@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/src/cmp/lua/Main_lua.ts

@@ -4,7 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
-  targetFeatures,
+  targetFeatures, pluginExcludes,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
 
@@ -27,6 +27,18 @@ import { MainEntity } from './MainEntity_lua'
 import { EntityTypes } from './EntityTypes_lua'
 
 
+// Features whose source is a CONTAINER under the top-level feature/ dir,
+// beside the flat `<name>_feature.lua` every other lua feature is. Today
+// that is `secrets`: its folder holds a vendored @voxgig/sekreto port, the
+// voxgig/plugin runtime and the C transport helper - some forty files of
+// key-store, request-signing and child-process code that an SDK which never
+// asked for secrets must not ship. Anything named here is EXCLUDED from the
+// verbatim copy unless the model SELECTS the feature (see the Copy below);
+// its shipped test suite under test/feature/<name>/ goes with it. The
+// clojure target gates its container the same way (Main_clojure.ts).
+const CONTAINED = ['secrets']
+
+
 const Main = cmp(async function Main(props: any) {
 
   const { target } = props
@@ -42,15 +54,93 @@ const Main = cmp(async function Main(props: any) {
 
   Gitignore({})
 
-  // Copy tm/lua files with replacements
+  // THE feature/<name>/ CONTAINER IS GATED HERE, at generate time - the
+  // top-level-container peer of the `srcFeatureExcludes` gate ts and js
+  // apply to src/feature/<name>/. `target add` keeps an unselected
+  // feature out of a project's tm/ in the first place; this covers a
+  // feature switched off after it was added, and the generator suite,
+  // which copies the whole scaffold tree.
+  const containerExcludes = CONTAINED
+    .filter((name: string) => null == feature[name])
+    .flatMap((name: string) => [
+      new RegExp('(^|/)feature/' + name + '_feature\\.lua$'),
+      new RegExp('(^|/)feature/' + name + '/'),
+      new RegExp('(^|/)test/feature/' + name + '/'),
+    ])
+
+  // Copy tm/lua files with replacements.
+  //
+  // pluginExcludes: the generate-time plugin trim (an ACTIVE feature's
+  // INACTIVE plugin group's declared files stay out of the tree). The
+  // model's lua `path` entries are target-root-relative, which is this
+  // Copy's root - helpers/featureSource documents that getting the root
+  // wrong makes the trim a silent no-op.
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE,
+      ...containerExcludes, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }
   })
 
+  // THE NATIVE BUILD SEAM. sekreto's lua PLUGIN kinds (hashicorp, aws, ...)
+  // run a small compiled transport helper, because Lua 5.4 has no sockets
+  // and no TLS; the four built-in kinds never reach it. The helper's
+  // source is vendored with the feature (feature/secrets/native/
+  // sekretonet.c) and the template Makefile `-include`s this fragment, so
+  // it is compiled - and OpenSSL linked - ONLY when the model activates a
+  // plugin group that lua has definitions for. An SDK without secrets, or
+  // with the built-in chain alone, gets no fragment, no compiler run and
+  // no OpenSSL dependency.
+  //
+  // The vendored file opens with the vendoring tool's three-line `--`
+  // provenance header (every file under tm/lua is stamped in lua's comment
+  // syntax; the guard holds that), which the C compiler cannot read - so
+  // the rule feeds the compiler from line four. Line numbers in a compiler
+  // diagnostic are therefore three lower than in the file.
+  const nativeGroups: string[] = []
+  each(feature, (f: any) => {
+    each(f.plugin, (plugin: any) => {
+      if (false === plugin.active || null == plugin.active) return
+      if (0 < Object.keys(plugin.def?.lua || {}).length) {
+        nativeGroups.push(f.name + '.' + plugin.name)
+      }
+    })
+  })
+
+  if (0 < nativeGroups.length) {
+    Folder({ name: 'feature' }, () => {
+      Folder({ name: 'secrets' }, () => {
+        File({ name: 'native.mk' }, () => {
+          Content(`# ${model.const.Name} SDK: the sekreto transport helper build.
+#
+# GENERATED because a secrets plugin group is active
+# (${nativeGroups.sort().join(', ')}): the plugin provider kinds run this
+# helper for every socket and child process, since Lua 5.4 has none. An
+# SDK without an active plugin group has no such file, and its Makefile's
+# optional include of it is a no-op - nothing is compiled and OpenSSL is
+# not linked.
+#
+# The source carries the vendoring tool's three-line provenance header in
+# lua comment syntax, which the compiler cannot read: it is fed the file
+# from line four. Compiler line numbers are therefore three lower than the
+# file's.
+NATIVE := feature/secrets/native/sekreto-net
+
+CC ?= cc
+CFLAGS ?= -std=c11 -O2 -Wall -Wextra
+LDLIBS ?= -lssl -lcrypto
+
+feature/secrets/native/sekreto-net: feature/secrets/native/sekretonet.c
+	@command -v $(CC) >/dev/null 2>&1 || { echo "secrets: a C compiler ($(CC)) is needed to build the sekreto transport helper that this SDK's plugin provider kinds run - install one, or use only the built-in provider kinds" >&2; exit 1; }
+	tail -n +4 $< | $(CC) $(CFLAGS) -x c - -o $@ $(LDLIBS)
+`)
+        })
+      })
+    })
+  }
+
   // Generate main SDK file
   File({ name: model.name + '_sdk.' + target.ext }, () => {
 

