@voxgig/sdkgen 4.20.0 → 4.21.0

package/project/.sdk/model/feature/secrets.aon

@@ -1046,6 +1046,134 @@ main: kit: feature: secrets: {
     # The only plugin that runs a CHILD PROCESS: the secretspec CLI
     # bridge. Gated on its own so an SDK never carries spawnSync into a
     # runtime that would refuse it.
+    # THE MINI VAULT: a project's own secrets, encrypted at rest in one
+    # file, with no service to reach. Every other kind here fetches from
+    # somewhere; this one opens a file, which is why it needs crypto and
+    # not fetch, and why it is the kind an offline or air-gapped consumer
+    # can actually use.
+    #
+    # It arrived in sekreto after the previous checkpoint and was the
+    # ONE provider kind no SDK could reach: every other kind is vendored
+    # into all twenty ports, and this was vendored into none, because an
+    # explicit route table cannot see a file nobody told it about. The
+    # audit (`make vendor-audit`) is what now reports such a file.
+    #
+    # swift has no mini vault upstream, so it is absent here too - the
+    # only one of the twenty missing, and missing because the port does
+    # not have one rather than because this group declined to take it.
+    minivault: {
+      title: 'The local encrypted vault (AES-256-GCM, one file)'
+      needs: { fs: true, crypto: true }
+      path: [
+        'src/feature/secrets/sekreto/plugins/minivault.ts'
+        'src/feature/secrets/sekreto/plugins/minivault.js'
+        'pkg/feature/secrets/voxgig_sekreto/plugins/minivault.py'
+        'feature/secrets/voxgig_sekreto/plugins/minivault.rb'
+        'feature/secrets/sekreto/plugins/minivault.php'
+        'feature/secrets/plugins/minivault/minivault.go'
+        'feature/secrets/plugins/minivault/format.go'
+        'feature/secrets/plugins/minivault.rs'
+        'feature/secrets/plugins/minivault/format.rs'
+        'feature/secrets/plugins/MiniVault.cs'
+        'feature/secrets/sekreto/plugins/Minivault.java'
+        'feature/secrets/sekreto/plugins/Minivault.scala'
+        'feature/secrets/sekreto/plugins/Minivault.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Minivault.pm'
+        'feature/secrets/plugins/minivault.c'
+        'feature/secrets/plugins/Minivault.cpp'
+        'feature/secrets/plugins/Minivault.hpp'
+        'feature/secrets/voxgig/sekreto/plugins/minivault.clj'
+        'lib/projectname/feature/secrets/sekreto/plugins/minivault.ex'
+        'feature/secrets/sekreto/plugins/minivault.lua'
+        'feature/secrets/native/sekretovault.c'
+        'feature/secrets/plugins/minivault.ml'
+        'feature/secrets/plugins/minivault_stubs.c'
+        'feature/secrets/plugins/minivault.zig'
+      ]
+
+      # The two ports whose vault needs C. ocaml's stub is an object the
+      # bytecode links against libcrypto; lua's is a loadable module the
+      # interpreter opens with package.loadlib, because Lua 5.4 has no
+      # cryptography at all. Every other port takes AES-256-GCM from its
+      # standard library and names nothing here.
+      stub: ocaml: [ 'feature/secrets/plugins/minivault_stubs.c' ]
+      stub: lua: [ 'feature/secrets/native/sekretovault.c' ]
+
+      # rust is the ONE port that needs a package for this, and the
+      # reason plugin-level deps exist: `ring` supplies AES-256-GCM and
+      # PBKDF2, and declaring it at feature level would put it in the
+      # Cargo.toml of every secrets-enabled rust SDK - including the ones
+      # whose chain is [env, dotenv], whose trim has just deleted the
+      # files that use it. Every other port takes this from its standard
+      # library: node:crypto, go's crypto/aes, python's ctypes-loaded
+      # OpenSSL, java's javax.crypto.
+      #
+      # It costs a rust SDK nothing new in practice: plugins/httpjson
+      # takes rustls with its `ring` feature, so ring is already in
+      # Cargo.lock wherever an HTTPS kind is active.
+      deps: rust: {
+        'ring': { active: true, version: '0.17' }
+      }
+
+      def: ts: {
+        minivault: 'src/feature/secrets/sekreto/plugins/minivault.ts'
+      }
+      def: js: {
+        minivault: 'src/feature/secrets/sekreto/plugins/minivault.js'
+      }
+      def: py: {
+        minivault: 'pkg/feature/secrets/voxgig_sekreto/plugins/minivault.py'
+      }
+      def: rb: {
+        'VoxgigSekreto::Plugins::MINIVAULT': 'feature/secrets/voxgig_sekreto/plugins/minivault.rb'
+      }
+      def: php: {
+        minivault: 'feature/secrets/sekreto/plugins/minivault.php'
+      }
+      def: go: {
+        'minivault.Plugin': 'feature/secrets/plugins/minivault/minivault.go'
+      }
+      def: rust: {
+        'minivault::minivault': 'feature/secrets/plugins/minivault.rs'
+      }
+      def: csharp: {
+        'MiniVault.Plugin': 'feature/secrets/plugins/MiniVault.cs'
+      }
+      def: java: {
+        'Minivault.PLUGIN': 'feature/secrets/sekreto/plugins/Minivault.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.minivault': 'feature/secrets/sekreto/plugins/Minivault.scala'
+      }
+      def: kotlin: {
+        minivault: 'feature/secrets/sekreto/plugins/Minivault.kt'
+      }
+      def: perl: {
+        minivault: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Minivault.pm'
+      }
+      def: c: {
+        sek_plugin_minivault: 'feature/secrets/plugins/minivault.c'
+      }
+      def: cpp: {
+        minivault: 'feature/secrets/plugins/Minivault.cpp'
+      }
+      def: clojure: {
+        'voxgig.sekreto.plugins.minivault/minivault': 'feature/secrets/voxgig/sekreto/plugins/minivault.clj'
+      }
+      def: elixir: {
+        'Sekreto.Plugins.Minivault.minivault': 'lib/projectname/feature/secrets/sekreto/plugins/minivault.ex'
+      }
+      def: lua: {
+        minivault: 'feature/secrets/sekreto/plugins/minivault.lua'
+      }
+      def: ocaml: {
+        'Minivault.plugin': 'feature/secrets/plugins/minivault.ml'
+      }
+      def: zig: {
+        minivault: 'feature/secrets/plugins/minivault.zig'
+      }
+    }
+
     secretspec: {
       title: 'secretspec CLI bridge (child process)'
       needs: { fs: true }

