@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/model/feature/secrets.aon

@@ -6,15 +6,6 @@ main: kit: feature: secrets: {
   version: '0.1.0'
   base: 'BASE'
 
-  # `active` is deliberately NOT set here. The base schema defaults it
-  # (`active: *false | boolean`), and in aontu a concrete value does not
-  # yield to another concrete value — it CONFLICTS. Restating `active:
-  # false` here would make a project's `main: kit: feature: secrets:
-  # active: true` fail to unify, which is the same defect the publication
-  # keys carry a warning about in model/target/ts.aon.
-  #
-  # So the feature is OFF until a project turns it on, in its own overlay
-  # (model/project.aon), which `feature add` never overwrites.
 
   # Applicability (docs/design/feature-tags.md). The feature is a thin
   # layer over a VENDORED sekreto port, so it only applies to a target
@@ -23,129 +14,10 @@ main: kit: feature: secrets: {
   # carry an import for a class it has no source for.
   needs: { sekreto: true }
 
-  # SPEC-DERIVED OPTIONS. apidef recognises an API's access-token exchange
-  # in the spec and records it as model facts (info.security.exchange): the
-  # endpoint's path and method, and the field names it sends and answers
-  # with. This maps those facts onto `options.exchange` below, so a project
-  # whose spec describes an exchange does not hand-copy its own API's token
-  # endpoint into its model.
-  #
-  # What arrives is WHAT THE EXCHANGE IS, never that it should run:
-  # `exchange.active` stays the project's call, because resolving a static
-  # credential through this feature on an API that also has a token endpoint
-  # is a legitimate configuration. Turning it on remains a deliberate act.
   spec: { authexchange: 'exchange' }
 
-  # PLUGINS — the provider kinds, each carrying its own platform cost.
-  #
-  # This is what keeps a generated SDK lean. sekreto's core resolves a
-  # chain and ships `env` and `memory`, which import nothing; every other
-  # kind lives in its own module and REGISTERS ITSELF at import, so a kind
-  # nobody imports is not in the build. These entries decide which of
-  # those modules are generated at all.
-  #
-  # An SDK whose chain is `[dotenv, env]` — the common case, and
-  # elementdemo's — needs `dotenv` alone. Before this it carried AWS
-  # request signing and seven HTTP vault clients as well, because one
-  # import reached every kind.
-  #
-  # `path` is DECLARED rather than conventional: these files are vendored
-  # from sekreto, and both the vendoring guard and their own relative
-  # imports pin them at upstream's directory depth.
-  #
-  # All inactive by default, like the feature itself. A project turns on
-  # what its chain actually names.
   plugin: {
-    # NO dotenv/file GROUP. Upstream sekreto made dotenv and file
-    # BUILT-INS (src/provider/builtin.ts imports and instantiates them
-    # unconditionally, and Sekreto.ts imports builtin.ts) — so they ship
-    # with the feature core and CANNOT be a trimmable group: a trimmable
-    # group here would let the trim delete two modules the vendored core
-    # imports, and the SDK would not compile.
-    #
-    # plugins/httpjson.ts is likewise in no group: it is the shared HTTP
-    # helper eight plugins import, so it ships with the feature core.
-    #
-    # php has a SECOND such file: plugins/runcmd.php, the child-process
-    # helper that boru.php (`vault`) and secretspec.php (`secretspec`)
-    # both require. It spans two groups, so no group may own it - trimming
-    # either one would delete a file the other group's plugin requires.
-    #
-    # java has THREE such files, and the third is the surprising one.
-    # plugins/Httpjson.java is the shared HTTP helper (eight plugins
-    # import it) and plugins/Proc.java the child-process helper Boru
-    # (`vault`) and Secretspec (`secretspec`) both use - the php story,
-    # one language over. plugins/Sigv4.java is NOT aws-only in this port:
-    # its package-private `uriescape` is also called by Doppler and
-    # Infisical and Onepassword (`saas`) and by Azuresecrets (`cloud`), so
-    # listing it under `aws` would let a saas-only trim delete a file
-    # three other kinds compile against - and javac, which does no
-    # dead-code elimination, fails the whole build on it. All three ship
-    # with the java feature core and belong to NO group. The cost is real
-    # and stated rather than hidden: a secrets-enabled java SDK links
-    # HMAC-SHA256 and a ProcessBuilder call even with no group active.
-    #
-    # scala repeats the java Sigv4 story exactly, and it was got WRONG
-    # first: plugins/Sigv4.scala was listed under `aws`, and its
-    # `private[plugins] def uriescape` is called by Doppler, Infisical and
-    # Onepassword (`saas`) and by Azuresecrets (`cloud`). A saas-only trim
-    # then deleted it and scalac failed the SDK with four "Not found:
-    # uriescape"; a cloud-only trim, with two. It ships with the scala
-    # feature core and belongs to NO group. plugins/Httpjson.scala is the
-    # other ungrouped scala file, and it is BOTH helpers in one: `fetchjson`
-    # (eight plugins) and `runcmd`, the ProcessBuilder helper Boru (`vault`)
-    # and Secretspec (`secretspec`) share, which is why scala needs two
-    # ungrouped files where java needs three. Those two are the whole set:
-    # every `private[plugins]` symbol crossing a file boundary is defined in
-    # Httpjson.scala or Sigv4.scala, and nothing else is shared.
 
