@voxgig/sdkgen 4.8.3 → 4.10.0

package/project/.sdk/src/cmp/swift/Main_swift.ts

@@ -1,11 +1,12 @@
 
 import * as Path from 'node:path'
 
-import { swiftTargetDir, swiftTestDir } from './utility_swift'
+import { swiftSecretsActive, swiftTargetDir, swiftTestDir } from './utility_swift'
 
 import {
   cmp, each,
   File, Content, Copy, Folder, Fragment,
+  pluginExcludes,
 } from '@voxgig/sdkgen'
 
 
@@ -36,6 +37,28 @@ const Main = cmp(async function Main(props: any) {
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
 
+  // THE SECRETS TRIM, at generate time, and swift NEEDS it where go, py and
+  // dart leave the feature-level trim to `target add` (vendor-tag rollout,
+  // Decision 5). DELIBERATE DIVERGENCE, and the reason is the build: the
+  // feature's three vendored trees are separate SwiftPM MODULES that
+  // Package_swift declares only when the feature is active (see the note
+  // there). With the feature off, a tree still in Sources/<Name>Sdk/ would
+  // be folded into the SDK target and fail it on five redeclarations, and
+  // feature/SecretsFeature.swift would fail on `import Sekreto` naming a
+  // module the manifest never declared. Every other swift feature is a
+  // single file the SDK module compiles regardless, so it needs no such
+  // exclude. Keyed on the SAME predicate the manifest uses, so the two
+  // cannot disagree. The gated suite under Tests/.../feature/secrets/ goes
+  // with it: it imports Sekreto too.
+  const secrets = swiftSecretsActive(model, target)
+  const secretsSourceExcludes: RegExp[] = secrets ? [] : [
+    /(^|\/)feature\/SecretsFeature\.swift$/,
+    /(^|\/)feature\/secrets\//,
+  ]
+  const secretsTestExcludes: RegExp[] = secrets ? [] : [
+    /(^|\/)feature\/secrets\//,
+  ]
+
   Package({ target })
 
   Gitignore({})
@@ -66,6 +89,16 @@ const Main = cmp(async function Main(props: any) {
     Copy({
       from: 'tm/' + target.name + '/Sources/ProjectNameSDK',
       to: swiftTargetDir(model),
+      // pluginExcludes: the generate-time plugin trim (an ACTIVE feature's
+      // INACTIVE plugin group's declared files stay out of the tree). The
+      // model's swift `path` entries are relative to THIS Copy's root
+      // (`feature/secrets/plugins/Aws.swift`, not `Sources/ProjectNameSDK/
+      // ...`), as py's are to its pkg copy - helpers/featureSource documents
+      // that getting the root wrong makes the trim a silent no-op. No
+      // verbatim carve-out is needed for the vendored trees: none of the
+      // upstream swift files carries a ProjectName/PROJECTENV token, so the
+      // blanket replace is inert over them.
+      exclude: [...secretsSourceExcludes, ...pluginExcludes(model)],
       replace: {
         ...props.ctx$.stdrep,
         ProjectName: model.const.Name,
@@ -77,6 +110,7 @@ const Main = cmp(async function Main(props: any) {
     Copy({
       from: 'tm/' + target.name + '/Tests/ProjectNameSDKTests',
       to: swiftTestDir(model),
+      exclude: secretsTestExcludes,
       replace: {
         ...props.ctx$.stdrep,
         ProjectName: model.const.Name,

package/project/.sdk/src/cmp/swift/Package_swift.ts

@@ -1,5 +1,4 @@
-
-import { swiftTargetDir, swiftTestDir } from './utility_swift'
+import { swiftSecretsActive, swiftTargetDir, swiftTestDir } from './utility_swift'
 