package/project/.sdk/model/feature/validate.aon

@@ -10,8 +10,9 @@ main: kit: feature: validate: {
 
   # Applicability (docs/design/feature-tags.md): this feature is nothing
   # without the generated `Schema` module, so it applies only to targets that
-  # emit one. ts and js today; a target joins by emitting Schema from its
-  # Main and declaring the tag.
+  # emit one AND carry an implementation of the feature. Every bundled
+  # language target does today; the tag is what a target added later, or an
+  # external package's target, declares to join.
   needs: { schema: true }
 
   # The one feature whose schema is not hand-written: the specs come from

package/project/.sdk/model/target/c.aon

@@ -11,7 +11,7 @@ main: kit: target: c: {
   # Applicability tags (docs/design/feature-tags.md): this target vendors
   # the c port of @voxgig/sekreto (with voxgig/plugin under it) inside its
   # gated `feature/secrets/` container, so the `secrets` feature applies.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the fused corpus runner, whose engine half is now

package/project/.sdk/model/target/clojure.aon

@@ -16,7 +16,7 @@ main: kit: target: clojure: {
   # `(require 'voxgig.sekreto.chain)` to voxgig/sekreto/chain.clj searched
   # from each :paths entry, never by relative import, so Package_clojure
   # adds `feature/secrets` to :paths whenever this feature is active.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   deps: &: {
     kind: *'prod' | string

package/project/.sdk/model/target/cpp.aon

@@ -14,7 +14,7 @@ main: kit: target: cpp: {
   # applies. The port is a multi-translation-unit library where the SDK
   # itself is header-only; tm/cpp/Makefile compiles it into an archive only
   # through the generated feature/secrets/kinds.mk it `-include`s.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner header

package/project/.sdk/model/target/csharp.aon

@@ -10,7 +10,7 @@ main: kit: target: csharp: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/csharp/feature/secrets/),
   # so a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct corpus engine. Runner.cs (class

