@voxgig/sdkgen 4.8.2 → 4.9.0

package/project/.sdk/src/cmp/elixir/Package_elixir.ts

@@ -78,7 +78,10 @@ const Package = cmp(async function Package(props: any) {
 
 ${depsBlock}
 
-  defp elixirc_paths(:test), do: ["lib", "test/support"]
+  # test/vendor carries the vendored @voxgig/omni engine the corpus suites
+  # run through; it is a .ex tree, so mix has to be told to compile it, and
+  # only under :test - a consumer's library build never sees the runner.
+  defp elixirc_paths(:test), do: ["lib", "test/support", "test/vendor"]
   defp elixirc_paths(_), do: ["lib"]
 
   defp package do

package/project/.sdk/src/cmp/go/Config_go.ts

@@ -11,6 +11,7 @@ import {
   each,
   configDefinition,
   configReprSetting,
+  goModule,
   isAuthActive,
   isConfigData,
   resolveAuthPrefix,
@@ -75,6 +76,53 @@ const Config = cmp(async function Config(props: any) {
   const { def: configDef, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
+  // PLUGIN DEFINITION IMPORTS AND THE FeaturePlugins MAP (the go peer of
+  // Config_ts's pluginImports/pluginDefs).
+  //
+  // Upstream sekreto replaced its self-registration registry with
+  // voxgig/plugin definitions: a provider kind the caller did not pass in
+  // via `Plugins: [...]` is unknown to that Sekreto. So the config imports
+  // each active plugin's exported Definition BY NAME (the model's
+  // per-target `def` map - `aws.Secrets`, a package-qualified go symbol)
+  // and hands the list to the feature through core.FeaturePlugins.
+  //
+  // Emitted in core (not in the feature package) so the dependency runs
+  // core -> plugins -> sekreto -> plugin with no cycle; the feature reads
+  // it back as []any and type-asserts, so a tree with the feature present
+  // but never selected still compiles.
+  const gomodule = goModule(model, target.name)
+  const pluginPaths = new Set<string>()
+  const featurePlugins: Record<string, string[]> = {}
+
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered (see Config_ts.pluginImports: getting this wrong
+      // emits an import for a package the trim just deleted).
+      if (false === plugin.active || null == plugin.active) return
+      for (const [sym, one] of Object.entries(plugin.def?.go || {})) {
+        // 'feature/secrets/plugins/aws/aws.go' -> its PACKAGE directory.
+        pluginPaths.add(String(one).replace(/\/[^/]+$/, ''))
+        syms.push(sym)
+      }
+    })
+    if (0 < syms.length) {
+      featurePlugins[f.name] = syms.sort()
+    }
+  })
+
+  const pluginImportLines = Array.from(pluginPaths).sort()
+    .map((p: string) => `\t"${gomodule}/${p}"\n`).join('')
+  const pluginImportBlock = '' === pluginImportLines ? '' :
+    '\n' + pluginImportLines
+
+  const featurePluginsBlock =
+    'var featurePlugins = map[string][]any{\n' +
+    Object.keys(featurePlugins).sort().map((fname: string) =>
+      `\t"${fname}": {${featurePlugins[fname].join(', ')}},\n`).join('') +
+    '}\n'
+
   File({ name: 'config.' + target.ext }, () => {
 
     // ABOVE THE THRESHOLD: emit the model as DATA.
@@ -96,7 +144,7 @@ import (
 	"encoding/json"
 	"math"
 	"sync"
-)
+${pluginImportBlock})
 
 // The API model, emitted as data rather than as a composite literal: see
 // sdkgen rung L1. Parsed by MakeConfig, and parsed once by SharedConfig.
@@ -153,7 +201,7 @@ func MakeConfig() map[string]any {
 
 import (
 	"sync"
-)
+${pluginImportBlock})
 
 `)
 
