@voxgig/sdkgen 4.30.0 → 4.30.1

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Depend.ts

@@ -1,30 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Depend.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Dependency cardinality, policy, and the restart graph (§11.3).
- *
- * TWO AXES, BOTH DECLARED BY THE DEFINITION THAT HAS THE REQUIREMENT,
- * because only it knows what it can cope with:
- *
- *                | static (default)          | dynamic
- *   -------------|---------------------------|--------------------------
- *   mandatory    | unmet -> pending;         | unmet -> pending;
- *   (default)    | lost  -> pending,         | lost  -> STAYS LIVE,
- *                |          recursively      |          notified
- *   -------------|---------------------------|--------------------------
- *   optional:true| never gates activation;   | never gates activation;
- *                | a change deactivates and  | a change is a
- *                | reactivates               | notification, nothing else
- *
- * `dynamic` means the plugin has said, IN WRITING, that it can survive
- * its provider being swapped underneath it. It is not the default
- * because most plugins cannot, and the cost of wrongly assuming they
- * can is a live instance holding a dead reference.
- *
- * The rebinding-preference axis is deliberately omitted. OSGi has
- * reluctant vs greedy and it is a knob every author must understand to
- * read anyone else's component; we take always-reluctant. Three axes
- * were more than the model can carry across twenty ports. */
 
 import { Required } from './Capability'
 import { tryref } from './Ref'
@@ -35,21 +11,6 @@ export function normrequire(r: any): Required {
   return ('string' === typeof r ? { name: r } : (r || {})) as Required
 }
 
-/** The requirements a definition declared, normalized.
- *
- * BOTH AXES ARE READ AT TWO LEVELS, AND THE PER-REQUIREMENT ONE WINS.
- *
- * The instance-level `policy` and `optional` list are how a DOCUMENT
- * states the axis without editing the definition, and they apply to
- * every requirement. The per-requirement form is the one §11.1's object
- * syntax exists for, and it is strictly more expressive: an instance
- * that is `static` on its store and `dynamic` on its metrics cannot be
- * written at all at the instance level, and that is the ordinary case
- * rather than an exotic one.
- *
- * `optional` unions rather than overriding — both spellings are
- * statements that this requirement need not gate activation, and there
- * is no reading under which one of them means "actually, mandatory". */
 export function requirements(options: any): Required[] {
   const raw: any[] = (options && options.requires) || []
   const marked: string[] = (options && options.optional) || []
@@ -64,44 +25,14 @@ export function requirements(options: any): Required[] {
   })
 }
 
-/** Does losing this requirement's SELECTED provider restart the
- * consumer? The mandatory ones under `static`, and the `static`
- * optional ones — both make a capability change deactivate and
- * reactivate. `dynamic` never restarts: mandatory-dynamic stays live
- * and is notified, optional-dynamic is a notification and nothing
- * else. */
 export function restartsonloss(r: Required): boolean {
   return 'dynamic' !== (r.policy || 'static')
 }
 
-/** Does an unmet requirement keep the consumer out of `live`?
- *
- * Cardinality alone decides this, NOT policy. `dynamic` is a statement
- * about surviving a SWAP, not about starting without the thing at all —
- * a mandatory-dynamic consumer still waits in `pending` for its first
- * provider. Conflating the two would let a plugin that declared it can
- * cope with replacement activate with nothing to call. */
 export function gatesactivation(r: Required): boolean {
   return true !== r.optional
 }
 
-/** Edges that can cause a restart, which is exactly the set a cycle
- * must be detected over (§11.3).
- *
- * Those are the mandatory requirements AND THE `static` OPTIONAL ONES,
- * because both make a capability change deactivate and reactivate the
- * consumer — and a cycle of restarts does not settle: A comes up, B
- * restarts, which changes B's capability, which restarts A,
- * indefinitely.
- *
- * ONLY `dynamic` OPTIONAL EDGES ARE EXCLUDED, and they are the ones the
- * exclusion was for: two plugins that optionally and dynamically
- * consume each other's capabilities both activate happily, neither
- * gates on the other, and each is merely notified when the other
- * appears. Nothing restarts, so nothing oscillates.
- *
- * An earlier draft of §11.3 excluded EVERY optional edge and thereby
- * admitted the non-terminating case it was trying to permit. */
 export function restartcausing(r: Required): boolean {
   return gatesactivation(r) || restartsonloss(r)
 }
@@ -112,24 +43,7 @@ export type Node = {
   requires: Required[]
 }
 
