@voxgig/sdkgen 4.8.3 → 4.10.0

package/project/.sdk/model/target/clojure.aon

@@ -8,6 +8,16 @@ main: kit: target: clojure: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/clojure/feature/secrets/),
+  # so a feature that resolves secrets through sekreto can apply here.
+  #
+  # That container is ALSO a classpath root: Clojure resolves
+  # `(require 'voxgig.sekreto.chain)` to voxgig/sekreto/chain.clj searched
+  # from each :paths entry, never by relative import, so Package_clojure
+  # adds `feature/secrets` to :paths whenever this feature is active.
+  provides: { sekreto: true }
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/csharp.aon

@@ -7,6 +7,11 @@ main: kit: target: csharp: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/csharp/feature/secrets/),
+  # so a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct corpus engine. Runner.cs (class
   # TestRunner) is support-only and RETAINED, name unchanged so emitted

package/project/.sdk/model/target/elixir.aon

@@ -8,6 +8,12 @@ main: kit: target: elixir: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container
+  # (tm/elixir/lib/projectname/feature/secrets/), so a feature that resolves
+  # secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written corpus engine, replaced by the
   # vendored @voxgig/omni runner under test/vendor/omni driven through

package/project/.sdk/model/target/java.aon

@@ -7,6 +7,11 @@ main: kit: target: java: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/java/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner class
   # (test/RunnerSupport.java is support-only and RETAINED, name unchanged

package/project/.sdk/model/target/js.aon

@@ -7,6 +7,11 @@ main: kit: target: js: {
   module: name: '$$name$$'
   base: 'BASE'
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container, so a feature that resolves
+  # secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the single fused runner. `doctor` reports
   # leftovers; `doctor prune` deletes them.

package/project/.sdk/model/target/kotlin.aon

@@ -7,6 +7,13 @@ main: kit: target: kotlin: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md): this target's feature
+  # container carries a vendored sekreto port, so the `secrets` feature —
+  # whose `needs` is exactly this tag — applies here. Without it
+  # featureApplies() refuses the feature and Config emits neither the
+  # import nor the registry entry.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner class
   # (test/RunnerSupport.kt is support-only and RETAINED, name unchanged

package/project/.sdk/model/target/perl.aon

@@ -8,6 +8,11 @@ main: kit: target: perl: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/perl/feature/secrets/),
+  # so a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (t/runner.pm is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/php.aon

@@ -8,6 +8,11 @@ main: kit: target: php: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/php/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/Runner.php is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/rb.aon

@@ -8,6 +8,11 @@ main: kit: target: rb: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/rb/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/runner.rb is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/rust.aon

@@ -8,6 +8,11 @@ main: kit: target: rust: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/rust/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written struct corpus runner, superseded
   # by the vendored @voxgig/omni engine driven through

package/project/.sdk/model/target/scala.aon

@@ -7,6 +7,11 @@ main: kit: target: scala: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container, so a feature that resolves
+  # secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Retired by the move to the vendored @voxgig/omni corpus runner
   # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so
   # rather than leaving the key off.
@@ -72,8 +77,39 @@ main: kit: target: scala: publish: {
 
