@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/java/test/vendor/omni/Json.java

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (java/src/com/voxgig/omni/Json.java)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (java/src/com/voxgig/omni/Json.java)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON parser for omni.
 //

package/project/.sdk/tm/java/test/vendor/omni/Runner.java

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (java/src/com/voxgig/omni/Runner.java)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (java/src/com/voxgig/omni/Runner.java)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/java/test/vendor/omni/Util.java

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (java/src/com/voxgig/omni/Util.java)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (java/src/com/voxgig/omni/Util.java)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/java/utility/MakeOptions.java

@@ -110,6 +110,13 @@ final class MakeOptions {
         + "\"feature\": { \"`$CHILD`\": {"
         + "  \"`$OPEN`\": true, \"active\": false } },"
         + "\"utility\": {},"
+        // Feature INSTANCES supplied at construction (the `extend` seam
+        // SdkClient's constructor reads at line 82): class instances, not
+        // data, so `$ANY` accepts them verbatim. Without this entry the
+        // seam is DEAD - validate drops the unknown key and the
+        // constructor's loop never sees a feature. Ported from
+        // MakeOptionsUtility.ts / make_options.go, which both carry it.
+        + "\"extend\": \"`$ANY`\","
         + "\"system\": {},"
         + "\"test\": { \"active\": false, \"entity\": { \"`$OPEN`\": true } },"
         + "\"clean\": { \"keys\": \"key,token,id\" },"

package/project/.sdk/tm/java/utility/struct/Struct.java

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.1 (java/src/Struct.java)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 package JAVAPACKAGE.utility.struct;
 