-    #
-    # c has the shared-helper shape too, and five files of it, every one
-    # verified by a symbol scan of the port at the tag rather than read off
-    # a comment: plugins/httpjson.c (the socket HTTP client eight kinds
-    # call), plugins/tls.c (its OpenSSL binding - the ONLY file that names
-    # OpenSSL), plugins/encode.c (`sek_uriescape` for four stores and
-    # base64 for two), plugins/clock.c (token renewal time, SigV4's
-    # timestamp) and plugins/proc.c (`sek_runcmd`, for boru in `vault` AND
-    # secretspec in `secretspec`). All five belong to NO group. The two
-    # plugin headers (sekretoplugins.h, support.h) are ungrouped for the
-    # same reason. What makes c different from java/scala is that the
-    # Makefile can see the trim: it compiles these helpers, and links
-    # OpenSSL, only when at least one KIND file survived, so an
-    # [env, memory] chain compiles the sekreto and voxgig/plugin cores
-    # alone and links libc alone. sha256.c and sigv4.c are NOT shared in c
-    # (aws.c is their only caller) and go with `aws`.
-    #
-    # ocaml has the java/scala Sigv4 shape AND the c Makefile-visible
-    # trim, verified by an `open`/qualifier scan of the port at the tag:
-    # plugins/sigv4.ml's `uriescape` is called by azuresecrets (`cloud`)
-    # and by doppler, infisical and onepassword (`saas`), plugins/crypto.ml
-    # is sigv4.ml's only caller but must compile before it, and
-    # plugins/runcmd.ml (the child-process helper) is opened by boru
-    # (`vault`) AND secretspec (`secretspec`). The transport chain
-    # plugins/httpjson.ml -> http.ml -> tls.ml (+ tls_stubs.c, the OpenSSL
-    # binding) is opened by every HTTPS kind. All seven belong to NO
-    # group. What makes the cost zero when no kind needs them is the
-    # generated feature/secrets/feature.mk (Main_ocaml): OCaml compiles
-    # exactly the modules it is handed, in the order it is handed them, so
-    # the fragment lists the transport helpers (and compiles the stub,
-    # linking OpenSSL) only when an active group declares `needs.fetch`,
-    # and runcmd.ml only when any kind is active. A chain of built-ins,
-    # or `secretspec` alone, compiles neither and links no OpenSSL.
-    #
-    # cpp has four ungrouped shared helpers, read off the port's own
-    # include lines at the tag rather than off a comment: plugins/Httpjson
-    # .cpp (the socket HTTP client eight kinds include), plugins/Tls.cpp
-    # (its OpenSSL binding, included by Httpjson.cpp - the ONLY file that
-    # names OpenSSL), plugins/Crypto.cpp (SHA-256/HMAC, included by Tls.cpp
-    # AND Sigv4.cpp) and plugins/Proc.cpp (`runcmd`, for Boru in `vault`
-    # AND Secretspec in `secretspec`). All four belong to NO group, .hpp
-    # and .cpp alike. Sigv4.{cpp,hpp} is included by Aws.cpp alone
-    # (upstream's own `make lean` asserts only aws needs a digest) and goes
-    # with `aws`. As in c, the Makefile can see the trim: it compiles the
-    # helpers, and links OpenSSL, only when at least one KIND file survived,
-    # so an [env, memory] chain compiles the sekreto and voxgig/plugin cores
-    # alone and links libstdc++ alone.
     vault: {
       title: 'HashiCorp Vault and boru'
       needs: { fs: true, fetch: true }
@@ -201,8 +73,6 @@ main: kit: feature: secrets: {
         hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.ts'
         boru: 'src/feature/secrets/sekreto/plugins/boru.ts'
       }
-      # go: package-qualified Definition symbols (each plugin is its own
-      # package, and the symbol grammar is the language's own).
       def: go: {
         'hashicorp.Plugin': 'feature/secrets/plugins/hashicorp/hashicorp.go'
         'boru.Plugin': 'feature/secrets/plugins/boru/boru.go'
@@ -229,8 +99,6 @@ main: kit: feature: secrets: {
         'VoxgigSekreto::Plugins::HASHICORP': 'feature/secrets/voxgig_sekreto/plugins/hashicorp.rb'
         'VoxgigSekreto::Plugins::BORU': 'feature/secrets/voxgig_sekreto/plugins/boru.rb'
       }
-      # js: the same symbol set as ts, CommonJS module paths (Config_js
-      # strips the leading src/ and the .js extension to build a require).
       def: js: {
         hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.js'
         boru: 'src/feature/secrets/sekreto/plugins/boru.js'
@@ -274,19 +142,6 @@ main: kit: feature: secrets: {
         hashicorp: 'feature/secrets/sekreto/plugins/Hashicorp.kt'
         boru: 'feature/secrets/sekreto/plugins/Boru.kt'
       }
-      # perl: the bare sub each module exports (`@EXPORT_OK`), and the
-      # module file under tm/perl - this target's root, which is also
-      # Main_perl's Copy root, so the emitted exclude matches it. The
-      # vendored tree keeps upstream's PACKAGE layout because perl
-      # resolves by @INC, hence the Voxgig/Sekreto/Plugins/ depth.
-      #
-      # plugins/Proc.pm does NOT go with Boru: perl has a SECOND shared
-      # helper (php's runcmd story, one language over). Proc.pm is used by
-      # Boru (`vault`) AND Secretspec (`secretspec`), so it ships with the
-      # feature core alongside Httpjson.pm and belongs to NO group -
-      # listing it here would let a secretspec-only trim delete a file
-      # Boru's `use` line needs, which is a load failure, not a degraded
-      # chain.
       def: perl: {
         hashicorp: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Hashicorp.pm'
         boru: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Boru.pm'
@@ -309,67 +164,18 @@ main: kit: feature: secrets: {
         'voxgig.sekreto.plugins.hashicorp/hashicorp': 'feature/secrets/voxgig/sekreto/plugins/hashicorp.clj'
         'voxgig.sekreto.plugins.boru/boru': 'feature/secrets/voxgig/sekreto/plugins/boru.clj'
       }
-      # elixir: fully-qualified CALLS - each plugin module answers its
-      # definition from a zero-arity function (`Sekreto.Plugins.Hashicorp
-      # .hashicorp()`), so Config_elixir emits the key with `()` appended
-      # and needs no import at all: Elixir resolves modules globally, by
-      # their `defmodule`, not by path. The `def` path is target-root
-      # relative, while the `path` above is relative to Main_elixir's
-      # `lib/projectname` Copy - the root the plugin trim matches against -
-      # which is the same split py uses.
-      #
-      # plugins/proc.ex is NOT listed here: see the elixir note in the
-      # `secretspec` group. It is a feature-core file both groups use.
       def: elixir: {
         'Sekreto.Plugins.Hashicorp.hashicorp': 'lib/projectname/feature/secrets/sekreto/plugins/hashicorp.ex'
         'Sekreto.Plugins.Boru.boru': 'lib/projectname/feature/secrets/sekreto/plugins/boru.ex'
       }
-      # swift: PLAIN TOP-LEVEL LETS (`public let hashicorp: Definition = ...`)
-      # in the vendored SekretoPlugins MODULE, named by simple symbol - so
-      # ts-shaped keys. The `def` path is target-root-relative (tm/swift/...),
-      # while the `path` entries above are relative to Main_swift's
-      # Sources/ProjectNameSDK Copy - the root the plugin trim matches
-      # against - which is the same split py uses.
-      #
-      # plugins/Proc.swift does NOT go with Boru: swift has the php/perl
-      # SHARED-HELPER shape. `runcmd` lives in Proc.swift and is called by
-      # Boru (`vault`) AND Secretspec (`secretspec`), so it ships with the
-      # feature core beside plugins/Httpjson.swift and belongs to NO group -
-      # a path listed in two groups is trimmed as soon as EITHER is off,