 # Feature source is NOT trimmed to the model's selection here: the cross-
 # feature tests live inside sdktest/SdkTestMain.scala, the single test
-# entry point, so they cannot be dropped without losing every other test
-# too. Trimming stays off until that suite is split per feature.
+# entry point, and that file constructs fifteen feature classes BY NAME
+# (NetsimFeature, RetryFeature, TimeoutFeature, RatelimitFeature,
+# CacheFeature, ...), so a trim that dropped an unselected feature's source
+# would stop the whole suite compiling. Every other target that trims has a
+# `fullset` file to drop with it (java's test/FeatureTest.java, go's
+# test/feature_test.go); scala's equivalent is fused into SdkTestMain, so
+# `fullset: ['sdktest/SdkTestMain.scala']` would take 137 runtime assertions
+# with it. Trimming stays off until that suite is split per feature.
+#
+# WHAT THAT COSTS, stated rather than left to be discovered. Every feature's
+# source ships to every scala SDK whatever the model selected, and the
+# secrets feature is by far the largest: measured on a feature-OFF SDK it
+# adds 26 files / 6,443 lines - SecretsFeature.scala, the vendored sekreto
+# core (6 files) and voxgig/plugin core (16), and the two UNGROUPED plugin
+# files. Those two are the ones with teeth: plugins/Sigv4.scala links
+# javax.crypto for AWS HMAC-SHA256 request signing, and
+# plugins/Httpjson.scala carries both the shared HTTP client and `runcmd`,
+# a ProcessBuilder child-process launcher. Neither can join a plugin group -
+# four and eight provider kinds respectively compile against them, so any
+# group owning them would let another group's trim delete them (which is
+# exactly how Sigv4.scala broke the saas and cloud groups once).
+#
+# The NINE provider clients ARE trimmed, in both directions: Main_scala
+# applies pluginExcludes for an active feature's inactive groups, and every
+# declared group of a feature that is itself off - so a secrets-off SDK
+# carries no vault, cloud, saas, aws or secretspec client. Both ends are
+# pinned, in ts/test/generate.test.ts and in the generated suite itself
+# (SecretsTestMain's vocabulary case reads the compiled module set).
+#
+# Flipping trim on is therefore a THREE-part change, not a one-line one:
+# split the feature tests out of SdkTestMain.scala into a `fullset` file,
+# stop the Makefile naming a per-feature suite that may not have shipped,
+# and re-measure. It is deliberately not part of the secrets work.
 main: kit: target: scala: feature: {
   trim: false
 }

package/project/.sdk/model/target/swift.aon

@@ -7,6 +7,16 @@ main: kit: target: swift: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container
+  # (tm/swift/Sources/ProjectNameSDK/feature/secrets/{plugin,sekreto,plugins}),
+  # so a feature that resolves secrets through sekreto can apply here. The
+  # three vendored trees are SEPARATE SwiftPM modules (VoxgigPlugin, Sekreto,
+  # SekretoPlugins - upstream's own module boundary, and load-bearing: the
+  # SDK, plugin and sekreto each declare a `Value`, a `Point` or a `Json`),
+  # which Package_swift declares only when the feature is active.
+  provides: { sekreto: true }
+
   # Retired by the move to the vendored @voxgig/omni corpus runner
   # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so
   # rather than leaving the key off.

package/project/.sdk/model/target/zig.aon

@@ -8,6 +8,15 @@ main: kit: target: zig: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the hand-written struct runner, whose engine half
+  # AND assertion half are now the vendored omni port driven through
+  # test/omniresolver.zig. `doctor` reports leftovers; `doctor prune`
+  # deletes them.
+  superseded: [
+    'test/struct_runner.zig'
+  ]
+
   # The vendored voxgig struct port is in-tree (utility/voxgigstruct) — Zig
   # has no package registry to depend on, so there are no external deps.
   deps: &: {

package/project/.sdk/src/cmp/clojure/Config_clojure.ts

@@ -25,6 +25,12 @@ import {
 } from './utility_clojure'
 