package/project/.sdk/tm/js/src/feature/secrets/SecretsFeature.js

@@ -0,0 +1,454 @@
+
+const { BaseFeature } = require('../base/BaseFeature')
+const { Sekreto, envkey } = require('./sekreto')
+
+
+// Secret access via a vendored @voxgig/sekreto provider chain, and the
+// access-token exchange some APIs require on top of it.
+//
+// The SDK's `apikey` option keeps exactly its old meaning: an explicit
+// credential given in code. This feature makes it ONE SOURCE among several
+// rather than the only one: when active, the apikey is resolved through a
+// sekreto chain in which the explicit option (when set) is the FIRST
+// provider — a `memory` store named `options` — so an explicit value always
+// wins, by sekreto's own first-hit rule rather than by special-case logic.
+// When the option is unset, the remaining providers (env, dotenv, a vault)
+// are asked in order, and moving a credential from code to a vault becomes
+// a configuration change.
+//
+// SOME APIs will not take a long-lived credential at all. What the chain
+// resolves is then a REFRESH token, which buys a short-lived ACCESS token
+// from a token endpoint; the access token is what every request carries,
+// and it expires. `exchange.active` turns that round trip on: the resolved
+// secret is POSTed to `exchange.path` (relative to options.base), the
+// access token from the response is written to options.apikey, and a
+// response in `exchange.statuses` (401) buys another and retries once.
+//
+// That last part is why this feature wraps the transport. Expiry is only
+// ever discovered from a RESPONSE, and the transport is the one place a
+// response can be seen before the operation pipeline turns it into a
+// result. With the exchange off, nothing is wrapped.
+//
+// Resolution is ASYNC (providers may do IO), but the auth header is built
+// by the synchronous prepareAuth inside makeSpec. The bridge is the
+// feature hook pipeline: every entity op awaits featureHook('PreSpec')
+// before calling makeSpec, so the PreSpec hook below resolves the secret
+// once and writes it into the live options where prepareAuth already
+// looks. prepareAuth itself is untouched. ProjectNameSDK.prepare()
+// bypasses feature hooks entirely, so it awaits client._secrets.resolve()
+// itself — which is what defends the raw direct()/graphql() paths, since
+// both reach the wire through prepare().
+class SecretsFeature extends BaseFeature {
+  version = '0.1.0'
+  name = 'secrets'
+
+  _client
+  _sekreto
+  _secretname = 'apikey'
+  _resolving
+  _cache = true
+
+  // Exchange state. `_exchange` is the resolved config (null when off),
+  // `_refresh` the credential the chain gave us, and `_buying` the single
+  // in-flight token purchase concurrent callers share.
+  _exchange = null
+  _refresh
+  _buying
+
+
+  // Sync by contract (the constructor cannot await): build the chain only,
+  // never look anything up here.
+  init(ctx, fopts) {
+    const client = ctx.client
+    const options = ctx.options
+
+    // DEFERRED REQUIRE, and it must stay deferred.
+    //
+    // Config.js requires this module at its top (the generated
+    // #ImportFeatures block) and only assigns `module.exports` at the END
+    // of its body, so a top-level `require('../../Config')` here binds to
+    // a half-built module and FEATURE_PLUGINS reads as undefined. Keeping
+    // a module handle does not help either — Config REPLACES
+    // module.exports rather than adding to it, so the handle is the stale
+    // empty object. By the time a feature initialises, Config has
+    // finished, so reading the property here gets the real map.
+    //
+    // The failure this avoids is silent: an SDK whose provider vocabulary
+    // is EMPTY, every builtin-only test green, and every plugin kind
+    // refused at runtime as an unknown provider kind. Upstream sekreto
+    // documents the same hazard for its own pair in
+    // sekreto/provider/support.js.
+    const plugins = require('../../Config').FEATURE_PLUGINS || {}
+
+    this._client = client
+    this._secretname = 'string' === typeof fopts.name &&
+      '' !== fopts.name ? fopts.name : 'apikey'
+
+    // Exchange config, normalised once. Null when off, so every later
+    // decision is a null check rather than a repeated `true === ...active`.