-/** A cycle through restart-causing requirements is
- * `plugin_dependency_cycle`, detected AT LOAD — before anything runs,
- * because the failure it describes is a non-terminating reconcile and
- * the only safe time to report that is before it starts.
- *
- * The graph is over capabilities, not refs: an edge runs from a
- * consumer to EVERY node that provides what it needs, because any of
- * them could be the one selected and a cycle through any is a cycle.
- * A node also satisfies its own name as a ref (§11.1), which is why the
- * ref is a provider of itself here. */
 export function dependencycycle(nodes: Node[]): string[] | null {
-  // TWO INDEXES, NOT ONE MERGED MAP. Capability names and refs are
-  // matched differently — a capability by its exact name, a ref through
-  // the canonical spelling (§4 rule 5) — and a single map keyed by both
-  // can only do one of them. Keyed by both and looked up raw, as this
-  // was, a cycle spelled `a$`/`b$` found no providers and EVADED the
-  // load-time check that exists to catch a non-terminating reconcile:
-  // the same graph, written two ways, gave two answers.
   const bycap: { [cap: string]: string[] } = {}
   const isref: { [ref: string]: boolean } = {}
   for (const n of nodes) {
@@ -159,8 +73,6 @@ export function dependencycycle(nodes: Node[]): string[] | null {
     edges[n.ref] = out.sort()
   }
 
-  // Iterative DFS with an explicit stack: twenty ports, and several of
-  // them have no recursion budget worth relying on.
   const WHITE = 0, GREY = 1, BLACK = 2
   const colour: { [ref: string]: number } = {}
   for (const n of nodes) colour[n.ref] = WHITE

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Env.ts

@@ -1,28 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Env.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Environment overrides (§9.5) — level 7 of the ladder.
- *
- * One prefix, so nothing drifts: `VOXGIG_PLUGIN_*`.
- *
- *   VOXGIG_PLUGIN_PROFILE            the profile name
- *   VOXGIG_PLUGIN_<REF>_<PATH>       one option
- *   VOXGIG_PLUGIN_ACTIVE/INACTIVE    comma-separated refs, INACTIVE wins
- *
- * THE ENCODING IS LOSSY, AND THIS SAYS SO RATHER THAN PRETENDING
- * OTHERWISE. Ref and path are upper-snake with `$` -> `__` and `.` ->
- * `_`. But `_` is legal in a name and in a tag, and the mapping folds
- * case, so `retry$fast` and `retry__fast` both encode to `RETRY__FAST`,
- * as do `Retry$fast` and `retry$Fast`.
- *
- * Rather than restrict a grammar the rest of the stack already uses,
- * the host DETECTS THE COLLISION: it encodes every ref it holds, and a
- * key two refs claim is `plugin_env_ambiguous`, naming both. The
- * affected pair stays configurable by document and by API, just not by
- * environment — which is the honest trade.
- *
- * Pure: a function over a string map and a ref set. The corpus tests it
- * without touching a real environment. */
 
 import { fail } from './Types'
 import { canonref, parseref } from './Ref'
@@ -38,14 +16,10 @@ export type EnvResult = {
 
 export type EnvInput = {
   env: { [k: string]: string }
-  /** Every ref the host holds. Needed because the encoding is lossy:
-   * without the set there is no way to know where the ref ends and the
-   * path begins in `RETRY__FAST_MIN_DELAY`. */
   refs?: string[]
   reserved?: string[]
 }
 
