@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/ocaml/feature/secrets/plugin/defs.ml

@@ -0,0 +1,143 @@
+(* VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ocaml/src/defs.ml) *)
+(* Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* The mutually recursive types: a definition's callbacks take an
+   instance, an instance points at its host, and a host holds a catalog
+   of definitions.
+
+   THEY LIVE IN ONE FILE BECAUSE OCAML SAYS SO. Modules cannot be
+   mutually recursive across compilation units, and this cycle is real
+   rather than accidental — it is the same cycle `c` expresses with a
+   forward `typedef struct Inst Inst;`. The functions over these types
+   are split back out into `catalog.ml` and `host.ml`, so only the
+   declarations are gathered here. *)
+
+module V = Value
+
+(* A scope release: a closure, so an instance's teardown captures
+   whatever it needs rather than being handed a context pointer the way
+   `c` must. *)
+type release = unit -> unit
+
+(* `acquire` hands back one of these so a plugin can release early; the
+   scope keeps the entry, and unwinding it twice is a no-op. *)
+type scope_entry = {
+  sfn : release option;
+  mutable done_ : bool;
+  (* `acquire` and `release` both count toward `open`; a nested host's
+     teardown does NOT — a teardown is not an acquisition, and the
+     inner host keeps its own counter (`nest/open`). *)
+  counts : bool;
+}
+
+type definition = {
+  dname : string;
+  mutable shape : V.t;
+  (* A DEFINITION IS DATA WITH FUNCTIONS IN IT, not a class to extend.
+     A document could produce one, which is the property that makes a
+     catalog a data structure rather than a compile-time registry. *)
+  define : (inst -> unit) option;
+  activate : (inst -> unit) option;
+  deactivate : (inst -> unit) option;
+  close : (inst -> unit) option;
+  reconfigure : (inst -> V.t -> V.t -> unit) option;
+}
+
+and catalog = { mutable defs : (string * definition) list }
+
+and inst = {
+  iref : string;
+  idef : definition;
+  mutable status : string;
+  mutable pos : float;
+  seq : float;
+  mutable options : V.t;
+  istate : V.t;
+  mutable order : V.t;
+  (* §11.4's ALWAYS-RELUCTANT rebinding, made concrete: the provider
+     ref this instance's activation actually selected, per requirement
+     name. Recomputing the best candidate on every question silently
+     re-points a live consumer at any better-ranked newcomer, and then
+     losing the provider it was really using does not restart it. *)
+  mutable selected : V.t;
+  (* §9.6's `active: false`. THE BAR OUTLIVES THE APPLY THAT SET IT: a
+     flag consulted only while `apply` ran let a later direct `ready`
+     bring the instance live, which is the config switch it exists to
+     be silently ignored. *)
+  mutable barred : bool;
+  mutable unmet : V.t;
+  mutable scope : scope_entry list;
+  (* Declared in `define`, inserted only when activation SUCCEEDS
+     (§8.1). Holding them until then is what makes a failed activate
+     leave nothing behind. *)
+  mutable bindings : Point.bound list;
+  mutable inner : host option;
+  (* Declared in `define`, and VISIBLE while merely `loaded` (§11):
+     they are data, and hiding them would make the loaded state useless
+     for introspection. *)
+  exports : V.t;
+  provides : V.t;
+  owner : host;
+}
+
+and host = {
+  hcatalog : catalog;
+  reserved : V.t;
+  keys : V.t;
+  defaults : V.t;
+  profile : V.t;
+  points : V.t;
+  bases : (string * (V.t -> V.t)) list;
+  (* §11.3. `restart` (the default) treats provider replacement as an
+     ordinary runtime operation. `hold` is the strict reading —
+     deactivating a required instance is `plugin_dependency_held`. NOT
+     the default, because a station that cannot swap a provider without
+     a restart has lost the argument for having a plugin system. *)
+  dependency : string;
+  (* Set for the duration of a bulk teardown, so `held` knows this is a
+     coordinated operation rather than an ad-hoc deactivation. *)
+  mutable coordinated : bool;
+  mutable instances : inst list;
+  hlog : V.t;
+  events : V.t;
+  mutable seqn : float;
+  mutable openc : float;
+  mutable intransition : bool;
+  (* WHICH callback is running, not merely that one is. §8.1 puts
+     resource capture in `activate` and §8.3 says `release` outside
+     `activate` is `plugin_release_scope` — and a boolean alone cannot
