@voxgig/sdkgen 4.10.0 → 4.11.0

package/bin/voxgig-sdkgen

@@ -8,7 +8,7 @@ const { Shape, One, Skip } = require('shape')
 
 const { SdkGen } = require('../dist/sdkgen.js')
 
-const VERSION = '4.9.0'
+const VERSION = '4.11.0'
 const KONSOLE = console
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/sdkgen",
-  "version": "4.10.0",
+  "version": "4.11.0",
   "main": "dist/sdkgen.js",
   "type": "commonjs",
   "engines": {

package/project/.sdk/model/feature/secrets.aon

@@ -99,6 +99,53 @@ main: kit: feature: secrets: {
     # every `private[plugins]` symbol crossing a file boundary is defined in
     # Httpjson.scala or Sigv4.scala, and nothing else is shared.
 
+    #
+    # c has the shared-helper shape too, and five files of it, every one
+    # verified by a symbol scan of the port at the tag rather than read off
+    # a comment: plugins/httpjson.c (the socket HTTP client eight kinds
+    # call), plugins/tls.c (its OpenSSL binding - the ONLY file that names
+    # OpenSSL), plugins/encode.c (`sek_uriescape` for four stores and
+    # base64 for two), plugins/clock.c (token renewal time, SigV4's
+    # timestamp) and plugins/proc.c (`sek_runcmd`, for boru in `vault` AND
+    # secretspec in `secretspec`). All five belong to NO group. The two
+    # plugin headers (sekretoplugins.h, support.h) are ungrouped for the
+    # same reason. What makes c different from java/scala is that the
+    # Makefile can see the trim: it compiles these helpers, and links
+    # OpenSSL, only when at least one KIND file survived, so an
+    # [env, memory] chain compiles the sekreto and voxgig/plugin cores
+    # alone and links libc alone. sha256.c and sigv4.c are NOT shared in c
+    # (aws.c is their only caller) and go with `aws`.
+    #
+    # ocaml has the java/scala Sigv4 shape AND the c Makefile-visible
+    # trim, verified by an `open`/qualifier scan of the port at the tag:
+    # plugins/sigv4.ml's `uriescape` is called by azuresecrets (`cloud`)
+    # and by doppler, infisical and onepassword (`saas`), plugins/crypto.ml
+    # is sigv4.ml's only caller but must compile before it, and
+    # plugins/runcmd.ml (the child-process helper) is opened by boru
+    # (`vault`) AND secretspec (`secretspec`). The transport chain
+    # plugins/httpjson.ml -> http.ml -> tls.ml (+ tls_stubs.c, the OpenSSL
+    # binding) is opened by every HTTPS kind. All seven belong to NO
+    # group. What makes the cost zero when no kind needs them is the
+    # generated feature/secrets/feature.mk (Main_ocaml): OCaml compiles
+    # exactly the modules it is handed, in the order it is handed them, so
+    # the fragment lists the transport helpers (and compiles the stub,
+    # linking OpenSSL) only when an active group declares `needs.fetch`,
+    # and runcmd.ml only when any kind is active. A chain of built-ins,
+    # or `secretspec` alone, compiles neither and links no OpenSSL.
+    #
+    # cpp has four ungrouped shared helpers, read off the port's own
+    # include lines at the tag rather than off a comment: plugins/Httpjson
+    # .cpp (the socket HTTP client eight kinds include), plugins/Tls.cpp
+    # (its OpenSSL binding, included by Httpjson.cpp - the ONLY file that
+    # names OpenSSL), plugins/Crypto.cpp (SHA-256/HMAC, included by Tls.cpp
+    # AND Sigv4.cpp) and plugins/Proc.cpp (`runcmd`, for Boru in `vault`
+    # AND Secretspec in `secretspec`). All four belong to NO group, .hpp
+    # and .cpp alike. Sigv4.{cpp,hpp} is included by Aws.cpp alone
+    # (upstream's own `make lean` asserts only aws needs a digest) and goes
+    # with `aws`. As in c, the Makefile can see the trim: it compiles the
+    # helpers, and links OpenSSL, only when at least one KIND file survived,
+    # so an [env, memory] chain compiles the sekreto and voxgig/plugin cores
+    # alone and links libstdc++ alone.
     vault: {
       title: 'HashiCorp Vault and boru'
       needs: { fs: true, fetch: true }
@@ -137,6 +184,18 @@ main: kit: feature: secrets: {
         'feature/secrets/plugins/Boru.swift'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Hashicorp.lean'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Boru.lean'
+        'feature/secrets/plugins/hashicorp.c'
+        'feature/secrets/plugins/boru.c'
+        'feature/secrets/sekreto/plugins/hashicorp.lua'
+        'feature/secrets/sekreto/plugins/boru.lua'
+        'feature/secrets/plugins/hashicorp.zig'
+        'feature/secrets/plugins/boru.zig'
+        'feature/secrets/plugins/hashicorp.ml'
+        'feature/secrets/plugins/boru.ml'
+        'feature/secrets/plugins/Hashicorp.cpp'
+        'feature/secrets/plugins/Hashicorp.hpp'
+        'feature/secrets/plugins/Boru.cpp'
+        'feature/secrets/plugins/Boru.hpp'
       ]
