@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/memory.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/memory.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd, MIT License */
 

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/support.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/sekreto 0.2.0 (typescript/src/provider/support.ts)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, and how a
 // provider kind becomes a voxgig/plugin definition.

package/project/.sdk/tm/ts/src/feature/test/TestFeature.ts

@@ -17,6 +17,8 @@ const S_NOT_FOUND = 'Not found'
 // against the API's real param names, never a bare 'id' the API itself
 // does not use.
 function ownIdField(config: any, getpath: any, entityName: string): string {
+  let fallback = ''
+
   for (const opname of ['load', 'remove', 'update']) {
     const points = getpath(config, ['entity', entityName, 'op', opname, 'points']) || []
     const canonical = points.filter((pt: any) =>
@@ -50,7 +52,41 @@ function ownIdField(config: any, getpath: any, entityName: string): string {
     const query = (best && best.args && best.args.query) || []
     const reqdQuery = query.filter((q: any) => false !== q.reqd)
     if (1 === reqdQuery.length) return String(reqdQuery[0].name)
+
+    // The last path parameter of a literal-terminal route is remembered as
+    // a LAST RESORT, but not returned yet — see below.
+    if ('' === fallback) {
+      for (let i = parts.length - 1; 0 <= i; i--) {
+        const part = String(parts[i])
+        if (part.startsWith('{')) {
+          fallback = part.slice(1, -1)
+          break
+        }
+      }
+    }
+  }
+
+  // ONLY AFTER EVERY OP, because an op whose routes all end in a literal
+  // says nothing while another op may still name the key outright.
+  // github's `private_registry` reads
+  // `/orgs/{org}/private-registries/public-key` under `load` and writes
+  // `/orgs/{org}/private-registries/{secret_name}` under `update`:
+  // returning the load route's last parameter made the key `org`, and its
+  // update answered 404 for want of a registry named after an
+  // organisation.
+  //
+  // Reached at all only by an entity with no record-terminal route
+  // anywhere — github's `copilot` is read from
+  // `/orgs/{org_id}/members/{username}/copilot`, whose key is plainly
+  // `username`. Abstaining left the mock stamping no key on a created
+  // record while the provider addressed it by `username`, so the load
+  // straight after a create found nothing. The provider's recordKey has
+  // always used this fallback; matching it removes a disagreement rather
+  // than adding a guess.
+  if ('' !== fallback) {
+    return fallback
   }
+
   return 'id'
 }
 
@@ -354,7 +390,69 @@ class TestFeature extends BaseFeature {
     const qand: any[] = []
     const q = { '`$AND`': qand }
 
-    for (let k of keysof(args)) {
+    // WHERE A PATH PARAMETER'S VALUE ACTUALLY LIVES IN A RECORD.
+    //
+    // A request addresses a record by path parameter; a stored record carries
+    // whatever the API's response carries. Those are not always the same
+    // name, and are not always at the same depth: github addresses a repo by
+    // `{owner}/{repo}` and returns the owner as an OBJECT (`owner.login`)
+    // with the repository under `name`. Matching by parameter name alone
+    // found nothing for such a record, so a seeded composite record was
+    // unfindable and every read of it came back 404.
+    //
+    // `id.from` in the model says where each parameter is carried, as a
+    // dotted path. `select` matches a NESTED query shape but not a dotted
+    // key, so the path is expanded into one — `owner.login` becomes
+    // `{ owner: { login: value } }`.
+    const idfrom = getpath(ctx.config, [
+      'entity', getprop(ctx.entity, 'name'), 'id', 'from']) || {}
+
+    const nest = (path: string, value: any) => {
+      const keys = String(path).split('.')
+      let out: any = value
+      for (let i = keys.length - 1; 0 <= i; i--) {
+        out = { [keys[i]]: out }
+      }
+      return out
+    }
+
+    // THE COMPOSITE PARTS FROM THE ENTITY MATCH TOO.
+    //
+    // A path parameter does not have to travel with the body. The seneca
+    // provider puts a composite record's parts in the ENTITY MATCH and
+    // leaves the body as the caller wrote it, because a path parameter is
+    // not a field — so `update`, which builds its query from `reqdata`,
+    // never looked at them. The query then matched every repo and
+    // `Repo({match:{owner,repo}}).update(...)` answered 404 while the same
+    // call with the parts in the body succeeded.
+    //
+    // EXACTLY THE PARTS, and only when nothing else addresses the record.
+    //
+    // Not every key the match holds: the match ACCRETES across calls on one
+    // entity instance, so after a create and an update it carries that
+    // record's parent scope as well — and the create branch below stamps the
+    // record's OWN key over the field it was seeded with, so a later read
+    // constrained on an accreted value finds nothing. Twenty-five of this
+    // SDK's own entity tests failed that way.
+    //
+    // And not when the call already carries an `id`: a direct id IS the
+    // address, and an accreted part then only narrows it wrongly — this
+    // SDK's own activity test updates `id: ACTIVITY00` on an entity whose
+    // match still holds the `repo` a previous list used.
+    const match = ctx.match || {}
+    const names: any[] = [...keysof(args)]
+
+    if (null == getprop(args, 'id')) {
+      for (const part of (getpath(ctx.config, [
+        'entity', getprop(ctx.entity, 'name'), 'id', 'parts']) || [])) {
+        const pname = String(part)
+        if (!names.includes(pname) && null != getprop(match, pname)) {
+          names.push(pname)
+        }
+      }
+    }
+
+    for (let k of names) {
       if ('id' === k || !isempty(select(reqd, k))) {
         const v = param(ctx, k)
         const ka = getprop(op.alias, k)
@@ -364,6 +462,14 @@ class TestFeature extends BaseFeature {
           qor.push({ [ka]: v })
         }
 