@@ -206,6 +254,15 @@ configDef.entity, 2)},
     }
 
     Content(`
+// The plugin definitions the model selected per feature, as []any so a
+// feature package can consume them without core naming its types. Empty
+// when no active feature declares active plugin groups for this target.
+${featurePluginsBlock}
+// FeaturePlugins is the definitions list for one feature's chain.
+func FeaturePlugins(name string) []any {
+	return featurePlugins[name]
+}
+
 var (
 	sharedConfigOnce sync.Once
 	sharedConfigVal  map[string]any

package/project/.sdk/src/cmp/go/Main_go.ts

@@ -4,7 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
-  entityClassName, entityCollection, goModule, goPackageIdent,
+  entityClassName, entityCollection, goModule, goPackageIdent, pluginExcludes,
   targetFeatures,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
@@ -60,7 +60,13 @@ const Main = cmp(async function Main(props: any) {
   // downstream consumers.
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, /utility\/struct\/go\.mod$/, TEST_CONTROL_EXCLUDE],
+    // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+    // group's declared files stay out of the tree - the model's `path`
+    // entries are target-root-relative, which is this Copy's root). The
+    // FEATURE-level trim for go stays an add-time concern (vendor-tag
+    // rollout, Decision 5).
+    exclude: [/src\//, /utility\/struct\/go\.mod$/, TEST_CONTROL_EXCLUDE,
+      ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
       GOMODULE: gomodule,

package/project/.sdk/src/cmp/java/Test_java.ts

@@ -24,11 +24,12 @@ const Test = cmp(function Test(props: any) {
     // Write-once: a project's edited control file survives regeneration.
     TestControl({ target, dir: 'test' })
 
-    // The shared test infrastructure (RunnerSupport, FeatureHarness,
-    // PipelineTest, FeatureTest, NetsimTest, PrimaryUtilityTest,
-    // CustomUtilityTest, StructRunner/StructCorpusTest, ExistsTest and
-    // sdk-test-control.json) ships as templates in tm/java/test/ and is
-    // copied by Main_java. Here we generate only the API-specific tests.
+    // The shared test infrastructure (RunnerSupport, the vendored omni
+    // runner under test/vendor/omni with its OmniResolver/OmniSmokeTest,
+    // FeatureHarness, PipelineTest, FeatureTest, NetsimTest,
+    // PrimaryUtilityTest, CustomUtilityTest, StructCorpusTest, ExistsTest
+    // and sdk-test-control.json) ships as templates in tm/java/test/ and
+    // is copied by Main_java. Here we generate only the API-specific tests.
     const entity = each(entityCollection(model))
       .filter((e: any) => false !== e.active)
     each(entity, (entity: ModelEntity) => {

package/project/.sdk/src/cmp/kotlin/Test_kotlin.ts

@@ -24,11 +24,12 @@ const Test = cmp(function Test(props: any) {
     // Write-once: a project's edited control file survives regeneration.
     TestControl({ target, dir: 'test' })
 
-    // The shared test infrastructure (RunnerSupport, FeatureHarness,
-    // PipelineTest, FeatureTest, NetsimTest, PrimaryUtilityTest,
-    // CustomUtilityTest, StructRunner/StructCorpusTest, ExistsTest and
-    // sdk-test-control.json) ships as templates in tm/kotlin/test/ and is
-    // copied by Main_kotlin. Here we generate only the API-specific tests.
+    // The shared test infrastructure (RunnerSupport, the vendored omni
+    // runner under test/vendor/omni with its OmniResolver/OmniSmokeTest,
+    // FeatureHarness, PipelineTest, FeatureTest, NetsimTest,
+    // PrimaryUtilityTest, CustomUtilityTest, StructCorpusTest, ExistsTest
+    // and sdk-test-control.json) ships as templates in tm/kotlin/test/ and
+    // is copied by Main_kotlin. Here we generate only the API-specific tests.
     const entity = each(entityCollection(model))
       .filter((e: any) => false !== e.active)
     each(entity, (entity: ModelEntity) => {

package/project/.sdk/src/cmp/lean/Package_lean.ts

@@ -36,6 +36,22 @@ version = "${packageVersion(model, target.name)}"
 defaultTargets = ["SdkClient"]
 