package/project/.sdk/model/target/elixir.aon

@@ -12,7 +12,7 @@ main: kit: target: elixir: {
   # lives in this target's feature container
   # (tm/elixir/lib/projectname/feature/secrets/), so a feature that resolves
   # secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written corpus engine, replaced by the

package/project/.sdk/model/target/go.aon

@@ -11,7 +11,7 @@ main: kit: target: go: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/go/feature/secrets/), so
   # a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): both fused runners. `doctor` reports leftovers;

package/project/.sdk/model/target/java.aon

@@ -10,7 +10,7 @@ main: kit: target: java: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/java/feature/secrets/), so
   # a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner class

package/project/.sdk/model/target/kotlin.aon

@@ -12,7 +12,7 @@ main: kit: target: kotlin: {
   # whose `needs` is exactly this tag — applies here. Without it
   # featureApplies() refuses the feature and Config emits neither the
   # import nor the registry entry.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner class

package/project/.sdk/model/target/lua.aon

@@ -23,7 +23,7 @@ main: kit: target: lua: {
   # and links no OpenSSL. `sekreto.plugins.net` finds the binary through
   # its own adapted helperpath() (vendor/routes.json), at
   # feature/secrets/native/sekreto-net.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/runner.lua is

package/project/.sdk/model/target/ocaml.aon

@@ -24,7 +24,7 @@ main: kit: target: ocaml: {
   # and links OpenSSL ONLY when a plugin group that needs a transport is
   # active, so an SDK without secrets, or with the built-in chain alone,
   # or with `secretspec` alone, runs no C compiler and links no OpenSSL.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written corpus engine, replaced by

package/project/.sdk/model/target/perl.aon

@@ -11,7 +11,7 @@ main: kit: target: perl: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/perl/feature/secrets/),
   # so a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (t/runner.pm is

package/project/.sdk/model/target/php.aon

@@ -11,7 +11,7 @@ main: kit: target: php: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/php/feature/secrets/), so
   # a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/Runner.php is

package/project/.sdk/model/target/py.aon

@@ -11,7 +11,7 @@ main: kit: target: py: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/py/pkg/feature/secrets/),
   # so a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/runner.py is

package/project/.sdk/model/target/rb.aon

@@ -11,7 +11,7 @@ main: kit: target: rb: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/rb/feature/secrets/), so
   # a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/runner.rb is

package/project/.sdk/model/target/rust.aon

@@ -11,7 +11,7 @@ main: kit: target: rust: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container (tm/rust/feature/secrets/), so
   # a feature that resolves secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written struct corpus runner, superseded

package/project/.sdk/model/target/scala.aon

@@ -10,7 +10,7 @@ main: kit: target: scala: {
   # Applicability (docs/design/feature-tags.md). A vendored sekreto port
   # lives in this target's feature container, so a feature that resolves
   # secrets through sekreto can apply here.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Retired by the move to the vendored @voxgig/omni corpus runner
   # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so

package/project/.sdk/model/target/swift.aon

@@ -15,7 +15,7 @@ main: kit: target: swift: {
   # SekretoPlugins - upstream's own module boundary, and load-bearing: the
   # SDK, plugin and sekreto each declare a `Value`, a `Point` or a `Json`),
   # which Package_swift declares only when the feature is active.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Retired by the move to the vendored @voxgig/omni corpus runner
   # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so

package/project/.sdk/model/target/zig.aon

@@ -17,7 +17,7 @@ main: kit: target: zig: {
   # and `sekretoplugins` by the generated build.zig (Main_zig) - and ONLY
   # when the feature is active, so an SDK without secrets declares none of
   # them and compiles nothing of it. Mirrors ts.aon / go.aon / rust.aon.
-  provides: { sekreto: true }
+  provides: { sekreto: true, schema: true }
 
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written struct runner, whose engine half

package/project/.sdk/src/cmp/c/Main_c.ts

@@ -22,6 +22,7 @@ import {
 
 import { Package } from './Package_c'
 import { Config, FeaturePlugins } from './Config_c'
+import { Schema } from './Schema_c'
 import { Gitignore } from './Gitignore_c'
 import { MainEntity } from './MainEntity_c'
 import { EntityBase } from './EntityBase_c'
@@ -121,6 +122,8 @@ const Main = cmp(async function Main(props: any) {
     })
 
     Config({ target })
+
+    Schema({ target })
   })
 
