@voxgig/sdkgen 4.8.2 → 4.9.0

package/project/.sdk/tm/swift/Tests/vendor/omni/Util.swift

@@ -0,0 +1,162 @@
+// VENDORED: @voxgig/omni sdk-20260907-0029-0 (swift/Sources/Omni/Util.swift)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Omni internal JSON utilities.
+//
+// Self-contained by design: the omni runner must be able to test *any*
+// library, including libraries that provide these same operations.
+
+import Foundation
+
+public let NULLMARK = "__NULL__"  // Value is JSON null.
+public let UNDEFMARK = "__UNDEF__"  // Value is not present.
+public let EXISTSMARK = "__EXISTS__"  // Value exists (not undefined).
+
+/// Deep copy a JSON value (the value model already has value semantics).
+public func clone(_ val: Json) -> Json {
+  return val
+}
+
+/// Read a value by path. Returns `.absent` when any step is missing.
+public func getpath(_ val: Json, _ path: [String]) -> Json {
+  var current = val
+
+  for part in path {
+    switch current {
+    case .list(let entries):
+      guard let index = Int(part), 0 <= index, index < entries.count else {
+        return .absent
+      }
+      current = entries[index]
+    case .map(let entries):
+      guard let found = entries.first(where: { $0.0 == part }) else {
+        return .absent
+      }
+      current = found.1
+    default:
+      return .absent
+    }
+  }
+
+  return current
+}
+
+/// Depth-first walk: children first, then the containing node.
+public func walk(_ val: Json, _ apply: (Json, [String]) -> Json, _ path: [String] = []) -> Json {
+  var next = val
+
+  switch val {
+  case .list(let entries):
+    var out: [Json] = []
+    for (index, entry) in entries.enumerated() {
+      out.append(walk(entry, apply, path + [String(index)]))
+    }
+    next = .list(out)
+  case .map(let entries):
+    var out: [(String, Json)] = []
+    for (key, entry) in entries {
+      out.append((key, walk(entry, apply, path + [key])))
+    }
+    next = .map(out)
+  default:
+    break
+  }
+
+  return apply(next, path)
+}
+
+/// Deep structural equality: numbers by value, bools never numbers.
+public func deepequal(_ a: Json, _ b: Json) -> Bool {
+  switch (a, b) {
+  case (.absent, .absent): return true
+  case (.null, .null): return true
+  case (.bool(let x), .bool(let y)): return x == y
+  case (.num(let x), .num(let y)): return x == y || (x.isNaN && y.isNaN)
+  case (.str(let x), .str(let y)): return x == y
+  case (.list(let x), .list(let y)):
+    if x.count != y.count { return false }
+    for index in 0..<x.count where !deepequal(x[index], y[index]) {
+      return false
+    }
+    return true
+  // Order-independent, like every other port's deepequal: two maps with the
+  // same entries are equal however they were written.
+  case (.map(let x), .map(let y)):
+    if x.count != y.count { return false }
+    for (key, val) in x {
+      guard let other = y.first(where: { $0.0 == key }), deepequal(val, other.1) else {
+        return false
+      }
+    }
+    return true
+  default:
+    return false
+  }
+}
+
+/// Render a number the same way in every port: 5.0 prints as 5.
+public func numstr(_ val: Double) -> String {
+  if val.isNaN || val.isInfinite {
+    return "null"
+  }
+  if val == val.rounded(.towardZero) && abs(val) < 9_007_199_254_740_992.0 {
+    return String(Int64(val))
+  }
+  return String(val)
+}
+
+/// Render a string as a JSON string literal.
+public func quote(_ val: String) -> String {
+  var out = "\""
+
+  for ch in val.unicodeScalars {
+    switch ch {
+    case "\"": out += "\\\""
+    case "\\": out += "\\\\"
+    case "\n": out += "\\n"
+    case "\r": out += "\\r"
+    case "\t": out += "\\t"
+    default:
+      if 0x20 > ch.value {
+        out += String(format: "\\u%04x", ch.value)
+      } else {
+        out.unicodeScalars.append(ch)
+      }
+    }
+  }
+
+  return out + "\""
+}
+
+/// Compact JSON text with map keys sorted, identical in every port.
+public func jsonstr(_ val: Json) -> String {
+  switch val {
+  case .absent: return "undefined"
+  case .null: return "null"
+  case .bool(let flag): return flag ? "true" : "false"
+  case .num(let entry): return numstr(entry)
+  case .str(let text): return quote(text)
+  case .list(let entries): return "[" + entries.map(jsonstr).joined(separator: ",") + "]"
+  // Insertion order, not sorted: the map now carries the order the spec
+  // author wrote, and a failure message that reorders it is harder to read
+  // against the source.
+  case .map(let entries):
+    return "{" + entries.map { quote($0.0) + ":" + jsonstr($0.1) }.joined(separator: ",") + "}"
+  // Never authored in a spec (see Json.provider) - rendered only if a
+  // failure message happens to reach into it.
+  case .provider: return quote("<provider>")
+  }
+}
+
+/// Strings verbatim, everything else as compact JSON.
+public func stringify(_ val: Json) -> String {
+  if case .str(let text) = val {
+    return text
+  }
+  return jsonstr(val)
+}
+
+/// Render a path as a dotted string.
+public func pathify(_ path: [String]) -> String {
+  return path.joined(separator: ".")
+}