-      # which would break the other. Upstream's own `make lean` builds every
-      # non-AWS kind as `<Kind>.swift Httpjson.swift Proc.swift`.
       def: swift: {
         hashicorp: 'Sources/ProjectNameSDK/feature/secrets/plugins/Hashicorp.swift'
         boru: 'Sources/ProjectNameSDK/feature/secrets/plugins/Boru.swift'
       }
-      # lean: QUALIFIED DEFINITIONS (`Sekreto.hashicorp`) - the value each
-      # vendored SekretoPlugins module defines; Main_lean derives the import
-      # (`import SekretoPlugins.Hashicorp`) from the path's module tail. The
-      # path is target-root-relative, as go's is, because Main_lean's Copy is
-      # rooted at tm/lean. Httpjson.lean and Proc.lean are in NO group: the
-      # shared HTTP round-trip and child-process helpers ship with the
-      # feature core (Boru reaches both), like php's runcmd.php. They cost
-      # nothing when no kind imports them - Lake compiles an import closure,
-      # not a directory - and the libcurl link goes with the plugin groups,
-      # not with the core (see model/target/lean.aon).
       def: lean: {
         'Sekreto.hashicorp': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Hashicorp.lean'
         'Sekreto.boru': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Boru.lean'
       }
-      # c: the `Definition *sek_plugin_<kind>(void)` constructor each
-      # vendored plugin file defines (plugins/sekretoplugins.h declares all
-      # ten; only the objects the link line names are carried). The path is
-      # target-root-relative, as go's is, because Main_c's Copy is rooted
-      # at tm/c. The generated feature/secrets/kinds.c (Config_c) calls
-      # these and hands the list to the feature through feature_plugins().
-      #
-      # plugins/proc.c does NOT go with boru: it is the php/perl
-      # SHARED-HELPER shape - `sek_runcmd` is called by boru (`vault`) AND
-      # secretspec (`secretspec`), so it ships with the feature core
-      # beside httpjson.c, tls.c, encode.c and clock.c and belongs to NO
-      # group. The Makefile compiles the ungrouped helpers only when a
-      # kind file is present, so they cost nothing (and need no OpenSSL
-      # headers) in a chain that is [env, memory].
       def: c: {
         sek_plugin_hashicorp: 'feature/secrets/plugins/hashicorp.c'
         sek_plugin_boru: 'feature/secrets/plugins/boru.c'
@@ -383,55 +189,14 @@ main: kit: feature: secrets: {
         hashicorp: 'feature/secrets/sekreto/plugins/hashicorp.lua'
         boru: 'feature/secrets/sekreto/plugins/boru.lua'
       }
-      # zig: the BARE export names upstream's plugins/all.zig re-exports
-      # (`pub const hashicorp = @import("hashicorp.zig").hashicorp;`), so the
-      # symbol is what Config_zig re-exports from the generated
-      # feature/secrets/plugins.zig - the root of the `sekretoplugins` build
-      # module, which is what makes the trim REAL in zig: the compiler
-      # analyses only what a module root reaches, so a kind this file does
-      # not name is neither compiled nor in the vocabulary. The path is
-      # target-root-relative, as go's is, because Main_zig's Copy is rooted
-      # at tm/zig. plugins/httpjson.zig is in NO group (eight kinds import
-      # it by relative path, and the exchange's fetch of last resort is its
-      # fetchjson), so it ships with the feature core.
       def: zig: {
         hashicorp: 'feature/secrets/plugins/hashicorp.zig'
         boru: 'feature/secrets/plugins/boru.zig'
       }
-      # ocaml: MODULE-QUALIFIED FUNCTIONS (`Hashicorp.plugin`), the
-      # `unit -> Defs.definition` each vendored kind module defines
-      # (upstream's allplugins.ml names exactly these); Config_ocaml
-      # appends `()`. OCaml's namespace is flat and resolved by -I, so the
-      # symbol needs no import and the path is only what the plugin trim
-      # matches and what feature/secrets/feature.mk compiles. The path is target-root
-      # relative, as go's is, because Main_ocaml's Copy is rooted at
-      # tm/ocaml.
-      #
-      # plugins/runcmd.ml does NOT go with boru: it is the php/perl
-      # SHARED-HELPER shape (secretspec opens it too), so it ships with the
-      # feature core and belongs to NO group - see the ocaml note at the
-      # head of this `plugin` block.
       def: ocaml: {
         'Hashicorp.plugin': 'feature/secrets/plugins/hashicorp.ml'
         'Boru.plugin': 'feature/secrets/plugins/boru.ml'
       }
-      # cpp: the bare `Definition <kind>()` factory each vendored kind file
-      # defines in namespace sekreto (Hashicorp.hpp: `Definition hashicorp();`),
-      # so the key is the unqualified function name; the generated
-      # feature/secrets/kinds.cpp (Config_cpp) qualifies it as
-      # `sekreto::hashicorp()` and includes the owning file's header. The path
-      # is target-root-relative, as go's is, because Main_cpp's Copy is rooted
-      # at tm/cpp; the .hpp rides in `path` beside its .cpp so the trim removes
-      # the pair, and the .cpp is what the def names because it is what the
-      # Makefile compiles.
-      #
-      # plugins/Proc.cpp does NOT go with Boru: it is the php/perl
-      # SHARED-HELPER shape - `runcmd` is called by Boru (`vault`) AND
-      # Secretspec (`secretspec`), so it ships with the feature core beside
-      # Httpjson.cpp, Tls.cpp and Crypto.cpp and belongs to NO group. The
-      # Makefile compiles the ungrouped helpers only when a kind file is
-      # present, so they cost nothing (and need no OpenSSL headers) in a chain
-      # that is [env, memory].
       def: cpp: {
         hashicorp: 'feature/secrets/plugins/Hashicorp.cpp'
         boru: 'feature/secrets/plugins/Boru.cpp'
@@ -578,7 +343,6 @@ main: kit: feature: secrets: {
         'Gcpsecrets.plugin': 'feature/secrets/plugins/gcpsecrets.ml'
         'Azuresecrets.plugin': 'feature/secrets/plugins/azuresecrets.ml'
       }
-      # cpp: see the vault group.
       def: cpp: {
         gcpsecrets: 'feature/secrets/plugins/Gcpsecrets.cpp'
         azuresecrets: 'feature/secrets/plugins/Azuresecrets.cpp'
@@ -729,13 +493,6 @@ main: kit: feature: secrets: {
         'voxgig.sekreto.plugins.doppler/doppler': 'feature/secrets/voxgig/sekreto/plugins/doppler.clj'
         'voxgig.sekreto.plugins.infisical/infisical': 'feature/secrets/voxgig/sekreto/plugins/infisical.clj'
       }
-      # elixir: fully-qualified CALLS - each plugin module answers its
-      # definition from a zero-arity function, so Config_elixir emits the
-      # key with `()` appended and needs no import at all (Elixir resolves
-      # modules globally, by their `defmodule`). The `def` path is
-      # target-root relative; the `path` above is relative to Main_elixir's
-      # `lib/projectname` Copy, which is the root the plugin trim matches
-      # against - the same split py uses.
       def: elixir: {
         'Sekreto.Plugins.Onepassword.onepassword': 'lib/projectname/feature/secrets/sekreto/plugins/onepassword.ex'
         'Sekreto.Plugins.Doppler.doppler': 'lib/projectname/feature/secrets/sekreto/plugins/doppler.ex'
@@ -776,7 +533,6 @@ main: kit: feature: secrets: {
         'Doppler.plugin': 'feature/secrets/plugins/doppler.ml'
         'Infisical.plugin': 'feature/secrets/plugins/infisical.ml'
       }
-      # cpp: see the vault group.
       def: cpp: {
         onepassword: 'feature/secrets/plugins/Onepassword.cpp'
         doppler: 'feature/secrets/plugins/Doppler.cpp'
@@ -784,10 +540,6 @@ main: kit: feature: secrets: {
       }
     }
 
