@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/catalog.clj

@@ -0,0 +1,44 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/catalog.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin.catalog
+  "The definition catalog (section 10.1).
+
+  A definition is registered once and may back many instances. Option
+  shapes are validated AT REGISTRATION, not when a document happens to
+  exercise a key - so a malformed shape fails once, and in the same place
+  everywhere (section 9.4).
+
+  THE CATALOG IS A VALUE HERE, not an object with an `add` method. Every
+  other port hands out a mutable catalog and lets the host and its caller
+  share it; a clojure map cannot be mutated, so `add` RETURNS the new
+  catalog and the host - whose registry is the one atom in the port - owns
+  the one it reads. `host/catalog-add!` is how a caller extends a live
+  host's catalog, and it is the only path that has to exist: a caller
+  holding a catalog value simply keeps the result of `add`."
+  (:require [voxgig.plugin.types :as t]
+            [voxgig.plugin.ref :as r]
+            [voxgig.plugin.config :as config]))
+
+(defn add [catalog definition]
+  (let [nm (t/get definition "name")]
+    (when-not (and (map? definition) (r/check-name nm))
+      (t/fail "plugin_definition_name"
+              (str "invalid definition name: "
+                   (t/encode (if (map? definition) nm definition)))))
+    ;; Validate the shape HERE. Deferring it to resolution time means a
+    ;; malformed shape surfaces at a different moment in every host that
+    ;; loads it, which is the divergence the stated domain exists to
+    ;; prevent.
+    (when-let [shape (t/get definition "shape")] (config/check-shape shape))
+    (assoc catalog nm definition)))
+
+(defn make-catalog
+  ([] (make-catalog nil))
+  ([definitions] (reduce add {} (or definitions []))))
+
+(defn definition-of [catalog nm] (t/get catalog nm))
+
+(defn has-definition? [catalog nm] (t/has? catalog nm))
+
+(defn definition-names [catalog] (vec (t/sorted-keys catalog)))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/config.clj

@@ -0,0 +1,240 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/config.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin.config
+  "The declarative document (section 9): normalization, and the ten-level
+  precedence ladder.
+
+  TWO FUNCTIONS, AND THE SPLIT BETWEEN THEM IS FORCED.
+
+  `normalize-config` normalizes STRUCTURE and ENTRY KEYS. It does not
+  merge options, and cannot: section 9.4 makes merge behaviour a property
+  of the definition's option SHAPE, which normalization has never seen. A
+  normalizer that flattened the option layers would make `$MERGE: append`
+  unimplementable at load time, because the layers it must concatenate
+  would already be collapsed.
+
+  `resolve-options` applies the ladder, and it is the only place that
+  knows the shape."
+  (:require [voxgig.plugin.types :as t]
+            [voxgig.plugin.ref :as r]))
+
+(def ^:private merge-words #{"replace" "append"})
+
+(defn- pick
+  "PRESENCE decides, not truthiness and not nil. A JSON `null` is a present
+  value in JavaScript (`undefined !== null`), so it must be one here."
+  [src k dflt]
+  (if (t/has? src k) (t/get src k) dflt))
+
+(defn- entries
+  "Both document forms reduce to {ref -> entry} plus the order the form
+  implies: array POSITION for the array form, sorted refs for the map
+  form."
+  [src]
+  (cond
+    (nil? src) {:map {} :order []}
+
+    (sequential? src)
+    {:map (reduce #(assoc %1 (r/canon-ref (t/get %2 "ref")) %2) {} src)
+     :order (vec (map #(r/canon-ref (t/get % "ref")) src))}
+
+    :else
+    ;; Map-form refs arrive as KEYS, through a different path than an array
+    ;; element's `ref` field - and must canonicalize the same way.
+    (let [m (reduce #(assoc %1 (r/canon-ref %2) (src %2)) {} (t/sorted-keys src))]
+      ;; Byte-wise, NOT locale-aware and NOT case-folded. All-lowercase
+      ;; refs sort identically under all three, so only mixed input
+      ;; discriminates: '@' is 0x40, uppercase 0x41-0x5A, lowercase
+      ;; 0x61-0x7A. Clojure's `compare` on strings is String.compareTo,
+      ;; which is exactly that.