package/project/.sdk/tm/ts/src/feature/secrets/SecretsFeature.ts

@@ -2,6 +2,12 @@ import type { Context, FeatureOptions } from '../../types'
 
 import { BaseFeature } from '../base/BaseFeature'
 import { Sekreto, envkey } from './sekreto'
+// The plugin DEFINITIONS the model selected for this feature, emitted by
+// Config generically from the catalogue's active `plugin.def` entries.
+// Upstream sekreto's contract since the registry was retired: a kind not
+// passed in `plugins` is unknown to that Sekreto, so the model's choice of
+// plugin groups IS the SDK's provider vocabulary.
+import { FEATURE_PLUGINS } from '../../Config'
 
 
 // Secret access via a vendored @voxgig/sekreto provider chain, and the
@@ -107,6 +113,7 @@ class SecretsFeature extends BaseFeature {
 
     this._sekreto = new Sekreto({
       providers,
+      plugins: FEATURE_PLUGINS[this.name] || [],
       cache: this._cache,
     })
 

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Capability.ts

@@ -0,0 +1,148 @@
+// VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Capability.ts)
+// Source: https://github.com/voxgig/plugin @ b48ae643eb0eb56c5ebe3198da98cecdf6a7f7fc  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Capabilities (§11.1).
+ *
+ * A DEPENDENCY IS ON A CAPABILITY, NOT ON A REF — because it is a
+ * dependency on something that can do the job, and which instance is
+ * doing it is exactly the configuration detail a plugin must not care
+ * about.
+ *
+ * But A BINDING IS TO AN INSTANCE, not to a capability, which is what
+ * decides behaviour when the bound provider leaves while another match
+ * remains. */
+
+import { satisfies } from './Version'
+
+export type Provided = {
+  name: string
+  version?: string
+  priority?: number
+  attrs?: { [k: string]: any }
+}
+
+export type Required = {
+  name: string
+  range?: string
+  match?: { [k: string]: any }
+  optional?: boolean
+  /** §11.3: `static` restarts the consumer when its SELECTED provider
+   * leaves, even though another still matches; `dynamic` says in
+   * writing that it can survive the swap. Static is the default because
+   * most plugins cannot, and the cost of wrongly assuming they can is a
+   * live instance holding a dead reference. */
+  policy?: 'static' | 'dynamic'
+}
+
+export type Candidate = {
+  ref: string
+  pos: number
+  provides: Provided
+}
+
+/** Rank the matching live providers and return them best-first:
+ * highest `version`, then LOWEST `priority` (default 0), then
+ * declaration position `pos` ascending.
+ *
+ * `priority` is a field on the capability rather than §7's `order`
+ * band, because bands live on POINT BINDINGS: a provider may have
+ * several bindings with different bands, or none at all, so a rank
+ * reaching for one would be undefined in the common case.
+ *
+ * Without a total rank, "any provider satisfies" is true of the GRAPH
+ * and useless to the PLUGIN — two ports could bind different `store`
+ * instances, both resolve green, and behave differently, which is
+ * precisely the divergence a shared corpus exists to catch. */
+export function resolvecapability(req: Required, candidates: Candidate[]): Candidate[] {
+  const hits = candidates.filter((c) => matches(req, c.provides))
+  hits.sort((a, b) => {
+    const av = a.provides.version, bv = b.provides.version
+    if (av !== bv) {
+      if (undefined === av) return 1
+      if (undefined === bv) return -1
+      const c = compare(bv, av)      // highest version FIRST
+      if (0 !== c) return c
+    }
+    const ap = a.provides.priority || 0
+    const bp = b.provides.priority || 0
+    if (ap !== bp) return ap - bp    // lowest priority first
+    return a.pos - b.pos
+  })
+  return hits
+}
+
+export function matches(req: Required, prov: Provided): boolean {
+  if (req.name !== prov.name) return false
+
+  if (undefined !== req.range) {
+    if (undefined === prov.version) return false
+    if (!satisfies(prov.version, req.range)) return false
+  }
+
+  // `match` is checked against the provider's `attrs`, key by key. A
+  // key the provider does not carry is a miss, not a pass: a
+  // requirement asking for `transactional: true` must not be satisfied
+  // by a provider that never said.
+  if (undefined !== req.match) {
+    const attrs: any = prov.attrs || {}
+    for (const k of Object.keys(req.match)) {
+      if (!(k in attrs)) return false
+      if (!matchvalue((req.match as any)[k], attrs[k])) return false
+    }
+  }
+
+  return true
+}
+
+/** PARTIAL MATCH, RECURSING INTO MAPS (§11.1).
+ *
+ * §11.1 defines `match` as "a partial match against `attrs`, with
+ * exactly the semantics voxgig/struct and the omni corpus already
+ * define for `match` — every leaf in the requirement must be present
+ * and equal in the capability, keys not mentioned are not checked."
+ *
+ * THIS FUNCTION IS WHAT "EVERY LEAF" MEANS, and an earlier draft did
+ * not have it: the check was `attrs[k] !== req.match[k]`, which for any
+ * compound value is JavaScript REFERENCE IDENTITY. A requirement and a
+ * capability are declared in different places and are never the same
+ * object, so `match: {limits: {max: 5}}` could not be satisfied by any
+ * provider at all — including one declaring exactly that. The flat
+ * reading is invisible while every corpus entry is scalar, which is why
+ * the go port found it and P2 did not.
+ *
+ * A LIST IS COMPARED LEAF-WISE AT THE SAME LENGTH, not as a subset.
+ * "the first two of your three regions" is not something `match` can
+ * say, and inventing a spelling for it would be inventing the filter
+ * language §11.1 explicitly declines to add. */
+export function matchvalue(want: any, got: any): boolean {
+  if (isMap(want)) {
+    if (!isMap(got)) return false
+    for (const k of Object.keys(want)) {
+      if (!(k in got)) return false
+      if (!matchvalue(want[k], got[k])) return false
+    }
+    return true
+  }
+  if (Array.isArray(want)) {
+    if (!Array.isArray(got) || want.length !== got.length) return false
+    for (let i = 0; i < want.length; i++) {
+      if (!matchvalue(want[i], got[i])) return false
+    }
+    return true
+  }
+  return want === got
+}
+
+function isMap(v: any): boolean {
+  return null != v && 'object' === typeof v && !Array.isArray(v)
+}
+
+function compare(a: string, b: string): number {
+  const pa = a.split('.').map(Number)
+  const pb = b.split('.').map(Number)
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] || 0, y = pb[i] || 0
+    if (x !== y) return x < y ? -1 : 1
+  }
+  return 0
+}