-    # The only plugin that costs node:crypto: AWS request signing.
-    # `plugins/sigv4.ts` goes with it, and goes only with it. ONE file,
-    # TWO definitions — Secrets Manager and Parameter Store — which is
-    # exactly why `def` is a map.
     aws: {
       title: 'AWS Secrets Manager and Parameter Store (SigV4 signing)'
       needs: { fetch: true, crypto: true }
@@ -845,207 +597,188 @@ main: kit: feature: secrets: {
         awssecrets: 'src/feature/secrets/sekreto/plugins/aws.ts'
         awsparams: 'src/feature/secrets/sekreto/plugins/aws.ts'
       }
-      # ONE package, TWO definitions - go's spelling of the ts aws.ts pair.
       def: go: {
         'aws.Secrets': 'feature/secrets/plugins/aws/aws.go'
         'aws.Params': 'feature/secrets/plugins/aws/aws.go'
       }
-      # ONE module, TWO definitions - rust's spelling of the ts aws.ts
-      # pair (upstream exports `pub fn secrets()` and `pub fn params()`).
-      # plugins/aws/sigv4.rs and plugins/aws/crypto.rs go with it, and go
-      # only with it: nothing outside aws.rs reaches into either.
       def: rust: {
         'aws::secrets': 'feature/secrets/plugins/aws.rs'
         'aws::params': 'feature/secrets/plugins/aws.rs'
       }
-      # ONE module, TWO definitions - py's spelling of the ts aws.ts pair.
-      # plugins/sigv4.py goes with it, and goes only with it.
       def: py: {
         awssecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
         awsparams: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
       }
-      # ONE module, TWO definitions - rb's spelling of the ts aws.ts
-      # pair. plugins/sigv4.rb goes with it, and goes only with it.
       def: rb: {
         'VoxgigSekreto::Plugins::AWSSECRETS': 'feature/secrets/voxgig_sekreto/plugins/aws.rb'
         'VoxgigSekreto::Plugins::AWSPARAMS': 'feature/secrets/voxgig_sekreto/plugins/aws.rb'
       }
-      # ONE module, TWO definitions - js's spelling of the ts aws.ts pair.
-      # plugins/sigv4.js goes with it, and goes only with it.
       def: js: {
         awssecrets: 'src/feature/secrets/sekreto/plugins/aws.js'
         awsparams: 'src/feature/secrets/sekreto/plugins/aws.js'
       }
-      # ONE file, TWO definitions - php's spelling of the ts aws.ts pair.
-      # plugins/sigv4.php goes with it, and goes only with it.
       def: php: {
         awssecrets: 'feature/secrets/sekreto/plugins/aws.php'
         awsparams: 'feature/secrets/sekreto/plugins/aws.php'
       }
-      # ONE file, TWO definitions - csharp's spelling of the ts aws.ts
-      # pair. The class is `AwsPlugins`, not `Aws`: the provider TYPES in
-      # Aws.cs are named AwsSecretsProvider/AwsParamsProvider and the
-      # definition holder cannot collide with them.
-      # plugins/Sigv4.cs goes with it, and goes only with it.
       def: csharp: {
         'AwsPlugins.Secrets': 'feature/secrets/plugins/Aws.cs'
         'AwsPlugins.Params': 'feature/secrets/plugins/Aws.cs'
       }
-      # ONE class, TWO definitions - java's spelling of the ts aws.ts
-      # pair. plugins/Sigv4.java does NOT go with it: see the java note
-      # at the head of this `plugin` block.
       def: java: {
         'Aws.SECRETS': 'feature/secrets/sekreto/plugins/Aws.java'
         'Aws.PARAMS': 'feature/secrets/sekreto/plugins/Aws.java'
       }
-      # ONE file, TWO definitions - scala's spelling of the ts aws.ts pair.
-      # plugins/Sigv4.scala does NOT go with it: the java story repeats here
-      # exactly (see the java note at the head of this `plugin` block),
-      # because Sigv4.scala's `private[plugins] def uriescape` is also called
-      # by Azuresecrets (`cloud`) and by Doppler, Infisical and Onepassword
-      # (`saas`) - so listing it under `aws` let a saas-only or cloud-only
-      # trim delete a file four other kinds compile against, and scalac fails
-      # the whole build on it ("Not found: uriescape", x4 for saas, x2 for
-      # cloud - measured, not predicted).
       def: scala: {
         'com.voxgig.sekreto.plugins.awssecrets': 'feature/secrets/sekreto/plugins/Aws.scala'
         'com.voxgig.sekreto.plugins.awsparams': 'feature/secrets/sekreto/plugins/Aws.scala'
       }
-      # ONE file, TWO definitions - kotlin's spelling of the ts aws.ts
-      # pair. plugins/Sigv4.kt does NOT go with it: the java story repeats
-      # here exactly (see the java note at the head of this `plugin`
-      # block), because Sigv4.kt's `internal fun uriescape` is also called
-      # by Azuresecrets (`cloud`) and by Doppler, Infisical and
-      # Onepassword (`saas`) - so listing it under `aws` would let a
-      # saas-only trim delete a file four other kinds compile against, and
-      # kotlinc fails the whole module on it.
       def: kotlin: {
         awssecrets: 'feature/secrets/sekreto/plugins/Aws.kt'
         awsparams: 'feature/secrets/sekreto/plugins/Aws.kt'
       }
-      # ONE module, TWO definitions - perl's spelling of the ts aws.ts
-      # pair (Aws.pm's `@EXPORT_OK` is `awssecrets awsparams sigv4`).
-      # plugins/Sigv4.pm goes with it, and goes only with it: nothing
-      # outside Aws.pm calls into it in this port.
       def: perl: {
         awssecrets: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
         awsparams: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
       }
-      # ONE file, TWO definitions - dart's spelling of the ts aws.ts pair.
-      # plugins/sigv4.dart goes with it, and so does plugins/crypto.dart:
-      # this port has no crypto library to lean on, so SHA-256 and HMAC are
-      # its own, and sigv4.dart is their only caller. Listing crypto.dart
-      # anywhere else would let an aws-only trim delete the file sigv4.dart
-      # compiles against - and `dart analyze` runs over the whole package,
-      # so that is a hard build failure, not a degraded chain.
       def: dart: {
         awssecrets: 'lib/feature/secrets/sekreto/plugins/aws.dart'
         awsparams: 'lib/feature/secrets/sekreto/plugins/aws.dart'
       }