-/** `retry$fast` -> `RETRY__FAST`. */
 export function encoderef(ref: string): string {
   return ref.replace(/\$/g, '__').replace(/\./g, '_').toUpperCase()
 }
@@ -75,8 +49,6 @@ export function applyenv(input: EnvInput): EnvResult {
     }
   }
 
-  // Longest encoded ref first, so `retry$fast` wins over `retry` on
-  // `RETRY__FAST_MIN`. Shortest-first would read the tag as a path.
   const encoded = Object.keys(byencoded).sort((a, b) => b.length - a.length)
 
   for (const key of Object.keys(env).sort()) {
@@ -88,11 +60,6 @@ export function applyenv(input: EnvInput): EnvResult {
     if ('ACTIVE' === rest || 'INACTIVE' === rest) {
       for (const r of split(env[key])) {
         const c = canonref(r)
-        // The reservation covers EVERY input layer (§9.1).
-        // VOXGIG_PLUGIN_INACTIVE=station is easier to set than editing
-        // a config file, and INACTIVE has the final word — so guarding
-        // documents alone would leave the one lever this mechanism
-        // exists to deny wide open.
         checkreserved(c, reserved)
         if ('ACTIVE' === rest) out.active.push(c)
         else out.inactive.push(c)
@@ -129,9 +96,6 @@ function checkreserved(ref: string, reserved: string[]): void {
   }
 }
 
-/** Values parse as JSON, FALLING BACK TO STRING — so `8080` is a
- * number, `true` is a boolean, `{"a":1}` is a map, and `hello` is the
- * string it looks like rather than a parse error. */
 function parsevalue(v: string): any {
   try { return JSON.parse(v) }
   catch (err) { return v }

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Export.ts

@@ -1,17 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Export.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Exports (§11).
- *
- * An instance publishes values for other plugins and for the
- * application. Read with `host.exports('retry$fast/client')`.
- *
- * THE UNQUALIFIED ALIAS IS THE INTERESTING PART. `retry/client`
- * resolves to the UNTAGGED instance if one exists; if not, and exactly
- * one tagged instance exports that key, it resolves to that one; if two
- * do, it is `plugin_export_ambiguous` — deliberately diverging from
- * seneca's silent last-wins, because with multi-instance as a headline
- * feature an ambiguous alias is a defect waiting for production. */
 
 import { fail } from './Types'
 import { parseref, canonref } from './Ref'
@@ -19,17 +8,6 @@ import { parseref, canonref } from './Ref'
 export type Exported = { ref: string, key: string, value: any }
 
 export function resolveexport(spec: string, exported: Exported[]): any {
-  // THE LAST SLASH, not the first. §4's `checkname` permits `/` in a
-  // NAME — `@acme/store` is legal, and `resolvecandidates` has a branch
-  // for resolving a scoped name verbatim — so splitting at the first one
-  // read `@acme/store/client` as the ref `@acme` with the key
-  // `store/client`, which matches nothing. A scoped definition had no
-  // spelling for its exports at all, and said so by answering absent.
-  //
-  // The cost is that an export KEY may not contain `/`. Nothing declares
-  // one, no port shipped one, and the two cannot both be reachable with
-  // one separator: a name may hold slashes because §4 says so, a key
-  // holds them because nobody stopped it.
   const cut = spec.lastIndexOf('/')
   if (-1 === cut) {
     fail('plugin_export_ambiguous', 'export spec needs a key: ' + spec, { spec })