 ${libBlocks}
+# The corpus ENGINE: the vendored @voxgig/omni Lean port, source rather than
+# a dependency. Its own lean_lib so Lake can find the module, and
+# deliberately NOT in defaultTargets: only the test executables import it, so
+# \`lake build\` compiles the shipped library without it and nothing a
+# consumer installs ever names omni. Lake has no test-scoped dependency, so
+# vendoring is what keeps that isolation.
+[[lean_lib]]
+name = "Omni"
+srcDir = "test/vendor/omni"
+
+# The adapter that drives omni's native API with subjects built from this
+# SDK's own utilities. Imported by the corpus suites and the smoke test.
+[[lean_lib]]
+name = "OmniResolver"
+srcDir = "test"
+
 [[lean_exe]]
 name = "runner"
 srcDir = "test"
@@ -55,6 +71,13 @@ root = "TPrimaryUtility"
 name = "feature"
 srcDir = "test"
 root = "TFeature"
+
+# Smoke test for the vendored engine itself: a runner that cannot FAIL a bad
+# entry would turn every corpus suite vacuously green.
+[[lean_exe]]
+name = "omnismoke"
+srcDir = "test"
+root = "OmniSmoke"
 `)
   })
 

package/project/.sdk/src/cmp/lean/ReadmeInstall_lean.ts

@@ -28,6 +28,7 @@ Run the offline struct-corpus test (no server needed) and the live entity
 tests (point them at a server with \`SDK_TEST_BASE\`):
 
 \`\`\`bash
+lake exe omnismoke
 lake exe structcorpus
 SDK_TEST_BASE=http://localhost:8901 lake exe runner
 \`\`\`

package/project/.sdk/src/cmp/lean/ReadmeTopTest_lean.ts

@@ -6,6 +6,7 @@ const ReadmeTopTest = cmp(function ReadmeTopTest(props: any) {
   Content(`\`\`\`bash
 cd ${target.name}
 lake build
+lake exe omnismoke      # the vendored @voxgig/omni corpus engine itself
 lake exe primary        # shared corpus: request-shaping utilities
 lake exe feature        # the feature catalog (retry, cache, rbac, netsim, …)
 lake exe structcorpus   # shared corpus: the vendored struct model

package/project/.sdk/src/cmp/ocaml/Gitignore_ocaml.ts

@@ -18,6 +18,7 @@ const Gitignore = cmp(async function Gitignore(_props: any) {
 *.a
 a.out
 run_sdk_test
+run_omni_smoke
 run_struct_corpus
 run_primary_corpus
 

package/project/.sdk/src/cmp/ocaml/Main_ocaml.ts

@@ -37,11 +37,15 @@ const Main = cmp(async function Main(props: any) {
 
   // Copy tm/ocaml verbatim with ProjectName replacement. The src/ subtree
   // only stages per-feature custom-source dirs (srcfeature: false, so unused),
-  // excluded like the go/rust targets. Stray compiled artifacts are excluded
-  // defensively.
+  // excluded like the go/rust targets. Stray compiled artifacts and built
+  // test binaries are excluded defensively. test/vendor/omni (the vendored
+  // @voxgig/omni corpus engine) rides along verbatim - the replacements are
+  // ProjectName-shaped and the port names nothing project-specific, so it
+  // lands byte-identical to its recorded vendored.json digest.
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, /\.(cmi|cmo|cmx|cma|cmxa|o|a)$/, /a\.out$/, /run_sdk_test$/, /run_struct_corpus$/],
+    exclude: [/src\//, /\.(cmi|cmo|cmx|cma|cmxa|o|a)$/, /a\.out$/,
+      /run_sdk_test$/, /run_omni_smoke$/, /run_struct_corpus$/, /run_primary_corpus$/],
     replace: {
       ...props.ctx$.stdrep,
     }

package/project/.sdk/src/cmp/py/Config_py.ts

@@ -32,6 +32,64 @@ import {
 } from './utility_py'
 
 
+// PLUGIN DEFINITION IMPORTS AND THE FEATURE_PLUGINS MAP (mirrors
+// cmp/ts/Config_ts.ts).
+//
+// Upstream sekreto replaced its self-registration registry with
+// voxgig/plugin definitions: a provider kind the caller did not pass in
+// via `plugins: [...]` is unknown to that Sekreto. So config imports each
+// active plugin's exported definition BY NAME (the model's `def.py` map)
+// and hands the list to the feature through FEATURE_PLUGINS.
+//
+// The `def` map is declared in the model rather than derived from
+// filenames because one module may export several definitions (sekreto's
+// aws.py exports awssecrets AND awsparams). A def value is the module's
+// path under tm/py ('pkg/feature/.../aws.py'); Main copies tm/py/pkg INTO
+// the <name>_sdk package, so the import module is the path with `pkg/`
+// swapped for the package name and slashes for dots.
+function pluginImports(feature: any, pkg: string) {
+  each(feature, (f: any) => {
+    // path -> [symbol, ...], so one import line serves a two-definition
+    // module.
+    const bypath: Record<string, string[]> = {}
+
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object
+      // to arrive filtered: getting it wrong in this direction emits an
+      // import for a module the plugin trim just deleted - an SDK that
+      // does not import, rather than one that merely carries too much.
+      if (false === plugin.active || null == plugin.active) return
+
+      for (const [sym, one] of Object.entries(plugin.def?.py || {})) {
+        const path = String(one)
+        ; (bypath[path] = bypath[path] || []).push(sym)
+      }
+    })
+
+    for (const path of Object.keys(bypath).sort()) {
+      const mod = pkg + '.' +
+        path.replace(/^pkg\//, '').replace(/\.py$/, '').replace(/\//g, '.')
+      Line(`from ${mod} import ${bypath[path].sort().join(', ')}`)
+    }
+  })
+}
+
+// The FEATURE_PLUGINS entries: one line per feature that has any active
+// plugin definitions, listing the imported symbols.
+function pluginDefs(feature: any) {
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      if (false === plugin.active || null == plugin.active) return
+      syms.push(...Object.keys(plugin.def?.py || {}))
+    })
+    if (0 < syms.length) {
+      Line(`    "${f.name}": [${syms.sort().join(', ')}],`)
+    }
+  })
+}
+
+
 const Config = cmp(async function Config(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -76,10 +134,33 @@ const Config = cmp(async function Config(props: any) {
   const { def: configDef, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
+  const pkg = model.const.Name.toLowerCase() + '_sdk'
+
   File({ name: 'config.' + target.ext }, () => {
 
     Content(`# ${model.const.Name} SDK configuration
-${asData ? '\nimport json\n' : ''}
+${asData ? '\nimport json\n' : ''}`)
+
+    pluginImports(feature, pkg)
+
+    // The FEATURE_PLUGINS map is ALWAYS emitted, even empty: the secrets
+    // feature module imports it unconditionally, and (unlike ts) the py
+    // feature source is copied by Main's blanket pkg copy whether or not
+    // the model declares the feature - an import of a missing name would
+    // fail the whole package at collection time.
+    Content(`
+
+# The sekreto plugin DEFINITIONS the model selected per feature, imported
+# above by name from the modules the catalogue's active \`plugin.def\`
+# entries declare. Handed to each feature (secrets builds its Sekreto
+# with them): a provider kind not listed here is unknown to that SDK.
+FEATURE_PLUGINS = {
+`)
+
+    pluginDefs(feature)
+
+    Content(`}
+
 
 _shared_config = None
 

package/project/.sdk/src/cmp/py/Main_py.ts

@@ -5,6 +5,7 @@ import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
   entityClassName, entityCollection,
+  pluginExcludes,
   targetFeatures,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
@@ -39,6 +40,10 @@ const Main = cmp(async function Main(props: any) {
   // helpers/applicability.
   const feature = targetFeatures(model, target)
 
+  // Does the secrets feature apply here and is it switched on? Both, since
+  // targetFeatures already dropped it for a target with no sekreto port.
+  const secrets = null != (feature as any).secrets
+
   // The one package directory everything the SDK owns lives in.
   const pkgdir = model.const.Name.toLowerCase() + '_sdk'
 
@@ -73,6 +78,13 @@ const Main = cmp(async function Main(props: any) {
 
   Copy({
     from: 'tm/' + target.name + '/pkg',
+    // An ACTIVE feature's INACTIVE plugins do not ship. py has no
+    // src/feature layout (srcfeature: false), so this blanket pkg copy is
+    // the one place the generate-time plugin trim can act; the model's
+    // `plugin.<group>.path` entries name their files relative to THIS
+    // copy's root ('feature/secrets/voxgig_sekreto/plugins/<kind>.py').
+    // See helpers/featureSource.pluginExcludes.
+    exclude: [...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }
@@ -87,6 +99,38 @@ const Main = cmp(async function Main(props: any) {
         replace: {
           ...props.ctx$.stdrep,
 
+          // SECRETS. Both slots are emitted only when the secrets feature
+          // applies to this target AND the model activates it - an
+          // unconditional edit would land in every generated SDK, and with
+          // the feature off the marker line is REMOVED, so the inactive
+          // output is byte-identical to pre-migration. `feature` is
+          // already gated by targetFeatures, so a target that does not
+          // provide 'sekreto' never reaches these.
+          //
+          // CUSTOM-REGEX keys, like Entity_py's hook markers: jostraca's
+          // built-in `#Name` tag pattern is hardcoded to `//` comments,
+          // so a bare '#SecretsAccessor' key would silently never match a
+          // python `# #SecretsAccessor` marker line.
+
+          // The LIVE Sekreto, not a clone: sekreto holds provider and
+          // cache state, so a clone would resolve into a copy that
+          // prepare_auth never sees.
+          '/(?<indent>[ \\t]*)#[ \\t]*#SecretsAccessor[ \\t]*\\n?/':
+            ({ indent }: any) => !secrets ? '' :
+              `${indent}def secrets(self):\n` +
+              `${indent}    _s = getattr(self, "_secrets", None)\n` +
+              `${indent}    return None if _s is None else _s.sekreto()\n\n`,
+
+          // prepare() bypasses the feature hook pipeline, so the PreSpec
+          // hook that resolves the secret for entity ops never runs on
+          // this path and the resolve has to be explicit. It RAISES on a
+          // broken provider - prepare() already raises on prepare_auth
+          // errors, so the direct path's error contract is unchanged.
+          '/(?<indent>[ \\t]*)#[ \\t]*#SecretsResolve[ \\t]*\\n?/':
+            ({ indent }: any) => !secrets ? '' :
+              `${indent}if getattr(self, "_secrets", None) is not None:\n` +
+              `${indent}    self._secrets.resolve()\n\n`,
+
           '#BuildFeatures': ({ indent }: any) => {
             each(feature, (feat: any) => {
               const fname = feat.name.charAt(0).toUpperCase() + feat.name.slice(1)

package/project/.sdk/src/cmp/py/fragment/Main.fragment.py

@@ -99,6 +99,7 @@ class ProjectNameSDK:
     def get_root_ctx(self):
         return self._rootctx
 
+    # #SecretsAccessor
     def prepare(self, fetchargs=None):
         utility = self._utility
 
@@ -114,6 +115,7 @@ class ProjectNameSDK:
             "ctrl": ctrl,
         }, self._rootctx)
 
+        # #SecretsResolve
         options = self.options
 
         path = vs.getprop(fetchargs, "path") or ""

package/project/.sdk/src/cmp/swift/Main_swift.ts

@@ -82,6 +82,16 @@ const Main = cmp(async function Main(props: any) {
         ProjectName: model.const.Name,
       }
     })
+
+    // The vendored @voxgig/omni corpus engine. Its path is FIXED (Package
+    // .swift declares an `Omni` target over Tests/vendor/omni, and the port
+    // calls `Omni.errify` by module name), and its files are vendored
+    // verbatim - no ProjectName substitution, which would rewrite an
+    // upstream file.
+    Copy({
+      from: 'tm/' + target.name + '/Tests/vendor',
+      to: 'vendor',
+    })
   })
 