+      {:map m :order (vec (sort (keys m)))})))
+
+(defn- check-reserved [ref reserved]
+  (when (some #(= % (r/ref-name ref)) reserved)
+    (t/fail "plugin_ref_reserved" (str "ref is reserved by the host: " ref) {"ref" ref})))
+
+(defn normalize-config [input]
+  (let [doc (or (t/get input "doc") {})
+        keys- (or (t/get input "keys") {})
+        ikey (or (t/get keys- "instance") "instance")
+        dkey (or (t/get keys- "default") "default")
+        reserved (or (t/get input "reserved") [])
+        profile (t/get input "profile")
+        ;; The rename is applied at TWO PLACES AND NO OTHERS: the document
+        ;; root, and every profile.<name> overlay root (section 9.1). A
+        ;; rename applied only at the root would leave `profile.prod.sdk`
+        ;; untranslated and silently drop every environment override the
+        ;; host depends on. Recursing further would be worse: option data
+        ;; is the definition's.
+        basedef (or (t/get doc dkey) {})
+        overlay (let [o (when profile (t/get (t/get doc "profile") profile))]
+                  (if (map? o) o {}))
+        overdef (or (t/get overlay dkey) {})
+        base (entries (t/get doc ikey))
+        over (entries (t/get overlay ikey))]
+
+    (doseq [group [(keys (:map base)) (keys (:map over))
+                   (keys basedef) (keys overdef)]
+            ref group]
+      (check-reserved ref reserved))
+
+    ;; A PARTIAL ARRAY IS NOT A FILTER (section 9.1). sdkgen learned this
+    ;; the hard way: deriving order from a partial array silently dropped
+    ;; config-activated features. Refs in the base but absent from the
+    ;; overlay still load, in sorted position AFTER the listed ones. A
+    ;; profile may also INTRODUCE a ref the base never declared. The
+    ;; remainder keeps the BASE's own order.
+    (let [order (vec (distinct (concat (:order over) (:order base))))
+          instance
+          (into {}
+                (map-indexed
+                 (fn [i ref]
+                   (let [b ((:map base) ref)
+                         o ((:map over) ref)
+                         ;; MERGE THE ENTRIES AS AUTHORED, THEN APPLY
+                         ;; DEFAULTS TO THE RESULT (section 9.3). A safety
+                         ;; rule, not a tidiness one: if the overlay had
+                         ;; its defaults filled in before merging it would
+                         ;; carry a synthesized active:true and overwrite a
+                         ;; base's false - silently re-enabling a
+                         ;; deliberately disabled integration in
+                         ;; production.
+                         block (pick o "order" (pick b "order" nil))
+                         nm (r/ref-name ref)
+                         ;; Option layers, levels 3-6, IN LADDER ORDER.
+                         ;; Never merged here.
+                         layers (vec (for [src [(t/get basedef nm) b (t/get overdef nm) o]
+                                           :when (t/has? src "options")]
+                                       (t/get src "options")))
+                         ent {"pos" i
+                              "active" (pick o "active" (pick b "active" true))
+                              "start" (pick o "start" (pick b "start" "eager"))
+                              "optionlayers" layers}]
+                     [ref (if (nil? block) ent (assoc ent "order" block))]))
+                 order))]
+      {"instance" instance
+       "order" order
+       ;; `default` DECLARES NOTHING (section 9.3). It is a base for every
+       ;; instance of that definition; it does not create one, and an entry
+       ;; for a name with no instances is inert rather than an error -
+       ;; which is what makes a shared library of defaults shippable.
+       "default" (merge basedef overdef)})))
+
+;; --- resolve-options: section 9.3's ten levels, and 9.4's directives --
+
+(defn check-shape
+  "Section 9.4: N is an integer of at least 1, and everything else is an
+  error.
+
+  `{\"deep\": 0}` is rejected DESPITE having an obvious reading, because
+  \"replace at this key\" already has a spelling and two spellings for one
+  behaviour is the defect class this repo exists to avoid."