+    const xopts = fopts.exchange
+    this._exchange = (null != xopts && true === xopts.active) ? {
+      path: 'string' === typeof xopts.path ? xopts.path : 'auth/token',
+      method: 'string' === typeof xopts.method ? xopts.method : 'POST',
+      request: 'string' === typeof xopts.request ? xopts.request : 'refresh_token',
+      response: 'string' === typeof xopts.response ? xopts.response : 'access_token',
+      statuses: Array.isArray(xopts.statuses) ? xopts.statuses : [401],
+      retries: 'number' === typeof xopts.retries ? xopts.retries : 1,
+    } : null
+
+    const providers = []
+
+    // The explicit credential, when set, is the first store in the chain.
+    //
+    // WHICH option that is depends on the exchange. Without one, the secret
+    // being resolved IS the credential the transport sends, so `apikey` is
+    // it. With one, the secret is a REFRESH token and `apikey` means the
+    // opposite thing — an access token the caller already holds — so the
+    // explicit seat belongs to `exchange.refresh`, and apikey is left alone
+    // to serve as the starting access token (see resolve below).
+    const explicit = null == this._exchange ?
+      options.apikey :
+      (null == xopts ? undefined : xopts.refresh)
+
+    if ('string' === typeof explicit && '' !== explicit) {
+      providers.push({
+        kind: 'memory',
+        name: 'options',
+        values: { [envkey(this._secretname)]: explicit },
+      })
+    }
+
+    for (const p of (fopts.providers || [])) {
+      providers.push(p)
+    }
+
+    this._cache = false !== fopts.cache
+
+    this._sekreto = new Sekreto({
+      providers,
+      plugins: plugins[this.name] || [],
+      cache: this._cache,
+    })
+
+    // Seam for ProjectNameSDK.prepare() (no feature hooks on that path)
+    // and for the public secrets() accessor.
+    client._secrets = this
+
+    // Wrap the transport ONLY when there is an exchange to defend. A spent
+    // access token is discovered from the response, and this is the one
+    // place a response can be seen and the request tried again.
+    if (null != this._exchange) {
+      const self = this
+      const utility = ctx.utility
+      const inner = utility.fetcher
+
+      utility.fetcher = async function (ctx2, url, fetchdef) {
+        return self._withRefresh(ctx2, url, fetchdef, inner)
+      }
+    }
+  }
+
+
+  // The LIVE Sekreto instance, for the SDK's secrets() accessor and for
+  // callers who want arbitrary secrets or redaction:
+  //
+  //   await sdk.secrets().get('db.password')
+  //   sdk.secrets().redact(logline)
+  //
+  // Public, so the accessor does not have to reach into a private field.
+  // Never a clone: sekreto holds provider state (caches, vault leases)
+  // that has to stay live to be worth anything.
+  sekreto() {
+    return this._sekreto
+  }
+
+
+  PreSpec(_ctx) {
+    return this.resolve()
+  }
+
+
+  // Resolve the apikey before the first request. Concurrent ops share the
+  // one IN-FLIGHT promise; a settled one is not reused unless caching is
+  // on. A provider ERROR (unreachable vault, bad creds) rejects and fails
+  // the op — sekreto's miss-vs-error rule: never fall through to an
+  // unauthenticated request because a store was broken.
+  //
+  // The promise is cleared on REJECTION, after success when caching is off,
+  // and after a MISS however caching is set. Holding a settled promise
+  // forever would mean a transient vault outage poisoned the client
+  // permanently — every later operation failing with the original error long
+  // after the vault recovered — and it would make the documented
+  // `cache: false` a lie, since the chain would never be asked a second time.
+  //
+  // The MISS rule is sekreto's, not this feature's: `A miss is never cached:
+  // the next read asks again`, in sekreto's own source. Retaining a settled
+  // miss here would override that from the layer above, and a secret
+  // provisioned after startup — a mounted file, a policy granted a minute
+  // late — would never be picked up for the life of the client. `cache` is
+  // about caching a HIT; it was never a promise to keep saying no.
+  resolve() {
+    if (null == this._resolving) {
+      const inflight = this._resolveonce()