       def: ts: {
         hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.ts'
@@ -297,6 +356,86 @@ main: kit: feature: secrets: {
         'Sekreto.hashicorp': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Hashicorp.lean'
         'Sekreto.boru': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Boru.lean'
       }
+      # c: the `Definition *sek_plugin_<kind>(void)` constructor each
+      # vendored plugin file defines (plugins/sekretoplugins.h declares all
+      # ten; only the objects the link line names are carried). The path is
+      # target-root-relative, as go's is, because Main_c's Copy is rooted
+      # at tm/c. The generated feature/secrets/kinds.c (Config_c) calls
+      # these and hands the list to the feature through feature_plugins().
+      #
+      # plugins/proc.c does NOT go with boru: it is the php/perl
+      # SHARED-HELPER shape - `sek_runcmd` is called by boru (`vault`) AND
+      # secretspec (`secretspec`), so it ships with the feature core
+      # beside httpjson.c, tls.c, encode.c and clock.c and belongs to NO
+      # group. The Makefile compiles the ungrouped helpers only when a
+      # kind file is present, so they cost nothing (and need no OpenSSL
+      # headers) in a chain that is [env, memory].
+      def: c: {
+        sek_plugin_hashicorp: 'feature/secrets/plugins/hashicorp.c'
+        sek_plugin_boru: 'feature/secrets/plugins/boru.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        hashicorp: 'feature/secrets/sekreto/plugins/hashicorp.lua'
+        boru: 'feature/secrets/sekreto/plugins/boru.lua'
+      }
+      # zig: the BARE export names upstream's plugins/all.zig re-exports
+      # (`pub const hashicorp = @import("hashicorp.zig").hashicorp;`), so the
+      # symbol is what Config_zig re-exports from the generated
+      # feature/secrets/plugins.zig - the root of the `sekretoplugins` build
+      # module, which is what makes the trim REAL in zig: the compiler
+      # analyses only what a module root reaches, so a kind this file does
+      # not name is neither compiled nor in the vocabulary. The path is
+      # target-root-relative, as go's is, because Main_zig's Copy is rooted
+      # at tm/zig. plugins/httpjson.zig is in NO group (eight kinds import
+      # it by relative path, and the exchange's fetch of last resort is its
+      # fetchjson), so it ships with the feature core.
+      def: zig: {
+        hashicorp: 'feature/secrets/plugins/hashicorp.zig'
+        boru: 'feature/secrets/plugins/boru.zig'
+      }
+      # ocaml: MODULE-QUALIFIED FUNCTIONS (`Hashicorp.plugin`), the
+      # `unit -> Defs.definition` each vendored kind module defines
+      # (upstream's allplugins.ml names exactly these); Config_ocaml
+      # appends `()`. OCaml's namespace is flat and resolved by -I, so the
+      # symbol needs no import and the path is only what the plugin trim
+      # matches and what feature/secrets/feature.mk compiles. The path is target-root
+      # relative, as go's is, because Main_ocaml's Copy is rooted at
+      # tm/ocaml.
+      #
+      # plugins/runcmd.ml does NOT go with boru: it is the php/perl
+      # SHARED-HELPER shape (secretspec opens it too), so it ships with the
+      # feature core and belongs to NO group - see the ocaml note at the
+      # head of this `plugin` block.
+      def: ocaml: {
+        'Hashicorp.plugin': 'feature/secrets/plugins/hashicorp.ml'
+        'Boru.plugin': 'feature/secrets/plugins/boru.ml'
+      }
+      # cpp: the bare `Definition <kind>()` factory each vendored kind file
+      # defines in namespace sekreto (Hashicorp.hpp: `Definition hashicorp();`),
+      # so the key is the unqualified function name; the generated
+      # feature/secrets/kinds.cpp (Config_cpp) qualifies it as
+      # `sekreto::hashicorp()` and includes the owning file's header. The path
+      # is target-root-relative, as go's is, because Main_cpp's Copy is rooted
+      # at tm/cpp; the .hpp rides in `path` beside its .cpp so the trim removes
+      # the pair, and the .cpp is what the def names because it is what the
+      # Makefile compiles.
+      #
+      # plugins/Proc.cpp does NOT go with Boru: it is the php/perl
+      # SHARED-HELPER shape - `runcmd` is called by Boru (`vault`) AND
+      # Secretspec (`secretspec`), so it ships with the feature core beside
+      # Httpjson.cpp, Tls.cpp and Crypto.cpp and belongs to NO group. The
+      # Makefile compiles the ungrouped helpers only when a kind file is
+      # present, so they cost nothing (and need no OpenSSL headers) in a chain
+      # that is [env, memory].
+      def: cpp: {
+        hashicorp: 'feature/secrets/plugins/Hashicorp.cpp'
+        boru: 'feature/secrets/plugins/Boru.cpp'
+      }
     }
 