package/project/.sdk/src/cmp/lua/Package_lua.ts

@@ -23,6 +23,43 @@ import type {
 } from '@voxgig/apidef'
 
 
+// The vendored modules the secrets feature needs whatever its chain names
+// (ts/vendor/routes.json `sekreto/lua` and `plugin/lua`, minus the plugin
+// KINDS, which are listed per active group from the model). Held to the
+// vendored tree by ts/test/generate.test.ts's lua secrets case.
+const SECRETS_CORE_MODULES = [
+  'feature/secrets/sekreto',
+  'feature/secrets/sekreto/addr',
+  'feature/secrets/sekreto/err',
+  'feature/secrets/sekreto/name',
+  'feature/secrets/sekreto/providers',
+  // The shared plugin helpers, in no group: httpjson (eight kinds), net
+  // (httpjson, boru, secretspec), json and support (every kind), crypto
+  // (aws AND gcpsecrets - two groups, so neither may own it).
+  'feature/secrets/sekreto/plugins/crypto',
+  'feature/secrets/sekreto/plugins/httpjson',
+  'feature/secrets/sekreto/plugins/json',
+  'feature/secrets/sekreto/plugins/net',
+  'feature/secrets/sekreto/plugins/support',
+  'feature/secrets/plugin',
+  'feature/secrets/plugin/capability',
+  'feature/secrets/plugin/catalog',
+  'feature/secrets/plugin/config',
+  'feature/secrets/plugin/depend',
+  'feature/secrets/plugin/env',
+  'feature/secrets/plugin/export',
+  'feature/secrets/plugin/graph',
+  'feature/secrets/plugin/host',
+  'feature/secrets/plugin/json',
+  'feature/secrets/plugin/order',
+  'feature/secrets/plugin/point',
+  'feature/secrets/plugin/ref',
+  'feature/secrets/plugin/resolve',
+  'feature/secrets/plugin/types',
+  'feature/secrets/plugin/version',
+]
+
+
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -81,6 +118,15 @@ dependencies = {
     // rock exists to depend on - station design 9.2's registry-less tier).
     // Gated: a feature that does not apply to lua must not be listed
     // as a rockspec module — the require would not resolve.
+    //
+    // The secrets feature carries the VENDORED sekreto core, the
+    // voxgig/plugin runtime and the shared plugin helpers (no sekreto or
+    // plugin rock exists to depend on); the plugin KINDS themselves are
+    // listed from the model's active `def.lua` entries, so a trimmed
+    // group's modules are not claimed. The compiled transport helper the
+    // plugin kinds run is NOT a rock module: `build.type = "builtin"`
+    // cannot produce an executable, so an install-from-rock carries the
+    // helper's source and `make build` compiles it where the SDK runs.
     const feature = targetFeatures(model, target)
     let featureModules = `    ["feature.base_feature"] = "feature/base_feature.lua",\n`
     each(feature, (f: any) => {
@@ -90,6 +136,19 @@ dependencies = {
         featureModules +=
           `    ["feature.station.voxgig_station"] = "feature/station/voxgig_station.lua",\n`
       }
+      if ('secrets' === f.name) {
+        const mods = [...SECRETS_CORE_MODULES]
+        each(f.plugin, (plugin: any) => {
+          if (false === plugin.active || null == plugin.active) return
+          for (const one of Object.values(plugin.def?.lua || {})) {
+            mods.push(String(one).replace(/\.lua$/, ''))
+          }
+        })
+        for (const mod of Array.from(new Set(mods)).sort()) {
+          featureModules +=
+            `    ["${mod.replace(/\//g, '.')}"] = "${mod}.lua",\n`
+        }
+      }
     })
 