+        // An ALTERNATIVE, never a replacement: the parameter name still
+        // matches a record that happens to carry it flat, so a seed written
+        // either way is found. `$OR` is what makes that safe.
+        const kf = getprop(idfrom, k)
+        if (null != kf && k !== kf) {
+          qor.push(nest(kf, v))
+        }
+
         qor = { '`$OR`': qor }
 
         qand.push(qor)

package/project/.sdk/tm/ts/src/utility/StructUtility.ts

@@ -1,9 +1,9 @@
 // VENDORED: @voxgig/struct 0.3.4 (typescript/src/StructUtility.ts)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/struct @ abd93227e3295151f8dcd18597c3f3f2577af8b7  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
 
-// VERSION: @voxgig/struct 0.3.5
+// VERSION: @voxgig/struct 0.3.6
 
 /* Voxgig Struct
  * =============

package/project/.sdk/tm/ts/src/utility/TransformRequestUtility.ts

@@ -22,7 +22,7 @@ function transformRequest(ctx: Context) {
       reqdata: ctx.reqdata
     }, reqform)
 
-    return reqdata
+    return stripAction(reqdata)
   }
   catch (err) {
     return utility.makeError(ctx, err)
@@ -30,6 +30,54 @@ function transformRequest(ctx: Context) {
 }
 
 
+
+// `$action` selects WHICH POINT of the op to use (see MakePointUtility). It
+// is the SDK's own discriminator, never an API field, so it must not survive
+// into the wire body. The GraphQL path already strips it where it builds its
+// input object; this is the same rule on the REST path, which had no such
+// step and sent it verbatim -- `{"$action":"merge", ...}` to GitHub's merge
+// endpoint. Harmless there, because GitHub ignores unknown keys; not
+// harmless against an API that validates its request bodies strictly.
+//
+// Only a top-level key of a plain object: a body may legitimately be an
+// array or a scalar, and neither can carry a selector.
+//
+// `__proto__` is assigned through Object.defineProperty, never `body[key] =`.
+// It is a legal JSON key and can be a real API field, but plain assignment
+// invokes the inherited setter: the key would vanish from the serialised
+// request and silently become the body's prototype instead. Same treatment
+// as StructUtility's condenseSet, for the same reason.
+
+function stripAction(reqdata: any) {
+  if (null == reqdata || 'object' !== typeof reqdata || Array.isArray(reqdata)) {
+    return reqdata
+  }
+
+  if (!Object.prototype.hasOwnProperty.call(reqdata, '$action')) {
+    return reqdata
+  }
+
+  const body: Record<string, any> = {}
+  for (const key of Object.keys(reqdata)) {
+    if ('$action' === key) {
+      continue
+    }
+    if ('__proto__' === key) {
+      Object.defineProperty(body, key, {
+        value: reqdata[key],
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      })
+    }
+    else {
+      body[key] = reqdata[key]
+    }
+  }
+
+  return body
+}
+
 export {
   transformRequest
 }

package/project/.sdk/tm/ts/test/feature/secrets/Secrets.test.ts

@@ -260,6 +260,71 @@ describe('secrets', () => {
   })
 
