@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/rust/feature/secrets/plugin/mod.rs

@@ -0,0 +1,18 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/lib.rs)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+pub mod value;
+pub mod types;
+pub mod refs;
+pub mod version;
+pub mod capability;
+pub mod resolve;
+pub mod export;
+pub mod graph;
+pub mod order;
+pub mod depend;
+pub mod config;
+pub mod env;
+pub mod point;
+pub mod catalog;
+pub mod host;

package/project/.sdk/tm/rust/feature/secrets/plugin/order.rs

@@ -0,0 +1,226 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/order.rs)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Ordering (§7) - one rule, one place.
+//!
+//! sdkgen grew two special cases in `makeOptions` (`test`, then `station`)
+//! and the third was not far off. This sort is the whole replacement, and
+//! the tiers are in this order for a reason:
+//!
+//!   1 constraints   before/after edges, by ref or by name
+//!   2 bands         integer, lower first, default 0
+//!   3 declaration   ties break by `pos`
+//!
+//! CONSTRAINTS BEAT BANDS precisely so the correct tool wins when both are
+//! present. A band expresses a genuine cross-cutting layer; a constraint
+//! expresses a relationship between two specific things; and a band chosen
+//! by trial and error to fix an ordering bug is a bug wearing a number.
+
+use std::collections::BTreeMap;
+
+use super::refs::refname;
+use super::types::{details, fail, stable_sort_by, PluginError};
+use super::value::Value;
+
+/// One thing to place: its ref, its declared position, and its ordering
+/// block as authored.
+#[derive(Clone)]
+pub struct Binding {
+    pub eref: String,
+    pub pos: f64,
+    pub order: Value,
+}
+
+pub fn resolve_order(bindings: &[Binding], pin: &Value) -> Result<Vec<String>, PluginError> {
+    let byref: BTreeMap<String, Binding> = bindings
+        .iter()
+        .map(|b| (b.eref.clone(), b.clone()))
+        .collect();
+
+    // Constraints are edges. A constraint naming an ABSENT binding is
+    // satisfied VACUOUSLY (§7) - a plugin ordered `after: 'test'` must
+    // load in a host with no test plugin. That is sdkgen's __after__
+    // behaviour, kept.
+    let mut edges: BTreeMap<String, Vec<String>> = bindings
+        .iter()
+        .map(|b| (b.eref.clone(), Vec::new()))
+        .collect();
+
+    for b in bindings.iter() {
+        let block = &b.order;
+        // An ABSENT constraint and an EMPTY LIST are both "no constraint".
+        if order_declared(&block.get("after")) {
+            for t in order_targets(&block.get("after"), bindings) {
+                edges.get_mut(&t).unwrap().push(b.eref.clone());
+            }
+        }
+        if order_declared(&block.get("before")) {
+            let targets = order_targets(&block.get("before"), bindings);
+            edges.get_mut(&b.eref).unwrap().extend(targets);
+        }
+    }
+
+    // Stable topological sort. Among ready nodes, band first (lower runs
+    // first), then `pos` - the position the DOCUMENT visibly states, not
+    // the order instances happened to load and not the incarnation `seq`.
+    let mut indeg: BTreeMap<String, usize> =
+        bindings.iter().map(|b| (b.eref.clone(), 0)).collect();
+    for tos in edges.values() {
+        for to in tos.iter() {
+            *indeg.get_mut(to).unwrap() += 1;
+        }
+    }
+
+    let mut out: Vec<String> = Vec::new();
+    let mut ready: Vec<Binding> = bindings
+        .iter()
+        .filter(|b| 0 == indeg[&b.eref])
+        .cloned()
+        .collect();
+
+    while !ready.is_empty() {
+        stable_sort_by(&mut ready, |b| (order_band(&b.order), b.pos));
+        let nxt = ready.remove(0);
+        out.push(nxt.eref.clone());
+        for to in edges[&nxt.eref].clone() {
+            let d = indeg.get_mut(&to).unwrap();
+            *d -= 1;
+            if 0 == *d {
+                ready.push(byref[&to].clone());
+            }
+        }
+    }
+
+    if out.len() != bindings.len() {
+        let stuck: Vec<String> = bindings
+            .iter()
+            .filter(|b| !out.contains(&b.eref))
+            .map(|b| b.eref.clone())
+            .collect();
+        return fail(
+            "plugin_order_cycle",
+            &format!("before/after constraints cycle: {}", stuck.join(" -> ")),
+            details(&[(