+        .then(
+          (hit) => {
+            if (!this._cache || !hit) {
+              this._resolving = undefined
+            }
+          },
+          (err) => {
+            this._resolving = undefined
+            throw err
+          })
+
+      this._resolving = inflight
+    }
+
+    return this._resolving
+  }
+
+
+  // Resolve once, reporting whether a credential came out of it. That
+  // boolean is the whole of what resolve() needs to tell a cacheable HIT
+  // from a miss it must not retain.
+  async _resolveonce() {
+    if (null == this._sekreto) {
+      return false
+    }
+
+    const found = await this._sekreto.try(this._secretname)
+
+    if (null == this._exchange) {
+      if (undefined !== found) {
+        // The same live-mutation seam TestFeature uses for the transport:
+        // prepareAuth reads client.options() (a clone of _options), so the
+        // resolved value lands where the sync auth path already looks.
+        this._client._options.apikey = found
+      }
+      return undefined !== found
+    }
+
+    // Exchanging: what the chain resolved is the REFRESH token, kept for
+    // every later purchase. A miss is not fatal here — an explicit
+    // `apikey` may already hold a usable access token, and the API is
+    // what gets to say whether it does.
+    this._refresh = undefined === found ? undefined : String(found)
+
+    const apikey = this._client._options.apikey
+    if ('string' === typeof apikey && '' !== apikey) {
+      // A starting access token was supplied. Spend it: if it is stale the
+      // API answers 401 and the transport wrapper buys another, which is
+      // the same path expiry takes anyway.
+      return true
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. _withRefresh honours suppression
+    // for the RETRY, but it runs after this — by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (null == this._client.options().auth) {
+      return false
+    }
+
+    this._client._options.apikey = await this._buy()
+
+    return true
+  }
+
+
+  // Buy an access token with the refresh token.
+  //
+  // Concurrent callers share the ONE in-flight purchase: a client running
+  // four operations at once must not open four token requests, and three of
+  // the four tokens would be wasted. The promise is cleared once settled,
+  // so the next expiry buys a fresh one rather than replaying this result.
+  _buy() {
+    // TEST MODE BUYS NOTHING.
+    //
+    // The test feature replaces the transport so that no request leaves the
+    // process; an exchange here would be the one HTTP call it could not
+    // stop, and it would need a live token endpoint for a suite whose whole
+    // point is not needing one. So test mode gets a deterministic,
+    // obviously-fake token instead — the same answer makeOptions gives a
+    // required server variable, for the same reason.
+    if ('live' !== this._client._mode) {
+      return Promise.resolve('test-' + this._exchange.response)
+    }
+
+    if (null != this._buying) {
+      return this._buying
+    }
+
+    const buying = this._buyonce()
+      .then(
+        (token) => {
+          this._buying = undefined
+          return token
+        },
+        (err) => {
+          this._buying = undefined
+          throw err
+        })
+
+    this._buying = buying
+
+    return buying
+  }
+
+
+  async _buyonce() {
+    const x = this._exchange
+
+    if (null == this._refresh || '' === this._refresh) {
+      throw new Error(
+        "secrets: no refresh token: the provider chain has no '" +
+        this._secretname + "', and feature.secrets.exchange.refresh is unset")
+    }
+
+    const options = this._client.options()
+
+    // The token endpoint is RELATIVE to the base, which already carries
+    // whatever account or tenant segment the server URL declares.
+    const base = String(options.base || '').replace(/\/+$/, '')
+    const url = base + '/' + String(x.path).replace(/^\/+/, '')
+
+    const fetch = options.system && options.system.fetch
+
+    if ('function' !== typeof fetch) {
+      throw new Error('secrets: no fetch implementation for the token exchange')
+    }
+
+    // Deliberately NOT the SDK transport. The transport is what this
+    // feature wraps, and sending the token request back through it would