 import {
   Content,
@@ -53,6 +52,34 @@ import type {
 // declared as a .testTarget rather than a .target so `swift build` - a
 // consumer's library build - never compiles the test engine; `swift test`
 // builds it and the suite target depends on it.
+//
+// THE SECRETS FEATURE ADDS THREE MORE MODULES, and this is the same
+// precedent, load-bearing rather than tidy. The vendored @voxgig/plugin
+// host, the @voxgig/sekreto core and its plugins live under
+// Sources/<Name>Sdk/feature/secrets/{plugin,sekreto,plugins} and are
+// compiled as VoxgigPlugin, Sekreto and SekretoPlugins - upstream's own
+// three-module boundary (sekreto's swift Makefile builds exactly these). A
+// flat layout collides on five names: plugin's `Value` and `Point` against
+// the SDK's, sekreto's `Json` against plugin's, and `dropsuffix`/`getenv`,
+// which sekreto declares in BOTH src/ and plugins/ because upstream never
+// compiles them as one module. So, when the feature is active for this
+// target:
+//
+//   - three `.target`s are declared over the three directories;
+//   - the SDK target gains them as dependencies and `exclude: ["feature/
+//     secrets"]`, so SwiftPM does not ALSO fold the files into the SDK
+//     module (`exclude:` must come AFTER `path:` in the argument list, or
+//     the manifest itself fails to compile);
+//   - the library product vends all four, because `SecretsFeature.sekreto()`
+//     is public API returning a `Sekreto`, and a downstream package may only
+//     `import Sekreto` if the product exposes it;
+//   - the test target depends on Sekreto and VoxgigPlugin as well, since
+//     the gated suite builds providers against Sekreto's `Provider`
+//     protocol and reads the selected `Definition`s' kinds back.
+//
+// Keyed on swiftSecretsActive - the SAME predicate Main_swift's Copy uses
+// to ship or withhold the trees - so the manifest and the tree agree by
+// construction (a manifest naming a missing path fails the whole package).
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -79,13 +106,49 @@ const Package = cmp(async function Package(props: any) {
       `        .package(url: "${d.url}", from: "${d.from}"),\n`).join('') +
     '    ],'
 
-  const targetdeps = 0 === deps.length ? '' :
+  const secrets = swiftSecretsActive(model, target)
+  const srcdir = `Sources/${swiftTargetDir(model)}`
+
+  // The SDK target's dependency list: declared package products, then the
+  // three vendored secrets modules when the feature is active.
+  const sdkdeps: string[] = deps.map((d) =>
+    `.product(name: "${d.product}", package: "${d.identity}")`)
+  if (secrets) {
+    sdkdeps.push('"Sekreto"', '"SekretoPlugins"', '"VoxgigPlugin"')
+  }
+
+  const targetdeps = 0 === sdkdeps.length ? '' :
     '\n            dependencies: [\n' +
-    deps.map((d) =>
-      `                .product(name: "${d.product}", package: "${d.identity}"),\n`)
-      .join('') +
+    sdkdeps.map((d) => `                ${d},\n`).join('') +
     '            ],'
 
+  // `exclude:` AFTER `path:` - SwiftPM's argument order, not a style choice.
+  const sdkpath = secrets
+    ? `\n            path: "${srcdir}",\n            exclude: ["feature/secrets"]),`
+    : `\n            path: "${srcdir}"),`
+
+  const secretsTargets = !secrets ? '' :
+    `        .target(
+            name: "VoxgigPlugin",
+            path: "${srcdir}/feature/secrets/plugin"),
+        .target(
+            name: "Sekreto",
+            dependencies: ["VoxgigPlugin"],
+            path: "${srcdir}/feature/secrets/sekreto"),
+        .target(
+            name: "SekretoPlugins",
+            dependencies: ["Sekreto", "VoxgigPlugin"],
+            path: "${srcdir}/feature/secrets/plugins"),
+`
+
+  const products = secrets
+    ? `["${Name}Sdk", "Sekreto", "SekretoPlugins", "VoxgigPlugin"]`
+    : `["${Name}Sdk"]`
+
+  const testdeps = secrets
+    ? `["${Name}Sdk", "Omni", "Sekreto", "VoxgigPlugin"]`
+    : `["${Name}Sdk", "Omni"]`
+
   File({ name: 'Package.swift' }, () => {
     Content(`// swift-tools-version:5.9
 //
@@ -97,19 +160,26 @@ import PackageDescription
 