+  [shape]
+  (when (map? shape)
+    (doseq [k (t/sorted-keys shape)
+            :let [v (t/get shape k)]
+            :when (and (map? v) (t/has? v "$MERGE"))]
+      (let [directive (t/get v "$MERGE")]
+        (cond
+          (and (string? directive) (contains? merge-words directive)) nil
+
+          (and (map? directive) (t/has? directive "deep")
+               (let [n (t/get directive "deep")]
+                 ;; `(integer? true)` is false in clojure, so the boolean
+                 ;; case falls out for free here - unlike python, where it
+                 ;; does not.
+                 (and (integer? n) (<= 1 n))))
+          nil
+
+          :else
+          (t/fail "plugin_shape_invalid"
+                  (str "invalid $MERGE directive at " k ": " (t/encode directive))
+                  {"key" k "directive" directive}))))))
+
+(defn- defaults-of
+  "The shape's non-directive values are the level-1 defaults."
+  [shape]
+  (into {} (for [k (t/sorted-keys shape)
+                 :let [v (t/get shape k)]
+                 :when (not (and (map? v) (t/has? v "$MERGE")))]
+             [k v])))
+
+(defn- opts-of [src k]
+  (cond
+    (nil? src) nil
+    ;; The array form is equivalent to the map form (section 9.1).
+    (sequential? src) (some #(when (= k (r/canon-ref (t/get % "ref"))) (t/get % "options")) src)
+    :else (some #(when (= k (r/canon-ref %))
+                   (let [entry (t/get src %)]
+                     (when (map? entry) (t/get entry "options"))))
+                (t/sorted-keys src))))
+
+(declare merge-one)
+
+(defn- deep-to
+  "Merge N levels below this key, replace below that."
+  [base over n]
+  (if (or (<= n 0) (not (and (map? base) (map? over))))
+    over
+    (reduce (fn [acc k] (assoc acc k (deep-to (t/get acc k) (t/get over k) (dec n))))
+            base
+            (t/sorted-keys over))))
+
+(defn- merge-one
+  "Merge ONE layer onto the accumulator, honouring the shape's directives.
+  The directive holds at EVERY precedence level, not only between document
+  levels - section 9.4 makes it a property of the shape, which does not
+  know which layer a value arrived from."
+  [base over shape]
+  (cond
+    (nil? over) base
+    (not (and (map? base) (map? over))) over
+    :else
+    (reduce
+     (fn [acc k]
+       (let [o (t/get over k)
+             b (t/get acc k)
+             directive (when (map? (t/get shape k)) (t/get (t/get shape k) "$MERGE"))]
+         (cond
+           (= "replace" directive) (assoc acc k o)
+           (= "append" directive)
+           (assoc acc k (vec (concat (if (sequential? b) b [])
+                                     (if (sequential? o) o [o]))))
+           (and (map? directive) (t/has? directive "deep"))
+           (assoc acc k (deep-to b o (t/get directive "deep")))
+           ;; Library default: deep for maps, REPLACE for lists.
+           ;; struct.merge is element-wise by index, which for option maps
+           ;; is nearly always wrong - ["a"] over ["x","y","z"] yielding
+           ;; ["a","y","z"] is the defect station hit on
+           ;; secrets.providers.
+           :else (assoc acc k (if (and (map? b) (map? o)) (merge-one b o nil) o)))))
+     base
+     (t/sorted-keys over))))
+
+(defn resolve-options [input]
+  (let [shape (or (t/get input "shape") {})
+        _ (check-shape shape)
+        ref (r/canon-ref (t/get input "ref"))
+        nm (r/ref-name ref)
+        doc (or (t/get input "doc") {})
+        profile (t/get input "profile")
+        overlay (let [o (when profile (t/get (t/get doc "profile") profile))]
+                  (if (map? o) o {}))]
+    ;; ONE ordered merge, lowest to highest. Levels 3-6 are not two
+    ;; namespaces collapsed separately and composed afterwards: that
+    ;; inverts the rule that PROFILE SPECIFICITY OUTRANKS DEFINITION
+    ;; SPECIFICITY, so a prod per-definition default would lose to a base
+    ;; instance value.