     cloud: {
@@ -337,6 +476,18 @@ main: kit: feature: secrets: {
         'feature/secrets/plugins/Azuresecrets.swift'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Gcpsecrets.lean'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Azuresecrets.lean'
+        'feature/secrets/plugins/gcpsecrets.c'
+        'feature/secrets/plugins/azuresecrets.c'
+        'feature/secrets/sekreto/plugins/gcpsecrets.lua'
+        'feature/secrets/sekreto/plugins/azuresecrets.lua'
+        'feature/secrets/plugins/gcpsecrets.zig'
+        'feature/secrets/plugins/azuresecrets.zig'
+        'feature/secrets/plugins/gcpsecrets.ml'
+        'feature/secrets/plugins/azuresecrets.ml'
+        'feature/secrets/plugins/Gcpsecrets.cpp'
+        'feature/secrets/plugins/Gcpsecrets.hpp'
+        'feature/secrets/plugins/Azuresecrets.cpp'
+        'feature/secrets/plugins/Azuresecrets.hpp'
       ]
       def: ts: {
         gcpsecrets: 'src/feature/secrets/sekreto/plugins/gcpsecrets.ts'
@@ -406,6 +557,32 @@ main: kit: feature: secrets: {
         'Sekreto.gcpsecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Gcpsecrets.lean'
         'Sekreto.azuresecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Azuresecrets.lean'
       }
+      def: c: {
+        sek_plugin_gcpsecrets: 'feature/secrets/plugins/gcpsecrets.c'
+        sek_plugin_azuresecrets: 'feature/secrets/plugins/azuresecrets.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        gcpsecrets: 'feature/secrets/sekreto/plugins/gcpsecrets.lua'
+        azuresecrets: 'feature/secrets/sekreto/plugins/azuresecrets.lua'
+      }
+      def: zig: {
+        gcpsecrets: 'feature/secrets/plugins/gcpsecrets.zig'
+        azuresecrets: 'feature/secrets/plugins/azuresecrets.zig'
+      }
+      def: ocaml: {
+        'Gcpsecrets.plugin': 'feature/secrets/plugins/gcpsecrets.ml'
+        'Azuresecrets.plugin': 'feature/secrets/plugins/azuresecrets.ml'
+      }
+      # cpp: see the vault group.
+      def: cpp: {
+        gcpsecrets: 'feature/secrets/plugins/Gcpsecrets.cpp'
+        azuresecrets: 'feature/secrets/plugins/Azuresecrets.cpp'
+      }
     }
 