 
+import {
+  extraFeatures,
+  pluginRequires,
+} from './featureextra_clojure'
+
+
 // sdk/config.clj: make-config builds the embedded API model as a vendored
 // struct value node (LinkedHashMap/ArrayList) via vs/jm and vs/jt. The whole
 // config is assembled as a JSON-shaped object and rendered once through
@@ -45,6 +51,47 @@ const Config = cmp(async function Config(props: any) {
   const { def: config, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
+  // THE FEATURE WIRING (the clojure peer of Config_go's pluginImports /
+  // FeaturePlugins, and of Config_ts's pluginDefs).
+  //
+  // Two maps, both always emitted so sdk.features can name them without
+  // knowing whether this SDK selected anything:
+  //
+  //   feature-plugins  the voxgig/plugin DEFINITIONS the model's plugin
+  //                    groups selected, per feature. Upstream sekreto's
+  //                    contract since the registry was retired is that a
+  //                    provider kind not passed in is unknown to that
+  //                    Sekreto - so this map IS the SDK's provider
+  //                    vocabulary, and an inactive group leaves neither a
+  //                    require nor a reference behind.
+  //
+  //   feature-extra    the constructor for each feature whose source lives
+  //                    outside src/sdk/features.clj. make-feature consults
+  //                    it rather than requiring the container directly,
+  //                    which is what keeps the ~35 vendored namespaces out
+  //                    of every clojure SDK's load graph.
+  //
+  // Emitted HERE (not in the feature container) so the load order is
+  // core -> feature/secrets -> config -> features -> client, with no cycle.
+  const extra = extraFeatures(model, target)
+  const { requires: plugreq, plugins: featplugins } = pluginRequires(model, target)
+
+  const wireRequires =
+    plugreq.map((r: any) => `\n            [${r.ns} :as ${r.alias}]`).join('') +
+    extra.map((f: any) => `\n            [${f.ns} :as fx-${f.name}]`).join('')
+
+  const wireBlock = `
+(def feature-plugins
+  {${Object.keys(featplugins).sort()
+      .map((fname: string) =>
+        `"${fname}" [${featplugins[fname].join(' ')}]`).join('\n   ')}})
+
+(def feature-extra
+  {${extra.map((f: any) =>
+        `"${f.name}" (fn [] (${f.ns}/${f.ctor} (get feature-plugins "${f.name}")))`)
+      .join('\n   ')}})
+`
+
   File({ name: 'config.clj' }, () => {
 
     // ABOVE THE THRESHOLD: emit the model as DATA.
@@ -65,24 +112,24 @@ const Config = cmp(async function Config(props: any) {
 ;; threshold, or when main.kit.config.repr pins it: for a small model the
 ;; literal is smaller and far easier to read when debugging.
 (ns sdk.config
-  (:require [sdk.core :as core]))
+  (:require [sdk.core :as core]${wireRequires}))
 
 (def ^:private config-data
   (str ${cljStringChunks(configJson).map((c: string) => JSON.stringify(c)).join('\n       ')}))
 
 (defn make-config []
   (core/json-parse config-data))
-`)
+${wireBlock}`)
       return
     }
 
     Content(`;; ${model.const.Name} SDK configuration (generated by @voxgig/sdkgen).
 (ns sdk.config
-  (:require [voxgig.struct :as vs]))
+  (:require [voxgig.struct :as vs]${wireRequires}))
 
 (defn make-config []
   ${formatCljValue(config, 1)})
-`)
+${wireBlock}`)
   })
 })
 

package/project/.sdk/src/cmp/clojure/Main_clojure.ts

@@ -2,6 +2,7 @@
 import {
   cmp, each,
   File, Content, Copy, Folder,
+  pluginExcludes,
 } from '@voxgig/sdkgen'
 
 
@@ -16,12 +17,21 @@ import {
 } from '@voxgig/apidef'
 
 
+import { extraFeatures } from './featureextra_clojure'
 import { Package } from './Package_clojure'
 import { Config } from './Config_clojure'
 import { Gitignore } from './Gitignore_clojure'
 import { MainEntity } from './MainEntity_clojure'
 
 
+// Features that ship a top-level `feature/<name>/` container in
+// tm/clojure. Listed rather than discovered: a component cannot walk the
+// template tree, and the list is short and changes with the templates it
+// describes. Anything named here is EXCLUDED from the verbatim copy unless
+// the model selects it (see the Copy below).
+const CONTAINED = ['secrets']
+
+
 const Main = cmp(async function Main(props: any) {
 