+    // recurse on the first 401 — and would route the exchange through the
+    // test mock, which knows nothing about it.
+    const res = await fetch(url, {
+      method: x.method,
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ [x.request]: this._refresh }),
+    })
+
+    const status = null == res ? 0 : res.status
+
+    if (200 > status || 300 <= status) {
+      throw new Error(
+        'secrets: token exchange failed: ' + status + ' from ' + url)
+    }
+
+    const body = 'function' === typeof res.json ? await res.json() : res.body
+    const token = null == body ? undefined : body[x.response]
+
+    if ('string' !== typeof token || '' === token) {
+      throw new Error(
+        "secrets: token exchange returned no '" + x.response + "' field from " + url)
+    }
+
+    return token
+  }
+
+
+  // Buy a token and try the request again when the API says the current one
+  // is spent. Wraps the transport; installed only when exchanging.
+  //
+  // The retry rewrites the Authorization header IN PLACE on the fetchdef,
+  // because the header was built by the synchronous prepareAuth before this
+  // request left, and it carries the token that just failed. Rebuilt the
+  // way prepareAuth builds it, from the same options.auth.prefix, so the
+  // two cannot drift.
+  async _withRefresh(ctx, url, fetchdef, inner) {
+    const x = this._exchange
+    const max = null == x ? 0 : x.retries
+
+    // `auth: null` is the documented way to send NO credential, and
+    // prepareAuth honours it by removing the header. A refusal of a
+    // deliberately unauthenticated request is not an expired token and
+    // cannot be fixed by buying one — retrying would transmit exactly the
+    // credential the caller suppressed.
+    if (null == this._client.options().auth) {
+      return inner(ctx, url, fetchdef)
+    }
+
+    let attempt = 0
+
+    for (; ;) {
+      // The credential THIS attempt goes out with, captured before it
+      // leaves: it is what tells a stale refusal apart from a fresh one.
+      const used = this._client._options.apikey
+
+      const res = await inner(ctx, url, fetchdef)
+
+      if (attempt >= max || !this._spent(res)) {
+        return res
+      }
+
+      // Another request may have bought a token while this one was in
+      // flight. Concurrent 401s share the in-flight purchase, but
+      // STAGGERED ones do not: the first finishes and clears it, and the
+      // second would then buy again — a second exchange for a token that
+      // is already current, and on a provider that invalidates the
+      // previous credential on issuance, one that breaks the first
+      // request's own retry. So spend what is current before buying.
+      const current = this._client._options.apikey
+      let token
+
+      if ('string' === typeof current && '' !== current && current !== used) {
+        token = current
+      }
+      else {
+        try {
+          token = await this._buy()
+        }
+        catch (err) {
+          // The purchase failed: answer with the API's own refusal rather
+          // than this one. The caller asked for data, and the 401 is the
+          // more useful of the two — the exchange error is a symptom.
+          return res
+        }
+
+        this._client._options.apikey = token
+      }
+
+      this._reauth(fetchdef, token)
+
+      attempt++
+    }
+  }
+
+
+  _spent(res) {
+    if (null == res || res instanceof Error) {
+      return false
+    }
+    const statuses = this._exchange.statuses
+    return statuses.indexOf(res.status) >= 0
+  }
+
+
+  _reauth(fetchdef, token) {
+    if (null == fetchdef || null == fetchdef.headers) {
+      return
+    }
+
+    const auth = this._client.options().auth
+
+    // Suppressed auth means NO header, the same answer prepareAuth gives.
+    // Reached defensively - _withRefresh does not retry at all when auth
+    // is null - but this is the function that writes the credential, so
+    // it is where the rule has to hold.
+    if (null == auth) {
+      delete fetchdef.headers.authorization
+      return
+    }
+
+    const prefix = auth.prefix
+    fetchdef.headers.authorization = prefix ? prefix + ' ' + token : token
+  }
+}
+
+
+module.exports = {
+  SecretsFeature
+}