     saas: {
@@ -463,6 +640,24 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Onepassword.lean'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Doppler.lean'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Infisical.lean'
+        'feature/secrets/plugins/onepassword.c'
+        'feature/secrets/plugins/doppler.c'
+        'feature/secrets/plugins/infisical.c'
+        'feature/secrets/sekreto/plugins/onepassword.lua'
+        'feature/secrets/sekreto/plugins/doppler.lua'
+        'feature/secrets/sekreto/plugins/infisical.lua'
+        'feature/secrets/plugins/onepassword.zig'
+        'feature/secrets/plugins/doppler.zig'
+        'feature/secrets/plugins/infisical.zig'
+        'feature/secrets/plugins/onepassword.ml'
+        'feature/secrets/plugins/doppler.ml'
+        'feature/secrets/plugins/infisical.ml'
+        'feature/secrets/plugins/Onepassword.cpp'
+        'feature/secrets/plugins/Onepassword.hpp'
+        'feature/secrets/plugins/Doppler.cpp'
+        'feature/secrets/plugins/Doppler.hpp'
+        'feature/secrets/plugins/Infisical.cpp'
+        'feature/secrets/plugins/Infisical.hpp'
       ]
       def: ts: {
         onepassword: 'src/feature/secrets/sekreto/plugins/onepassword.ts'
@@ -556,6 +751,37 @@ main: kit: feature: secrets: {
         'Sekreto.doppler': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Doppler.lean'
         'Sekreto.infisical': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Infisical.lean'
       }
+      def: c: {
+        sek_plugin_onepassword: 'feature/secrets/plugins/onepassword.c'
+        sek_plugin_doppler: 'feature/secrets/plugins/doppler.c'
+        sek_plugin_infisical: 'feature/secrets/plugins/infisical.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        onepassword: 'feature/secrets/sekreto/plugins/onepassword.lua'
+        doppler: 'feature/secrets/sekreto/plugins/doppler.lua'
+        infisical: 'feature/secrets/sekreto/plugins/infisical.lua'
+      }
+      def: zig: {
+        onepassword: 'feature/secrets/plugins/onepassword.zig'
+        doppler: 'feature/secrets/plugins/doppler.zig'
+        infisical: 'feature/secrets/plugins/infisical.zig'
+      }
+      def: ocaml: {
+        'Onepassword.plugin': 'feature/secrets/plugins/onepassword.ml'
+        'Doppler.plugin': 'feature/secrets/plugins/doppler.ml'
+        'Infisical.plugin': 'feature/secrets/plugins/infisical.ml'
+      }
+      # cpp: see the vault group.
+      def: cpp: {
+        onepassword: 'feature/secrets/plugins/Onepassword.cpp'
+        doppler: 'feature/secrets/plugins/Doppler.cpp'
+        infisical: 'feature/secrets/plugins/Infisical.cpp'
+      }
     }
 