+    (reduce #(merge-one %1 %2 shape)
+            {}
+            [(defaults-of shape)                            ; 1
+             (t/get input "hostdefaults")                   ; 2
+             (opts-of (t/get doc "default") nm)             ; 3
+             (opts-of (t/get doc "instance") ref)           ; 4
+             (opts-of (t/get overlay "default") nm)         ; 5
+             (opts-of (t/get overlay "instance") ref)       ; 6
+             (t/get input "env")                            ; 7
+             (t/get input "hostoptions")                    ; 8
+             (t/get input "loadoptions")                    ; 9
+             (t/get input "patch")])))                      ; 10

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/depend.clj

@@ -0,0 +1,199 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/depend.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin.depend
+  "Dependency cardinality, policy, and the restart graph (section 11.3).
+
+  TWO AXES, BOTH DECLARED BY THE DEFINITION THAT HAS THE REQUIREMENT,
+  because only it knows what it can cope with:
+
+                 | static (default)          | dynamic
+    -------------|---------------------------|-------------------------
+    mandatory    | unmet -> pending;         | unmet -> pending;
+    (default)    | lost  -> pending,         | lost  -> STAYS LIVE,
+                 |          recursively      |          notified
+    -------------|---------------------------|-------------------------
+    optional:true| never gates activation;   | never gates activation;
+                 | a change deactivates and  | a change is a
+                 | reactivates               | notification, nothing else
+
+  `dynamic` means the plugin has said, IN WRITING, that it can survive its
+  provider being swapped underneath it. It is not the default because most
+  plugins cannot, and the cost of wrongly assuming they can is a live
+  instance holding a dead reference.
+
+  The rebinding-preference axis is deliberately omitted. OSGi has
+  reluctant vs greedy and it is a knob every author must understand to
+  read anyone else's component; we take always-reluctant. Three axes were
+  more than the model can carry across twenty ports."
+  (:require [voxgig.plugin.types :as t]
+            [voxgig.plugin.ref :as r]))
+
+(defn norm-require
+  "A bare string is shorthand for `{name}`."
+  [raw]
+  (cond (string? raw) {"name" raw}
+        (map? raw) raw
+        :else {}))
+
+(defn requirements
+  "The requirements a definition declared, normalized.
+
+  BOTH AXES ARE READ AT TWO LEVELS, AND THE PER-REQUIREMENT ONE WINS.
+
+  The instance-level `policy` and `optional` list are how a DOCUMENT
+  states the axis without editing the definition, and they apply to every
+  requirement. The per-requirement form is the one section 11.1's object
+  syntax exists for, and it is strictly more expressive: an instance that
+  is `static` on its store and `dynamic` on its metrics cannot be written
+  at all at the instance level.
+
+  `optional` unions rather than overriding - both spellings are statements
+  that this requirement need not gate activation, and there is no reading
+  under which one of them means \"actually, mandatory\"."
+  [options]
+  (let [raw (or (t/get options "requires") [])
+        marked (t/get options "optional")
+        fallback (t/get options "policy")]
+    (vec (for [item raw]
+           (let [req (norm-require item)
+                 req (if (or (t/truthy (t/get req "optional"))
+                             (and (sequential? marked)
+                                  (boolean (some #(= % (t/get req "name")) marked))))
+                       (assoc req "optional" true)
+                       req)]
+             (if (and (nil? (t/get req "policy")) (some? fallback))
+               (assoc req "policy" fallback)
+               req))))))
+
+(defn restarts-on-loss?
+  "Does losing this requirement's SELECTED provider restart the consumer?
+  The mandatory ones under `static`, and the `static` optional ones - both
+  make a capability change deactivate and reactivate. `dynamic` never
+  restarts."
+  [req]
+  (not= "dynamic" (or (t/get req "policy") "static")))
+
+(defn gates-activation?
+  "Does an unmet requirement keep the consumer out of `live`?
+
+  Cardinality alone decides this, NOT policy. `dynamic` is a statement
+  about surviving a SWAP, not about starting without the thing at all - a
+  mandatory-dynamic consumer still waits in `pending` for its first
+  provider."
+  [req]
+  (not= true (t/get req "optional")))
+
+(defn restart-causing?
+  "Edges that can cause a restart, which is exactly the set a cycle must be
+  detected over (section 11.3).