     Content(`}
@@ -99,6 +158,7 @@ build = {
     ["${model.name}_sdk"] = "${model.name}_sdk.lua",
     ["config"] = "config.lua",
     ["config_shared"] = "config_shared.lua",
+    ["config_plugins"] = "config_plugins.lua",
     ["features"] = "features.lua",
 ${featureModules}  }
 }

package/project/.sdk/src/cmp/lua/fragment/Main.fragment.lua

@@ -85,6 +85,16 @@ function ProjectNameSDK.new(options)
     end
   end
 
+  -- CONSUMED, not kept. `extend` holds feature INSTANCES, and every shipped
+  -- feature's init stores `self.client = ctx.client` - so leaving the list
+  -- in self.options makes the options map CYCLIC (client.options.extend[1]
+  -- .client == client), and options_map()'s vs.clone, which has no cycle
+  -- guard, blew the stack on the first prepare_auth of any client built with
+  -- an extend feature. The instances live on self.features from here on,
+  -- which is the only place anything reads them; the SAME table is
+  -- self._rootctx.options, so the root context loses the key too.
+  self.options["extend"] = nil
+
   -- Initialize features.
   for _, f in ipairs(self.features) do
     utility.feature_init(self._rootctx, f)

package/project/.sdk/src/cmp/ocaml/Config_ocaml.ts

@@ -26,6 +26,106 @@ import {
 } from './utility_ocaml'
 
