@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/csharp/test/vendor/omni/Runner.cs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (csharp/src/Runner.cs)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (csharp/src/Runner.cs)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (C# port).
 //

package/project/.sdk/tm/csharp/test/vendor/omni/Util.cs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (csharp/src/Util.cs)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (csharp/src/Util.cs)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/csharp/utility/MakeOptions.cs

@@ -214,6 +214,16 @@ public static partial class SdkUtility
                 },
             },
             ["utility"] = new Dictionary<string, object?>(),
+            // Feature INSTANCES supplied at construction (the `extend` seam
+            // the client constructor reads after the config-driven features):
+            // class instances, not data, so `$ANY` accepts them verbatim.
+            // Without this entry the seam is DEAD - validate REJECTS the
+            // unknown key ("Unexpected keys at field <root>: extend"), so a
+            // caller cannot hand in a feature the model did not activate,
+            // although the README documents the option. Ported from
+            // MakeOptionsUtility.ts / make_options.go / MakeOptions.java,
+            // which all carry it.
+            ["extend"] = "`$ANY`",
             ["system"] = new Dictionary<string, object?>(),
             ["test"] = new Dictionary<string, object?>
             {

package/project/.sdk/tm/csharp/utility/struct/Struct.cs

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.1 (csharp/Struct.cs)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025-2026 Voxgig Ltd. MIT LICENSE. */
 

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/capability.ex

@@ -0,0 +1,118 @@
+# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/capability.ex)
+# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+defmodule Voxgig.Plugin.Capability do
+  @moduledoc """
+  Capabilities (section 11.1).
+
+  A DEPENDENCY IS ON A CAPABILITY, NOT ON A REF - because it is a
+  dependency on something that can do the job, and which instance is doing
+  it is exactly the configuration detail a plugin must not care about.
+
+  But A BINDING IS TO AN INSTANCE, not to a capability, which is what
+  decides behaviour when the bound provider leaves while another match
+  remains.
+  """
+
+  alias Voxgig.Plugin.Types
+  alias Voxgig.Plugin.Version
+
+  @doc """
+  Rank the matching live providers and return them best-first: highest
+  `version`, then LOWEST `priority` (default 0), then declaration position
+  `pos` ascending.
+
+  `priority` is a field on the capability rather than section 7's `order`
+  band, because bands live on POINT BINDINGS: a provider may have several
+  bindings with different bands, or none at all, so a rank reaching for one
+  would be undefined in the common case.
+
+  Without a total rank, "any provider satisfies" is true of the GRAPH and
+  useless to the PLUGIN - two ports could bind different `store` instances,
+  both resolve green, and behave differently, which is precisely the
+  divergence a shared corpus exists to catch.
+  """
+  def resolve_capability(req, candidates) do
+    candidates
+    |> Enum.filter(&matches(req, Types.get(&1, "provides") || %{}))
+    |> Types.stable_sort_by(&rank_key/1)
+  end
+
+  @doc """
+  An ABSENT version sorts LAST, whatever the other is - "no version" loses
+  to every version rather than being read as 0.0.0. The leading flag is
+  what expresses that in a sort KEY rather than a comparator.
+  """
+  def rank_key(cand) do
+    prov = Types.get(cand, "provides") || %{}
+    version = Types.get(prov, "version")
+
+    parts =
+      case version do
+        nil -> [0, 0, 0]
+        text -> text |> Version.version_parts() |> Enum.map(&(-&1))
+      end
+
+    {if(is_nil(version), do: 1, else: 0), parts, Types.get(prov, "priority") || 0,
+     Types.get(cand, "pos") || 0}
+  end
+
+  def matches(req, prov) do
+    cond do
+      Types.get(req, "name") != Types.get(prov, "name") ->
+        false
+
+      not is_nil(Types.get(req, "range")) and
+          (is_nil(Types.get(prov, "version")) or
+             not Version.satisfiesq(Types.get(prov, "version"), Types.get(req, "range"))) ->
+        false
+
+      true ->
+        # `match` is checked against the provider's `attrs`, key by key. A
+        # key the provider does not carry is a miss, not a pass: a
+        # requirement asking for `transactional: true` must not be
+        # satisfied by a provider that never said.