-      # ONE module, TWO definitions - clojure's spelling of the ts aws.ts
-      # pair (upstream's aws.clj carries `awssecrets` and `awsparams`).
-      # plugins/sigv4.clj goes with it, and goes only with it: nothing
-      # outside aws.clj requires it in this port.
       def: clojure: {
         'voxgig.sekreto.plugins.aws/awssecrets': 'feature/secrets/voxgig/sekreto/plugins/aws.clj'
         'voxgig.sekreto.plugins.aws/awsparams': 'feature/secrets/voxgig/sekreto/plugins/aws.clj'
       }
-      # ONE file, TWO definitions - elixir's spelling of the ts aws.ts pair.
-      # plugins/sigv4.ex goes with it, and goes only with it: it holds
-      # Sekreto.Plugins.Signing and Sekreto.Plugins.Sigv4, and aws.ex is
-      # this port's only caller of either.
       def: elixir: {
         'Sekreto.Plugins.Aws.awssecrets': 'lib/projectname/feature/secrets/sekreto/plugins/aws.ex'
         'Sekreto.Plugins.Aws.awsparams': 'lib/projectname/feature/secrets/sekreto/plugins/aws.ex'
       }
-      # ONE file, TWO definitions - swift's spelling of the ts aws.ts pair
-      # (Aws.swift:258,264 at the tag). plugins/Sigv4.swift goes with it, and
-      # goes only with it: `sigv4` is called from Aws.swift alone - this port
-      # has no java/kotlin/scala `uriescape` story, checked at the tag. And so
-      # does plugins/Crypto.swift: swift has no hashing in its standard
-      # library (CryptoKit is Apple-only, swift-crypto a package), so SHA-256
-      # and HMAC are the port's own and Sigv4.swift is their only caller (the
-      # one other `hex` under plugins/ is a comment in Httpjson.swift).
-      # Listing Crypto.swift anywhere else would let an aws-only trim delete
-      # the file Sigv4.swift compiles against - swiftc fails the whole
-      # SekretoPlugins module on it.
       def: swift: {
         awssecrets: 'Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift'
         awsparams: 'Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift'
       }
-      # ONE file, TWO definitions - lean's spelling of the ts aws.ts pair.
-      # Sigv4.lean, Crypto.lean AND Clock.lean travel with it: in this port
-      # Aws.lean is their only importer (no saas/cloud kind reaches
-      # `uriescape`, which lives in Httpjson.lean), so an aws-off trim
-      # leaves nothing dangling. Clock.lean is the `sekreto_epoch_seconds`
-      # extern's only caller; its two-line C stub is compiled with the curl
-      # one whenever any plugin group is on, and is dead weight otherwise.
       def: lean: {
         'Sekreto.awssecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
         'Sekreto.awsparams': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
       }
-      # c: ONE file, TWO definitions - the c spelling of the ts aws.ts
-      # pair, as go spells it aws.Secrets/aws.Params. plugins/sigv4.c AND
-      # plugins/sha256.c ride with it and only with it: upstream's own
-      # plugins/support.h says "sha256.c and nothing else. The aws plugin is
-      # the only thing in the library that names these", and a symbol scan
-      # of the port at the tag confirms aws.c is the sole caller of
-      # sek_sigv4 / sek_sha256 / sek_hmac_sha256. Unlike java's and scala's
-      # Sigv4, the c percent-encoder the other stores use (`sek_uriescape`)
-      # lives in the ungrouped encode.c, so nothing outside this group
-      # compiles against sigv4.c.
       def: c: {
         sek_plugin_awssecrets: 'feature/secrets/plugins/aws.c'
         sek_plugin_awsparams: 'feature/secrets/plugins/aws.c'
       }
-      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
-      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
-      # and the module path under tm/lua - this target's root, which is also
-      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
-      # turns the path into a require (strip .lua, slashes to dots).
-      # sigv4.lua is required by aws.lua ALONE in the lua port (checked at the
-      # tag: gcpsecrets.lua reaches crypto.lua directly, never sigv4), so it
-      # belongs to this group. crypto.lua is shared by aws and cloud and
-      # ships ungrouped with the feature core.
       def: lua: {
         awssecrets: 'feature/secrets/sekreto/plugins/aws.lua'
         awsparams: 'feature/secrets/sekreto/plugins/aws.lua'
       }
-      # ONE file, TWO definitions - zig's spelling of the ts aws.ts pair
-      # (upstream all.zig: `awssecrets` and `awsparams`, both from aws.zig).
-      # plugins/sigv4.zig goes with it, and goes only with it: at the tag
-      # aws.zig is the ONLY file that `@import("sigv4.zig")` - the zig port
-      # has no java/kotlin/scala `uriescape` story (checked by grep at the
-      # tag), so an aws-off trim leaves nothing dangling.
       def: zig: {
         awssecrets: 'feature/secrets/plugins/aws.zig'
         awsparams: 'feature/secrets/plugins/aws.zig'
       }
-      # ONE module, TWO definitions - ocaml's spelling of the ts aws.ts
-      # pair (aws.ml defines `secretsplugin` and `paramsplugin`).
-      # plugins/sigv4.ml and plugins/crypto.ml do NOT go with it: the
-      # java/scala story repeats here (see the ocaml note at the head of
-      # this `plugin` block), because `Sigv4.uriescape` is also called by
-      # azuresecrets (`cloud`) and by doppler, infisical and onepassword
-      # (`saas`), and crypto.ml has to compile before sigv4.ml.
       def: ocaml: {
         'Aws.secretsplugin': 'feature/secrets/plugins/aws.ml'
         'Aws.paramsplugin': 'feature/secrets/plugins/aws.ml'
       }
-      # cpp: ONE file, TWO definitions (`Definition awssecrets();` and
-      # `Definition awsparams();`, both in Aws.hpp) - the ts/go/py shape. The
-      # SigV4 signer is aws-only in this port: Sigv4.hpp is included by Aws.cpp
-      # and nothing else, so Sigv4.{cpp,hpp} go with `aws`; Crypto.cpp, which
-      # Sigv4.cpp AND Tls.cpp include, stays with the feature core.
       def: cpp: {
         awssecrets: 'feature/secrets/plugins/Aws.cpp'
         awsparams: 'feature/secrets/plugins/Aws.cpp'
       }
     }
 