+     tell `activate` from `define`, so it admitted an acquire in
+     `define` whose scope `unload` would never unwind. *)
+  mutable phase : string;
+}
+
+type hostoptions = {
+  ocatalog : catalog option;
+  oreserved : V.t;
+  okeys : V.t;
+  odefaults : V.t;
+  oprofile : V.t;
+  opoints : V.t;
+  obases : (string * (V.t -> V.t)) list;
+  odependency : string;
+}
+
+let nohostoptions =
+  { ocatalog = None; oreserved = V.vnull; okeys = V.vnull;
+    odefaults = V.vnull; oprofile = V.vnull; opoints = V.vnull;
+    obases = []; odependency = "" }
+
+type declarespec = {
+  sdefinition : string;
+  soptions : V.t option;
+  sorder : V.t;
+  spos : float option;
+  stag : string;
+  (* §9.1: set ONLY by `hostdeclare` — "the host declares those
+     instances itself, after the user merge, and always wins". *)
+  shostowned : bool;
+}
+
+let nospec =
+  { sdefinition = ""; soptions = None; sorder = V.vnull; spos = None;
+    stag = ""; shostowned = false }

package/project/.sdk/tm/ocaml/feature/secrets/plugin/depend.ml

@@ -0,0 +1,217 @@
+(* VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ocaml/src/depend.ml) *)
+(* Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* Dependency cardinality, policy, and the restart graph (§11.3).
+
+   TWO AXES, BOTH DECLARED BY THE DEFINITION THAT HAS THE REQUIREMENT,
+   because only it knows what it can cope with:
+
+                  | static (default)          | dynamic
+     -------------|---------------------------|--------------------------
+     mandatory    | unmet -> pending;         | unmet -> pending;
+     (default)    | lost  -> pending,         | lost  -> STAYS LIVE,
+                  |          recursively      |          notified
+     -------------|---------------------------|--------------------------
+     optional:true| never gates activation;   | never gates activation;
+                  | a change deactivates and  | a change is a
+                  | reactivates               | notification, nothing else
+
+   `dynamic` means the plugin has said, IN WRITING, that it can survive
+   its provider being swapped underneath it. It is not the default
+   because most plugins cannot, and the cost of wrongly assuming they
+   can is a live instance holding a dead reference. *)
+
+module V = Value
+
+(* A bare string is shorthand for `{name}`. *)
+let normrequire r =
+  if V.is_str r then begin
+    let out = V.vmap () in
+    V.set out "name" r;
+    out
+  end
+  else if V.is_map r then r
+  else V.vmap ()
+
+(* BOTH AXES ARE READ AT TWO LEVELS, AND THE PER-REQUIREMENT ONE WINS.
+
+   The instance-level `policy` and `optional` list are how a DOCUMENT
+   states the axis without editing the definition, and they apply to
+   every requirement. The per-requirement form is strictly more
+   expressive: an instance that is `static` on its store and `dynamic`
+   on its metrics cannot be written at all at the instance level, and
+   that is the ordinary case rather than an exotic one.
+
+   `optional` UNIONS rather than overriding — both spellings say this
+   requirement need not gate activation, and there is no reading under
+   which one of them means "actually, mandatory". *)
+let requirements options =
+  let raw = V.get options "requires" in
+  let marked = V.get options "optional" in
+  let fallback = V.get options "policy" in
+  V.oflist
+    (List.map
+       (fun item ->
+         let r = normrequire item in
+         let o = V.vmap () in
+         List.iter (fun k -> V.set o k (V.get r k)) (V.keys r);
+         let opt =
+           V.truthy (V.get r "optional")
+           || (V.is_list marked
+              && List.exists (fun m -> V.same m (V.get r "name"))
+                   (V.items marked))
+         in
+         if opt then V.set o "optional" (V.vbool true);
+         if V.is_null (V.get o "policy") && not (V.is_null fallback) then
+           V.set o "policy" fallback;
+         o)
+       (V.items raw))
+
+(* Does losing this requirement's SELECTED provider restart the
+   consumer? The mandatory ones under `static`, and the `static`
+   optional ones — both make a capability change deactivate and
+   reactivate. `dynamic` never restarts. *)
+let restartsonloss r =
+  let p = V.get r "policy" in
+  "dynamic" <> (if V.is_str p then V.as_str p else "static")
+
+(* Does an unmet requirement keep the consumer out of `live`?