 let package = Package(
     name: "${Name}Sdk",
+    // The deployment floor. Without it SwiftPM assumes the oldest macOS the
+    // toolchain still targets, and the SDK's AsyncStream-based streaming
+    // (EntityBase) fails to compile on macOS with "'AsyncStream' is only
+    // available in macOS 10.15 or newer" - linux has no such floor, which
+    // is why the generator's own linux runs never saw it. Found by the
+    // secrets lane, the first lane to build a full generated swift SDK on
+    // the macos CI leg.
+    platforms: [.macOS(.v10_15)],
     products: [
-        .library(name: "${Name}Sdk", targets: ["${Name}Sdk"]),
+        .library(name: "${Name}Sdk", targets: ${products}),
     ],${pkgdeps}
     targets: [
-        .target(
-            name: "${Name}Sdk",${targetdeps}
-            path: "Sources/${swiftTargetDir(model)}"),
+${secretsTargets}        .target(
+            name: "${Name}Sdk",${targetdeps}${sdkpath}
         .testTarget(
             name: "Omni",
             path: "Tests/vendor/omni"),
         .testTarget(
             name: "${Name}SdkTests",
-            dependencies: ["${Name}Sdk", "Omni"],
+            dependencies: ${testdeps},
             path: "Tests/${swiftTestDir(model)}"),
     ]
 )

package/project/.sdk/src/cmp/swift/fragment/Main.fragment.swift

@@ -1,16 +1,30 @@
 // ProjectName SDK client.
+//
+// SDK TYPES ARE MODULE-QUALIFIED IN THIS FILE (`ProjectNameSdk.VMap`, not
+// `VMap`), and only in this file. MainEntity_swift emits one accessor PER
+// ENTITY into this class body, named after the entity - `Utility()`,
+// `Spec()`, `Value()` for an API with entities of those names - and inside
+// a class body a METHOD of that name shadows the TYPE for every unqualified
+// use: `utility = Utility()` then reads as a call to the accessor, and
+// `-> Utility` as a return type that does not exist. The entity TYPE is
+// already renamed on such a collision (swiftSafeTypeName), but the accessor
+// keeps the entity's own name, which is the public API. Qualifying by
+// module - the generated module is <Name>Sdk, so `ProjectNameSdk.` lands as
+// `<Name>Sdk.` - is the one spelling a method cannot shadow. The shared
+// fixture's `utility` entity is what found this; every other swift file is
+// outside this class and unaffected.
 
 import Foundation
 
 public final class ProjectNameSDK {
   public var mode = "live"
-  private var options: VMap = VMap()
-  private let utility: Utility
+  private var options: ProjectNameSdk.VMap = ProjectNameSdk.VMap()
+  private let utility: ProjectNameSdk.Utility
   public var features: [BaseFeature] = []
-  private var rootctx: Context!
+  private var rootctx: ProjectNameSdk.Context!
 
-  public init(_ optionsIn: VMap? = nil) {
-    utility = Utility()
+  public init(_ optionsIn: ProjectNameSdk.VMap? = nil) {
+    utility = ProjectNameSdk.Utility()
 
     // The process-wide config (sdkgen rung L2): read-only on the request path,
     // so every client shares one rather than rebuilding it.
@@ -20,7 +34,7 @@ public final class ProjectNameSDK {
       "client": self,
       "utility": utility,
       "config": config,
-      "shared": VMap(),
+      "shared": ProjectNameSdk.VMap(),
     ]
     if let o = optionsIn { ctxmap["options"] = o }
 
@@ -39,7 +53,7 @@ public final class ProjectNameSDK {
     // feature installs the base mock transport and the transport features
     // (retry/cache/netsim/proxy/ratelimit) wrap whatever is current, so `test`
     // must be added before them to sit at the base of the chain.
-    let featureOpts = gp(options, "feature").asMap ?? VMap()
+    let featureOpts = gp(options, "feature").asMap ?? ProjectNameSdk.VMap()
     if let featureOrder = gpath(options, "__derived__", "featureorder").asList {
       for fnameVal in featureOrder.items {
         let fname = fnameVal.asString ?? ""
@@ -67,24 +81,24 @@ public final class ProjectNameSDK {
     utility.featureHook(rootctx, "PostConstruct")
   }
 
-  public func optionsMap() -> VMap {
-    return clone(.map(options)).asMap ?? VMap()
+  public func optionsMap() -> ProjectNameSdk.VMap {
+    return clone(.map(options)).asMap ?? ProjectNameSdk.VMap()
   }
 
-  public func getUtility() -> Utility {
-    return Utility.copy(utility)
+  public func getUtility() -> ProjectNameSdk.Utility {
+    return ProjectNameSdk.Utility.copy(utility)
   }
 
-  public func getRootCtx() -> Context {
+  public func getRootCtx() -> ProjectNameSdk.Context {
     return rootctx
   }
 
-  public func prepare(_ fetchargsIn: VMap?) throws -> VMap {
+  public func prepare(_ fetchargsIn: ProjectNameSdk.VMap?) throws -> ProjectNameSdk.VMap {
     let utility = self.utility
 
-    let fetchargs = fetchargsIn ?? VMap()
+    let fetchargs = fetchargsIn ?? ProjectNameSdk.VMap()
 
-    let ctrl = gp(fetchargs, "ctrl").asMap ?? VMap()
+    let ctrl = gp(fetchargs, "ctrl").asMap ?? ProjectNameSdk.VMap()
 
     let ctx = utility.makeContext(["opname": "prepare", "ctrl": ctrl], rootctx)
 
@@ -94,8 +108,8 @@ public final class ProjectNameSDK {
     var method = gp(fetchargs, "method").asString ?? ""
     if method == "" { method = "GET" }
 
-    let pathParams = gp(fetchargs, "params").asMap ?? VMap()
-    let query = gp(fetchargs, "query").asMap ?? VMap()
+    let pathParams = gp(fetchargs, "params").asMap ?? ProjectNameSdk.VMap()
+    let query = gp(fetchargs, "query").asMap ?? ProjectNameSdk.VMap()
 
     let headers = utility.prepareHeaders(ctx)
 
@@ -103,7 +117,7 @@ public final class ProjectNameSDK {
     let prefix = gp(options, "prefix").asString ?? ""
     let suffix = gp(options, "suffix").asString ?? ""
 
-    let specmap = VMap()
+    let specmap = ProjectNameSdk.VMap()
     specmap.entries["base"] = .string(basev)
     specmap.entries["prefix"] = .string(prefix)
     specmap.entries["suffix"] = .string(suffix)
@@ -114,7 +128,7 @@ public final class ProjectNameSDK {
     specmap.entries["headers"] = .map(headers)
     specmap.entries["body"] = gp(fetchargs, "body")
     specmap.entries["step"] = .string("start")
-    ctx.spec = Spec(specmap)
+    ctx.spec = ProjectNameSdk.Spec(specmap)
 
     // Merge user-provided headers.
     if let uhm = gp(fetchargs, "headers").asMap {
@@ -131,7 +145,7 @@ public final class ProjectNameSDK {
   // Raw endpoint access is operator-controllable, like every entity op.
   // Blocking it means denying BOTH the 'direct' and 'graphql' tokens, since
   // either one reaches the same endpoint.
-  public func direct(_ fetchargsIn: VMap?) -> VMap {
+  public func direct(_ fetchargsIn: ProjectNameSdk.VMap?) -> ProjectNameSdk.VMap {
     if !opAllowed("direct") {
       return opDenied("direct")
     }
@@ -145,9 +159,9 @@ public final class ProjectNameSDK {
     return allow.contains(op)
   }
 
-  private func opDenied(_ op: String) -> VMap {
+  private func opDenied(_ op: String) -> ProjectNameSdk.VMap {
     let allow = gpath(options, "allow", "op").asString ?? ""
-    let r = VMap()
+    let r = ProjectNameSdk.VMap()
     r.entries["ok"] = .bool(false)
     r.entries["err"] = .nat(ProjectNameError(
       op + "_allow",
@@ -160,38 +174,38 @@ public final class ProjectNameSDK {
   // its own allow.op token first. Private, rather than a flag on fetchargs:
   // a caller-supplied marker would let anyone opt straight back out of the
   // gate by passing it.
-  private func rawRequest(_ fetchargsIn: VMap?) -> VMap {
+  private func rawRequest(_ fetchargsIn: ProjectNameSdk.VMap?) -> ProjectNameSdk.VMap {
     let utility = self.utility
 
-    let fetchdef: VMap
+    let fetchdef: ProjectNameSdk.VMap
     do {
       fetchdef = try prepare(fetchargsIn)
     } catch {
-      let r = VMap()
+      let r = ProjectNameSdk.VMap()
       r.entries["ok"] = .bool(false)
       r.entries["err"] = .nat(error)
       return r
     }
 
-    let fetchargs = fetchargsIn ?? VMap()
-    let ctrl = gp(fetchargs, "ctrl").asMap ?? VMap()
+    let fetchargs = fetchargsIn ?? ProjectNameSdk.VMap()
+    let ctrl = gp(fetchargs, "ctrl").asMap ?? ProjectNameSdk.VMap()
 
     let ctx = utility.makeContext(["opname": "direct", "ctrl": ctrl], rootctx)
 
     let url = gp(fetchdef, "url").asString ?? ""
 
-    let fetched: Value
+    let fetched: ProjectNameSdk.Value
     do {
       fetched = try utility.fetcher(ctx, url, fetchdef)
     } catch {
-      let r = VMap()
+      let r = ProjectNameSdk.VMap()
       r.entries["ok"] = .bool(false)
       r.entries["err"] = .nat(error)
       return r
     }
 
     if isNil(fetched) {
-      let r = VMap()
+      let r = ProjectNameSdk.VMap()
       r.entries["ok"] = .bool(false)
       r.entries["err"] = .nat(ctx.makeError("direct_no_response", "response: undefined"))
       return r
@@ -209,12 +223,12 @@ public final class ProjectNameSDK {
       }
       let noBody = status == 204 || status == 304 || contentLength == "0"
 
-      var jsonData: Value = .noval
-      if !noBody, let jf = gp(fm, "json").asNative as? NativeCall0 {
+      var jsonData: ProjectNameSdk.Value = .noval
+      if !noBody, let jf = gp(fm, "json").asNative as? ProjectNameSdk.NativeCall0 {
         jsonData = jf()
       }
 
-      let r = VMap()
+      let r = ProjectNameSdk.VMap()
       r.entries["ok"] = .bool(status >= 200 && status < 300)
       r.entries["status"] = .int(Int64(status))
       r.entries["headers"] = headers
@@ -222,7 +236,7 @@ public final class ProjectNameSDK {
       return r
     }
 
-    let r = VMap()
+    let r = ProjectNameSdk.VMap()
     r.entries["ok"] = .bool(false)
     r.entries["err"] = .nat(ctx.makeError("direct_invalid", "invalid response type"))
     return r
@@ -240,24 +254,24 @@ public final class ProjectNameSDK {
   // NOTE: like direct, this bypasses the feature pipeline — no retry,
   // ratelimit or paging features apply.
   public func graphql(
-    _ query: String, _ variables: VMap? = nil, _ ctrl: VMap? = nil
-  ) -> VMap {
+    _ query: String, _ variables: ProjectNameSdk.VMap? = nil, _ ctrl: ProjectNameSdk.VMap? = nil
+  ) -> ProjectNameSdk.VMap {
     if !opAllowed("graphql") {
       return opDenied("graphql")
     }
 