 
+// THE SECRETS BUILD MODEL, derived from the model ONCE and read by both the
+// Makefile fragment (Main_ocaml emits feature/secrets/feature.mk from it)
+// and the generated config (the definitions list and the bundled transport
+// below), so the two cannot disagree about which kinds are compiled.
+//
+// Upstream sekreto retired its self-registration registry for voxgig/plugin
+// definitions: a provider kind the caller did not pass in `~plugins` is
+// unknown to that Sekreto. So the model's choice of plugin groups IS the
+// SDK's provider vocabulary, and the generated code names each active
+// group's constructor (`def: ocaml:` in model/feature/secrets.aon -
+// `Hashicorp.plugin`, the `unit -> Defs.definition` each vendored kind
+// module defines) and nothing else. A symbol named here whose module the
+// plugin trim removed is an "Unbound module" at compile time - a loud
+// failure, which is the right kind.
+//
+// MODULE ORDER IS THE DEPENDENCY ORDER, written down (upstream's own
+// Makefile is the source): the voxgig/plugin host, the sekreto core, the
+// shared helpers, the kinds. The helpers are ungrouped in the model (see the
+// ocaml note at the head of its `plugin` block) and are listed here only
+// when a selected kind needs them - the transport chain (crypto, sigv4, tls,
+// http, httpjson) when an active group declares `needs.fetch`, the
+// child-process helper (runcmd) when any kind is on - because OCaml
+// compiles exactly what it is handed: an [env, memory] chain compiles the
+// two cores alone, and `secretspec` alone compiles runcmd.ml and no TLS.
+//
+// Null when the model does not activate `secrets` for this target. Read
+// with `only_active: false` on the plugin map (pluginExcludesFor's
+// subtlety: the feature object a component is handed has already been
+// filtered, so a feature whose groups are all off would look like one
+// with no plugin machinery).
+type SecretsBuild = {
+  groups: string[],
+  tlsGroups: string[],
+  tls: boolean,
+  plugin: string[],
+  core: string[],
+  helpers: string[],
+  kinds: string[],
+  syms: string[],
+}
+
+const SECRETS_PLUGIN_MODULES = [
+  'value', 'types', 'ref', 'version', 'capability', 'resolve', 'env',
+  'config', 'graph', 'order', 'export', 'depend', 'point', 'defs',
+  'catalog', 'host',
+].map((m) => 'feature/secrets/plugin/' + m + '.ml')
+
+const SECRETS_CORE_MODULES = ['json', 'secret', 'provider', 'sekreto']
+  .map((m) => 'feature/secrets/sekreto/' + m + '.ml')
+
+const SECRETS_TLS_HELPERS = ['crypto', 'sigv4', 'tls', 'http', 'httpjson']
+  .map((m) => 'feature/secrets/plugins/' + m + '.ml')
+
+const SECRETS_PROC_HELPERS = ['feature/secrets/plugins/runcmd.ml']
+
+function secretsBuild(model: Model, target: any): SecretsBuild | null {
+  const feature = targetFeatures(model, target)
+  if (null == (feature as any).secrets) return null
+
+  const declared = getModelPath(model,
+    `main.${KIT}.feature.secrets.plugin`,
+    { required: false, only_active: false }) || {}
+
+  const groups: string[] = []
+  const tlsGroups: string[] = []
+  const syms = new Set<string>()
+  const kinds = new Set<string>()
+
+  each(declared, (plugin: any) => {
+    // Filter on `active` HERE rather than trusting the feature object to
+    // arrive filtered (Config_go's note): getting this wrong names a
+    // constructor for a module the trim just deleted.
+    if (true !== plugin.active) return
+    const defs: Record<string, string> = plugin.def?.[target.name] || {}
+    if (0 === Object.keys(defs).length) return
+    groups.push(plugin.name)
+    if (true === plugin.needs?.fetch) tlsGroups.push(plugin.name)
+    for (const [sym, path] of Object.entries(defs)) {
+      syms.add(sym)
+      kinds.add(String(path))
+    }
+  })
+
+  const tls = 0 < tlsGroups.length
+  return {
+    groups: groups.sort(),
+    tlsGroups: tlsGroups.sort(),
+    tls,
+    plugin: SECRETS_PLUGIN_MODULES,
+    core: SECRETS_CORE_MODULES,
+    helpers: [
+      ...(tls ? SECRETS_TLS_HELPERS : []),
+      ...(0 < kinds.size ? SECRETS_PROC_HELPERS : []),
+    ],
+    kinds: Array.from(kinds).sort(),
+    syms: Array.from(syms).sort(),
+  }
+}
+
+
 // sdk_config.ml: make_config () builds the embedded API model as a value;
 // make_feature name is the N-feature-safe factory the client uses to
 // instantiate features named in the options (mirrors go/rust Config).
@@ -40,6 +140,8 @@ const Config = cmp(async function Config(props: any) {
   // helpers/applicability.
   const feature = targetFeatures(model, target)
 