package/project/.sdk/tm/js/src/feature/secrets/plugin/capability.js

@@ -0,0 +1,119 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/capability.js)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Capabilities (§11.1).
+ *
+ * A DEPENDENCY IS ON A CAPABILITY, NOT ON A REF — because it is a
+ * dependency on something that can do the job, and which instance is
+ * doing it is exactly the configuration detail a plugin must not care
+ * about.
+ *
+ * But A BINDING IS TO AN INSTANCE, not to a capability, which is what
+ * decides behaviour when the bound provider leaves while another match
+ * remains. */
+
+'use strict'
+
+const { satisfies } = require('./version')
+
+/** Rank the matching live providers and return them best-first:
+ * highest `version`, then LOWEST `priority` (default 0), then
+ * declaration position `pos` ascending.
+ *
+ * `priority` is a field on the capability rather than §7's `order` band,
+ * because bands live on POINT BINDINGS: a provider may have several
+ * bindings with different bands, or none at all, so a rank reaching for
+ * one would be undefined in the common case.
+ *
+ * Without a total rank, "any provider satisfies" is true of the GRAPH
+ * and useless to the PLUGIN — two ports could bind different `store`
+ * instances, both resolve green, and behave differently, which is
+ * precisely the divergence a shared corpus exists to catch. */
+function resolvecapability(req, candidates) {
+  const hits = candidates.filter((c) => matches(req, c.provides))
+  hits.sort((a, b) => {
+    const av = a.provides.version, bv = b.provides.version
+    if (av !== bv) {
+      if (undefined === av) return 1
+      if (undefined === bv) return -1
+      const c = compare(bv, av)      // highest version FIRST
+      if (0 !== c) return c
+    }
+    const ap = a.provides.priority || 0
+    const bp = b.provides.priority || 0
+    if (ap !== bp) return ap - bp    // lowest priority first
+    return a.pos - b.pos
+  })
+  return hits
+}
+
+function matches(req, prov) {
+  if (req.name !== prov.name) return false
+
+  if (undefined !== req.range) {
+    if (undefined === prov.version) return false
+    if (!satisfies(prov.version, req.range)) return false
+  }
+
+  // `match` is checked against the provider's `attrs`, key by key. A key
+  // the provider does not carry is a miss, not a pass: a requirement
+  // asking for `transactional: true` must not be satisfied by a provider
+  // that never said.
+  if (undefined !== req.match) {
+    const attrs = prov.attrs || {}
+    for (const k of Object.keys(req.match)) {
+      if (!(k in attrs)) return false
+      if (!matchvalue(req.match[k], attrs[k])) return false
+    }
+  }
+
+  return true
+}
+
+/** PARTIAL MATCH, RECURSING INTO MAPS (§11.1).
+ *
+ * §11.1 defines `match` as "a partial match against `attrs`, with
+ * exactly the semantics voxgig/struct and the omni corpus already define
+ * for `match` — every leaf in the requirement must be present and equal
+ * in the capability, keys not mentioned are not checked."
+ *
+ * `===` here is not incidental: EQUALITY IS BY JSON TYPE AS WELL AS
+ * VALUE, so `transactional: 1` does not satisfy `transactional: true`.
+ * Half the ports are written in languages whose default comparison says
+ * otherwise, and `capability/match` pins it for all of them.
+ *
+ * A LIST IS COMPARED LEAF-WISE AT THE SAME LENGTH, not as a subset. */
+function matchvalue(want, got) {
+  if (isMap(want)) {
+    if (!isMap(got)) return false
+    for (const k of Object.keys(want)) {
+      if (!(k in got)) return false
+      if (!matchvalue(want[k], got[k])) return false
+    }
+    return true
+  }
+  if (Array.isArray(want)) {
+    if (!Array.isArray(got) || want.length !== got.length) return false
+    for (let i = 0; i < want.length; i++) {
+      if (!matchvalue(want[i], got[i])) return false
+    }
+    return true
+  }
+  return want === got
+}
+
+function isMap(v) {
+  return null != v && 'object' === typeof v && !Array.isArray(v)
+}
+
+function compare(a, b) {
+  const pa = a.split('.').map(Number)
+  const pb = b.split('.').map(Number)
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] || 0, y = pb[i] || 0
+    if (x !== y) return x < y ? -1 : 1
+  }
+  return 0
+}
+
+module.exports = { resolvecapability, matches, matchvalue }

package/project/.sdk/tm/js/src/feature/secrets/plugin/catalog.js

@@ -0,0 +1,42 @@
+// VENDORED: @voxgig/plugin sdk-20260908-1556-0 (javascript/src/catalog.js)
+// Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The definition catalog (§10.1).
+ *
+ * A definition is registered once and may back many instances. Option
+ * shapes are validated AT REGISTRATION, not when a document happens to
+ * exercise a key — so a malformed shape fails once, and in the same
+ * place everywhere (§9.4). */
+
+'use strict'
+
+const { fail } = require('./types')
+const { checkname } = require('./ref')
+const { checkshape } = require('./config')
+
+function makecatalog(defs) {
+  const map = {}
+
+  const add = (def) => {
+    if (!def || !checkname(def.name)) {
+      fail('plugin_definition_name', 'invalid definition name: ' + (def && def.name))
+    }
+    // Validate the shape HERE. Deferring it to resolution time means a
+    // malformed shape surfaces at a different moment in every host that
+    // loads it, which is the divergence the stated domain exists to
+    // prevent.
+    if (def.shape) checkshape(def.shape)
+    map[def.name] = def
+  }
+
+  for (const d of defs || []) add(d)
+
+  return {
+    add,
+    get: (name) => map[name],
+    has: (name) => undefined !== map[name],
+    names: () => Object.keys(map).sort(),
+  }
+}
+
+module.exports = { makecatalog }