+        want = Types.get(req, "match")
+
+        if is_nil(want) do
+          true
+        else
+          attrs = Types.get(prov, "attrs") || %{}
+
+          Enum.all?(Types.keys(want), fn k ->
+            Types.has(attrs, k) and matchvalue(Map.get(want, k), Map.get(attrs, k))
+          end)
+        end
+    end
+  end
+
+  @doc """
+  PARTIAL MATCH, RECURSING INTO MAPS (section 11.1).
+
+  Section 11.1 defines `match` as "a partial match against `attrs`, with
+  exactly the semantics voxgig/struct and the omni corpus already define
+  for `match` - every leaf in the requirement must be present and equal in
+  the capability, keys not mentioned are not checked."
+
+  Equality is by JSON TYPE as well as value: `transactional: 1` does not
+  satisfy `transactional: true`. ELIXIR NEEDS NO GUARD FOR THAT - `true ==
+  1` and `"1" == 1` are both false, while `1 == 1.0` is true, which is
+  exactly JSON's rule - so the explicit check php, perl and lua each carry
+  would be dead code here.
+
+  A LIST IS COMPARED LEAF-WISE AT THE SAME LENGTH, not as a subset.
+  """
+  def matchvalue(want, got) when is_map(want) do
+    is_map(got) and
+      Enum.all?(Types.keys(want), fn k ->
+        Types.has(got, k) and matchvalue(Map.get(want, k), Map.get(got, k))
+      end)
+  end
+
+  def matchvalue(want, got) when is_list(want) do
+    is_list(got) and length(want) == length(got) and
+      want |> Enum.zip(got) |> Enum.all?(fn {w, g} -> matchvalue(w, g) end)
+  end
+
+  def matchvalue(want, got), do: Types.same(want, got)
+end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/catalog.ex

@@ -0,0 +1,56 @@
+# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/catalog.ex)
+# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+defmodule Voxgig.Plugin.Catalog do
+  @moduledoc """
+  The definition catalog (section 10.1).
+
+  A definition is registered once and may back many instances. Option
+  shapes are validated AT REGISTRATION, not when a document happens to
+  exercise a key - so a malformed shape fails once, and in the same place
+  everywhere (section 9.4).
+
+  THE CATALOG IS A VALUE HERE, not an object with an `add` method. Every
+  other port hands out a mutable catalog and lets the host and its caller
+  share it; in Elixir a value cannot be mutated, so `add/2` RETURNS the
+  new catalog and the host - which is a process, and the only mutable
+  thing in the port - owns the one the host reads. `Host.catalog_add/2`
+  is how a caller extends a live host's catalog, and it is the only path
+  that has to exist: a caller holding a catalog value can simply keep the
+  result of `add/2`.
+  """
+
+  alias Voxgig.Plugin.Config
+  alias Voxgig.Plugin.Ref
+  alias Voxgig.Plugin.Types
+
+  defstruct defs: %{}
+
+  def add(%__MODULE__{} = catalog, definition) do
+    name = Types.get(definition, "name")
+
+    if not (is_map(definition) and Ref.check_name(name)) do
+      shown = if is_map(definition), do: name, else: definition
+      Types.fail("plugin_definition_name", "invalid definition name: #{Types.encode(shown)}")
+    end
+
+    # Validate the shape HERE. Deferring it to resolution time means a
+    # malformed shape surfaces at a different moment in every host that
+    # loads it, which is the divergence the stated domain exists to
+    # prevent.
+    shape = Types.get(definition, "shape")
+    if shape, do: Config.check_shape(shape)
+
+    %__MODULE__{catalog | defs: Map.put(catalog.defs, name, definition)}
+  end
+
+  def get(%__MODULE__{defs: defs}, name), do: Map.get(defs, name)
+
+  def has?(%__MODULE__{defs: defs}, name), do: Map.has_key?(defs, name)
+
+  def names(%__MODULE__{defs: defs}), do: defs |> Map.keys() |> Enum.sort()
+
+  def make_catalog(definitions \\ nil) do
+    Enum.reduce(definitions || [], %__MODULE__{}, &add(&2, &1))
+  end
+end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/plugin/config.ex

@@ -0,0 +1,320 @@
+# VENDORED: @voxgig/plugin sdk-20260908-1556-0 (elixir/lib/voxgig_plugin/config.ex)
+# Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+defmodule Voxgig.Plugin.Config do
+  @moduledoc """
+  The declarative document (section 9): normalization, and the ten-level
+  precedence ladder.