+  const secrets = secretsBuild(model, target)
+
   // The canonical config OBJECT and its JSON, from the shared helper. Both
   // representations render from the same `def`, so they cannot describe
   // different configs - and this target picks up `options.server` (the OpenAPI
@@ -80,9 +182,6 @@ let config_data = "${ocamlString(configJson)}"
 
 let make_config () : value =
   Sdk_json.json_read config_data
-
-let make_feature (name : string) : feature =
-  match name with
 `)
     }
     else {
@@ -99,11 +198,76 @@ open Sdk_features
 
 let make_config () : value =
   ${formatOcamlValue(config, 1)}
+`)
+    }
 
-let make_feature (name : string) : feature =
+    // THE PLUGIN DEFINITIONS the model selected, per feature (the ocaml
+    // peer of Config_go's featurePlugins map). EMITTED UNCONDITIONALLY, so
+    // every generated config answers the same question - but typed as
+    // `Defs.definition list` only when the secrets feature is active: the
+    // `Defs` module is part of the vendored voxgig/plugin tree, which is
+    // compiled only then, so an inactive model gets the polymorphic empty
+    // list instead (`'a list`, which unifies with anything a caller
+    // expects). DELIBERATE DIVERGENCE from the c/lua accessors, whose
+    // untyped return (void**, a table) needs no such split.
+    if (null == secrets) {
+      Content(`
+(* The plugin definitions the model selected, per feature: none - no
+ * plugin-bearing feature is active in this SDK. *)
+let feature_plugins (_name : string) = []
+`)
+    }
+    else {
+      Content(`
+(* The plugin definitions the model selected for the secrets feature's
+ * provider chain${0 === secrets.groups.length ? ': none - the chain can name the four built-in kinds (env, memory, dotenv, file) and a custom provider, and nothing else' : ' (plugin groups: ' + secrets.groups.join(', ') + ')'}.
+ * Built, not held: every call is a fresh list, so two chains never share
+ * a definition. *)
+let feature_plugins (name : string) : Defs.definition list =
   match name with
+  | "secrets" -> [${0 === secrets.syms.length ? '' : '\n' + secrets.syms.map((sym: string) => '      ' + sym + ' ();\n').join('') + '    '}]
+  | _ -> []
+`)
+
+      // THE EXCHANGE TRANSPORT OF LAST RESORT (go's rawExchangeFetch): the
+      // vendored sekreto HTTP client, which the active plugin groups
+      // compile and link anyway (feature/secrets/feature.mk adds the OpenSSL binding on
+      // exactly this condition). It exists so an exchange works with
+      // ordinary SDK options - requiring a custom transport for the COMMON
+      // case would refuse every live token purchase before a request was
+      // made. Same result shape the system.fetch seam promises ({status,
+      // statusText, headers, body, json()}). With no such group the feature
+      // is built without it and a purchase with no options.system.fetch
+      // fails with a named error (see secrets_feature.ml).
+      if (secrets.tls) {
+        Content(`
+(* The token-exchange transport of last resort: the vendored sekreto HTTP
+ * client (plugins/http.ml over plugins/tls.ml), compiled because a plugin
+ * group needing a transport is active (${secrets.tlsGroups.join(', ')}).
+ * A network failure raises sekreto's own Sekreto_error, which the feature
+ * reports as the refusal. *)
+let secrets_transport (url : string) (fetchdef : value) : value =
+  let meth = match getp fetchdef "method" with Str s -> s | _ -> "POST" in
+  let headers = match getp fetchdef "headers" with
+    | Map _ as h ->
+      List.filter_map (fun k -> match getp h k with Str v -> Some (k, v) | _ -> None) (keysof h)
+    | _ -> [] in
+  let body = match getp fetchdef "body" with Str s -> Some s | _ -> None in
+  let res = Http.request meth url headers body in
+  let text = res.Http.body in
+  jo [("status", Num (float_of_int res.Http.status));
+      ("statusText", Str (if res.Http.status >= 400 then "ERR" else "OK"));
+      ("headers", empty_map ());
+      ("body", Str text);
+      ("json", json_thunk (try Sdk_json.json_read text with _ -> Noval))]
 `)
+      }
     }
+    // The factory, AFTER the definitions it names: OCaml binds top to bottom.
+    Content(`
+let make_feature (name : string) : feature =
+  match name with
+`)
 