   const { target } = props
@@ -36,9 +46,41 @@ const Main = cmp(async function Main(props: any) {
   // Copy tm/clojure verbatim (runtime under src/, the test suite under test/,
   // Makefile/LICENSE/VERSION). The feature-add scaffolding under src/feature
   // is excluded — the clojure target does not use per-feature custom source.
+  //
+  // THE TOP-LEVEL feature/ CONTAINER IS GATED HERE, at generate time.
+  //
+  // clojure declares `feature: trim: false` (model/target/clojure.aon)
+  // because every ordinary feature lives in the single generated module
+  // src/sdk/features.clj, so `target add` copies the whole template tree.
+  // That was harmless while nothing per-feature existed. It stopped being
+  // harmless with `secrets`: its container holds a vendored
+  // @voxgig/sekreto port and the voxgig/plugin runtime, and an SDK that
+  // never asked for secrets would otherwise ship ~35 files of key-store,
+  // request-signing and child-process code. So the container is excluded
+  // unless the model SELECTS the feature — the top-level-container peer of
+  // the `srcFeatureExcludes` gate ts and js apply to src/feature/<name>/.
+  //
+  // pluginExcludes: one level deeper, the generate-time plugin trim. An
+  // INACTIVE plugin group's declared files stay out of the tree; the
+  // model's `path` entries are target-root-relative, which is this Copy's
+  // root. It runs independently of `feature.trim`, so the group trim works
+  // while that decision stands.
+  //
+  // The gated feature's own TEST suite goes with it, and is named
+  // separately: it lives at test/sdk/test/feature/<name>.clj (a file, so
+  // the container pattern's trailing slash does not reach it) because
+  // Clojure resolves `sdk.test.feature.<name>` to that exact path.
+  const featureGate = extraFeatures(model, target).map((f: any) => f.name)
+  const containerExcludes = CONTAINED
+    .filter((name: string) => !featureGate.includes(name))
+    .flatMap((name: string) => [
+      new RegExp('(^|/)feature/' + name + '/'),
+      new RegExp('(^|/)test/sdk/test/feature/' + name + '\\.clj$'),
+    ])
+
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\/feature\//],
+    exclude: [/src\/feature\//, ...containerExcludes, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }

package/project/.sdk/src/cmp/clojure/Package_clojure.ts

@@ -11,6 +11,11 @@ import type {
 } from '@voxgig/apidef'
 
 
+import {
+  extraFeatures,
+} from './featureextra_clojure'
+
+
 // deps.edn — the tools.deps manifest. The vendored voxgig struct port needs no
 // external dependency; the library itself only needs org.clojure/clojure. The
 // tools.deps shim used to run the tests supports `-M:alias` reading :paths /
@@ -23,13 +28,24 @@ import type {
 // the classpath. Rooting it at `test` instead would demand the namespace
 // `vendor.omni.voxgig.omni.runner`, which the vendored file cannot carry -
 // it is read-only, resynced from upstream.
+//
+// A feature whose source ships as its own tree - `secrets`, which vendors
+// a whole @voxgig/sekreto port - needs the SAME treatment for the SAME
+// reason: the vendored files declare `voxgig.sekreto.chain`, so they
+// resolve only when the directory holding `voxgig/` is on the classpath.
+// So `feature/<name>` joins :paths, and only when the model selects that
+// feature: an SDK that did not ask for secrets gets the deps.edn it always
+// had, naming no directory that is not there.
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
+  const target = props.target
   const model: Model = ctx$.model
 
+  const roots = ['src', ...extraFeatures(model, target).map((f: any) => f.path)]
+
   File({ name: 'deps.edn' }, () => {
     Content(`;; ${model.const.Name} SDK for Clojure (generated by @voxgig/sdkgen).
-{:paths ["src"]
+{:paths [${roots.map((r: string) => JSON.stringify(r)).join(' ')}]
  :deps {org.clojure/clojure {:mvn/version "1.12.5"}}
  :aliases
  {:test