+
+  ONLY `dynamic` OPTIONAL EDGES ARE EXCLUDED, and they are the ones the
+  exclusion was for: two plugins that optionally and dynamically consume
+  each other's capabilities both activate happily, neither gates on the
+  other, and each is merely notified when the other appears. Nothing
+  restarts, so nothing oscillates. An earlier draft of section 11.3
+  excluded EVERY optional edge and thereby admitted the non-terminating
+  case it was trying to permit."
+  [req]
+  (or (gates-activation? req) (restarts-on-loss? req)))
+
+;; TWO INDEXES, NOT ONE MERGED MAP. Capability names and refs are matched
+;; differently - a capability by its exact name, a ref through the
+;; canonical spelling (section 4 rule 5) - and one map keyed by both can
+;; only do one of them. Keyed by both and looked up raw, as this was, a
+;; cycle spelled `a$`/`b$` found no providers and EVADED the load-time
+;; check that exists to catch a non-terminating reconcile.
+(defn- providers-of [nodes]
+  (reduce (fn [acc n]
+            (reduce #(update %1 %2 (fnil conj []) (:ref n)) acc (vec (:provides n))))
+          {}
+          nodes))
+
+(defn- edges-of [nodes]
+  (let [bycap (providers-of nodes)
+        isref (set (map :ref nodes))]
+    (into {}
+          (for [n nodes]
+            [(:ref n)
+             (vec (sort (distinct (for [req (:requires n)
+                                        :when (restart-causing? req)
+                                        ;; A node satisfies its own name AS
+                                        ;; A REF (section 11.1),
+                                        ;; canonically - exactly what
+                                        ;; `providers-of` does at runtime.
+                                        ;; `canon` hands back a name no ref
+                                        ;; could have unchanged, and no
+                                        ;; instance ref can equal one.
+                                        p (let [nm (t/get req "name")
+                                                from (or (bycap nm) [])
+                                                asref (r/canon nm)]
+                                            (if (isref asref)
+                                              (conj (vec from) asref)
+                                              from))
+                                        :when (not= p (:ref n))]
+                                    p))))]))))
+
+(defn dependency-cycle
+  "A cycle through restart-causing requirements is
+  `plugin_dependency_cycle`, detected AT LOAD - before anything runs,
+  because the failure it describes is a non-terminating reconcile and the
+  only safe time to report that is before it starts.
+
+  The graph is over capabilities, not refs: an edge runs from a consumer
+  to EVERY node that provides what it needs, because any of them could be
+  the one selected and a cycle through any is a cycle. A node also
+  satisfies its own name as a ref (section 11.1), which is why the ref is
+  a provider of itself here.
+
+  `nodes` is a list of `{:ref :provides :requires}`.
+
+  Iterative DFS with an explicit stack: twenty ports, and several of them
+  have no recursion budget worth relying on. Clojure is one - it has no
+  tail-call elimination, and `recur` cannot express a DFS's two-way
+  branch."
+  [nodes]
+  (let [edges (edges-of nodes)]
+    (loop [starts (sort (keys edges))
+           colour (zipmap (map :ref nodes) (repeat :white))]
+      (if (empty? starts)
+        nil
+        (let [start (first starts)]
+          (if (not= :white (colour start))
+            (recur (rest starts) colour)
+            (let [result
+                  (loop [path [start]
+                         stack [[start 0]]
+                         colour (assoc colour start :grey)]
+                    (if (empty? stack)
+                      [nil colour]
+                      (let [[node at] (peek stack)
+                            outs (edges node)]
+                        (if (<= (count outs) at)
+                          (recur (pop path) (pop stack) (assoc colour node :black))
+                          (let [nxt (outs at)
+                                stack (conj (pop stack) [node (inc at)])]
+                            (cond
+                              ;; Report the cycle itself, not the walk
+                              ;; that found it.
+                              (= :grey (colour nxt))
+                              [(vec (concat (subvec path (.indexOf ^java.util.List path nxt))
+                                            [nxt]))
+                               colour]
+
+                              (= :black (colour nxt)) (recur path stack colour)
+                              :else (recur (conj path nxt)
+                                           (conj stack [nxt 0])
+                                           (assoc colour nxt :grey))))))))]
+              (if (first result)
+                (first result)
+                (recur (rest starts) (second result))))))))))
+
+(defn check-cycle
+  "Raise on a cycle, naming it. Separate from the detector so the detector
+  stays pure and corpus-testable."
+  [nodes]
+  (when-let [cycle (dependency-cycle nodes)]
+    (t/fail "plugin_dependency_cycle"
+            (str "requirements cycle: " (clojure.string/join " -> " cycle))
+            {"cycle" cycle})))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/env.clj

@@ -0,0 +1,111 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/env.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin.env
+  "Environment overrides (section 9.5) - level 7 of the ladder.
+
+  One prefix, so nothing drifts: `VOXGIG_PLUGIN_*`.
+
+    VOXGIG_PLUGIN_PROFILE            the profile name
+    VOXGIG_PLUGIN_<REF>_<PATH>       one option
+    VOXGIG_PLUGIN_ACTIVE/INACTIVE    comma-separated refs, INACTIVE wins
+
+  THE ENCODING IS LOSSY, AND THIS SAYS SO RATHER THAN PRETENDING
+  OTHERWISE. Ref and path are upper-snake with `$` -> `__` and `.` -> `_`.
+  But `_` is legal in a name and in a tag, and the mapping folds case, so
+  `retry$fast` and `retry__fast` both encode to `RETRY__FAST`.
+
+  Rather than restrict a grammar the rest of the stack already uses, the
+  host DETECTS THE COLLISION: it encodes every ref it holds, and a key two
+  refs claim is `plugin_env_ambiguous`, naming both."
+  (:require [voxgig.plugin.types :as t]
+            [voxgig.plugin.ref :as r]
+            [voxgig.plugin.json :as json]
+            [clojure.string :as str]))
+
+(def ^:private prefix "VOXGIG_PLUGIN_")
+
+(defn encode-ref
+  "`retry$fast` -> `RETRY__FAST`."
+  [ref]
+  (-> ref (str/replace "$" "__") (str/replace "." "_") str/upper-case))
+
+(defn- check-reserved [ref reserved]
+  (when (some #(= % (r/ref-name ref)) reserved)
+    (t/fail "plugin_ref_reserved" (str "ref is reserved by the host: " ref) {"ref" ref})))
+
+(defn- env-split [value]
+  (->> (str/split (str value) #",") (map str/trim) (remove empty?) vec))
+
+(defn- collisions
+  "Encode every ref the host holds, and refuse a key that two of them
+  claim. Done up front so the collision is reported even when no
+  environment variable exercises it - a latent ambiguity is still an
+  ambiguity, and finding it at deploy time is the failure this exists to
+  prevent."
+  [byencoded]
+  (doseq [e (t/sorted-keys byencoded)
+          :when (< 1 (count (byencoded e)))]
+    (let [pair (vec (sort (byencoded e)))]
+      (t/fail "plugin_env_ambiguous"
+              (str "refs collide in the environment encoding as " e ": "
+                   (str/join ", " pair))
+              {"encoded" e "refs" pair}))))
+
+(defn- assoc-path
+  "Write one option at a dotted path, creating maps as it goes. A step
+  whose current value is not a map is REPLACED, because a scalar written
+  by a shallower variable cannot also be a container."
+  [m [step & more] value]
+  (let [m (if (map? m) m {})]
+    (if (empty? more)
+      (assoc m step value)
+      (assoc m step (assoc-path (t/get m step) more value)))))
+
+(defn- apply-one [out env encoded byencoded reserved key]
+  (let [rest (subs key (count prefix))]
+    (cond
+      (= "PROFILE" rest) (assoc out "profile" (env key))
+
+      (contains? #{"ACTIVE" "INACTIVE"} rest)
+      (let [k (if (= "ACTIVE" rest) "active" "inactive")]
+        (reduce (fn [acc raw]
+                  (let [ref (r/canon-ref raw)]
+                    ;; The reservation covers EVERY input layer (section
+                    ;; 9.1). VOXGIG_PLUGIN_INACTIVE=station is easier to
+                    ;; set than editing a config file, and INACTIVE has
+                    ;; the final word - so guarding documents alone would
+                    ;; leave the one lever this mechanism exists to deny
+                    ;; wide open.
+                    (check-reserved ref reserved)
+                    (update acc k conj ref)))
+                out
+                (env-split (env key))))
+
+      :else
+      ;; Longest encoded ref first, so `retry$fast` wins over `retry` on
+      ;; `RETRY__FAST_MIN`. Shortest-first would read the tag as a path.
+      (if-let [enc (first (filter #(or (= rest %) (str/starts-with? rest (str % "_")))
+                                  encoded))]
+        (let [ref (first (byencoded enc))]
+          (check-reserved ref reserved)
+          ;; A ref with no path sets nothing.
+          (if (= rest enc)
+            out
+            (let [path (str/split (str/lower-case (subs rest (inc (count enc)))) #"_")]
+              (update out "options" assoc ref
+                      (assoc-path (t/get (out "options") ref) path
+                                  (json/parse-scalar (env key)))))))
+        ;; Not for any ref this host holds.
+        out))))
+
+(defn apply-env [input]
+  (let [env (or (t/get input "env") {})
+        refs (map r/canon-ref (or (t/get input "refs") []))
+        reserved (or (t/get input "reserved") [])
+        byencoded (reduce #(update %1 (encode-ref %2) (fnil conj []) %2) {} refs)]
+    (collisions byencoded)
+    (let [encoded (t/stable-sort-by #(- (count %)) (t/sorted-keys byencoded))]
+      (reduce #(apply-one %1 env encoded byencoded reserved %2)
+              {"options" {} "active" [] "inactive" []}
+              (filter #(str/starts-with? % prefix) (t/sorted-keys env))))))

package/project/.sdk/tm/clojure/feature/secrets/voxgig/plugin/export.clj

@@ -0,0 +1,46 @@
+;; VENDORED: @voxgig/plugin sdk-20260908-1556-0 (clojure/src/voxgig/plugin/export.clj)
+;; Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+;; License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+(ns voxgig.plugin.export
+  "Exports (section 11).
+
+  An instance publishes values for other plugins and for the application.
+  Read with `(host/exports h \"retry$fast/client\")`.
+
+  THE UNQUALIFIED ALIAS IS THE INTERESTING PART. `retry/client` resolves
+  to the UNTAGGED instance if one exists; if not, and exactly one tagged
+  instance exports that key, it resolves to that one; if two do, it is
+  `plugin_export_ambiguous` - deliberately diverging from seneca's silent
+  last-wins, because with multi-instance as a headline feature an
+  ambiguous alias is a defect waiting for production."
+  (:require [voxgig.plugin.types :as t]
+            [voxgig.plugin.ref :as r]))
+
+(defn resolve-export
+  "`exported` is a list of `{:ref :key :value}` - an internal shape, never
+  a corpus value, so it uses keyword keys where the data does not."
+  [spec exported]
+  (let [cut (.indexOf ^String spec "/")]
+    (when (neg? cut)
+      (t/fail "plugin_export_ambiguous" (str "export spec needs a key: " spec)
+              {"spec" spec}))
+    (let [head (subs spec 0 cut)
+          k (subs spec (inc cut))
+          want (r/canon head)
+          ;; A fully qualified ref: exactly one answer or none.
+          qualified (first (filter #(and (= (:ref %) want) (= (:key %) k)) exported))]
+      (if qualified
+        (:value qualified)
+        ;; An alias: the name, not a ref. Look at every instance of it.
+        (let [byname (filter #(and (= (r/ref-name (:ref %)) head) (= (:key %) k)) exported)
+              untagged (first (filter #(empty? ((r/parse-ref (:ref %)) "tag")) byname))]
+          (cond
+            (empty? byname) nil
+            untagged (:value untagged)
+            (= 1 (count byname)) (:value (first byname))
+            :else
+            (let [refs (sort (map :ref byname))]
+              (t/fail "plugin_export_ambiguous"
+                      (str "alias " spec " matches " (count refs) " instances: "
+                           (clojure.string/join ", " refs))
+                      {"spec" spec "refs" (vec refs)}))))))))