     # The only plugin that costs node:crypto: AWS request signing.
@@ -602,6 +828,18 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Sigv4.lean'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Crypto.lean'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Clock.lean'
+        'feature/secrets/plugins/aws.c'
+        'feature/secrets/plugins/sigv4.c'
+        'feature/secrets/plugins/sha256.c'
+        'feature/secrets/sekreto/plugins/aws.lua'
+        'feature/secrets/sekreto/plugins/sigv4.lua'
+        'feature/secrets/plugins/aws.zig'
+        'feature/secrets/plugins/sigv4.zig'
+        'feature/secrets/plugins/aws.ml'
+        'feature/secrets/plugins/Aws.cpp'
+        'feature/secrets/plugins/Aws.hpp'
+        'feature/secrets/plugins/Sigv4.cpp'
+        'feature/secrets/plugins/Sigv4.hpp'
       ]
       def: ts: {
         awssecrets: 'src/feature/secrets/sekreto/plugins/aws.ts'
@@ -746,6 +984,63 @@ main: kit: feature: secrets: {
         'Sekreto.awssecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
         'Sekreto.awsparams': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
       }
+      # c: ONE file, TWO definitions - the c spelling of the ts aws.ts
+      # pair, as go spells it aws.Secrets/aws.Params. plugins/sigv4.c AND
+      # plugins/sha256.c ride with it and only with it: upstream's own
+      # plugins/support.h says "sha256.c and nothing else. The aws plugin is
+      # the only thing in the library that names these", and a symbol scan
+      # of the port at the tag confirms aws.c is the sole caller of
+      # sek_sigv4 / sek_sha256 / sek_hmac_sha256. Unlike java's and scala's
+      # Sigv4, the c percent-encoder the other stores use (`sek_uriescape`)
+      # lives in the ungrouped encode.c, so nothing outside this group
+      # compiles against sigv4.c.
+      def: c: {
+        sek_plugin_awssecrets: 'feature/secrets/plugins/aws.c'
+        sek_plugin_awsparams: 'feature/secrets/plugins/aws.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      # sigv4.lua is required by aws.lua ALONE in the lua port (checked at the
+      # tag: gcpsecrets.lua reaches crypto.lua directly, never sigv4), so it
+      # belongs to this group. crypto.lua is shared by aws and cloud and
+      # ships ungrouped with the feature core.
+      def: lua: {
+        awssecrets: 'feature/secrets/sekreto/plugins/aws.lua'
+        awsparams: 'feature/secrets/sekreto/plugins/aws.lua'
+      }
+      # ONE file, TWO definitions - zig's spelling of the ts aws.ts pair
+      # (upstream all.zig: `awssecrets` and `awsparams`, both from aws.zig).
+      # plugins/sigv4.zig goes with it, and goes only with it: at the tag
+      # aws.zig is the ONLY file that `@import("sigv4.zig")` - the zig port
+      # has no java/kotlin/scala `uriescape` story (checked by grep at the
+      # tag), so an aws-off trim leaves nothing dangling.
+      def: zig: {
+        awssecrets: 'feature/secrets/plugins/aws.zig'
+        awsparams: 'feature/secrets/plugins/aws.zig'
+      }
+      # ONE module, TWO definitions - ocaml's spelling of the ts aws.ts
+      # pair (aws.ml defines `secretsplugin` and `paramsplugin`).
+      # plugins/sigv4.ml and plugins/crypto.ml do NOT go with it: the
+      # java/scala story repeats here (see the ocaml note at the head of
+      # this `plugin` block), because `Sigv4.uriescape` is also called by
+      # azuresecrets (`cloud`) and by doppler, infisical and onepassword
+      # (`saas`), and crypto.ml has to compile before sigv4.ml.
+      def: ocaml: {
+        'Aws.secretsplugin': 'feature/secrets/plugins/aws.ml'
+        'Aws.paramsplugin': 'feature/secrets/plugins/aws.ml'
+      }
+      # cpp: ONE file, TWO definitions (`Definition awssecrets();` and
+      # `Definition awsparams();`, both in Aws.hpp) - the ts/go/py shape. The
+      # SigV4 signer is aws-only in this port: Sigv4.hpp is included by Aws.cpp
+      # and nothing else, so Sigv4.{cpp,hpp} go with `aws`; Crypto.cpp, which
+      # Sigv4.cpp AND Tls.cpp include, stays with the feature core.
+      def: cpp: {
+        awssecrets: 'feature/secrets/plugins/Aws.cpp'
+        awsparams: 'feature/secrets/plugins/Aws.cpp'
+      }
     }
 