   // utility/prepare_auth.c is GENERATED, not templated: where the credential

package/project/.sdk/src/cmp/c/Schema_c.ts

@@ -0,0 +1,106 @@
+import {
+  Content,
+  File,
+  cmp,
+  entitySpecMap,
+  optionSpec,
+} from '@voxgig/sdkgen'
+
+
+import {
+  Model,
+} from '@voxgig/apidef'
+
+
+import {
+  cStringLiteral,
+} from './utility_c'
+
+
+// THE GENERATED SCHEMA MODULE: the model's schemas, as data the SDK can run.
+//
+// The c peer of src/cmp/ts/Schema_ts.ts. Same two members, same source:
+// optspec from `main.kit.optspec` plus each feature's own `config.options`,
+// entityspec from the entity field sentinels — both built by the shared
+// helpers, so what c validates against and what ts validates against cannot
+// drift.
+//
+// EMBEDDED AS JSON, PARSED AT LOAD, where ts emits an object literal: JSON is
+// a subset of TypeScript's own literal syntax and is not a subset of c's. A
+// string constant, exactly as config.c carries its data rep above the size
+// threshold, and for the same reason — a nested `cmap(...)` literal is one
+// expression whose depth is what makes a C compiler's parser and register
+// allocator quadratic. The spec has no threshold of its own because it is
+// bounded by the option list and the feature set rather than by the API.
+//
+// The round-trip is exact because the spec holds only strings and booleans:
+// pinned by "strings and booleans only, so the JSON round-trip is lossless"
+// in ts/test/optspec.test.ts.
+const Schema = cmp(async function Schema(props: any) {
+  const ctx$ = props.ctx$
+
+  const model: Model = ctx$.model
+  const target = props.target
+
+  const optspec = optionSpec(model, target.name)
+  const entityspec = entitySpecMap(model, target.name) || {}
+
+  // Beside config.c, in core, and for the same reason: core owns the
+  // generated data, so nothing in utility or feature has to reach up for it.
+  // `core/*.c` is already on the Makefile's LIB_SRCS glob, so this file needs
+  // no build wiring.
+  File({ name: 'schema.c' }, () => {
+
+    Content(`// ${model.const.Name} SDK: generated schemas. Do not edit.
+//
+// Built from the model: \`main.kit.optspec\` and each feature's
+// \`config.options\` for the option spec; entity \`fields[].type\` for the
+// entity specs.
+
+#include "api.h"
+
+static const char OPTSPEC_DATA[] =
+${cStringLiteral(JSON.stringify(optspec))};
+
+static const char ENTITYSPEC_DATA[] =
+${cStringLiteral(JSON.stringify(entityspec))};
+
+voxgig_value* make_optspec(void) {
+  return json_parse(OPTSPEC_DATA);
+}
+
+voxgig_value* make_entityspec(void) {
+  return json_parse(ENTITYSPEC_DATA);
+}
+
+// SHARED SPECS, the shape shared_config uses and for the same reasons: the
+// spec is read on every client construction and never mutated, so a per-call
+// parse would be pure waste. Deliberately never freed: they live for the life
+// of the process, like any other program-lifetime singleton.
+//
+// The returned values are SHARED: treat them as read-only. make_options
+// validates AGAINST the spec and writes into the options, never into the spec.
+static voxgig_value* shared_optspec_val = NULL;
+static voxgig_value* shared_entityspec_val = NULL;
+
+voxgig_value* shared_optspec(void) {
+  if (NULL == shared_optspec_val) {
+    shared_optspec_val = make_optspec();
+  }
+  return shared_optspec_val;
+}
+
+voxgig_value* shared_entityspec(void) {
+  if (NULL == shared_entityspec_val) {
+    shared_entityspec_val = make_entityspec();
+  }
+  return shared_entityspec_val;
+}
+`)
+  })
+})
+
+
+export {
+  Schema
+}

package/project/.sdk/src/cmp/clojure/Main_clojure.ts

@@ -20,6 +20,7 @@ import {
 import { extraFeatures } from './featureextra_clojure'
 import { Package } from './Package_clojure'
 import { Config } from './Config_clojure'
+import { Schema } from './Schema_clojure'
 import { Gitignore } from './Gitignore_clojure'
 import { MainEntity } from './MainEntity_clojure'
 import { PrepareAuth } from './PrepareAuth_clojure'
@@ -99,6 +100,7 @@ const Main = cmp(async function Main(props: any) {
   Folder({ name: 'src' }, () => {
     Folder({ name: 'sdk' }, () => {
       Config({ target })
+      Schema({ target })
       PrepareAuth({ target })
     })
   })