package/project/.sdk/src/cmp/clojure/featureextra_clojure.ts

@@ -0,0 +1,130 @@
+
+import {
+  targetFeatures,
+} from '@voxgig/sdkgen'
+
+
+import {
+  KIT,
+  Model,
+  getModelPath,
+} from '@voxgig/apidef'
+
+
+// FEATURES WHOSE CLOJURE SOURCE LIVES OUTSIDE src/sdk/features.clj.
+//
+// Every ordinary feature is one arm of the hand-written `make-feature`
+// factory in that single module. A feature that vendors a LIBRARY cannot
+// be: `secrets` carries a whole @voxgig/sekreto port, and that port has to
+// be droppable for a project that did not ask for it. So its
+// implementation lives in the gated feature container instead
+// (`feature/secrets/sdk/feature/secrets.clj`, namespace
+// `sdk.feature.secrets`) and the generated config wires it in.
+//
+// The container is ALSO a classpath root. Clojure resolves
+// `(require 'voxgig.sekreto.chain)` to `voxgig/sekreto/chain.clj` searched
+// from each `:paths` entry - never by relative import - so the directory
+// holding `voxgig/` must itself be on the classpath. Package_clojure adds
+// `feature/<name>` to `:paths` for exactly the entries below that are
+// active. (`test/vendor/omni` is the same rule, already in that file.)
+//
+// A map rather than a convention because both halves are decisions:
+// WHICH namespace the container publishes, and WHAT the constructor is
+// called. A new one is added here, and nowhere else.
+const EXTRA: Record<string, { ns: string, ctor: string }> = {
+  secrets: { ns: 'sdk.feature.secrets', ctor: 'secrets-feature' },
+}
+
+
+type ExtraFeature = {
+  // Feature name, as the model and make-feature spell it.
+  name: string
+  // The namespace the feature container publishes.
+  ns: string
+  // The constructor var in it, taking the feature's plugin definitions.
+  ctor: string
+  // The classpath root the container needs (target-root-relative).
+  path: string
+}
+
+
+// The extra features this model actually selects, applicability included.
+// Sorted, so the emitted requires and maps are byte-stable.
+function extraFeatures(model: Model, target: any): ExtraFeature[] {
+  const active = targetFeatures(model, target)
+
+  return Object.keys(EXTRA).sort()
+    .filter((name: string) => null != active[name])
+    .map((name: string) => ({
+      name,
+      ns: EXTRA[name].ns,
+      ctor: EXTRA[name].ctor,
+      path: 'feature/' + name,
+    }))
+}
+
+
+// The plugin DEFINITIONS the model selected, per feature.
+//
+// `def.clojure` keys are FULLY-QUALIFIED vars
+// (`voxgig.sekreto.plugins.aws/awssecrets`); the namespace is the part
+// before the `/`, and one namespace may export several definitions (aws
+// exports two). Emitted as `(:require [<ns> :as p-<tail>])` plus
+// `p-<tail>/<var>` references, so an INACTIVE group leaves no require and
+// no reference - which is what makes the generate-time file trim safe.
+//
+// `only_active: false` is NOT used here, deliberately: this reads the
+// ACTIVE plugins, because these become references to files that must
+// exist. The trim (pluginExcludes, in Main_clojure) reads the unfiltered
+// map instead. Getting that backwards emits a require for a namespace the
+// trim just deleted.
+function pluginRequires(model: Model, target: any): {
+  requires: { ns: string, alias: string }[],
+  plugins: Record<string, string[]>,
+} {
+  const feature = targetFeatures(model, target)
+
+  const aliases: Record<string, string> = {}
+  const plugins: Record<string, string[]> = {}
+
+  for (const fname of Object.keys(feature).sort()) {
+    const syms: string[] = []
+
+    const pmap = getModelPath(model,
+      `main.${KIT}.feature.${fname}.plugin`, { required: false }) || {}
+
+    for (const pname of Object.keys(pmap).sort()) {
+      const plugin = pmap[pname]
+      if (false === plugin?.active || null == plugin?.active) continue
+
+      for (const sym of Object.keys(plugin.def?.clojure || {}).sort()) {
+        const cut = String(sym).lastIndexOf('/')
+        if (0 > cut) continue
+        const ns = String(sym).slice(0, cut)
+        const varname = String(sym).slice(cut + 1)
+        const alias = 'p-' + ns.split('.').pop()
+        aliases[ns] = alias
+        syms.push(alias + '/' + varname)
+      }
+    }
+
+    if (0 < syms.length) {
+      plugins[fname] = Array.from(new Set(syms)).sort()
+    }
+  }
+
+  const requires = Object.keys(aliases).sort()
+    .map((ns: string) => ({ ns, alias: aliases[ns] }))
+
+  return { requires, plugins }
+}
+
+
+export type {
+  ExtraFeature,
+}
+
+export {
+  extraFeatures,
+  pluginRequires,
+}