   // Generated sources join the copied runtime under Sources/ProjectNameSDK.

package/project/.sdk/src/cmp/swift/Package_swift.ts

@@ -44,6 +44,15 @@ import type {
 // An entry WITHOUT a `url` is not expressible in a SwiftPM manifest (no
 // registry-less by-name dependencies), so it is skipped - unadorned entries
 // keep today's zero-dependency output.
+//
+// The `Omni` target is the VENDORED corpus test engine (Tests/vendor/omni,
+// @voxgig/omni at the shared tag). It has to be its own MODULE, not files
+// folded into the test target: the port calls `Omni.errify` by module name,
+// and its top-level `clone`/`getpath`/`walk`/`stringify`/`pathify` collide
+// head-on with the struct utility's functions of the same names. It is
+// declared as a .testTarget rather than a .target so `swift build` - a
+// consumer's library build - never compiles the test engine; `swift test`
+// builds it and the suite target depends on it.
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -95,9 +104,12 @@ let package = Package(
         .target(
             name: "${Name}Sdk",${targetdeps}
             path: "Sources/${swiftTargetDir(model)}"),
+        .testTarget(
+            name: "Omni",
+            path: "Tests/vendor/omni"),
         .testTarget(
             name: "${Name}SdkTests",
-            dependencies: ["${Name}Sdk"],
+            dependencies: ["${Name}Sdk", "Omni"],
             path: "Tests/${swiftTestDir(model)}"),
     ]
 )

package/project/.sdk/src/cmp/ts/Config_ts.ts

@@ -110,6 +110,8 @@ const Config = cmp(async function Config(props: any) {
             Line(` ${f.name}: ${nom(f, 'Name')}Feature,`)
           }),
 
+          '// #FeaturePlugins': () => pluginDefs(feature),
+
           // A JS string literal, so the JSON survives verbatim. JSON.stringify
           // escapes the quotes and backslashes the model contains (values like
           // `$STRING` carry backticks, which a template literal could not).
@@ -154,6 +156,8 @@ const Config = cmp(async function Config(props: any) {
           Line(` ${f.name}: ${nom(f, 'Name')}Feature,`)
         }),
 
+        '// #FeaturePlugins': () => pluginDefs(feature),
+
         // Rendered from configDefinition's def, not from f.config, so the
         // literal carries the feature's `transport` role (station design
         // §8.4) beside its options and cannot drift from the data rep.
@@ -183,22 +187,26 @@ const Config = cmp(async function Config(props: any) {
 
 
 
-// PLUGIN REGISTRATION IMPORTS.
+// PLUGIN DEFINITION IMPORTS AND THE FEATURE_PLUGINS MAP.
 //
-// A sekreto provider module registers itself when it is imported, and
-// nothing else imports it: the core surface deliberately does not reach a
-// platform-dependent provider, and the full-set barrel — the file whose
-// job was to reach all of them — is not vendored into an SDK at all.
+// Upstream sekreto replaced its self-registration registry with
+// voxgig/plugin definitions: a provider kind the caller did not pass in
+// via `plugins: [...]` is unknown to that Sekreto. So Config no longer
+// imports provider modules for their side effects — it imports each
+// active plugin's exported Definition BY NAME (the model's `def` map)
+// and hands the list to the feature through FEATURE_PLUGINS.
 //
-// So without these lines an SDK generates `provider/dotenv.ts`, never
-// imports it, and throws `unknown provider kind: dotenv` the first time a
-// chain names it. Emitted here because Config already imports every active
-// feature from the model, and this is the same list one level down.
-//
-// Import for SIDE EFFECT only — `import '...'`, no bindings. The module's
-// top-level `register()` call is the whole point.
+// Emitted here because Config already imports every active feature from
+// the model, and this is the same list one level down. The `def` map is
+// declared in the model rather than derived from filenames because one
+// file may export several definitions (sekreto's aws.ts exports
+// awssecrets AND awsparams).
 function pluginImports(feature: any) {
   each(feature, (f: any) => {
+    // path -> [symbol, ...], so one import line serves a two-definition
+    // module.
+    const bypath: Record<string, string[]> = {}
+
     each(f.plugin, (plugin: any) => {
       // Filter on `active` HERE rather than trusting the feature object to
       // arrive filtered. Whether a model path was read with `only_active`
@@ -207,14 +215,31 @@ function pluginImports(feature: any) {
       // not compile, rather than one that merely carries too much.
       if (false === plugin.active || null == plugin.active) return
 