+                "cycle",
+                Value::List(stuck.iter().map(|r| Value::str(r)).collect()),
+            )]),
+        );
+    }
+
+    applypin(out, &edges, pin)
+}
+
+/// An integer, and only an integer: `true` and `"2"` are not bands.
+pub fn order_band(block: &Value) -> i64 {
+    block.get("band").as_int().unwrap_or(0)
+}
+
+/// Was a constraint stated? An absent value and an EMPTY LIST are both
+/// no-constraint - and an empty list is TRUTHY in most languages, which is
+/// exactly how this class of bug survives a reading.
+pub fn order_declared(spec: &Value) -> bool {
+    match spec {
+        Value::Null => false,
+        Value::List(l) => l.iter().any(|one| one.as_str() != Some("")),
+        Value::Str(s) => !s.is_empty(),
+        _ => true,
+    }
+}
+
+/// One spelling or a LIST of them. A list fans out to the UNION of what
+/// each names, so after: ['a','b'] means after BOTH, and the same instance
+/// named twice - once by name, once by ref - is one edge.
+pub fn order_targets(spec: &Value, nodes: &[Binding]) -> Vec<String> {
+    let specs: Vec<Value> = match spec {
+        Value::List(l) => l.clone(),
+        other => vec![other.clone()],
+    };
+    let mut hit: Vec<String> = Vec::new();
+    for one in specs.iter() {
+        let one = match one.as_str() {
+            Some(s) => s,
+            None => continue,
+        };
+        for b in nodes.iter() {
+            if hit.contains(&b.eref) {
+                continue;
+            }
+            if b.eref == one || refname(&b.eref) == one {
+                hit.push(b.eref.clone());
+            }
+        }
+    }
+    hit
+}
+
+/// A PIN IS NOT A CONSTRAINT (§7).
+///
+/// Constraints and bands are negotiable by definition - they are what
+/// plugins and documents say they want, and the sort's job is to satisfy
+/// them all. A pin is the host stating a structural invariant of its own
+/// architecture, which is a different kind of claim and must not lose a
+/// tie to a document.
+///
+/// So a pin PLACES the binding at the named end, and an ordering that
+/// would move it away is `plugin_order_pinned` - rejected, not honoured
+/// into a broken wrap.
+fn applypin(
+    order: Vec<String>,
+    edges: &BTreeMap<String, Vec<String>>,
+    pin: &Value,
+) -> Result<Vec<String>, PluginError> {
+    if pin.is_null() {
+        return Ok(order);
+    }
+
+    let mut out = order;
+
+    // SORTED, not insertion order. A pin map is data - it can arrive from
+    // a host's own construction options in any order, and two names pinned
+    // to the same end are order-sensitive (`{b:'first', a:'first'}` and
+    // `{a:'first', b:'first'}` give different results). A BTreeMap is
+    // sorted by construction, which is why `Value::Map` is one.
+    for name in pin.keys() {
+        let want = pin.get(&name);
+        let idx = out.iter().position(|r| refname(r) == name);
+        let idx = match idx {
+            Some(i) => i,
+            None => continue,
+        };
+
+        // `first`/`outermost` is index 0; `last`/`innermost` is the end.
+        // §6.2 makes the first chain binding outermost, which is why the
+        // vocabulary is positional and why the two spellings pair this
+        // way.
+        let wantfirst = matches!(want.as_str(), Some("first") | Some("outermost"));
+        let eref = out.remove(idx);
+        if wantfirst {
+            out.insert(0, eref);
+        } else {
+            out.push(eref);
+        }
+    }
+
+    // Now check that the placement did not break a constraint. This is the
+    // half that makes a pin a rejection rather than an override: the host
+    // wins on position, but it does not get to silently discard a
+    // relationship a plugin declared.
+    let at: BTreeMap<&String, usize> = out.iter().enumerate().map(|(i, r)| (r, i)).collect();
+    for (from, tos) in edges.iter() {
+        for to in tos.iter() {
+            if at[from] <= at[to] {
+                continue;
+            }
+            return fail(
+                "plugin_order_pinned",
+                &format!(
+                    "a pin would move a binding an ordering constrains: {} must precede {}",
+                    from, to
+                ),
+                details(&[("before", Value::str(from)), ("after", Value::str(to))]),
+            );
+        }
+    }
+
+    Ok(out)
+}