     # The only plugin that runs a CHILD PROCESS: the secretspec CLI
@@ -772,6 +1067,12 @@ main: kit: feature: secrets: {
         'feature/secrets/sekreto/plugins/secretspec.ex'
         'feature/secrets/plugins/Secretspec.swift'
         'src/feature/secrets/sekreto/plugins/SekretoPlugins/Secretspec.lean'
+        'feature/secrets/plugins/secretspec.c'
+        'feature/secrets/sekreto/plugins/secretspec.lua'
+        'feature/secrets/plugins/secretspec.zig'
+        'feature/secrets/plugins/secretspec.ml'
+        'feature/secrets/plugins/Secretspec.cpp'
+        'feature/secrets/plugins/Secretspec.hpp'
       ]
       def: ts: {
         secretspec: 'src/feature/secrets/sekreto/plugins/secretspec.ts'
@@ -853,6 +1154,35 @@ main: kit: feature: secrets: {
       def: lean: {
         'Sekreto.secretspec': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Secretspec.lean'
       }
+      # plugins/proc.c is NOT listed here either - see the c note in the
+      # `vault` group: it is a feature-core file both groups use.
+      def: c: {
+        sek_plugin_secretspec: 'feature/secrets/plugins/secretspec.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        secretspec: 'feature/secrets/sekreto/plugins/secretspec.lua'
+      }
+      def: zig: {
+        secretspec: 'feature/secrets/plugins/secretspec.zig'
+      }
+      # plugins/runcmd.ml is NOT listed here either - see the ocaml note in
+      # the `vault` group: it is a feature-core file both groups open.
+      # This is the one ocaml group that needs NO transport (`needs` has no
+      # `fetch`), so feature/secrets/feature.mk compiles runcmd.ml beside it and nothing of
+      # the TLS chain: a secretspec-only ocaml SDK links no OpenSSL.
+      def: ocaml: {
+        'Secretspec.plugin': 'feature/secrets/plugins/secretspec.ml'
+      }
+      # cpp: see the vault group. plugins/Proc.cpp (`runcmd`) is shared with
+      # Boru and ships with the feature core, not here.
+      def: cpp: {
+        secretspec: 'feature/secrets/plugins/Secretspec.cpp'
+      }
     }
   }
 

package/project/.sdk/model/target/c.aon

@@ -8,6 +8,11 @@ main: kit: target: c: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability tags (docs/design/feature-tags.md): this target vendors
+  # the c port of @voxgig/sekreto (with voxgig/plugin under it) inside its
+  # gated `feature/secrets/` container, so the `secrets` feature applies.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the fused corpus runner, whose engine half is now
   # the vendored omni runner (tests/vendor/omni) and whose support half
@@ -23,8 +28,16 @@ main: kit: target: c: {
   }
 
   # struct is vendored under utility/struct — no external dep. The whole
-  # pipeline is synchronous; the transport uses libcurl when available at
-  # build time (weak, optional) else returns a transport error.
+  # pipeline is synchronous, and the CORE ships no HTTP client at all: a
+  # live request without a caller-supplied `options.system.fetch` returns
+  # a transport error (utility/fetcher.c). The only external dependencies
+  # a c SDK can have arrive with the `secrets` feature, and only when it
+  # is active with a plugin group: the vendored vault kinds link OpenSSL
+  # (-lssl -lcrypto, plugins/tls.c), and the feature's token-exchange
+  # transport of last resort (feature/secrets/kinds.c, generated) links
+  # libcurl. Both are turned on by the generated feature/secrets/kinds.mk
+  # the Makefile includes, so an SDK with secrets inactive, or with no
+  # plugin group, links libc alone.
   deps: {
   }
 }