package/project/.sdk/tm/ts/src/feature/secrets/plugin/Catalog.ts

@@ -0,0 +1,55 @@
+// VENDORED: @voxgig/plugin 0.1.6 (typescript/src/Catalog.ts)
+// Source: https://github.com/voxgig/plugin @ b48ae643eb0eb56c5ebe3198da98cecdf6a7f7fc  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The definition catalog (§10.1).
+ *
+ * A definition is registered once and may back many instances. Option
+ * shapes are validated AT REGISTRATION, not when a document happens to
+ * exercise a key — so a malformed shape fails once, and in the same
+ * place everywhere (§9.4). */
+
+import { fail } from './Types'
+import { checkname } from './Ref'
+import { checkshape } from './Config'
+
+export type Definition = {
+  name: string
+  shape?: any
+  define?: (inst: any) => void
+  activate?: (inst: any) => void
+  deactivate?: (inst: any) => void
+  close?: (inst: any) => void
+  reconfigure?: (inst: any, options: any, previous: any) => void
+}
+
+export type Catalog = {
+  add: (def: Definition) => void
+  get: (name: string) => Definition | undefined
+  has: (name: string) => boolean
+  names: () => string[]
+}
+
+export function makecatalog(defs?: Definition[]): Catalog {
+  const map: { [name: string]: Definition } = {}
+
+  const add = (def: Definition): void => {
+    if (!def || !checkname(def.name)) {
+      fail('plugin_definition_name', 'invalid definition name: ' + (def && def.name))
+    }
+    // Validate the shape HERE. Deferring it to resolution time means a
+    // malformed shape surfaces at a different moment in every host that
+    // loads it, which is the divergence the stated domain exists to
+    // prevent.
+    if (def.shape) checkshape(def.shape)
+    map[def.name] = def
+  }
+
+  for (const d of defs || []) add(d)
+
+  return {
+    add,
+    get: (name: string) => map[name],
+    has: (name: string) => undefined !== map[name],
+    names: () => Object.keys(map).sort(),
+  }
+}