-    let headers = VMap()
+    let headers = ProjectNameSdk.VMap()
     headers.entries["content-type"] = .string("application/json")
 
-    let body = VMap()
+    let body = ProjectNameSdk.VMap()
     body.entries["query"] = .string(query)
-    body.entries["variables"] = .map(variables ?? VMap())
+    body.entries["variables"] = .map(variables ?? ProjectNameSdk.VMap())
 
-    let fetchargs = VMap()
+    let fetchargs = ProjectNameSdk.VMap()
     fetchargs.entries["method"] = .string("POST")
     fetchargs.entries["headers"] = .map(headers)
     fetchargs.entries["body"] = .map(body)
-    fetchargs.entries["ctrl"] = .map(ctrl ?? VMap())
+    fetchargs.entries["ctrl"] = .map(ctrl ?? ProjectNameSdk.VMap())
 
     let res = rawRequest(fetchargs)
 
@@ -284,10 +298,10 @@ public final class ProjectNameSDK {
 
   // <[SLOT]>
 
-  public static func testSDK(_ testoptsIn: VMap?, _ sdkoptsIn: VMap?) -> ProjectNameSDK {
-    let sdkopts = clone(.map(sdkoptsIn ?? VMap())).asMap ?? VMap()
+  public static func testSDK(_ testoptsIn: ProjectNameSdk.VMap?, _ sdkoptsIn: ProjectNameSdk.VMap?) -> ProjectNameSDK {
+    let sdkopts = clone(.map(sdkoptsIn ?? ProjectNameSdk.VMap())).asMap ?? ProjectNameSdk.VMap()
 
-    let testopts = clone(.map(testoptsIn ?? VMap())).asMap ?? VMap()
+    let testopts = clone(.map(testoptsIn ?? ProjectNameSdk.VMap())).asMap ?? ProjectNameSdk.VMap()
     testopts.entries["active"] = .bool(true)
 
     _ = setpath(.map(sdkopts), jtp("feature", "test"), .map(testopts))

package/project/.sdk/src/cmp/swift/utility_swift.ts

@@ -3,6 +3,7 @@ import * as Path from 'node:path'
 
 import {
   camelify,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 import {
@@ -146,10 +147,31 @@ function swiftTestDir(model: any): string {
 }
 
 
+// Is the `secrets` feature ACTIVE for this target - i.e. do the three
+// vendored trees under Sources/ProjectNameSDK/feature/secrets/ ship, and
+// does Package.swift declare them?
+//
+// ONE RULE, ONE PLACE: Package_swift (the manifest's three extra targets
+// plus the SDK target's `exclude:`) and Main_swift (the Copy that ships or
+// withholds the trees) both read this, so the manifest and the tree cannot
+// disagree - a manifest naming a path that is not there fails the WHOLE
+// SwiftPM package, not just the feature, and a tree without its manifest
+// entries folds three modules' worth of colliding `Value`/`Point`/`Json`
+// declarations into the SDK module.
+//
+// `targetFeatures` is the applicability gate (helpers/applicability): the
+// feature counts only when the model activates it AND this target
+// `provides: { sekreto: true }`.
+function swiftSecretsActive(model: any, target: any): boolean {
+  return null != targetFeatures(model, target)['secrets']
+}
+
+
 export {
   clean,
   projectPath,
   swiftPascalName,
+  swiftSecretsActive,
   swiftTargetDir,
   swiftTestDir,
   swiftVarName,

package/project/.sdk/src/cmp/zig/Package_zig.ts

@@ -12,7 +12,7 @@ import type {
 } from '@voxgig/apidef'
 
 
-import { zigModuleName } from './utility_zig'
+import { zigModuleName, zigPackageFingerprint } from './utility_zig'
 