     // ONLY THE FEATURES THIS PORT ACTUALLY IMPLEMENTS. Emitting an arm for a
     // name with no `<name>_feature` in tm/ocaml/sdk_features.ml is an
@@ -124,12 +288,26 @@ let make_feature (name : string) : feature =
       }
     })
 
+    // The secrets feature is the one ocaml feature that lives OUTSIDE
+    // sdk_features.ml (a container: feature/secrets_feature.ml plus the
+    // vendored trees), so its arm names its own module and hands it the
+    // definitions the model selected and, when a plugin group needing a
+    // transport is active, the bundled exchange transport. Emitted only
+    // when the feature is active: the module is not compiled otherwise
+    // (Main_ocaml's container gate, and the Makefile's feature/secrets/feature.mk).
+    if (null != secrets) {
+      Content(`  | "secrets" -> Secrets_feature.make ~plugins:(feature_plugins "secrets")${secrets.tls ? ' ~transport:secrets_transport' : ''} ()
+`)
+    }
+
     Content(`  | _ -> base_feature ()
 `)
+
   })
 })
 
 
 export {
-  Config
+  Config,
+  secretsBuild,
 }

package/project/.sdk/src/cmp/ocaml/Main_ocaml.ts

@@ -1,8 +1,10 @@
 
 import {
   cmp, each,
-  File, Content, Copy,
+  File, Content, Copy, Folder,
   entityClassName,
+  pluginExcludes,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -18,10 +20,24 @@ import {
 
 
 import { Package } from './Package_ocaml'
-import { Config } from './Config_ocaml'
+import { Config, secretsBuild } from './Config_ocaml'
 import { Gitignore } from './Gitignore_ocaml'
 import { MainEntity } from './MainEntity_ocaml'
 import { SdkError } from './SdkError_ocaml'
+import { entityModule, ocamlString } from './utility_ocaml'
+
+
+// Features whose source is a CONTAINER under the top-level feature/ dir,
+// beside the single template module (sdk_features.ml) every other ocaml
+// feature lives in. Today that is `secrets`: feature/secrets_feature.ml,
+// feature/secrets/ (the vendored @voxgig/sekreto port, the voxgig/plugin
+// host and the provider kinds - some forty modules of key-store,
+// request-signing and child-process code that an SDK which never asked for
+// secrets must not ship) and its shipped suite under test/feature/secrets/.
+// Anything named here is EXCLUDED from the verbatim copy unless the model
+// SELECTS the feature (see the Copy below). The lua and clojure targets gate
+// their containers the same way (Main_lua.ts, Main_clojure.ts).
+const CONTAINED = ['secrets']
 
 
 const Main = cmp(async function Main(props: any) {
@@ -30,6 +46,27 @@ const Main = cmp(async function Main(props: any) {
   const { model } = props.ctx$
 
   const entity: Record<string, ModelEntity> = getModelPath(model, `main.${KIT}.entity`)
+  // Gated by the applicability tags, so this target never names a feature
+  // it has no source for. One rule, one place: helpers/applicability.
+  const feature = targetFeatures(model, target)
+
+  // THE feature/<name>/ CONTAINER IS GATED HERE, at generate time - the
+  // top-level-container peer of the `srcFeatureExcludes` gate ts and js
+  // apply to src/feature/<name>/. `target add` keeps an unselected
+  // feature out of a project's tm/ in the first place (ocaml.aon has
+  // `feature: { trim: true }`); this covers a feature switched off after
+  // it was added, and the generator suite, which copies the whole scaffold
+  // tree. An inactive feature's vendored kind files go with it - every
+  // declared group's, not only the groups marked inactive, because
+  // pluginExcludes below walks only ACTIVE features (Main_c's
+  // inactivePluginExcludes, for the same reason one target over).
+  const containerExcludes = CONTAINED
+    .filter((name: string) => null == (feature as any)[name])
+    .flatMap((name: string) => [
+      new RegExp('(^|/)feature/' + name + '_feature\\.ml$'),
+      new RegExp('(^|/)feature/' + name + '/'),
+      new RegExp('(^|/)test/feature/' + name + '/'),
+    ])
 
