NULL;
+
+/* The error the most recent raise parked here. FILE SCOPE ON PURPOSE —
+ * see types.h for why it cannot live in the frame. */
+static PluginError *pending = NULL;
+
+int plugin_try(CatchFrame *f) {
+  f->prev = current;
+  current = f;
+  pending = NULL;
+  return 0;
+}
+
+PluginError *plugin_caught(void) {
+  return pending;
+}
+
+void plugin_end(CatchFrame *f) {
+  current = f->prev;
+}
+
+/* §12's detail fields, IN THIS FIXED ORDER. The order is part of the
+ * contract: an earlier draft named six fields while other sections
+ * promised diagnostics with nowhere to go, which would have left each
+ * port inventing its own order and breaking message parity. */
+static const char *DETAIL_ORDER[] = {
+  "host", "ref", "name", "tag", "point", "key", "capability",
+  "range", "version", "match", "candidates", "cycle", "holders",
+  "refs", "path", "cause", NULL
+};
+
+const char *format_error(const char *code, const char *text, Value *details) {
+  /* Values render as COMPACT JSON, so a value containing a space or a
+   * bracket cannot break the parse and a list renders as an array. The
+   * bracket is absent entirely when no field applies. */
+  size_t cap = 256;
+  if (NULL != text) cap += strlen(text);
+  char *tail = (char *)arena_alloc(1);
+  tail[0] = '\0';
+  size_t taillen = 0;
+  size_t tailcap = 1;
+
+  for (int i = 0; NULL != DETAIL_ORDER[i]; i++) {
+    const char *k = DETAIL_ORDER[i];
+    if (!vhas(details, k)) continue;
+    const char *rendered = vjson(vget(details, k));
+    size_t need = taillen + strlen(k) + strlen(rendered) + 4;
+    if (need + 1 > tailcap) {
+      size_t newcap = need * 2 + 16;
+      char *grown = (char *)arena_alloc(newcap);
+      memcpy(grown, tail, taillen + 1);
+      tail = grown;
+      tailcap = newcap;
+    }
+    if (0 < taillen) {
+      tail[taillen++] = ' ';
+      tail[taillen] = '\0';
+    }
+    int n = snprintf(tail + taillen, tailcap - taillen, "%s=%s", k, rendered);
+    taillen += (size_t)n;
+  }
+
+  size_t total = strlen("plugin/") + strlen(code) + 2 +
+                 (NULL == text ? 0 : strlen(text)) + taillen + 8;
+  char *out = (char *)arena_alloc(total);
+  if (0 < taillen) {
+    snprintf(out, total, "plugin/%s: %s [%s]", code,
+             NULL == text ? "" : text, tail);
+  }
+  else {
+    snprintf(out, total, "plugin/%s: %s", code, NULL == text ? "" : text);
+  }
+  (void)cap;
+  return out;
+}
+
+void fail(const char *code, const char *text, Value *details) {
+  PluginError *e = (PluginError *)arena_alloc(sizeof(PluginError));
+  e->code = arena_strdup(code);
+  e->text = arena_strdup(NULL == text ? "" : text);
+  e->details = NULL == details ? vmap() : details;
+  e->message = format_error(code, text, e->details);
+
+  if (NULL == current) {
+    /* No catch frame: the caller could not have checked, so saying so
+     * loudly beats returning into code that will use a bad value. */
+    fprintf(stderr, "plugin: uncaught %s\n", e->message);
+    exit(70);
+  }
+
+  CatchFrame *f = current;
+  current = f->prev;
+  pending = e;
+  longjmp(f->jmp, 1);
+}
+
+Value *details1(const char *k, Value *v) {
+  Value *d = vmap();
+  vset(d, k, v);
+  return d;
+}
+
+Value *details2(const char *k1, Value *v1, const char *k2, Value *v2) {
+  Value *d = vmap();
+  vset(d, k1, v1);
+  vset(d, k2, v2);
+  return d;
+}
+
+Value *plugin_merge(Value *a, Value *b) {
+  if (!vismap(a) || !vismap(b)) return NULL == b ? a : b;
+  Value *out = vmap();
+  const char **keys;
+  size_t n = vkeys(a, &keys);
+  for (size_t i = 0; i < n; i++) vset(out, keys[i], vget(a, keys[i]));
+  n = vkeys(b, &keys);
+  for (size_t i = 0; i < n; i++) {
+    Value *bv = vget(b, keys[i]);
+    Value *av = vget(out, keys[i]);
+    if (vismap(av) && vismap(bv)) vset(out, keys[i], plugin_merge(av, bv));
+    else vset(out, keys[i], bv);
+  }
+  return out;
+}
+
+bool matchvalue(Value *want, Value *have) {
+  if (visnull(want)) return true;
+  if (vismap(want)) {
+    if (!vismap(have)) return false;
+    const char **keys;
+    size_t n = vkeys(want, &keys);
+    for (size_t i = 0; i < n; i++) {
+      if (!vhas(have, keys[i])) return false;
+      if (!matchvalue(vget(want, keys[i]), vget(have, keys[i]))) return false;
+    }
+    return true;
+  }
+  return vsame(want, have);
+}

package/project/.sdk/tm/c/feature/secrets/plugin/types.h

@@ -0,0 +1,104 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (c/src/types.h)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Errors, and the raise mechanism (§12).