package/project/.sdk/tm/rust/feature/secrets/plugin/point.rs

@@ -0,0 +1,137 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/point.rs)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Extension points (§6). Three kinds, chosen because they are what the
+//! two existing systems actually needed, and no more.
+//!
+//! A PLUGIN NEVER MUTATES THE HOST. That inversion is what makes
+//! deactivation possible: sdkgen's `utility.fetcher = wrapped` is not
+//! undoable, but "this instance holds slot 3 of the request chain" is
+//! undoable in O(1). OSGi named it the whiteboard pattern in 2004, in a
+//! paper called *Listeners Considered Harmful*, and for exactly this
+//! reason.
+
+use std::rc::Rc;
+
+use super::types::{details, fail, stable_sort_by, PluginError};
+use super::value::Value;
+
+/// The next link of a chain (§6.2), or the base at the end of it.
+pub type NextFn = Rc<dyn Fn(&[Value]) -> Result<Value, PluginError>>;
+
+/// EVERY binding has one signature, whatever kind of point it is on: a
+/// hook and a provider ignore the `next` they are handed, a chain uses it.
+/// One signature is what lets `bound` return a single list the three
+/// callers share, rather than three parallel registries that can disagree
+/// about which instance holds slot 3.
+pub type BindFn = Rc<dyn Fn(Option<&NextFn>, &[Value]) -> Result<Value, PluginError>>;
+
+#[derive(Clone)]
+pub struct Bound {
+    pub eref: String,
+    pub point: String,
+    pub func: BindFn,
+    pub band: i64,
+}
+
+/// §6.1: "fan-out" is not one answer but four. In a language with
+/// asynchrony, "call every binding" hides a decision - start them all and
+/// wait, await each in turn, or do not wait - and a design that leaves it
+/// unsaid gets four different answers from four ports, in the concurrency
+/// behaviour of production code no corpus entry happens to cover.
+pub const MODES: [&str; 4] = ["emit", "parallel", "serial", "bail"];
+
+/// Fan-out. Return values are ignored except in `bail`.
+pub fn point_emit(bindings: &[Bound], mode: &str, arg: &Value) -> Result<Value, PluginError> {
+    if "bail" == mode {
+        // Stops at the first binding that RETURNS A VALUE - the "handled,
+        // stop" case. A `null` RETURN DECLINES (§6.1): rust has one way to
+        // say nothing here, and the model's rule is written to that rather
+        // than to JavaScript's null/undefined pair. Not truthiness -
+        // `false`, `0` and `""` are values.
+        for b in bindings.iter() {
+            let v = (b.func)(None, std::slice::from_ref(arg))?;
+            if !v.is_null() {
+                return Ok(v);
+            }
+        }
+        return Ok(Value::Null);
+    }
+
+    let mut errors: Vec<Value> = Vec::new();
+    for b in bindings.iter() {
+        match (b.func)(None, std::slice::from_ref(arg)) {
+            Ok(_) => {}
+            Err(e) => {
+                // `emit` raises synchronously; the collecting modes gather.
+                if "emit" == mode {
+                    return Err(e);
+                }
+                errors.push(Value::str(&e.message));
+            }
+        }
+    }
+    Ok(if "emit" == mode {
+        Value::Null
+    } else {
+        Value::List(errors)
+    })
+}
+
+/// Composition: b1(b2(b3(base))), FIRST BINDING OUTERMOST (§6.2).
+///
+/// Recomputed by the host whenever the live set changes, and cached
+/// between changes. Plugins receive `next` as an argument; they never see
+/// or store the previous value of anything. A plugin that stashes `next`
+/// and calls it after deactivation is a bug the host cannot prevent, and
+/// this says so rather than pretending otherwise.
+pub fn compose(bindings: &[Bound], base: NextFn) -> NextFn {
+    let mut nxt = base;
+    for b in bindings.iter().rev() {
+        let func = b.func.clone();
+        let inner = nxt.clone();
+        nxt = Rc::new(move |args: &[Value]| func(Some(&inner), args));
+    }
+    nxt
+}
+
+/// At most one live implementation (§6.3). The winner is the highest band,
+/// ties broken by ref sort, and THE LOSERS ARE VISIBLE rather than
+/// silently ignored.
+pub struct Picked {
+    pub winner: Option<Bound>,
+    pub shadowed: Vec<String>,
+}
+
+pub fn point_provider(bindings: &[Bound], spec: &Value) -> Result<Picked, PluginError> {
+    if bindings.is_empty() {
+        return Ok(Picked {
+            winner: None,
+            shadowed: Vec::new(),
+        });
+    }
+
+    if spec.get("exclusive").truthy() && 1 < bindings.len() {
+        let mut refs: Vec<String> = bindings.iter().map(|b| b.eref.clone()).collect();
+        refs.sort();
+        return fail(
+            "plugin_point_exclusive",
+            &format!(
+                "point is exclusive and has {} bindings: {}",
+                bindings.len(),
+                refs.join(", ")
+            ),
+            details(&[(
+                "refs",
+                Value::List(refs.iter().map(|r| Value::str(r)).collect()),
+            )]),
+        );
+    }
+
+    let mut ranked: Vec<Bound> = bindings.to_vec();
+    stable_sort_by(&mut ranked, |b| (-b.band, b.eref.clone()));
+    Ok(Picked {
+        winner: Some(ranked[0].clone()),
+        shadowed: ranked[1..].iter().map(|b| b.eref.clone()).collect(),
+    })
+}