package/project/.sdk/model/target/cpp.aon

@@ -8,6 +8,14 @@ main: kit: target: cpp: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability tags (docs/design/feature-tags.md): this target vendors
+  # the cpp port of @voxgig/sekreto (with voxgig/plugin under it) inside
+  # its gated `feature/secrets/` container, so the `secrets` feature
+  # applies. The port is a multi-translation-unit library where the SDK
+  # itself is header-only; tm/cpp/Makefile compiles it into an archive only
+  # through the generated feature/secrets/kinds.mk it `-include`s.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner header
   # (test/runner_support.hpp is support-only — the file/env loaders,
@@ -25,6 +33,16 @@ main: kit: target: cpp: {
   # struct is vendored under utility/voxgigstruct — no external dep. The SDK
   # is header-only; JSON parsing is the vendored struct parser and the mock
   # transport needs no network. Tests need only a C++17 compiler (g++).
+  #
+  # The one external dependency a cpp SDK can have arrives with the
+  # `secrets` feature, and only when it is active WITH a plugin group: the
+  # vendored vault kinds link OpenSSL (-lssl -lcrypto, plugins/Tls.cpp),
+  # and the feature's token-exchange transport of last resort (the
+  # generated feature/secrets/kinds.cpp) rides on the same vendored HTTPS
+  # client rather than adding libcurl - so there is exactly one HTTP stack
+  # and one -l pair. The generated feature/secrets/kinds.mk turns it on
+  # from the model, so an SDK with secrets inactive, or with no plugin
+  # group, links libstdc++ and libc alone.
   deps: {}
 }
 

package/project/.sdk/model/target/lua.aon

@@ -8,6 +8,23 @@ main: kit: target: lua: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/lua/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  #
+  # What lua ships: the four built-in kinds (env, memory, dotenv, file) in
+  # the vendored core, and every plugin kind as a trimmable group. The
+  # plugin kinds reach `sekreto.plugins.net`, which runs a small COMPILED
+  # helper (feature/secrets/native/sekretonet.c, -lssl -lcrypto) because
+  # Lua 5.4 has no sockets and no TLS. The helper is vendored with the
+  # feature and built by the generated Makefile ONLY when a plugin group is
+  # active (Main_lua emits feature/secrets/native.mk then), so an SDK
+  # without secrets - or with the built-in chain alone - runs no compiler
+  # and links no OpenSSL. `sekreto.plugins.net` finds the binary through
+  # its own adapted helperpath() (vendor/routes.json), at
+  # feature/secrets/native/sekreto-net.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/runner.lua is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/ocaml.aon

@@ -8,6 +8,24 @@ main: kit: target: ocaml: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/ocaml/feature/secrets/:
+  # the sekreto core under sekreto/, the voxgig/plugin host under plugin/
+  # and the provider kinds under plugins/), so a feature that resolves
+  # secrets through sekreto can apply here.
+  #
+  # What ocaml ships: the four built-in kinds (env, memory, dotenv, file)
+  # in the vendored core, and every plugin kind as a trimmable group. The
+  # four HTTPS groups (vault, cloud, saas, aws) reach plugins/http.ml ->
+  # plugins/tls.ml, whose externals are bound in plugins/tls_stubs.c
+  # against OpenSSL (-lssl -lcrypto, and `ocamlc -custom` to carry the
+  # stub). That dependency is scoped INSIDE the gated feature: the
+  # generated feature/secrets/feature.mk (Main_ocaml) compiles the stub
+  # and links OpenSSL ONLY when a plugin group that needs a transport is
+  # active, so an SDK without secrets, or with the built-in chain alone,
+  # or with `secretspec` alone, runs no C compiler and links no OpenSSL.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written corpus engine, replaced by
   # test/omni_resolver.ml over the vendored @voxgig/omni port
@@ -24,6 +42,17 @@ main: kit: target: ocaml: {
   # struct is vendored under utility/ (voxgig_struct.ml + vregex.ml) — the
   # runtime is dependency-free: it compiles with the stock ocamlc, no opam
   # packages, no dune. So there are no manifest dependencies.
+  #
+  # The CORE also bundles no HTTP transport (sdk_runtime.ml
+  # fetch_no_transport): a live request needs a caller-supplied
+  # `options.system.fetch`. The only external dependency an ocaml SDK can
+  # have arrives with the `secrets` feature, and only when a plugin group
+  # needing a transport is active: the vendored HTTPS kinds bind OpenSSL
+  # through plugins/tls_stubs.c, and the feature's token-exchange transport
+  # of last resort rides the same vendored HTTP client. The generated
+  # feature/secrets/feature.mk turns both on from the trimmed tree, so an
+  # SDK with secrets inactive, or with no plugin group, links the OCaml
+  # distribution alone (unix.cma for the dotenv/file built-ins).
   deps: {}
 }
 