package/project/.sdk/tm/ts/src/feature/secrets/plugin/FeatureHost.ts

@@ -1,60 +1,10 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/FeatureHost.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* The sdkgen bridge (§17.2, P3 item 2).
- *
- * THE DELIVERABLE IS A BRIDGE THAT RUNS AN UNMODIFIED SDKGEN FEATURE
- * CLASS AS A PLUGIN, proving the two vocabularies map — and leaving
- * whether sdkgen's generated code adopts the model as a separate,
- * sdkgen-side decision with its own cost across 23 template trees.
- *
- * A generated SDK is not natively a host. Wrapping one in `inst.host()`
- * directly would be a host-shaped object around a non-host, so the
- * INNER HOST IS THE BRIDGE, NOT THE SDK: it declares points for the
- * SDK's hook vocabulary and its `request` chain, and a feature's own
- * method names become its bindings.
- *
- * WHAT THE BRIDGE BUYS, IN ONE SENTENCE: sdkgen can activate a feature
- * and cannot deactivate one, because its transport wrap is an
- * irreversible assignment — `ctx.utility.fetcher = wrapped` — and its
- * hook methods are read off a fixed array. Both become bindings here,
- * and bindings come out.
- *
- *
- * THIS FILE IS OUTSIDE THE PORTABILITY BUDGET, DELIBERATELY, AND IT IS
- * THE ONLY ONE.
- *
- * `typescript/AGENTS.md` forbids dynamic property interception, and the
- * `utility.fetcher` getter/setter below is exactly that. The budget
- * governs the PORTABLE LIBRARY — the thing twenty languages implement
- * from one corpus — and it is not negotiable there.
- *
- * A BRIDGE TO SDKGEN CANNOT BE PORTED AND IS NOT MEANT TO BE. sdkgen
- * generates SDKs in 23 languages, each feature written in that
- * language's idiom; a Go SDK's feature does not assign
- * `ctx.utility.fetcher`, so there is nothing for a Go translation of
- * this file to intercept. Each language that wants the bridge writes
- * its own, against its own generated code, and the thing they share is
- * the plugin model underneath — not this mechanism.
- *
- * Said here because the contradiction is otherwise live and invisible:
- * `Config.ts` cites the same budget as the reason `apply` refills an
- * options map instead of installing a getter. That reasoning is correct
- * and unchanged; this file is a different kind of thing. */
 
 import { Definition } from './Catalog'
 import { PointSpec } from './Host'
 
-/** sdkgen's declared hook vocabulary (`main.kit.feature.&.hook` in
- * `model/sdkgen.aon`).
- *
- * §17.2 says "13 hook points, named exactly as today". The model
- * declares ELEVEN; the three station's own feature adds — `PrePoint`,
- * `PreDone`, `PreUnexpected` — are declared by that feature rather than
- * by the core, because `hook: &:` admits any name. So the count depends
- * on which features are installed, which is why the bridge takes the
- * extra names rather than this list pretending to be closed.
- * Recorded in doc/plan/handover.md rather than silently resolved. */
 export const SDK_HOOKS = [
   'PostConstruct',
   'PostConstructEntity',
@@ -69,30 +19,12 @@ export const SDK_HOOKS = [
   'PostOperation',
 ]
 
-/** The hooks sdkgen-station's feature declares beyond the core set.
- * Named here so the bridge's default vocabulary covers the one feature
- * this repo's first consumer actually ships. */
 export const STATION_HOOKS = ['PrePoint', 'PreDone', 'PreUnexpected']
 
-/** The one chain point: the SDK's transport. Its base is
- * `utility.fetcher`, which is exactly what a wrapping feature captures
- * and replaces today. */
 export const REQUEST_POINT = 'request'
 
-/** What a particular SDK adds to the default vocabulary.
- *
- * All three fields exist because §17.2's mapping is stated in terms of
- * a specific SDK's declarations, and a bridge that hard-coded them
- * would be right for exactly one SDK. */
 export type BridgeOptions = {
-  /** Hook names this SDK's installed features declare beyond the core
-   * set. */
   hooks?: string[]
-  /** §17.2: "`provider` points for the seams `__replace__` currently
-   * serves." A replacement seam is a PROVIDER point and not a chain —
-   * at most one implementation wins, the losers are visible, and the
-   * host keeps a default — which is precisely what `__replace__` means
-   * and what a chain cannot express. */
   replace?: string[]
   /** The SDK's REAL ctx. A feature's `init` may read `ctx.client`,
    * `ctx.utility.log` or anything else the SDK hands it, and a
@@ -102,9 +34,6 @@ export type BridgeOptions = {
   ctx?: any
 }
 