package/project/.sdk/tm/rust/feature/secrets/plugin/refs.rs

@@ -0,0 +1,148 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/refs.rs)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Identity: name+tag, written `name$tag` (§4).
+//!
+//! The four pure functions, and the whole of what `ref` pins. They are the
+//! first thing a new port implements and the first corpus section it
+//! passes.
+//!
+//! NO REGEX ENGINE, because the standard library has none and §16 permits
+//! no crate to supply one. The grammar is a character-class walk instead -
+//! which is also why the `#trailing-newline` entries cannot bite this port
+//! the way they bit ruby, python and perl: there is no `$` here to match
+//! before a newline.
+
+use super::types::{details, fail, PluginError};
+use super::value::Value;
+
+pub const REF_MAX: usize = 1024;
+
+/// §4: `^[a-zA-Z@][a-zA-Z0-9.~_\-/]*$`, max 1024.
+pub fn check_name(name: &Value) -> bool {
+    let text = match name.as_str() {
+        Some(s) => s,
+        None => return false,
+    };
+    if text.is_empty() || REF_MAX < text.chars().count() {
+        return false;
+    }
+    let mut chars = text.chars();
+    let first = chars.next().unwrap();
+    if !(first.is_ascii_alphabetic() || '@' == first) {
+        return false;
+    }
+    chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '~' | '_' | '-' | '/'))
+}
+
+/// §4: `^[a-zA-Z0-9.~_-]+$`, max 1024, or empty.
+///
+/// The asymmetry with a name is deliberate: a tag MAY start with a digit
+/// because auto-tagging assigns integer tags (`stripe$1`), and a tag
+/// admits neither `@` nor `/` because a name is a package specifier and a
+/// tag is not.
+pub fn check_tag(tag: &Value) -> bool {
+    let text = match tag.as_str() {
+        Some(s) => s,
+        None => return false,
+    };
+    // The empty tag is an ordinary tag (§4 rule 2). The single-instance
+    // case writes no tag and never learns tags exist.
+    if text.is_empty() {
+        return true;
+    }
+    if REF_MAX < text.chars().count() {
+        return false;
+    }
+    text.chars()
+        .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '~' | '_' | '-'))
+}
+
+/// `name$tag` -> the pair. Canonicalizing: `stripe$` and `stripe` both
+/// give tag "".
+pub fn parse_ref(value: &Value) -> Result<Value, PluginError> {
+    let text = match value.as_str() {
+        Some(s) => s,
+        None => return fail("plugin_bad_name", "ref must be a string", Value::Null),
+    };
+
+    // Split on the FIRST `$`. Nothing in the grammar decides this - `$` is
+    // in neither character class - so the corpus is the arbiter (§4 rule
+    // 5), and it picks the split that blames the part actually at fault:
+    // `a$b$c` is a good name with a bad tag, not the reverse.
+    let (name, tag) = match text.find('$') {
+        Some(cut) => (&text[..cut], &text[cut + 1..]),
+        None => (text, ""),
+    };
+    let namev = Value::str(name);
+    let tagv = Value::str(tag);
+
+    if !check_name(&namev) {
+        return fail(
+            "plugin_bad_name",
+            &format!("invalid plugin name: {}", name),
+            details(&[("name", namev)]),
+        );
+    }
+    if !check_tag(&tagv) {
+        return fail(
+            "plugin_bad_tag",
+            &format!("invalid plugin tag: {}", tag),
+            details(&[("name", namev), ("tag", tagv)]),
+        );
+    }
+
+    let mut out = Value::map();
+    out.set("name", Value::str(name));
+    out.set("tag", Value::str(tag));
+    Ok(out)
+}
+
+/// The pair -> `name$tag`. An empty tag NEVER writes the separator, which
+/// is the half of canonicalization `format_ref` owns: parse tolerates
+/// `stripe$`, format never produces it, so a round trip is idempotent.
+pub fn format_ref(name: &Value, tag: &Value) -> Result<String, PluginError> {
+    let tag = if tag.is_null() { Value::str("") } else { tag.clone() };
+    if !check_name(name) {
+        return fail(
+            "plugin_bad_name",
+            &format!("invalid plugin name: {}", name.json()),
+            details(&[("name", name.clone())]),
+        );
+    }
+    if !check_tag(&tag) {
+        return fail(
+            "plugin_bad_tag",
+            &format!("invalid plugin tag: {}", tag.json()),
+            details(&[("name", name.clone()), ("tag", tag.clone())]),
+        );
+    }
+    let name = name.as_str().unwrap();
+    let tag = tag.as_str().unwrap();
+    Ok(if tag.is_empty() {
+        name.to_string()
+    } else {
+        format!("{}${}", name, tag)
+    })
+}
+
+/// The canonical spelling of a ref. §4 rule 5: ports must canonicalize
+/// before comparison.
+pub fn canon_ref(value: &Value) -> Result<String, PluginError> {
+    let parsed = parse_ref(value)?;
+    format_ref(&parsed.get("name"), &parsed.get("tag"))
+}
+
+/// canon_ref for the internal callers that want the input back unchanged
+/// when it is not well formed. NEVER use it where a bad ref must be
+/// reported - the corpus pins plugin_bad_name at every public entry.
+pub fn canon(text: &str) -> String {
+    canon_ref(&Value::str(text)).unwrap_or_else(|_| text.to_string())
+}
+
+pub fn refname(text: &str) -> String {
+    match parse_ref(&Value::str(text)) {
+        Ok(r) => r.get("name").as_str().unwrap_or(text).to_string(),
+        Err(_) => text.to_string(),
+    }
+}