   Package({ target })
 
@@ -42,15 +79,108 @@ const Main = cmp(async function Main(props: any) {
   // @voxgig/omni corpus engine) rides along verbatim - the replacements are
   // ProjectName-shaped and the port names nothing project-specific, so it
   // lands byte-identical to its recorded vendored.json digest.
+  //
+  // pluginExcludes: the generate-time plugin trim (an ACTIVE feature's
+  // INACTIVE plugin group's declared files stay out of the tree). The
+  // model's ocaml `path` entries are target-root-relative, which is this
+  // Copy's root - helpers/featureSource documents that getting the root
+  // wrong makes the trim a silent no-op. ocaml has `srcfeature: false`, so
+  // the per-feature Copy in cmp/Feature.ts - where pluginExcludesFor
+  // normally applies this trim - never runs for it, and this whole-tree
+  // Copy is the ONLY copy the target has (Main_go.ts precedent).
   Copy({
     from: 'tm/' + target.name,
     exclude: [/src\//, /\.(cmi|cmo|cmx|cma|cmxa|o|a)$/, /a\.out$/,
-      /run_sdk_test$/, /run_omni_smoke$/, /run_struct_corpus$/, /run_primary_corpus$/],
+      /run_sdk_test$/, /run_omni_smoke$/, /run_struct_corpus$/, /run_primary_corpus$/,
+      ...containerExcludes, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }
   })
 