-/** Points for a bridge host: every hook name as a `hook` point, each
- * replacement seam as a `provider` point, plus `request` as a `chain`
- * whose base is the SDK's own fetcher. */
 export function featurepoints(
   fetcher: (...args: any[]) => any, options?: BridgeOptions
 ): { [point: string]: PointSpec } {
@@ -115,35 +44,18 @@ export function featurepoints(
     if (undefined === points[h]) { points[h] = { kind: 'hook' } }
   }
   for (const r of opts.replace || []) {
-    // A seam declared BOTH ways is a contradiction in the SDK's own
-    // declarations, and the provider reading wins loudly rather than
-    // the map's iteration order deciding.
     points[r] = { kind: 'provider' }
   }
   points[REQUEST_POINT] = { kind: 'chain', base: fetcher }
   return points
 }
 
-/** The ctx an sdkgen feature's `init` expects.
- *
- * `utility.fetcher` is a GETTER/SETTER PAIR rather than a field, and
- * that is the whole trick: a feature that writes
- * `ctx.utility.fetcher = wrapped` is expressing a chain binding, and
- * the bridge records it as one instead of letting it overwrite the
- * slot. Reading it back returns the marker the feature should call,
- * which is `next` — so the feature's own `const inner = utility.fetcher`
- * still gives it something to call through to.
- *
- * This is the single place the irreversible assignment becomes
- * reversible; everything else about the feature is untouched. */
 type Captured = {
   wrap?: (...args: any[]) => any
   inner: any
 }
 
 function makectx(base: any, captured: Captured, options: any): any {
-  // Layer onto the SDK's REAL utility, so a feature reading anything
-  // else off it still finds what the SDK put there.
   const source = (base && base.utility) || {}
   const utility: any = {}
   for (const k of Object.keys(source)) { utility[k] = source[k] }
@@ -160,41 +72,6 @@ export type FeatureClass = {
   new(...args: any[]): any
 }
 
-/** Turn an sdkgen `Feature` class into a plugin definition, MECHANICALLY
- * (§17.2):
- *
- *  - `name` and `version` come off the instance, as today;
- *  - `init(ctx, options)` runs in `define`, where reading options and
- *    declaring bindings belong;
- *  - a method named after a hook point IS a binding to that point —
- *    "a feature's method names are its bindings";
- *  - a method named after a replacement seam is a `provider` binding;
- *  - an assignment to `ctx.utility.fetcher` becomes a `request` chain
- *    binding rather than an irreversible overwrite.
- *
- * The feature class is not modified, subclassed or inspected beyond its
- * own public surface. That is the claim being proved.
- *
- *
- * WHAT "AND DEACTIVATES IT" CLAIMS, EXACTLY.
- *
- * §17.2 says `init` "splits into `define` (read options, declare
- * bindings) and `activate` (capture)". THAT SPLIT IS SDKGEN'S TO MAKE.
- * An unmodified feature has one `init` and no teardown method, so the
- * bridge runs `init` in `define` and there is nothing it could call to
- * undo a side effect `init` performed — a connection opened there stays
- * open, and no amount of bridging changes that.
- *
- * So the claim is precisely: THE FEATURE'S BINDINGS BECOME REVERSIBLE.
- * Its hooks stop firing and its transport wrap leaves the chain, with
- * no cooperation from the feature — which is the thing sdkgen cannot do
- * at all, because it assigns the slot and has nowhere to put the old
- * value back. It is not a claim that arbitrary `init` side effects are
- * undone.
- *
- * A feature that DOES carry `activate` / `deactivate` / `close` methods
- * gets them wired below, which is the same mapping applied to the
- * methods §17.2 expects an adopting sdkgen to add. */
 export function featuredefinition(
   name: string, Feature: FeatureClass, options?: BridgeOptions
 ): Definition {
@@ -217,12 +94,6 @@ export function featuredefinition(
     define: (inst: any) => {
       const feature: any = new (Feature as any)()
 