+
+   CARDINALITY ALONE DECIDES THIS, NOT POLICY. `dynamic` is a statement
+   about surviving a SWAP, not about starting without the thing at all
+   — a mandatory-dynamic consumer still waits in `pending` for its
+   first provider. Conflating the two would let a plugin that declared
+   it can cope with replacement activate with nothing to call. *)
+let gatesactivation r = true <> V.as_bool (V.get r "optional")
+
+(* Edges that can cause a restart, which is exactly the set a cycle
+   must be detected over (§11.3): the mandatory requirements AND THE
+   `static` OPTIONAL ONES, because both make a capability change
+   deactivate and reactivate the consumer — and a cycle of restarts
+   does not settle.
+
+   ONLY `dynamic` OPTIONAL EDGES ARE EXCLUDED, and they are the ones
+   the exclusion was for. An earlier draft of §11.3 excluded EVERY
+   optional edge and thereby admitted the non-terminating case it was
+   trying to permit. *)
+let restartcausing r = gatesactivation r || restartsonloss r
+
+let dependencycycle nodes =
+  (* TWO INDEXES, NOT ONE MERGED MAP. Capability names and refs are
+     matched differently — a capability by its exact name, a ref
+     through the canonical spelling (§4 rule 5) — and one map keyed by
+     both can only do one of them. Keyed by both and looked up raw, a
+     cycle spelled `a$`/`b$` finds no providers and EVADES the
+     load-time check that exists to catch a non-terminating
+     reconcile. *)
+  let bycap = V.vmap () in
+  let isref = V.vmap () in
+  List.iter
+    (fun n ->
+      let nref = V.as_str (V.get n "ref") in
+      V.set isref nref (V.vbool true);
+      List.iter
+        (fun capv ->
+          let cap = V.as_str capv in
+          let l = V.get bycap cap in
+          let l =
+            if V.is_null l then (let x = V.vlist () in V.set bycap cap x; x)
+            else l
+          in
+          V.push l (V.vstr nref))
+        (V.items (V.get n "provides")))
+    (V.items nodes);
+
+  let edges = V.vmap () in
+  List.iter
+    (fun n ->
+      let nref = V.as_str (V.get n "ref") in
+      let out = ref [] in
+      List.iter
+        (fun r ->
+          if restartcausing r then begin
+            let rname = V.as_str (V.get r "name") in
+            let from =
+              List.map V.as_str (V.items (V.get bycap rname))
+            in
+            (* A node satisfies its own name AS A REF (§11.1),
+               canonically — exactly what `providersof` does at
+               runtime, so the load-time graph and the running one
+               agree about what an edge is. *)
+            let from =
+              match Ref.tryref rname with
+              | Some a when V.has isref a && not (List.mem a from) ->
+                from @ [ a ]
+              | _ -> from
+            in
+            List.iter
+              (fun p -> if p <> nref && not (List.mem p !out) then
+                          out := !out @ [ p ])
+              from
+          end)
+        (V.items (V.get n "requires"));
+      V.set edges nref (V.oflist (List.map V.vstr (List.sort compare !out))))
+    (V.items nodes);
+
+  (* Iterative DFS with an explicit stack: twenty ports, and several of
+     them have no recursion budget worth relying on. *)
+  let white = 0 and grey = 1 and black = 2 in
+  let colour = V.vmap () in
+  List.iter
+    (fun n -> V.set colour (V.as_str (V.get n "ref")) (V.vnum (float_of_int white)))
+    (V.items nodes);
+
+  let found = ref None in
+  List.iter
+    (fun start ->
+      if None = !found
+         && white = int_of_float (V.as_num (V.get colour start))
+      then begin
+        let path = ref [ start ] in
+        let stack = ref [ (start, ref 0) ] in
+        V.set colour start (V.vnum (float_of_int grey));
+        while None = !found && [] <> !stack do
+          let tref, idx = List.hd !stack in
+          let tos = V.get edges tref in
+          if !idx >= V.len tos then begin
+            V.set colour tref (V.vnum (float_of_int black));
+            stack := List.tl !stack;
+            path := List.filteri (fun i _ -> i < List.length !path - 1) !path
+          end
+          else begin
+            let next = V.as_str (V.at tos !idx) in
+            incr idx;
+            let c = int_of_float (V.as_num (V.get colour next)) in
+            if c = grey then begin