-    # The only plugin that runs a CHILD PROCESS: the secretspec CLI
-    # bridge. Gated on its own so an SDK never carries spawnSync into a
-    # runtime that would refuse it.
+    minivault: {
+      title: 'The local encrypted vault (AES-256-GCM, one file)'
+      needs: { fs: true, crypto: true }
+      path: [
+        'src/feature/secrets/sekreto/plugins/minivault.ts'
+        'src/feature/secrets/sekreto/plugins/minivault.js'
+        'pkg/feature/secrets/voxgig_sekreto/plugins/minivault.py'
+        'feature/secrets/voxgig_sekreto/plugins/minivault.rb'
+        'feature/secrets/sekreto/plugins/minivault.php'
+        'feature/secrets/plugins/minivault/minivault.go'
+        'feature/secrets/plugins/minivault/format.go'
+        'feature/secrets/plugins/minivault.rs'
+        'feature/secrets/plugins/minivault/format.rs'
+        'feature/secrets/plugins/MiniVault.cs'
+        'feature/secrets/sekreto/plugins/Minivault.java'
+        'feature/secrets/sekreto/plugins/Minivault.scala'
+        'feature/secrets/sekreto/plugins/Minivault.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Minivault.pm'
+        'feature/secrets/plugins/minivault.c'
+        'feature/secrets/plugins/Minivault.cpp'
+        'feature/secrets/plugins/Minivault.hpp'
+        'feature/secrets/voxgig/sekreto/plugins/minivault.clj'
+        'lib/projectname/feature/secrets/sekreto/plugins/minivault.ex'
+        'feature/secrets/sekreto/plugins/minivault.lua'
+        'feature/secrets/native/sekretovault.c'
+        'feature/secrets/plugins/minivault.ml'
+        'feature/secrets/plugins/minivault_stubs.c'
+        'feature/secrets/plugins/minivault.zig'
+      ]
+
+      stub: ocaml: [ 'feature/secrets/plugins/minivault_stubs.c' ]
+      stub: lua: [ 'feature/secrets/native/sekretovault.c' ]
+
+      deps: rust: {
+        'ring': { active: true, version: '0.17' }
+      }
+
+      def: ts: {
+        minivault: 'src/feature/secrets/sekreto/plugins/minivault.ts'
+      }
+      def: js: {
+        minivault: 'src/feature/secrets/sekreto/plugins/minivault.js'
+      }
+      def: py: {
+        minivault: 'pkg/feature/secrets/voxgig_sekreto/plugins/minivault.py'
+      }
+      def: rb: {
+        'VoxgigSekreto::Plugins::MINIVAULT': 'feature/secrets/voxgig_sekreto/plugins/minivault.rb'
+      }
+      def: php: {
+        minivault: 'feature/secrets/sekreto/plugins/minivault.php'
+      }
+      def: go: {
+        'minivault.Plugin': 'feature/secrets/plugins/minivault/minivault.go'
+      }
+      def: rust: {
+        'minivault::minivault': 'feature/secrets/plugins/minivault.rs'
+      }
+      def: csharp: {
+        'MiniVault.Plugin': 'feature/secrets/plugins/MiniVault.cs'
+      }
+      def: java: {
+        'Minivault.PLUGIN': 'feature/secrets/sekreto/plugins/Minivault.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.minivault': 'feature/secrets/sekreto/plugins/Minivault.scala'
+      }
+      def: kotlin: {
+        minivault: 'feature/secrets/sekreto/plugins/Minivault.kt'
+      }
+      def: perl: {
+        minivault: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Minivault.pm'
+      }
+      def: c: {
+        sek_plugin_minivault: 'feature/secrets/plugins/minivault.c'
+      }
+      def: cpp: {
+        minivault: 'feature/secrets/plugins/Minivault.cpp'
+      }
+      def: clojure: {
+        'voxgig.sekreto.plugins.minivault/minivault': 'feature/secrets/voxgig/sekreto/plugins/minivault.clj'
+      }
+      def: elixir: {
+        'Sekreto.Plugins.Minivault.minivault': 'lib/projectname/feature/secrets/sekreto/plugins/minivault.ex'
+      }
+      def: lua: {
+        minivault: 'feature/secrets/sekreto/plugins/minivault.lua'
+      }
+      def: ocaml: {
+        'Minivault.plugin': 'feature/secrets/plugins/minivault.ml'
+      }
+      def: zig: {
+        minivault: 'feature/secrets/plugins/minivault.zig'
+      }
+    }
+
     secretspec: {
       title: 'secretspec CLI bridge (child process)'
       needs: { fs: true }
@@ -1107,20 +840,9 @@ main: kit: feature: secrets: {
       def: kotlin: {
         secretspec: 'feature/secrets/sekreto/plugins/Secretspec.kt'
       }
-      # plugins/Proc.pm is NOT listed here either - see the perl note in
-      # the `vault` group: it is a feature-core file both groups use.
       def: perl: {
         secretspec: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Secretspec.pm'
       }
-      # dart has the php/perl SHARED-HELPER shape, and worse. `runcmd`
-      # (Process.runSync) lives in plugins/httpjson.dart, which every
-      # HTTP plugin imports, so it ships with the FEATURE CORE and cannot
-      # be gated here at all - this group's `needs: { fs: true }` buys back
-      # the CLI kind, not the child-process call itself. Stated rather than
-      # hidden: a dart SDK with secrets active and a `[dotenv, env]` chain
-      # links HttpClient and a Process.runSync it never reaches. Dead code,
-      # not a defect, and an upstream shape issue (boru.dart calls runcmd
-      # too, so it is not secretspec-only there either).
       def: dart: {
         secretspec: 'lib/feature/secrets/sekreto/plugins/secretspec.dart'
       }
@@ -1131,21 +853,9 @@ main: kit: feature: secrets: {
       def: clojure: {
         'voxgig.sekreto.plugins.secretspec/secretspec': 'feature/secrets/voxgig/sekreto/plugins/secretspec.clj'
       }
-      # plugins/proc.ex is NOT listed here - the php/perl SHARED-HELPER
-      # story, one language over. The elixir port factors the child-process
-      # spawn out of the two plugins that need it, so proc.ex is used by
-      # Boru (`vault`) AND Secretspec (`secretspec`); listing its path in
-      # either group would delete a file the other group's plugin calls.
-      # It ships with the feature core instead, alongside http.ex and
-      # httpjson.ex. Stated rather than hidden: a secrets-enabled elixir
-      # SDK carries a `System.cmd("/bin/sh", ...)` source line even with
-      # this group off. The code is unreachable without a plugin that calls
-      # it, and it is an upstream shape issue rather than a local one.
       def: elixir: {
         'Sekreto.Plugins.Secretspec.secretspec': 'lib/projectname/feature/secrets/sekreto/plugins/secretspec.ex'
       }
-      # plugins/Proc.swift is NOT listed here either - see the swift note in
-      # the `vault` group: it is a feature-core file both groups use.
       def: swift: {
         secretspec: 'Sources/ProjectNameSDK/feature/secrets/plugins/Secretspec.swift'
       }
@@ -1154,8 +864,6 @@ main: kit: feature: secrets: {
       def: lean: {
         'Sekreto.secretspec': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Secretspec.lean'
       }
-      # plugins/proc.c is NOT listed here either - see the c note in the
-      # `vault` group: it is a feature-core file both groups use.
       def: c: {
         sek_plugin_secretspec: 'feature/secrets/plugins/secretspec.c'
       }
@@ -1178,27 +886,12 @@ main: kit: feature: secrets: {
       def: ocaml: {
         'Secretspec.plugin': 'feature/secrets/plugins/secretspec.ml'
       }
-      # cpp: see the vault group. plugins/Proc.cpp (`runcmd`) is shared with
-      # Boru and ships with the feature core, not here.
       def: cpp: {
         secretspec: 'feature/secrets/plugins/Secretspec.cpp'
       }
     }
   }
 