+
+  TWO FUNCTIONS, AND THE SPLIT BETWEEN THEM IS FORCED.
+
+  `normalize_config` normalizes STRUCTURE and ENTRY KEYS. It does not merge
+  options, and cannot: section 9.4 makes merge behaviour a property of the
+  definition's option SHAPE, which normalization has never seen. A
+  normalizer that flattened the option layers would make `$MERGE: append`
+  unimplementable at load time, because the layers it must concatenate
+  would already be collapsed.
+
+  `resolve_options` applies the ladder, and it is the only place that knows
+  the shape.
+  """
+
+  alias Voxgig.Plugin.Ref
+  alias Voxgig.Plugin.Types
+
+  @merge_words ~w(replace append)
+
+  def normalize_config(input) do
+    input = input || %{}
+    doc = Types.get(input, "doc") || %{}
+    keys = Types.get(input, "keys") || %{}
+    ikey = Types.get(keys, "instance") || "instance"
+    dkey = Types.get(keys, "default") || "default"
+    reserved = Types.get(input, "reserved") || []
+    profile = Types.get(input, "profile")
+
+    # The rename is applied at TWO PLACES AND NO OTHERS: the document root,
+    # and every profile.<name> overlay root (section 9.1). A rename applied
+    # only at the root would leave `profile.prod.sdk` untranslated and
+    # silently drop every environment override the host depends on.
+    # Recursing further would be worse: option data is the definition's.
+    baseinst = Types.get(doc, ikey)
+    basedef = Types.get(doc, dkey) || %{}
+
+    overlay =
+      if is_nil(profile) do
+        %{}
+      else
+        Types.get(Types.get(doc, "profile") || %{}, profile)
+      end
+
+    overlay = if is_map(overlay), do: overlay, else: %{}
+    overinst = Types.get(overlay, ikey)
+    overdef = Types.get(overlay, dkey) || %{}
+
+    {basemap, baseorder} = entries(baseinst)
+    {overmap, overorder} = entries(overinst)
+
+    for group <- [basemap, overmap, basedef, overdef], r <- Types.keys(group) do
+      checkreserved(r, reserved)
+    end
+
+    # A PARTIAL ARRAY IS NOT A FILTER (section 9.1). sdkgen learned this
+    # the hard way: deriving order from a partial array silently dropped
+    # config-activated features. Refs in the base but absent from the
+    # overlay still load, in sorted position AFTER the listed ones. A
+    # profile may also INTRODUCE a ref the base never declared.
+    order = Enum.uniq(overorder ++ baseorder)
+
+    instance =
+      order
+      |> Enum.with_index()
+      |> Enum.reduce(%{}, fn {ref, i}, acc ->
+        b = Map.get(basemap, ref)
+        o = Map.get(overmap, ref)
+
+        # MERGE THE ENTRIES AS AUTHORED, THEN APPLY DEFAULTS TO THE RESULT
+        # (section 9.3). A safety rule, not a tidiness one: if the overlay
+        # had its defaults filled in before merging it would carry a
+        # synthesized active:true and overwrite a base's false - silently
+        # re-enabling a deliberately disabled integration in production.
+        active = pick(o, "active", pick(b, "active", true))
+        start = pick(o, "start", pick(b, "start", "eager"))
+        block = pick(o, "order", pick(b, "order", nil))
+
+        # Option layers, levels 3-6, IN LADDER ORDER. Never merged here.
+        nm = Ref.refname(ref)
+
+        layers =
+          [Types.get(basedef, nm), b, Types.get(overdef, nm), o]
+          |> Enum.filter(&Types.has(&1, "options"))
+          |> Enum.map(&Map.get(&1, "options"))
+
+        ent = %{"pos" => i, "active" => active, "start" => start,
+                "optionlayers" => layers}
+
+        ent = if is_nil(block), do: ent, else: Map.put(ent, "order", block)
+        Map.put(acc, ref, ent)
+      end)
+
+    # `default` DECLARES NOTHING (section 9.3). It is a base for every
+    # instance of that definition; it does not create one, and an entry for
+    # a name with no instances is inert rather than an error - which is
+    # what makes a shared library of defaults shippable.