+ *
+ * SETJMP/LONGJMP, and the reason is fidelity rather than convenience.
+ * The canonical RAISES: a failing call abandons the rest of the
+ * function, and the corpus is full of entries that assert exactly what
+ * survived a raise mid-sequence (`resource/unwind`, `lifecycle/fail`).
+ * Threading an error return through every function would let a missed
+ * check silently continue past a failure, which is the one thing the
+ * corpus cannot see and the one thing it is trying to pin. `longjmp`
+ * abandons the frame the way a `throw` does.
+ *
+ * THIS IS SAFE HERE BECAUSE OF THE ARENA. `longjmp` past a frame leaks
+ * whatever that frame owned; nothing here owns anything, so there is
+ * nothing to leak. The two decisions hold each other up.
+ *
+ * Ports compare by CODE and never by message: wording is a port's own
+ * business. The FORMAT is pinned, because a parseable message is what
+ * makes a log searchable across twenty languages.
+ */
+
+#ifndef VOXGIG_PLUGIN_TYPES_H
+#define VOXGIG_PLUGIN_TYPES_H
+
+#include <setjmp.h>
+#include <stdbool.h>
+
+#include "value.h"
+
+typedef struct {
+  const char *code;
+  const char *text;
+  Value *details;
+  const char *message;
+} PluginError;
+
+/* The active catch frame. `plugin_try` pushes one, `plugin_end_try`
+ * pops it. A raise with no frame installed aborts loudly rather than
+ * returning into a caller that cannot have checked. */
+typedef struct CatchFrame {
+  jmp_buf jmp;
+  struct CatchFrame *prev;
+} CatchFrame;
+
+/* THE ERROR IS NOT IN THE FRAME, and that is the whole point of this
+ * declaration. The obvious design parks it in a `PluginError *err`
+ * member, but the frame is an automatic local of the function that
+ * called `setjmp`, and C11 7.13.2.1p3 says an automatic local of that
+ * function which is not `volatile` and was CHANGED between the `setjmp`
+ * and the `longjmp` has an INDETERMINATE value once `setjmp` returns
+ * the second time. `fail` changes it, through a pointer, from another
+ * translation unit. Taking the frame's address makes it work on every
+ * compiler anyone will use, and it is still undefined: the standard
+ * says nothing about the address being taken, only about the
+ * modification, so a future optimiser is entitled to cache the member
+ * in a register across the jump and hand the handler a stale pointer.
+ *
+ * A file-scope pending error has no such rule attached — it is static
+ * storage, not automatic — so `fail` parks the error there and the
+ * handler reads it back with `plugin_caught`. The `zig` port arrived at
+ * the same shape from the opposite direction: its error values carry no
+ * payload at all, so a module-global pending is the only place a
+ * `PluginError` can live. `plugin_try` clears it on push, so a handler
+ * can never read an error left over from an earlier frame.
+ *
+ * Use as:
+ *
+ *   CatchFrame f;
+ *   if (0 == PLUGIN_TRY(&f)) { ... body ... PLUGIN_END(&f); }
+ *   else { PluginError *e = plugin_caught(); ... }
+ *
+ * The body MUST reach PLUGIN_END on every non-raising path, and the
+ * handler MUST read `plugin_caught` before installing another frame.
+ */
+int plugin_try(CatchFrame *f);
+void plugin_end(CatchFrame *f);
+PluginError *plugin_caught(void);
+
+#define PLUGIN_TRY(f) (plugin_try(f), setjmp((f)->jmp))
+#define PLUGIN_END(f) plugin_end(f)
+
+/* Raise. Never returns. */
+void fail(const char *code, const char *text, Value *details);
+
+/* §12's detail fields render in a FIXED ORDER — part of the contract,
+ * not a formatting preference, because otherwise each port invents its
+ * own and message parity is gone. */
+const char *format_error(const char *code, const char *text, Value *details);
+
+/* Convenience: a one-key details map. */
+Value *details1(const char *k, Value *v);
+Value *details2(const char *k1, Value *v1, const char *k2, Value *v2);
+
+/* Deep merge, struct's semantics: maps merge, everything else replaces.
+ * §16 permits voxgig/struct for this and C has no port of it. */
+Value *plugin_merge(Value *a, Value *b);
+
+/* §11.1's partial match: every leaf in `want` must be present and equal
+ * in `have`; keys not mentioned are not checked. */
+bool matchvalue(Value *want, Value *have);
+
+#endif