+  // THE BUILD SEAM: feature/secrets/feature.mk, GENERATED only when the
+  // model activates `secrets` for this target. It is what only the model
+  // knows and only a Makefile can say in OCaml - the module list in
+  // DEPENDENCY ORDER (ocamlc compiles a module before anything that uses
+  // it and has no link-time reordering, so a wildcard over the vendored
+  // directories would not build), the -I paths, unix.cma for the dotenv
+  // and file built-ins, the gated suite, and, ONLY when an active plugin
+  // group declares `needs.fetch`, the OpenSSL binding: plugins/tls_stubs.c
+  // compiled and linked with `-custom -cclib -lssl -cclib -lcrypto`. The
+  // template Makefile includes `$(wildcard feature/*/feature.mk)` - it names
+  // no feature itself - and every variable a fragment sets is empty without
+  // one, so an SDK without secrets - or with the built-in
+  // chain alone, or with `secretspec` alone - runs no C compiler and links
+  // no OpenSSL. The shape lua's native.mk and c's kinds.c take.
+  //
+  // The vendored stub opens with the vendoring tool's three-line `(* *)`
+  // provenance header (every file under tm/ocaml is stamped in ocaml's
+  // comment syntax; the guard holds that), which a C compiler cannot
+  // read - so the rule feeds the compiler from line four, as lua's does.
+  // Compiler line numbers are therefore three lower than in the file.
+  const build = secretsBuild(model, target)
+  if (null != build) {
+    Folder({ name: 'feature' }, () => {
+      Folder({ name: 'secrets' }, () => {
+        File({ name: 'feature.mk' }, () => {
+          Content(`# ${model.const.Name} SDK: the secrets feature build.
+#
+# GENERATED because the model activates \`secrets\` for this target
+# (plugin groups: ${0 === build.groups.length ? 'none - the built-in kinds alone' : build.groups.join(', ')}).
+# An SDK whose model does not has no such file, and its Makefile's optional
+# include of it is a no-op: nothing of the feature is compiled. Do not
+# hand-edit - change the model's plugin groups and regenerate.
+#
+# MODULE ORDER IS THE DEPENDENCY ORDER: the voxgig/plugin host, the sekreto
+# core, the shared helpers the selected kinds open, the kinds, the feature.
+
+FEATURE_INC = -I +unix -I feature -I feature/secrets/plugin \\
+  -I feature/secrets/sekreto -I feature/secrets/plugins
+FEATURE_LIB = unix.cma
+
+SECRETS_PLUGIN = ${build.plugin.join(' \\\n  ')}
+
+SECRETS_CORE = ${build.core.join(' \\\n  ')}
+
+SECRETS_HELPERS =${0 === build.helpers.length ? '' : ' ' + build.helpers.join(' \\\n  ')}
+
+SECRETS_KINDS =${0 === build.kinds.length ? '' : ' ' + build.kinds.join(' \\\n  ')}
+
+FEATURE_SRC = $(SECRETS_PLUGIN) $(SECRETS_CORE) $(SECRETS_HELPERS) $(SECRETS_KINDS) \\
+  feature/secrets_feature.ml
+
+FEATURE_TESTS = test/feature/secrets/t_secrets.ml
+`)
+
+          if (build.tls) {
+            Content(`
+# THE ONE EXTERNAL DEPENDENCY, behind the plugin groups that need a
+# transport (${build.tlsGroups.join(', ')}): plugins/tls.ml's externals live in
+# plugins/tls_stubs.c against OpenSSL, so the stub is compiled here and the
+# bytecode executables are linked \`-custom\` with libssl and libcrypto.
+# The stub is fed from line four (past the provenance header, see above).
+OCAMLLIB = $(shell $(OCAMLC) -where)
+FEATURE_OBJ = feature/secrets/plugins/tls_stubs.o
+FEATURE_LINK = -custom -cclib -lssl -cclib -lcrypto
+
+feature/secrets/plugins/tls_stubs.o: feature/secrets/plugins/tls_stubs.c
+	@command -v $(CC) >/dev/null 2>&1 || { echo "secrets: a C compiler ($(CC)) is needed to build the OpenSSL binding that this SDK's secrets plugin kinds (${build.tlsGroups.join(', ')}) run - install one, or use only the built-in provider kinds" >&2; exit 1; }
+	tail -n +4 $< | $(CC) -std=c11 -O2 -Wall -Wextra -I$(OCAMLLIB) -x c - -c -o $@
+`)
+          }
+          else {
+            Content(`
+# No active plugin group needs a transport, so the OpenSSL binding is not
+# compiled and nothing is linked beyond the OCaml distribution.
+FEATURE_OBJ =
+FEATURE_LINK =
+`)
+          }
+        })
+      })
+    })
+  }
+
   // Generated API config + branded-error re-export.
   Config({ target })
   SdkError({ target })
@@ -109,6 +239,33 @@ let prepare (client : sdk_client) (fetchargs : value) : value =
     each(entity, (entity: ModelEntity) => {
       MainEntity({ target, entity })
     })
+
+    // Entity by NAME. DELIBERATE DIVERGENCE: OCaml has no dynamic dispatch
+    // over module names, so a caller that discovers entities from the config
+    // rather than naming a generated accessor - the shipped feature suites
+    // are templates and know no project's entity names - has no way to reach
+    // one without this. The go peer is the untyped interface go-cli/go-mcp
+    // dispatch through. None for a name this SDK did not generate.
+    const names = each(entity).map((e: ModelEntity) => e.name).sort()
+    if (0 === names.length) {
+      Content(`
+(* Entity by name: this SDK generated no entities. *)
+let entity (_client : sdk_client) (_name : string) (_entopts : value) : entity_obj option =
+  None
+`)
+    }
+    else {
+      Content(`
+(* Entity by name (None for a name this SDK did not generate). *)
+let entity (client : sdk_client) (name : string) (entopts : value) : entity_obj option =
+  match name with
+${names.map((name: string) => {
+        const mod = entityModule(name)
+        const Mod = mod.charAt(0).toUpperCase() + mod.slice(1)
+        return `  | "${ocamlString(name)}" -> Some (${Mod}.make client entopts)\n`
+      }).join('')}  | _ -> None
+`)
+    }
   })
 
 })