package/project/.sdk/tm/rust/feature/secrets/plugin/resolve.rs

@@ -0,0 +1,83 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (rust/src/resolve.rs)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Dynamic resolution (§10.2) - name to candidate module ids.
+//!
+//! PURE. It returns the ids a host WOULD try, in order; it does not load
+//! anything. That separation is what lets the corpus pin resolution in
+//! every language including those with no dynamic loading at all, and it
+//! is why §15.4 puts real module loading in per-port integration tests
+//! rather than here.
+
+use super::value::Value;
+
+pub fn default_sources() -> Vec<Value> {
+    let mut src = Value::map();
+    src.set("kind", Value::str("module"));
+    src.set(
+        "prefix",
+        Value::List(vec![
+            Value::str("@voxgig/plugin-"),
+            Value::str("voxgig-plugin-"),
+            Value::str("plugin-"),
+            Value::str(""),
+        ]),
+    );
+    vec![src]
+}
+
+pub fn resolve_candidates(name: &str, sources: &Value) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+
+    // A SCOPED NAME RESOLVES VERBATIM ONLY (§10.2). `@acme/thing` is
+    // already a package id; prefixing it produces
+    // `@voxgig/plugin-@acme/thing`, which is not a thing that can exist.
+    if name.starts_with('@') {
+        return vec![name.to_string()];
+    }
+
+    let given = sources.as_list().cloned().unwrap_or_default();
+    let list = if given.is_empty() {
+        default_sources()
+    } else {
+        given
+    };
+
+    for src in list.iter() {
+        match src.get("kind").as_str() {
+            Some("module") => {
+                let prefixes = src.get("prefix");
+                let mut list = prefixes.as_list().cloned().unwrap_or_default();
+                if list.is_empty() {
+                    list = vec![Value::str("")];
+                }
+                for p in list.iter() {
+                    let id = format!("{}{}", p.as_str().unwrap_or(""), name);
+                    if !out.contains(&id) {
+                        out.push(id);
+                    }
+                }
+            }
+            Some("path") => {
+                let dir = src.get("dir");
+                let dir = dir.as_str().unwrap_or("").trim_end_matches('/');
+                let id = format!("{}/{}", dir, name);
+                if !out.contains(&id) {
+                    out.push(id);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    out
+}
+
+/// A MODULE PATH IS NOT A NAME (§10.2). The ref grammar starts a name with
+/// a letter or `@`, so `./local/thing` is not a ref and never reaches
+/// candidate generation - seneca allows a path where a plugin name goes,
+/// and this design deliberately does not, because a ref is an ADDRESS
+/// WITHIN A HOST and a path is a LOCATION ON A DISK.
+pub fn resolve_from(from: &Value) -> Vec<Value> {
+    vec![from.clone()]
+}