+              (* Report the cycle itself, not the walk that found it. *)
+              let started = ref false in
+              let cycle =
+                List.filter
+                  (fun p ->
+                    if (not !started) && p = next then started := true;
+                    !started)
+                  !path
+              in
+              found := Some (V.oflist (List.map V.vstr (cycle @ [ next ])))
+            end
+            else if c <> black then begin
+              V.set colour next (V.vnum (float_of_int grey));
+              path := !path @ [ next ];
+              stack := (next, ref 0) :: !stack
+            end
+          end
+        done
+      end)
+    (V.sortedkeys edges);
+  !found
+
+(* Raise on a cycle, naming it. Separate from the detector so the
+   detector stays pure and corpus-testable. *)
+let checkcycle nodes =
+  match dependencycycle nodes with
+  | None -> ()
+  | Some cycle ->
+    Types.fail "plugin_dependency_cycle"
+      ("requirements cycle: "
+       ^ String.concat " -> " (List.map V.as_str (V.items cycle)))
+      ~details:(Types.details1 "cycle" cycle)

package/project/.sdk/tm/ocaml/feature/secrets/plugin/env.ml

@@ -0,0 +1,197 @@
+(* VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ocaml/src/env.ml) *)
+(* Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* Environment overrides (§9.5) — level 7 of the ladder.
+
+   One prefix, so nothing drifts: `VOXGIG_PLUGIN_*`.
+
+     VOXGIG_PLUGIN_PROFILE            the profile name
+     VOXGIG_PLUGIN_<REF>_<PATH>       one option
+     VOXGIG_PLUGIN_ACTIVE/INACTIVE    comma-separated refs, INACTIVE wins
+
+   THE ENCODING IS LOSSY, AND THIS SAYS SO RATHER THAN PRETENDING
+   OTHERWISE. Ref and path are upper-snake with `$` -> `__` and `.` ->
+   `_`. But `_` is legal in a name and in a tag, and the mapping folds
+   case, so `retry$fast` and `retry__fast` both encode to
+   `RETRY__FAST`.
+
+   Rather than restrict a grammar the rest of the stack already uses,
+   the host DETECTS THE COLLISION: it encodes every ref it holds, and a
+   key two refs claim is `plugin_env_ambiguous`, naming both.
+
+   Pure: a function over a string map and a ref set, so the corpus
+   tests it without touching a real environment. *)
+
+module V = Value
+
+let prefix = "VOXGIG_PLUGIN_"
+
+let encoderef r =
+  let buf = Buffer.create (String.length r * 2) in
+  String.iter
+    (fun c ->
+      if '$' = c then Buffer.add_string buf "__"
+      else if '.' = c then Buffer.add_char buf '_'
+      else if 'a' <= c && c <= 'z' then
+        Buffer.add_char buf (Char.uppercase_ascii c)
+      else Buffer.add_char buf c)
+    r;
+  Buffer.contents buf
+
+let checkreserved r reserved =
+  if V.is_list reserved && 0 < V.len reserved then begin
+    let name = Ref.refname r in
+    if List.exists (fun x -> V.is_str x && V.as_str x = name)
+         (V.items reserved)
+    then
+      Types.fail "plugin_ref_reserved"
+        ("ref is reserved by the host: " ^ r)
+        ~details:(Types.details1 "ref" (V.vstr r))
+  end
+
+(* Values parse as JSON, FALLING BACK TO STRING — so `8080` is a
+   number, `true` is a boolean, `{"a":1}` is a map, and `hello` is the
+   string it looks like rather than a parse error. *)
+let parsevalue s = try V.parse s with V.Parse_error _ -> V.vstr s
+
+let lower s = String.lowercase_ascii s
+
+let starts_with p s =
+  String.length s >= String.length p && String.sub s 0 (String.length p) = p
+
+let split_on c s = String.split_on_char c s
+
+let trim = String.trim
+
+let applyenv input =
+  let env = V.get input "env" in
+  let env = if V.is_map env then env else V.vmap () in
+  let refsin = V.get input "refs" in
+  let reserved = V.get input "reserved" in
+
+  let out = V.vmap () in
+  let options = V.vmap () in
+  let active = V.vlist () in
+  let inactive = V.vlist () in
+  V.set out "options" options;
+  V.set out "active" active;
+  V.set out "inactive" inactive;
+
+  (* Encode every ref the host holds, and refuse a key that two of them
+     claim. Done UP FRONT so the collision is reported even when no
+     environment variable exercises it — a latent ambiguity is still an
+     ambiguity, and finding it at deploy time is the failure this
+     exists to prevent. *)
+  let byencoded = V.vmap () in
+  if V.is_list refsin then
+    List.iter
+      (fun r ->
+        let r = Ref.canonref r in