+    defout = Map.merge(basedef, overdef)
+
+    %{"instance" => instance, "order" => order, "default" => defout}
+  end
+
+  # Both document forms reduce to {ref -> entry} plus the order the form
+  # implies: array POSITION for the array form, sorted refs for the map
+  # form.
+  defp entries(nil), do: {%{}, []}
+
+  defp entries(src) when is_list(src) do
+    Enum.reduce(src, {%{}, []}, fn item, {map, order} ->
+      ref = Ref.canon_ref(Types.get(item, "ref"))
+      {Map.put(map, ref, item), order ++ [ref]}
+    end)
+  end
+
+  defp entries(src) when is_map(src) do
+    map =
+      Enum.reduce(Types.keys(src), %{}, fn key, acc ->
+        Map.put(acc, Ref.canon_ref(key), Map.get(src, key))
+      end)
+
+    # Byte-wise, NOT locale-aware and NOT case-folded. All-lowercase refs
+    # sort identically under all three, so only mixed input discriminates:
+    # '@' is 0x40, uppercase 0x41-0x5A, lowercase 0x61-0x7A. Elixir's `<`
+    # on binaries is exactly that.
+    {map, Types.keys(map)}
+  end
+
+  # Section 9.1: reservation is all-or-nothing per NAME, so the tagged
+  # forms go too. A configuration surface that can disable the thing
+  # reading it is not a surface, it is a trap.
+  defp checkreserved(_ref, []), do: :ok
+
+  defp checkreserved(ref, reserved) do
+    if Ref.refname(ref) in reserved do
+      Types.fail("plugin_ref_reserved", "ref is reserved by the host: #{ref}", %{"ref" => ref})
+    end
+
+    :ok
+  end
+
+  # PRESENCE decides, not truthiness and not nil. A JSON `null` is a
+  # present value in JavaScript (`undefined !== null`), so it must be one
+  # here - and a map that HOLDS nil is what lets elixir say so without a
+  # sentinel.
+  defp pick(src, key, dflt) do
+    if Types.has(src, key), do: Map.get(src, key), else: dflt
+  end
+
+  # ------------------------------------------------------------------
+  # resolve_options - section 9.3's ten levels, and 9.4's directives
+  # ------------------------------------------------------------------
+
+  def resolve_options(input) do
+    shape = Types.get(input, "shape") || %{}
+    check_shape(shape)
+
+    ref = Ref.canon_ref(Types.get(input, "ref"))
+    name = Ref.refname(ref)
+    doc = Types.get(input, "doc") || %{}
+    profile = Types.get(input, "profile")
+
+    overlay =
+      if is_nil(profile) do
+        %{}
+      else
+        Types.get(Types.get(doc, "profile") || %{}, profile)
+      end
+
+    overlay = if is_map(overlay), do: overlay, else: %{}
+
+    # ONE ordered merge, lowest to highest. Levels 3-6 are not two
+    # namespaces collapsed separately and composed afterwards: that inverts
+    # the rule that PROFILE SPECIFICITY OUTRANKS DEFINITION SPECIFICITY, so
+    # a prod per-definition default would lose to a base instance value.
+    layers = [
+      defaultsof(shape),
+      Types.get(input, "hostdefaults"),
+      optsof(Types.get(doc, "default"), name),
+      optsof(Types.get(doc, "instance"), ref),
+      optsof(Types.get(overlay, "default"), name),
+      optsof(Types.get(overlay, "instance"), ref),
+      Types.get(input, "env"),
+      Types.get(input, "hostoptions"),
+      Types.get(input, "loadoptions"),
+      Types.get(input, "patch")
+    ]
+
+    Enum.reduce(layers, %{}, fn layer, acc ->
+      if is_nil(layer), do: acc, else: mergeone(acc, layer, shape)
+    end)
+  end
+
+  # The shape's non-directive values are the level-1 defaults.
+  defp defaultsof(shape) do
+    shape
+    |> Types.keys()
+    |> Enum.reject(&Types.has(Map.get(shape, &1), "$MERGE"))
+    |> Enum.reduce(%{}, fn k, acc -> Map.put(acc, k, Map.get(shape, k)) end)
+  end
+
+  defp optsof(nil, _key), do: nil
+
+  defp optsof(src, key) when is_list(src) do
+    # The array form is equivalent to the map form (section 9.1).