 
 // build.zig.zon — the Zig package manifest. Zig has no central package
@@ -24,16 +24,19 @@ import { zigModuleName } from './utility_zig'
 //
 // The `.paths` allow-list mirrors the (registry-less) template: it only
 // matters when packaging for a registry, which zig does not do, so it is kept
-// stable. `.name` is a plain string here rather than the newer enum-literal +
-// fingerprint form.
+// stable.
 //
-// TOOLCHAIN PIN: the string form REQUIRES zig <= 0.13. Zig 0.14 rejects it
-// outright — `build.zig.zon:2:13: error: expected enum literal` — so the
-// generated SDK will not build at all on a newer toolchain. The consumer CI
-// job pins 0.13.0 to match (create-sdkgen
-// project/standard/.github/workflows/ci.yml). Moving to a newer zig means
-// changing BOTH: `.name = .${name}` plus a `.fingerprint` here, and the CI
-// pin there.
+// TOOLCHAIN: zig 0.16. `.name` is an ENUM LITERAL (`.solar_sdk`), and a
+// `.fingerprint` is required beside it. That pairing is what a modern zig
+// wants: 0.14 rejects the older plain-string form outright —
+// `build.zig.zon:2:13: error: expected enum literal` — and 0.13 rejects the
+// enum-literal form, so the two cannot both be supported from one generator.
+// A move BACK to 0.13 would mean reverting both fields here and the CI pin in
+// create-sdkgen project/standard/.github/workflows/ci.yml together.
+//
+// The fingerprint is derived from the package name, not random, so
+// regenerating the same model does not rewrite this file — see
+// zigPackageFingerprint for why, and for what zig checks.
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -43,8 +46,9 @@ const Package = cmp(async function Package(props: any) {
 
   File({ name: 'build.zig.zon' }, () => {
     Content(`.{
-    .name = "${name}",
+    .name = .${name},
     .version = "${packageVersion(model, target.name)}",
+    .fingerprint = ${zigPackageFingerprint(name)},
     .dependencies = .{},
     .paths = .{
         "src",

package/project/.sdk/src/cmp/zig/fragment/Entity.fragment.zig

@@ -231,9 +231,9 @@ pub const EntyClass = struct {
         if (data == .array) {
             return data.array.data.items;
         } else if (!h.is_noval(data)) {
-            var out = std.ArrayList(Value).init(h.A());
-            out.append(data) catch {};
-            return out.toOwnedSlice() catch &.{};
+            var out: std.ArrayList(Value) = .empty;
+            out.append(h.A(), data) catch {};
+            return out.toOwnedSlice(h.A()) catch &.{};
         }
         return &.{};
     }

package/project/.sdk/src/cmp/zig/fragment/EntityListOp.fragment.zig

@@ -16,18 +16,18 @@ pub fn list(self: *EntyClass, reqmatch: Value, ctrl: Value) EntListResult {
     // `list` resolves to one ENTITY per record. make_result cannot build them
     // here — it works in Value, which has no slot for an entity — so the op
     // does, mirroring what the dynamic targets get from make_result.
-    var items = std.ArrayList(*EntyClass).init(h.A());
+    var items: std.ArrayList(*EntyClass) = .empty;
     if (out == .array) {
         for (out.array.data.items) |entry| {
             const ent = EntyClass.new(self.client, h.clone(self.entopts));
             if (entry == .object) {
                 _ = ent.data_impl(entry);
             }
-            items.append(ent) catch {};
+            items.append(h.A(), ent) catch {};
         }
     }
 
-    return EntListResult{ .ok = items.toOwnedSlice() catch &[_]*EntyClass{} };
+    return EntListResult{ .ok = items.toOwnedSlice(h.A()) catch &[_]*EntyClass{} };
 }
 
 fn list_post_done(self: *EntyClass, ctx: *Context) void {

package/project/.sdk/src/cmp/zig/fragment/Main.fragment.zig

@@ -45,7 +45,7 @@ pub const ProjectNameSDK = struct {
             .mode = "live",
             .options = h.vnull(),
             .sdkUtility = Utility.new(),
-            .features = std.ArrayList(Feature).init(h.A()),
+            .features = .empty,
             .rootctx = null,
         };
 