+        let e = encoderef r in
+        let l = V.get byencoded e in
+        let l = if V.is_null l then (let n = V.vlist () in V.set byencoded e n; n)
+                else l in
+        V.push l (V.vstr r))
+      (V.items refsin);
+
+  let encs = V.sortedkeys byencoded in
+  List.iter
+    (fun e ->
+      let claims = V.get byencoded e in
+      if 1 < V.len claims then begin
+        let a = V.as_str (V.at claims 0) and b = V.as_str (V.at claims 1) in
+        let lo = if a <= b then a else b and hi = if a <= b then b else a in
+        let d = V.vmap () in
+        V.set d "encoded" (V.vstr e);
+        V.set d "refs" (V.oflist [ V.vstr lo; V.vstr hi ]);
+        Types.fail "plugin_env_ambiguous"
+          ("refs collide in the environment encoding as " ^ e ^ ": " ^ lo
+           ^ ", " ^ hi)
+          ~details:d
+      end)
+    encs;
+
+  (* LONGEST encoded ref first, so `retry$fast` wins over `retry` on
+     `RETRY__FAST_MIN`. Shortest-first would read the tag as a path. *)
+  let order =
+    List.sort
+      (fun a b ->
+        let la = String.length a and lb = String.length b in
+        if la <> lb then compare lb la else compare a b)
+      encs
+  in
+
+  let plen = String.length prefix in
+  List.iter
+    (fun key ->
+      if starts_with prefix key then begin
+        let rest = String.sub key plen (String.length key - plen) in
+        let raw = V.get env key in
+        let value = if V.is_str raw then V.as_str raw else "" in
+
+        if "PROFILE" = rest then V.set out "profile" (V.vstr value)
+        else if "ACTIVE" = rest || "INACTIVE" = rest then begin
+          let isactive = "ACTIVE" = rest in
+          List.iter
+            (fun piece ->
+              let piece = trim piece in
+              if "" <> piece then begin
+                let c = Ref.canonrefs piece in
+                (* The reservation covers EVERY input layer (§9.1).
+                   VOXGIG_PLUGIN_INACTIVE=station is easier to set than
+                   editing a config file, and INACTIVE has the final
+                   word — so guarding documents alone would leave the
+                   one lever this mechanism exists to deny wide open. *)
+                checkreserved c reserved;
+                V.push (if isactive then active else inactive) (V.vstr c)
+              end)
+            (split_on ',' value)
+        end
+        else begin
+          let enc =
+            List.find_opt
+              (fun cand ->
+                rest = cand
+                || (String.length rest > String.length cand
+                    && starts_with cand rest
+                    && '_' = rest.[String.length cand]))
+              order
+          in
+          match enc with
+          | None -> ()   (* not for any ref this host holds *)
+          | Some enc ->
+            let r = V.as_str (V.at (V.get byencoded enc) 0) in
+            checkreserved r reserved;
+            (* A ref with no path sets nothing. *)
+            if rest <> enc then begin
+              let pathtext =
+                String.sub rest
+                  (String.length enc + 1)
+                  (String.length rest - String.length enc - 1)
+              in
+              let segs = split_on '_' pathtext in
+              let node = ref (V.get options r) in
+              if V.is_null !node then begin
+                let n = V.vmap () in
+                V.set options r n;
+                node := n
+              end;
+              let rec walk = function
+                | [] -> ()
+                | [ leaf ] -> V.set !node (lower leaf) (parsevalue value)
+                | seg :: rest ->
+                  let next = V.get !node (lower seg) in
+                  let next =
+                    if V.is_map next then next
+                    else (let n = V.vmap () in V.set !node (lower seg) n; n)
+                  in
+                  node := next;
+                  walk rest
+              in
+              walk segs
+            end
+        end
+      end)
+    (V.sortedkeys env);
+
+  out

package/project/.sdk/tm/ocaml/feature/secrets/plugin/export.ml

@@ -0,0 +1,89 @@
+(* VENDORED: @voxgig/plugin sdk-20260908-1556-0 (ocaml/src/export.ml) *)
+(* Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0] *)
+(* License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream. *)
+(* Exports (§11).