-  # rust: the TLS the vendored HTTP helper speaks.
-  #
-  # plugins/httpjson/http.rs opens its own sockets and names rustls
-  # directly, so cargo needs the crates as DIRECT dependencies even though
-  # both are already in the closure of the target's existing `ureq` dep
-  # (rustls 0.23 + webpki-roots 0.26). `default: false` is load-bearing,
-  # not tidiness: rustls with DEFAULT features pulls aws-lc-rs/aws-lc-sys
-  # and a cmake C build, while the ring feature set below is what ureq
-  # already compiles - so a secrets-enabled rust SDK adds no build at all.
-  # Package_rust renders the dependency-TABLE form when either key is set.
-  #
-  # Feature deps are `active: true` by explicit opt-in (collectDeps), so an
-  # SDK that does not select this feature names neither crate.
   deps: rust: {
     'rustls': {
       active: true, version: '0.23', kind: prod
@@ -1208,15 +901,6 @@ main: kit: feature: secrets: {
   }
 
 
-  # Transport role (station design §8.4).
-  #
-  # 'wrap', because the access-token exchange below has to SEE the response:
-  # a spent token is discovered by the API answering 401, and the only place
-  # to notice that and try again is around the transport. It wraps only when
-  # `exchange.active` — with the exchange off this feature never touches the
-  # transport, exactly as when its role was 'none' — but the role is a
-  # DECLARATION of what the feature may do, not a report of what one
-  # configuration does, so it is declared at its widest.
   transport: 'wrap'
 