package/project/.sdk/src/cmp/clojure/ReadmeExplanation_clojure.ts

@@ -23,6 +23,7 @@ ${target.name}/
 ├── src/sdk/api.clj        -- public API namespace (entity accessors)
 ├── src/sdk/client.clj     -- client constructors (make-sdk, test-sdk)
 ├── src/sdk/config.clj     -- generated configuration
+├── src/sdk/schema.clj     -- generated option + entity specs
 ├── src/sdk/core.clj       -- core types, context and pipeline
 ├── src/sdk/features.clj   -- feature factory
 ├── src/sdk/entity/        -- entity namespaces (one per entity)

package/project/.sdk/src/cmp/clojure/Schema_clojure.ts

@@ -0,0 +1,73 @@
+import {
+  Content,
+  File,
+  cmp,
+  entitySpecMap,
+  optionSpec,
+} from '@voxgig/sdkgen'
+
+
+import {
+  Model,
+} from '@voxgig/apidef'
+
+
+import {
+  cljStringChunks,
+} from './utility_clojure'
+
+
+// THE GENERATED SCHEMA NAMESPACE: the model's schemas, as data the SDK runs.
+//
+// The clojure peer of src/cmp/ts/Schema_ts.ts. Same source — OPTSPEC from
+// `main.kit.optspec` plus each feature's own `config.options`, ENTITYSPEC
+// from the entity field sentinels — built by the shared helpers, so what
+// clojure validates against and what ts validates against cannot drift.
+//
+// DATA ONLY, AND THAT IS STRUCTURAL. This namespace requires nothing and
+// exposes the raw JSON strings; `sdk.core` parses them. The parse it would
+// otherwise call, `json-parse`, is defined in sdk.core itself — and sdk.core
+// is what reads the spec — so a schema ns that required core to parse its own
+// data would close a require cycle. Holding the strings here and parsing
+// there is the only arrangement that does not.
+//
+// Chunked the way config.clj chunks its model: the JVM caps a string literal
+// at 64KB, so `cljStringChunks` splits and `str` rejoins at load.
+//
+// The round-trip is exact because the spec holds only strings and booleans —
+// pinned by "strings and booleans only, so the JSON round-trip is lossless"
+// in ts/test/optspec.test.ts.
+const Schema = cmp(async function Schema(props: any) {
+  const ctx$ = props.ctx$
+  const target = props.target
+
+  const model: Model = ctx$.model
+
+  const optspec = optionSpec(model, target.name)
+  const entityspec = entitySpecMap(model, target.name) || {}
+
+  const chunks = (json: string) =>
+    cljStringChunks(json).map((c: string) => JSON.stringify(c)).join('\n       ')
+
+  File({ name: 'schema.clj' }, () => {
+    Content(`;; ${model.const.Name} ${target.Name} SDK: generated schemas. Do not edit.
+;;
+;; Generated from the model: main.kit.optspec and each feature's
+;; config.options for the option spec; entity fields[].type for the entity
+;; specs. Parsed by sdk.core — see the note in Schema_clojure.ts for why the
+;; parse cannot live here.
+(ns sdk.schema)
+
+(def optspec-data
+  (str ${chunks(JSON.stringify(optspec))}))
+
+(def entityspec-data
+  (str ${chunks(JSON.stringify(entityspec))}))
+`)
+  })
+})
+
+
+export {
+  Schema
+}

package/project/.sdk/src/cmp/cpp/Main_cpp.ts

@@ -23,6 +23,7 @@ import {
 
 import { Package } from './Package_cpp'
 import { Config, FeaturePlugins } from './Config_cpp'
+import { Schema } from './Schema_cpp'
 import { Gitignore } from './Gitignore_cpp'
 import { MainEntity } from './MainEntity_cpp'
 import { EntityBase } from './EntityBase_cpp'
@@ -112,6 +113,8 @@ const Main = cmp(async function Main(props: any) {
 
     Config({ target })
 
+    Schema({ target })
+
     // core/client.hpp — the generated client class with entity accessors.
     File({ name: 'client.' + target.ext }, () => {