-      // THE DEFINITION NAME AND THE FEATURE'S OWN NAME MUST AGREE.
-      // §17.2 maps a feature's `name` to the definition's, so a caller
-      // passing a different string leaves configuration addressed by
-      // the SDK's feature name unable to resolve the definition, while
-      // the exported object reports a third identity. Loud, because the
-      // failure it prevents is silent.
       if (null != feature.name && feature.name !== name) {
         const err: any = new Error(
           'plugin/plugin_definition_name: feature name does not match the ' +
@@ -233,28 +104,6 @@ export function featuredefinition(
 
       const captured: Captured = { inner: undefined }
 
-      // `inner` is what the feature reads back from `utility.fetcher`.
-      // In a chain the value to call through to is `next`, which is not
-      // known until the binding runs — so the feature is handed a
-      // trampoline that forwards to whatever `next` is at call time.
-      //
-      // ONE SHARED SLOT, AND THE LIMIT IS REAL. An sdkgen feature
-      // stashes `inner` once, at init; §6.2 names that exact pattern as
-      // "a bug the host cannot prevent" and declines to pretend
-      // otherwise. Sequential and nested calls are correct — the
-      // binding sets `current` immediately before the wrap runs — but
-      // if the wrap awaits and a SECOND request begins before it
-      // resumes, both share this slot and the resumed wrap calls
-      // through the second request's chain.
-      //
-      // Restoring the previous value in a `finally` makes it worse, not
-      // better: the finally runs when the wrap returns its promise,
-      // before the feature ever calls `inner`. Fixing it properly needs
-      // either a per-invocation channel the feature would have to be
-      // modified to accept — which is the thing this bridge exists to
-      // avoid — or async-context storage, which the portability budget
-      // forbids and which does not exist in most of the 23 languages.
-      // Stated rather than papered over.
       let current: any = null
       captured.inner = (...args: any[]) =>
         null == current ? undefined : current(...args)
@@ -262,20 +111,15 @@ export function featuredefinition(
       const ctx = makectx(
         { client: inst, ...(opts.ctx || {}), feature }, captured, inst.options)
 
-      // The SDK calls `init(ctx, options)`; so do we, unchanged.
       if ('function' === typeof feature.init) {
         feature.init(ctx, inst.options)
       }
 
-      // A method named after a hook point IS a binding to it.
       for (const h of hooknames) {
         if ('function' !== typeof feature[h]) { continue }
         inst.bind(h, (...args: any[]) => feature[h](...args))
       }
 
-      // ...and a method named after a replacement seam is a PROVIDER
-      // binding (§17.2), which is what `__replace__` means: at most one
-      // wins, the losers are visible, and the host keeps a default.
       for (const r of seams) {
         if ('function' !== typeof feature[r]) { continue }
         inst.bind(r, (...args: any[]) => feature[r](...args))
@@ -297,21 +141,9 @@ export function featuredefinition(
         inst.export('version', feature.version)
       }
 
-      // ...and the instance's OWN state, which is where the three later
-      // callbacks read it from. The export is the public handle; it is
-      // not a channel back to the definition, because §11 hides the
-      // exports of a `failed` instance — and `unload` on a failed
-      // instance still runs `close` (§5.2). Reading the feature back
-      // through `exports` therefore lost it in exactly the case where a
-      // feature holding a connection most needs its `close` to run.
       inst.state.feature = feature
     },
 
-    // §17.2's `activate` (capture) half, for a feature that has one.
-    // Today's sdkgen features do not — which is why the bridge's claim
-    // is about bindings and not about side effects — but a feature that
-    // grows the methods §17.2 expects gets them called, in the phase
-    // the model puts them in.
     activate: (inst: any) => {
       const feature: any = inst && featureof(inst)
       if (feature && 'function' === typeof feature.activate) {
@@ -335,15 +167,6 @@ export function featuredefinition(
   }
 }
 