-      for (const one of (plugin.path || [])) {
+      for (const [sym, one] of Object.entries(plugin.def?.ts || {})) {
         const path = String(one)
-        // Only a provider MODULE registers a kind; a plugin may own other
-        // files (Sigv4.ts is signing support, not a provider).
-        if (!/\/provider\/[^/]+\.ts$/.test(path)) continue
-        Line(`import '${'./' + path.replace(/^src\//, '').replace(/\.ts$/, '')}'`)
+        ; (bypath[path] = bypath[path] || []).push(sym)
       }
     })
+
+    for (const path of Object.keys(bypath).sort()) {
+      const spec = './' + path.replace(/^src\//, '').replace(/\.ts$/, '')
+      Line(`import { ${bypath[path].sort().join(', ')} } from '${spec}'`)
+    }
+  })
+}
+
+// The FEATURE_PLUGINS entries: one line per feature that has any active
+// plugin definitions, listing the imported symbols.
+function pluginDefs(feature: any) {
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      if (false === plugin.active || null == plugin.active) return
+      syms.push(...Object.keys(plugin.def?.ts || {}))
+    })
+    if (0 < syms.length) {
+      Line(` ${f.name}: [${syms.sort().join(', ')}],`)
+    }
   })
 }
 

package/project/.sdk/src/cmp/ts/fragment/Config.data.fragment.ts

@@ -8,6 +8,17 @@ const FEATURE_CLASS: Record<string, typeof BaseFeature> = {
 }
 
 
+// Per-feature plugin DEFINITIONS (voxgig/plugin `Definition` values), from
+// the model's active plugin groups. A feature that takes a `plugins` option
+// (secrets over sekreto) reads its own entry; a feature with no plugins has
+// none. Named imports above make each definition statically reachable, so
+// an SDK carries exactly the plugin modules its model selects — the same
+// leanness the old side-effect registry imports bought, without a registry.
+const FEATURE_PLUGINS: Record<string, any[]> = {
+  // #FeaturePlugins
+}
+
+
 // THE API MODEL, EMBEDDED AS DATA (sdkgen rung L1).
 //
 // The literal form of this file declares the whole model as nested object
@@ -53,5 +64,6 @@ class Config {
 const config: any = Object.assign(new Config(), JSON.parse(CONFIG_DATA))
 
 export {
-  config
+  config,
+  FEATURE_PLUGINS,
 }

package/project/.sdk/src/cmp/ts/fragment/Config.fragment.ts

@@ -8,6 +8,17 @@ const FEATURE_CLASS: Record<string, typeof BaseFeature> = {
 }
 
 
+// Per-feature plugin DEFINITIONS (voxgig/plugin `Definition` values), from
+// the model's active plugin groups. A feature that takes a `plugins` option
+// (secrets over sekreto) reads its own entry; a feature with no plugins has
+// none. Named imports above make each definition statically reachable, so
+// an SDK carries exactly the plugin modules its model selects — the same
+// leanness the old side-effect registry imports bought, without a registry.
+const FEATURE_PLUGINS: Record<string, any[]> = {
+  // #FeaturePlugins
+}
+
+
 class Config {
 
   makeFeature(this: any, fn: string) {
@@ -54,6 +65,7 @@ class Config {
 const config = new Config()
 
 export {
-  config
+  config,
+  FEATURE_PLUGINS,
 }