 
+  // A MISS IS NOT A CACHEABLE ANSWER — sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // Default caching here, deliberately: `cache: true` is about holding a
+  // HIT, and holding the settled promise after a miss meant the chain was
+  // never asked again for the life of the client. A secret provisioned
+  // after startup (a mounted file, a vault policy granted a minute late)
+  // was invisible forever, and the only workaround was giving up hit
+  // caching entirely.
+  test('active: a MISS is re-asked, so a late secret is picked up',
+    async () => {
+      let calls = 0
+      const sdk = (SDK as any).test({}, {
+        feature: {
+          secrets: {
+            active: true,
+            providers: [{
+              lookup(_name: string): string | undefined {
+                calls++
+                // Absent on the first ask, present on the second.
+                return 1 < calls ? 'LATEKEY' : undefined
+              },
+              describe() { return 'late:test' },
+            }],
+          },
+        },
+      })
+
+      const first = await sdk.prepare({ path: '/' })
+      assert.equal(first.headers['authorization'], undefined,
+        'the first resolve missed, so no credential should go out')
+
+      const second = await sdk.prepare({ path: '/' })
+      credentialIs(second.headers['authorization'], 'LATEKEY')
+
+      assert.ok(1 < calls,
+        'the chain was asked once and the MISS cached: a secret that ' +
+        'appears later can never be picked up')
+    })
+
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  test('active: a HIT is still cached by default', async () => {
+    let calls = 0
+    const sdk = (SDK as any).test({}, {
+      feature: {
+        secrets: {
+          active: true,
+          providers: [{
+            lookup(_name: string): string { calls++; return 'KEY' + calls },
+            describe() { return 'counting:test' },
+          }],
+        },
+      },
+    })
+
+    await sdk.prepare({ path: '/' })
+    await sdk.prepare({ path: '/' })
+
+    assert.equal(calls, 1,
+      'a hit must be cached under the default cache: true')
+  })
+
+
   test('active: secret name is configurable', async () => {
     process.env[ENVPREFIX + 'API_TOKEN'] = 'TOKKEY01'
     try {
@@ -679,6 +744,14 @@ describe('secrets exchange', () => {
     assert.equal(stub.api().length, 1, 'a suppressed request must not be retried')
     assert.equal(stub.api()[0].auth, undefined,
       'no credential may be sent when auth is suppressed')
+
+    // AND NO PURCHASE. This is the half the API-call assertions cannot see:
+    // resolve() runs before _withRefresh's suppression check, so the
+    // refresh token used to go to the token endpoint in a request body
+    // even here. Stopping the retry does not unsend it.
+    assert.equal(stub.token().length, 0,
+      'auth: null suppressed the credential but the refresh token was ' +
+      'still POSTed to the exchange endpoint')
   })
 
 

package/project/.sdk/tm/ts/test/vendor/omni/Runner.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Runner.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/ts/test/vendor/omni/Util.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/Util.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/ts/test/vendor/omni/index.ts

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/omni 0.1.4 (typescript/src/index.ts)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // @voxgig/omni - shared multi-language test runner.
 