+
+   THE UNQUALIFIED ALIAS IS THE INTERESTING PART. `retry/client`
+   resolves to the UNTAGGED instance if one exists; if not, and exactly
+   one tagged instance exports that key, it resolves to that one; if
+   two do, it is `plugin_export_ambiguous` — deliberately diverging
+   from seneca's silent last-wins, because with multi-instance as a
+   headline feature an ambiguous alias is a defect waiting for
+   production. *)
+
+module V = Value
+
+(* Answers None for "no such export", which is not an error —
+   `export/missing` pins that, and is why the answer is an option
+   rather than a null Value. *)
+let resolveexport spec exported =
+  let s = if V.is_str spec then V.as_str spec else "" in
+  match String.index_opt s '/' with
+  | None ->
+    Types.fail "plugin_export_ambiguous"
+      ("export spec needs a key: " ^ s)
+      ~details:(Types.details1 "spec" (V.vstr s))
+  | Some cut ->
+    let head = String.sub s 0 cut in
+    let key = String.sub s (cut + 1) (String.length s - cut - 1) in
+
+    (* A fully qualified ref: exactly one answer or none.
+
+       VALIDATING, not tolerant. The canonical calls [canonref head],
+       which RAISES -- so [retry$bad!/client] is [plugin_bad_tag] and
+       [2fa/client] is [plugin_bad_name]. Reading it with [tryref]
+       turned a configuration typo into an ordinary missing export,
+       which is the error the caller most needs to see, silently
+       swallowed. *)
+    let byref =
+      match Some (Ref.canonrefs head) with
+      | None -> None
+      | Some want ->
+        List.fold_left
+          (fun acc e ->
+            match acc with
+            | Some _ -> acc
+            | None ->
+              if V.as_str (V.get e "ref") = want && V.as_str (V.get e "key") = key
+              then Some (V.get e "value")
+              else None)
+          None (V.items exported)
+    in
+    (match byref with
+     | Some v -> Some v
+     | None ->
+       (* An alias: the NAME, not a ref. Look at every instance of it. *)
+       let byname =
+         List.filter
+           (fun e ->
+             Ref.refname (V.as_str (V.get e "ref")) = head
+             && V.as_str (V.get e "key") = key)
+           (V.items exported)
+       in
+       if [] = byname then None
+       else
+         (* The untagged instance wins outright when there is one. *)
+         let untagged =
+           List.find_opt
+             (fun e -> None = String.index_opt (V.as_str (V.get e "ref")) '$')
+             byname
+         in
+         (match untagged with
+          | Some e -> Some (V.get e "value")
+          | None ->
+            if 1 = List.length byname then
+              Some (V.get (List.hd byname) "value")
+            else begin
+              let refs =
+                List.sort compare
+                  (List.map (fun e -> V.as_str (V.get e "ref")) byname)
+              in
+              let d = V.vmap () in
+              V.set d "spec" (V.vstr s);
+              V.set d "refs" (V.oflist (List.map V.vstr refs));
+              Types.fail "plugin_export_ambiguous"
+                ("alias " ^ s ^ " matches "
+                 ^ string_of_int (List.length byname)
+                 ^ " instances: " ^ String.concat ", " refs)
+                ~details:d
+            end))