   config: {
@@ -1230,42 +914,10 @@ main: kit: feature: secrets: {
       # wins — by sekreto's own first-hit rule, not by special-casing.
       providers: []
 
-      # The secret to resolve, for an API whose credential is not
-      # apikey-shaped. The resolved value is written to options.apikey
-      # regardless, because that is where prepareAuth looks.
-      #
-      # A DEFAULT, not a fixed value: the secret's name is a fact about the
-      # project's vault, not about sdkgen. univec resolves `sdk:univec` and so
-      # sets `name: 'univec'` in its project.aon — which a concrete value here
-      # cannot accept, because two concrete scalars conflict rather than yield:
-      #
-      #   Cannot unify values at path $.main.kit.feature.secrets.config.options.name
-      #
-      # That SDK worked only because its copy of this file had been hand-edited
-      # to star this line, and regeneration overwrites generated model files, so
-      # the edit was lost on every regen. An option a project must set has to be
-      # settable.
       name: *'apikey' | string
 
-      # sekreto caches resolved values by default. Off means every
-      # resolve() asks the chain again; redaction still tracks values.
       cache: true
 
-      # ACCESS-TOKEN EXCHANGE (the OAuth2 refresh grant, in miniature).
-      #
-      # Some APIs do not accept a long-lived credential at all: the secret the
-      # chain above resolves is a REFRESH token, which buys a short-lived ACCESS
-      # token from a token endpoint, and that access token is what every request
-      # carries. The access token then expires, and the client is expected to buy
-      # another without human help.
-      #
-      # Off by default, and inert when off: with `exchange.active: false` this
-      # feature behaves exactly as it always did — resolve one secret, write it to
-      # options.apikey. That is what keeps the change additive for every SDK
-      # already using it.
-      #
-      # With it on, set `name` to the refresh secret (`name: 'refresh_token'`),
-      # because `name` is what the chain is asked for.
       exchange: {
         active: false
 
@@ -1282,12 +934,6 @@ main: kit: feature: secrets: {
         request: 'refresh_token'
         response: 'access_token'
 
-        # An explicit refresh token, given in code. It becomes the FIRST
-        # provider in the chain, so it wins by sekreto's own first-hit rule —
-        # the same seat `options.apikey` takes when no exchange is configured.
-        # `options.apikey` cannot serve here: with an exchange configured it
-        # means "an access token I already hold", which is the opposite kind
-        # of credential.
         refresh: ''
 
         # Response statuses that mean "your access token is spent, buy