package/project/.sdk/tm/zig/feature/secrets/plugin/capability.zig

@@ -0,0 +1,137 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/capability.zig)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Capabilities (§11.1).
+//!
+//! A DEPENDENCY IS ON A CAPABILITY, NOT ON A REF — because it is a
+//! dependency on something that can do the job, and which instance is
+//! doing it is exactly the configuration detail a plugin must not care
+//! about. (§11.1 makes one narrow exception for a ref, and `host.zig`
+//! implements it; the ranking here is capabilities only.)
+//!
+//! But A BINDING IS TO AN INSTANCE, not to a capability, which is what
+//! decides behaviour when the bound provider leaves while another match
+//! remains.
+
+const std = @import("std");
+const v = @import("value.zig");
+const t = @import("types.zig");
+const version = @import("version.zig");
+
+/// PARTIAL MATCH, RECURSING INTO MAPS (§11.1). THIS FUNCTION IS WHAT
+/// "EVERY LEAF" MEANS, and an earlier draft of the canonical did not
+/// have it: the check was a scalar compare, which for any compound value
+/// is reference identity in JavaScript. A requirement and a capability
+/// are declared in different places and are never the same object, so
+/// `match: {limits: {max: 5}}` could not be satisfied by ANY provider —
+/// including one declaring exactly that. Invisible while every corpus
+/// entry is scalar, which is why the go port found it and P2 did not.
+///
+/// A LIST IS COMPARED LEAF-WISE AT THE SAME LENGTH, not as a subset —
+/// "the first two of your three regions" is not something `match` can
+/// say.
+pub fn capmatchvalue(want: ?*v.Value, got: ?*v.Value) bool {
+    if (v.isMap(want)) {
+        if (!v.isMap(got)) return false;
+        for (v.keys(want)) |k| {
+            if (!v.has(got, k)) return false;
+            if (!capmatchvalue(v.get(want, k), v.get(got, k))) return false;
+        }
+        return true;
+    }
+    if (v.isList(want)) {
+        if (!v.isList(got) or v.len(want) != v.len(got)) return false;
+        for (v.items(want), 0..) |x, i| {
+            if (!capmatchvalue(x, v.at(got, i))) return false;
+        }
+        return true;
+    }
+    return v.same(want, got);
+}
+
+pub fn capmatches(req: ?*v.Value, prov: ?*v.Value) bool {
+    if (!v.same(v.get(req, "name"), v.get(prov, "name"))) return false;
+
+    const range = v.get(req, "range");
+    if (!v.isNull(range)) {
+        const ver = v.get(prov, "version");
+        if (v.isNull(ver)) return false;
+        if (!version.satisfiesq(ver, range)) return false;
+    }
+
+    // `match` is checked against the provider's `attrs`, key by key. A
+    // key the provider does not carry is a MISS, not a pass: a
+    // requirement asking for `transactional: true` must not be satisfied
+    // by a provider that never said.
+    const m = v.get(req, "match");
+    if (!v.isNull(m)) {
+        var attrs = v.get(prov, "attrs");
+        if (v.isNull(attrs)) attrs = v.vmap();
+        for (v.keys(m)) |k| {
+            if (!v.has(attrs, k)) return false;
+            if (!capmatchvalue(v.get(m, k), v.get(attrs, k))) return false;
+        }
+    }
+
+    return true;
+}
+
+/// The rank key for one candidate. THE KEYS ARE PRECOMPUTED because the
+/// version comparison is fallible and a zig sort comparator cannot be:
+/// `parseversion` can fail, and a comparator that swallowed that would
+/// have to guess. Precomputing also makes the rank a TOTAL order on
+/// purpose — without one, "any provider satisfies" is true of the GRAPH
+/// and useless to the PLUGIN, and two ports could bind different `store`
+/// instances, both resolve green, and behave differently.
+const RankKey = struct {
+    noversion: u8, // a version beats none
+    ver: [3]f64, // negated, so HIGHEST version sorts first
+    priority: f64, // LOWEST priority first
+    pos: f64,
+    cand: *v.Value,
+};
+
+fn rankKey(c: *v.Value) RankKey {
+    const p = v.get(c, "provides");
+    const ver = v.get(p, "version");
+    var key = RankKey{
+        .noversion = if (v.isNull(ver)) 1 else 0,
+        .ver = .{ 0, 0, 0 },
+        .priority = if (v.isNum(v.get(p, "priority"))) v.asNum(v.get(p, "priority")) else 0,
+        .pos = v.asNum(v.get(c, "pos")),
+        .cand = c,
+    };
+    if (!v.isNull(ver)) {
+        if (version.parseversion(ver)) |parsed| {
+            var i: usize = 0;
+            while (i < 3) : (i += 1) key.ver[i] = -v.asNum(v.at(parsed, i));
+        } else |_| {
+            _ = t.take();
+        }
+    }
+    return key;
+}
+
+fn lessRank(_: void, a: RankKey, b: RankKey) bool {
+    if (a.noversion != b.noversion) return a.noversion < b.noversion;
+    var i: usize = 0;
+    while (i < 3) : (i += 1) {
+        if (a.ver[i] != b.ver[i]) return a.ver[i] < b.ver[i];
+    }
+    if (a.priority != b.priority) return a.priority < b.priority;
+    return a.pos < b.pos;
+}
+
+/// Rank the matching providers best-first: highest `version`, then
+/// LOWEST `priority` (default 0), then declaration position `pos`
+/// ascending. `candidates` is a list of {ref, pos, provides}.
+pub fn resolvecapability(req: ?*v.Value, candidates: ?*v.Value) *v.Value {
+    var hits = v.List(RankKey).init(v.arena());
+    for (v.items(candidates)) |c| {
+        if (capmatches(req, v.get(c, "provides"))) hits.append(rankKey(c)) catch @panic("oom");
+    }
+    std.mem.sort(RankKey, hits.items, {}, lessRank);
+    const out = v.vlist();
+    for (hits.items) |h| v.push(out, h.cand);
+    return out;
+}