@@ -59,10 +88,24 @@ main: kit: target: ocaml: publish: {
 }
 
 
-# Feature source is NOT trimmed to the model's selection here: every
-# feature lives inside a single generated module (sdk_features.ml), not in
-# per-feature source files, so there is nothing per-feature to leave out.
-# Trimming waits on that module becoming model-driven.
+# Feature source IS trimmed to the model's selection. The eighteen pipeline
+# features live inside one template module (sdk_features.ml), which is not
+# feature source and is never a trim candidate - so for a long time there
+# was nothing per-feature to leave out and trim stayed off. `secrets`
+# changed that: it is the first ocaml feature carried as a CONTAINER
+# (feature/secrets_feature.ml, feature/secrets/ with the vendored sekreto
+# and voxgig/plugin trees, test/feature/secrets/), some 5.5k lines that a
+# project which never selected the feature must not carry. With trim on,
+# `target add ocaml` copies that container only when the project's model
+# selects `secrets`; the per-feature placeholder dirs under src/feature/
+# (never generated - Main_ocaml excludes src/) are trimmed on the same
+# rule, which is what every trim:true target does.
+#
+# fullset is EMPTY on purpose: test/t_feature.ml gates every block on
+# `has_feature`, and the harness only constructs features the generated
+# config knows, so the cross-feature suite compiles and runs against any
+# trimmed set. Nothing else references a feature by name.
 main: kit: target: ocaml: feature: {
-  trim: false
+  trim: true
+  fullset: []
 }

package/project/.sdk/model/target/zig.aon

@@ -8,6 +8,17 @@ main: kit: target: zig: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md): the `secrets` feature is a
+  # thin layer over a VENDORED sekreto port and declares `needs: { sekreto:
+  # true }`; a target that does not say it carries one never gets the
+  # feature. This target does: tm/zig/feature/secrets/{sekreto,plugin,
+  # plugins} are the zig ports of @voxgig/sekreto and voxgig/plugin at the
+  # shared vendor tag, wired as the named build modules `sekreto`, `plugin`
+  # and `sekretoplugins` by the generated build.zig (Main_zig) - and ONLY
+  # when the feature is active, so an SDK without secrets declares none of
+  # them and compiles nothing of it. Mirrors ts.aon / go.aon / rust.aon.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written struct runner, whose engine half
   # AND assertion half are now the vendored omni port driven through
@@ -61,10 +72,25 @@ main: kit: target: zig: publish: {
 
 
 # Feature source is NOT trimmed to the model's selection here: root.zig
-# re-exports every feature type with @import("feature/<name>.zig"), and
-# build.zig names test/feature_test.zig explicitly, so a trimmed tree
-# fails to build. Trimming stays off until root.zig's feature exports are
-# driven from the model.
+# re-exports every BUILT-IN feature type with @import("feature/<name>.zig"),
+# and build.zig names test/feature_test.zig explicitly, so a trimmed tree
+# fails to build. Trimming stays off until those static exports are driven
+# from the model too.
+#
+# THE FORCING CASE is `secrets`, the first GATED feature this target
+# carries. With the trim off, its whole tree - feature/secrets.zig, the
+# vendored sekreto and voxgig/plugin cores and the provider plugins - ships
+# in EVERY zig SDK whatever the model says. What keeps that honest is that
+# zig compiles only what a module root reaches, so the generated build.zig
+# and root.zig (Main_zig, from the marker-slotted fragments) name the
+# feature's modules, its root export and its test step ONLY when the
+# feature is active: a secrets-off SDK carries the files as dead weight and
+# compiles none of them, and `make lint` (`zig fmt --check .`) is the one
+# gate that still reads them. Main_zig also drops the provider plugins of
+# an INACTIVE feature and the inactive groups of an active one (the scala
+# shape), so the dead weight is the two cores plus the ungrouped
+# httpjson/sigv4 helpers, never the nine vault clients. When the feature
+# trim lands here, that second exclude list becomes redundant, not wrong.
 main: kit: target: zig: feature: {
   trim: false
 }