-/** The feature object `define` built, read back from the instance's own
- * state rather than closed over, so the three later callbacks do not
- * each need their own capture.
- *
- * NOT from `exports`. §11 hides a `failed` instance's exports, and
- * `unload` on a failed instance still runs `close` — so an exports read
- * returned undefined precisely when a feature holding a connection
- * needed its `close` to run. `state` is the instance's own and survives
- * every status. */
 function featureof(inst: any): any {
   return inst.state && inst.state.feature
 }

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Graph.ts

@@ -1,24 +1,6 @@
 // VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Graph.ts)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-/* Whole-graph resolution (§11.4) — a phase, not a discovery.
- *
- * "Activate, and wait in `pending` if you must" is correct and, on its
- * own, produces a terrible experience: apply twenty instances against a
- * registry missing one thing and you get NINETEEN pending rows and no
- * statement of what is actually wrong.
- *
- * `resolvegraph` is a PURE FUNCTION of the registry and the intended
- * activation set. No callbacks run, no state changes, nothing is
- * touched. It answers for the whole graph at once which instances can be
- * live, and for each blocked one THE SPECIFIC REQUIREMENT that is
- * unmet, and why.
- *
- * The failure mode being designed against is a famous one: OSGi's
- * resolver is correct and its diagnostics are legendarily unusable. A
- * resolver that says "blocked" without saying WHY has moved the problem
- * rather than solved it, so `why` is part of the contract and the
- * corpus pins its shape. */
 
 import {
   Provided, Required, Candidate, resolvecapability, matchvalue,
@@ -55,10 +37,6 @@ export function resolvegraph(nodes: Node[]): Resolution {
   const resolved = new Set<string>()
   const blocked: { [ref: string]: Blocked } = {}
 
-  // Fixed point: a node resolves when every mandatory requirement is
-  // met by an ALREADY-RESOLVED provider. Iterating to a fixed point is
-  // what makes a provider that is itself blocked propagate, rather than
-  // each node being judged against the raw registry.
   let moved = true
   while (moved) {
     moved = false
@@ -81,10 +59,6 @@ export function resolvegraph(nodes: Node[]): Resolution {
   }
 }
 
-/** The FIRST unmet requirement, with the most specific explanation
- * available. Order matters: "no provider at all" and "a provider at the
- * wrong version" are different problems and a reader must not have to
- * guess which they have. */
 function firstunmet(
   n: Node,
   byref: { [ref: string]: Node },
@@ -128,9 +102,6 @@ function firstunmet(
       for (const c of all) {
         const attrs = c.provides.attrs || {}
         for (const k of Object.keys(req.match).sort()) {
-          // The same recursive partial match `matches` applies, so a
-          // nested requirement that FAILED the selection is also the
-          // one the diagnosis names (§11.4).
           if (!(k in attrs) || !matchvalue(req.match[k], attrs[k])) {
             return {
               ref: n.ref, unmet: req.name,
@@ -152,23 +123,9 @@ function firstunmet(
 
 function candidates(byref: { [ref: string]: Node }, name: string): Candidate[] {
   const out: Candidate[] = []
-  // A NODE SATISFIES ITS OWN REF (§11.1), and this is where the graph
-  // learned it. Considering only declared capabilities made `resolve()`
-  // answer `absent` about a provider sitting right there and live —
-  // §11.4's whole job is explaining the graph the runtime reconciles,
-  // and it was explaining a different one. Canonical (§4 rule 5), and
-  // tolerant, because a capability name need not be a well-formed ref.
   const asref = tryref(name)
   for (const ref of Object.keys(byref).sort()) {
     const n = byref[ref]
-    // Synthesized exactly as `providersof` synthesizes it, so the two
-    // answer the same question the same way — including that a bare ref
-    // carries no version, and so cannot satisfy a `range`.
-    // AND THE REF MATCH WINS OUTRIGHT for that node, as it does at
-    // runtime: `providersof` pushes the synthesized candidate and moves
-    // to the next instance. A node both named `b` and providing a
-    // capability `b` is ONE candidate, not two — without the skip the
-    // blocked-chain explanation named it twice.
     if (ref === asref) {
       out.push({ ref: n.ref, pos: n.pos, provides: { name } })
       continue