package/project/.sdk/tm/zig/feature/secrets/plugin/catalog.zig

@@ -0,0 +1,90 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (zig/src/catalog.zig)
+// Source: https://github.com/voxgig/plugin @ 91c4936555a4ce198669ca2c578b91e27e92e5ec  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The definition catalog (§10.1).
+//!
+//! A definition is registered once and may back many instances. Option
+//! shapes are validated AT REGISTRATION, not when a document happens to
+//! exercise a key — so a malformed shape fails once, and in the same
+//! place everywhere (§9.4). `declare/shape` pins that timing.
+
+const std = @import("std");
+const v = @import("value.zig");
+const t = @import("types.zig");
+const cfg = @import("config.zig");
+const ref = @import("ref.zig");
+
+pub const Inst = @import("inst.zig").Inst;
+
+/// A DEFINITION IS DATA WITH FUNCTIONS IN IT, not a class to extend. A
+/// document could produce one, which is the property that makes a
+/// catalog a data structure rather than a compile-time registry.
+pub const LifecycleFn = *const fn (*Inst) t.Err!void;
+pub const ReconfigureFn = *const fn (*Inst, ?*v.Value, ?*v.Value) t.Err!void;
+
+pub const Definition = struct {
+    name: []const u8,
+    shape: ?*v.Value = null,
+    define: ?LifecycleFn = null,
+    activate: ?LifecycleFn = null,
+    deactivate: ?LifecycleFn = null,
+    close: ?LifecycleFn = null,
+    reconfigure: ?ReconfigureFn = null,
+};
+
+pub const Catalog = struct {
+    defs: v.List(*Definition),
+
+    pub fn add(c: *Catalog, def: *Definition) t.Err!void {
+        if (!ref.checkname(v.vstr(def.name))) {
+            return t.fail("plugin_definition_name", v.print("invalid definition name: {s}", .{def.name}), null);
+        }
+        // Validate the shape HERE. Deferring it to resolution time means
+        // a malformed shape surfaces at a different moment in every host
+        // that loads it, which is the divergence the stated domain
+        // exists to prevent.
+        if (!v.isNull(def.shape)) try cfg.checkshape(def.shape);
+
+        for (c.defs.items) |*e| {
+            if (std.mem.eql(u8, e.*.name, def.name)) {
+                e.* = def;
+                return;
+            }
+        }
+        c.defs.append(def) catch @panic("oom");
+    }
+
+    pub fn get(c: *Catalog, name: []const u8) ?*Definition {
+        for (c.defs.items) |d| {
+            if (std.mem.eql(u8, d.name, name)) return d;
+        }
+        return null;
+    }
+
+    pub fn has(c: *Catalog, name: []const u8) bool {
+        return c.get(name) != null;
+    }
+
+    pub fn names(c: *Catalog) *v.Value {
+        const m = v.vmap();
+        for (c.defs.items) |d| v.set(m, d.name, v.vbool(true));
+        const out = v.vlist();
+        for (v.sortedKeys(m)) |k| v.push(out, v.vstr(k));
+        return out;
+    }
+};
+
+pub fn makecatalog() *Catalog {
+    const c = v.arena().create(Catalog) catch @panic("oom");
+    c.* = .{ .defs = v.List(*Definition).init(v.arena()) };
+    return c;
+}
+
+/// The callback for a phase, by the name the log and the corpus use.
+pub fn callbackFor(d: *Definition, at: []const u8) ?LifecycleFn {
+    if (std.mem.eql(u8, at, "define")) return d.define;
+    if (std.mem.eql(u8, at, "activate")) return d.activate;
+    if (std.mem.eql(u8, at, "deactivate")) return d.deactivate;
+    if (std.mem.eql(u8, at, "close")) return d.close;
+    return null;
+}