@@ -93,8 +93,8 @@ pub const ProjectNameSDK = struct {
         }
 
         // Initialize features.
-        var snap = std.ArrayList(Feature).init(h.A());
-        for (sdk.features.items) |f| snap.append(f) catch {};
+        var snap: std.ArrayList(Feature) = .empty;
+        for (sdk.features.items) |f| snap.append(h.A(), f) catch {};
         for (snap.items) |f| sdk.sdkUtility.feature_init(rootctx, f);
 
         sdk.sdkUtility.feature_hook(rootctx, "PostConstruct");

package/project/.sdk/src/cmp/zig/utility_zig.ts

@@ -26,8 +26,56 @@ function zigVarName(name: string): string {
 
 // The zig module identifier, e.g. solar_sdk (informational; the build module
 // is named "sdk").
+//
+// It is also the `.name` of build.zig.zon, which zig 0.16 reads as an enum
+// literal and requires to be a BARE identifier — `.@"2fa_sdk"` is rejected as
+// firmly as `.2fa_sdk` is — so a model name starting with a digit is given a
+// leading underscore. Nothing else in the target derives an identifier from
+// this, and the alternative for such a model is a package that does not build.
 function zigModuleName(model: any): string {
-  return `${model.name}_sdk`.toLowerCase().replace(/[^a-z0-9_]/g, '_')
+  const name = `${model.name}_sdk`.toLowerCase().replace(/[^a-z0-9_]/g, '_')
+  return /^[0-9]/.test(name) ? '_' + name : name
+}
+
+
+// The `.fingerprint` zig 0.14+ requires in build.zig.zon, as a 0x-prefixed
+// 16-digit hex literal.
+//
+// Zig reads the field as a packed struct of two u32s: the LOW half is a free
+// `id`, and the HIGH half is a `checksum` that must equal the CRC-32 (IEEE, as
+// zlib computes it) of the package name. Get the checksum wrong and zig
+// refuses to build, printing the value it wanted; get it right and any id in
+// [1, 0xfffffffe] is accepted.
+//
+// The id exists so a fork can be told apart from what it forked. A generated
+// SDK gets a DERIVED one — FNV-1a over the same name — rather than a random
+// one, because this file is regenerated on every run: a random id would
+// rewrite build.zig.zon each time and churn the consumer's diff, and a package
+// that changes identity between two generations of the same model is worse
+// than one that shares an id with a fork of itself. Distinct names still get
+// distinct ids.
+function zigPackageFingerprint(name: string): string {
+  // CRC-32 (IEEE 802.3, reflected, poly 0xEDB88320) — the one zig's
+  // std.hash.Crc32 and zlib both compute.
+  let crc = 0xffffffff
+  for (let i = 0; i < name.length; i++) {
+    crc ^= name.charCodeAt(i) & 0xff
+    for (let b = 0; b < 8; b++) {
+      crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1))
+    }
+  }
+  const checksum = (crc ^ 0xffffffff) >>> 0
+
+  // FNV-1a 32-bit, folded into the 1..0xfffffffe zig accepts.
+  let fnv = 0x811c9dc5
+  for (let i = 0; i < name.length; i++) {
+    fnv ^= name.charCodeAt(i) & 0xff
+    fnv = Math.imul(fnv, 0x01000193) >>> 0
+  }
+  const id = (fnv % 0xfffffffd) + 1
+
+  const hex = (n: number) => n.toString(16).padStart(8, '0')
+  return `0x${hex(checksum)}${hex(id)}`
 }
 
 
@@ -142,5 +190,6 @@ export {
   clean,
   formatZigValue,
   zigModuleName,
+  zigPackageFingerprint,
   zigVarName,
 }