+    case Enum.find(src, fn item -> Ref.canon_ref(Types.get(item, "ref")) == key end) do
+      nil -> nil
+      item -> Types.get(item, "options")
+    end
+  end
+
+  defp optsof(src, key) when is_map(src) do
+    case Enum.find(Types.keys(src), fn k -> Ref.canon_ref(k) == key end) do
+      nil ->
+        nil
+
+      k ->
+        entry = Map.get(src, k)
+        if is_map(entry), do: Types.get(entry, "options"), else: nil
+    end
+  end
+
+  # Merge ONE layer onto the accumulator, honouring the shape's directives.
+  # The directive holds at EVERY precedence level, not only between
+  # document levels - section 9.4 makes it a property of the shape, which
+  # does not know which layer a value arrived from.
+  defp mergeone(base, over, _shape) when not is_map(base) or not is_map(over), do: over
+
+  defp mergeone(base, over, shape) do
+    Enum.reduce(Types.keys(over), base, fn k, acc ->
+      o = Map.get(over, k)
+      directive = Types.get(Types.get(shape, k) || %{}, "$MERGE")
+      b = Map.get(acc, k)
+
+      merged =
+        cond do
+          "replace" == directive ->
+            o
+
+          "append" == directive ->
+            bl = if is_list(b), do: b, else: []
+            ol = if is_list(o), do: o, else: [o]
+            bl ++ ol
+
+          Types.has(directive, "deep") ->
+            deepto(b, o, Map.get(directive, "deep"))
+
+          # Library default: deep for maps, REPLACE for lists. struct.merge
+          # is element-wise by index, which for option maps is nearly
+          # always wrong - ["a"] over ["x","y","z"] yielding ["a","y","z"]
+          # is the defect station hit on secrets.providers.
+          is_map(b) and is_map(o) ->
+            mergeone(b, o, nil)
+
+          true ->
+            o
+        end
+
+      Map.put(acc, k, merged)
+    end)
+  end
+
+  # Merge N levels below this key, replace below that.
+  defp deepto(_base, over, n) when n <= 0, do: over
+  defp deepto(base, over, _n) when not is_map(base) or not is_map(over), do: over
+
+  defp deepto(base, over, n) do
+    Enum.reduce(Types.keys(over), base, fn k, acc ->
+      Map.put(acc, k, deepto(Map.get(acc, k), Map.get(over, k), n - 1))
+    end)
+  end
+
+  @doc """
+  Section 9.4: N is an integer of at least 1, and everything else is an
+  error.
+
+  `{"deep": 0}` is rejected DESPITE having an obvious reading, because
+  "replace at this key" already has a spelling and two spellings for one
+  behaviour is the defect class this repo exists to avoid.
+  """
+  def check_shape(shape) when is_map(shape) do
+    for k <- Types.keys(shape), Types.has(Map.get(shape, k), "$MERGE") do
+      directive = Map.get(Map.get(shape, k), "$MERGE")
+
+      cond do
+        is_binary(directive) and directive in @merge_words ->
+          :ok
+
+        is_binary(directive) ->
+          Types.fail("plugin_shape_invalid",
+                     "invalid $MERGE directive at #{k}: #{directive}", %{"key" => k})
+
+        Types.has(directive, "deep") ->
+          n = Map.get(directive, "deep")
+
+          # A JSON NUMBER, and an integer of at least 1. `is_integer`
+          # excludes `true` (which is not an integer in elixir) and `"2"`,
+          # so the type test the dynamic ports need is the guard itself.
+          if not (is_integer(n) and n >= 1) do
+            Types.fail("plugin_shape_invalid",
+                       "invalid $MERGE deep at #{k}: #{Types.encode(n)}", %{"key" => k})
+          end
+
+        true ->
+          Types.fail("plugin_shape_invalid",
+                     "invalid $MERGE directive at #{k}: #{Types.encode(directive)}",
+                     %{"key" => k})
+      end
+    end
+
+    :ok
+  end
+
+  def check_shape(_), do: :ok
+end