package/project/.sdk/src/cmp/csharp/Config_csharp.ts

@@ -52,6 +52,49 @@ const Config = cmp(async function Config(props: any) {
   const { def: configDef, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
+  // THE FEATURE PLUGIN MAP (the csharp peer of Config_go's featurePlugins).
+  //
+  // Upstream sekreto replaced its self-registration registry with
+  // voxgig/plugin definitions: a provider kind the caller did not pass in
+  // via `Plugins: [...]` is unknown to that Sekreto. So the config names
+  // each active plugin's exported Definition (the model's per-target `def`
+  // map - `AwsPlugins.Secrets`, a C# static field) and hands the list to
+  // the feature through SdkConfig.FeaturePlugins.
+  //
+  // FULLY QUALIFIED with `global::`, which is what makes an inactive model
+  // cost nothing: no `using` is emitted, so a config for a project with no
+  // plugin groups names no sekreto type at all and the generated file is
+  // byte-identical to one from a tree that has never heard of the feature.
+  const featurePlugins: Record<string, string[]> = {}
+
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered (see Config_go: getting this wrong emits a
+      // reference to a file the plugin trim has just deleted, and the SDK
+      // does not compile).
+      if (false === plugin.active || null == plugin.active) return
+      for (const sym of Object.keys(plugin.def?.csharp || {})) {
+        syms.push(sym)
+      }
+    })
+    if (0 < syms.length) {
+      featurePlugins[f.name] = syms.sort()
+    }
+  })
+
+  const featurePluginCases = Object.keys(featurePlugins).sort()
+    .map((fname: string) =>
+      `            case ${JSON.stringify(fname)}:
+                return new List<object?>
+                {
+` + featurePlugins[fname]
+        .map((sym: string) => `                    global::Voxgig.Sekreto.Plugins.${sym},
+`).join('') +
+      `                };
+`).join('')
+
   File({ name: 'Config.' + target.ext }, () => {
 
     Content(`// ${model.const.Name} SDK - generated model configuration and feature
@@ -186,6 +229,33 @@ public static class SdkConfig
     }
 `)
 
+    // ALWAYS EMITTED, even with no case at all - the same rule Config_py
+    // states for FEATURE_PLUGINS, and for the same reason. csharp's feature
+    // source is copied by Main's blanket `tm/<target>` copy whether or not
+    // the model declares the feature (only `target add` trims it, and only
+    // for a project that runs it), so SecretsFeature.cs can be present in a
+    // tree whose model has secrets switched off. Emitting this
+    // conditionally was tried and it breaks exactly there: `error CS0117:
+    // 'SdkConfig' does not contain a definition for 'FeaturePlugins'`,
+    // which takes the whole assembly down rather than leaving one unused
+    // class behind.
+    //
+    // The cost of always emitting is five inert lines and NO type
+    // reference: the return is List<object?>, so a Config.cs for a project
+    // with no plugin groups names nothing from the vendored trees and needs
+    // no `using`. The feature reads the list back and type-tests, which is
+    // go's shape too.
+    Content(`
+    public static List<object?> FeaturePlugins(string name)
+    {
+        switch (name)
+        {
+${featurePluginCases}            default:
+                return new List<object?>();
+        }
+    }
+`)
+
     Content(`
     public static Feature.BaseFeature MakeFeature(string name)
     {

package/project/.sdk/src/cmp/csharp/Main_csharp.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Content, Copy, Folder, Fragment,
+  pluginExcludes,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
 
@@ -41,9 +42,16 @@ const Main = cmp(async function Main(props: any) {
 
   // Copy tm/csharp files with replacements. `src/` holds only the
   // per-feature extension folders (not shipped into the SDK output).
+  //
+  // pluginExcludes: the generate-time plugin trim (a DECLARED-but-INACTIVE
+  // plugin group's files are never copied). Without it every group's files
+  // ship regardless of the model, and an SDK whose chain is [dotenv, env]
+  // carries AWS request signing and seven HTTP vault clients - the whole
+  // point of the trim. Feature-level trimming happens at `target add`
+  // time; this is the per-plugin cut inside a feature that IS selected.
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }