npm - @voxgig/sdkgen - Versions diffs - 4.9.0 → 4.10.0 - Mend

@voxgig/sdkgen 4.9.0 → 4.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (887) hide show

package/project/.sdk/model/feature/secrets.aon CHANGED Viewed

@@ -65,6 +65,39 @@ main: kit: feature: secrets: {
     #
     # plugins/httpjson.ts is likewise in no group: it is the shared HTTP
     # helper eight plugins import, so it ships with the feature core.
+    #
+    # php has a SECOND such file: plugins/runcmd.php, the child-process
+    # helper that boru.php (`vault`) and secretspec.php (`secretspec`)
+    # both require. It spans two groups, so no group may own it - trimming
+    # either one would delete a file the other group's plugin requires.
+    #
+    # java has THREE such files, and the third is the surprising one.
+    # plugins/Httpjson.java is the shared HTTP helper (eight plugins
+    # import it) and plugins/Proc.java the child-process helper Boru
+    # (`vault`) and Secretspec (`secretspec`) both use - the php story,
+    # one language over. plugins/Sigv4.java is NOT aws-only in this port:
+    # its package-private `uriescape` is also called by Doppler and
+    # Infisical and Onepassword (`saas`) and by Azuresecrets (`cloud`), so
+    # listing it under `aws` would let a saas-only trim delete a file
+    # three other kinds compile against - and javac, which does no
+    # dead-code elimination, fails the whole build on it. All three ship
+    # with the java feature core and belong to NO group. The cost is real
+    # and stated rather than hidden: a secrets-enabled java SDK links
+    # HMAC-SHA256 and a ProcessBuilder call even with no group active.
+    #
+    # scala repeats the java Sigv4 story exactly, and it was got WRONG
+    # first: plugins/Sigv4.scala was listed under `aws`, and its
+    # `private[plugins] def uriescape` is called by Doppler, Infisical and
+    # Onepassword (`saas`) and by Azuresecrets (`cloud`). A saas-only trim
+    # then deleted it and scalac failed the SDK with four "Not found:
+    # uriescape"; a cloud-only trim, with two. It ships with the scala
+    # feature core and belongs to NO group. plugins/Httpjson.scala is the
+    # other ungrouped scala file, and it is BOTH helpers in one: `fetchjson`
+    # (eight plugins) and `runcmd`, the ProcessBuilder helper Boru (`vault`)
+    # and Secretspec (`secretspec`) share, which is why scala needs two
+    # ungrouped files where java needs three. Those two are the whole set:
+    # every `private[plugins]` symbol crossing a file boundary is defined in
+    # Httpjson.scala or Sigv4.scala, and nothing else is shared.
     vault: {
       title: 'HashiCorp Vault and boru'
@@ -74,8 +107,36 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/boru.ts'
         'feature/secrets/plugins/hashicorp/hashicorp.go'
         'feature/secrets/plugins/boru/boru.go'
+        'feature/secrets/plugins/hashicorp.rs'
+        'feature/secrets/plugins/boru.rs'
         'feature/secrets/voxgig_sekreto/plugins/hashicorp.py'
         'feature/secrets/voxgig_sekreto/plugins/boru.py'
+        'src/feature/secrets/sekreto/plugins/hashicorp.js'
+        'src/feature/secrets/sekreto/plugins/boru.js'
+        'feature/secrets/voxgig_sekreto/plugins/hashicorp.rb'
+        'feature/secrets/voxgig_sekreto/plugins/boru.rb'
+        'feature/secrets/sekreto/plugins/hashicorp.php'
+        'feature/secrets/sekreto/plugins/boru.php'
+        'feature/secrets/plugins/Hashicorp.cs'
+        'feature/secrets/plugins/Boru.cs'
+        'feature/secrets/sekreto/plugins/Hashicorp.java'
+        'feature/secrets/sekreto/plugins/Boru.java'
+        'feature/secrets/sekreto/plugins/Hashicorp.scala'
+        'feature/secrets/sekreto/plugins/Boru.scala'
+        'feature/secrets/sekreto/plugins/Hashicorp.kt'
+        'feature/secrets/sekreto/plugins/Boru.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Hashicorp.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Boru.pm'
+        'lib/feature/secrets/sekreto/plugins/hashicorp.dart'
+        'lib/feature/secrets/sekreto/plugins/boru.dart'
+        'feature/secrets/sekreto/plugins/hashicorp.ex'
+        'feature/secrets/sekreto/plugins/boru.ex'
+        'feature/secrets/voxgig/sekreto/plugins/hashicorp.clj'
+        'feature/secrets/voxgig/sekreto/plugins/boru.clj'
+        'feature/secrets/plugins/Hashicorp.swift'
+        'feature/secrets/plugins/Boru.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Hashicorp.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Boru.lean'
       ]
       def: ts: {
         hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.ts'
@@ -87,6 +148,14 @@ main: kit: feature: secrets: {
         'hashicorp.Plugin': 'feature/secrets/plugins/hashicorp/hashicorp.go'
         'boru.Plugin': 'feature/secrets/plugins/boru/boru.go'
       }
+      # rust: module-qualified `pub fn` paths under
+      # feature/secrets/plugins/ (Main_rust emits the plugins.rs module
+      # index from these, one `pub mod` per owning file). The path is
+      # target-root-relative, as go's is.
+      def: rust: {
+        'hashicorp::plugin': 'feature/secrets/plugins/hashicorp.rs'
+        'boru::plugin': 'feature/secrets/plugins/boru.rs'
+      }
       # py: module paths relative to the SDK package root (Main_py copies
       # tm/py/pkg INTO <name>_sdk/, so the trim patterns drop the leading
       # pkg/ while Config_py derives the import module from it).
@@ -94,6 +163,140 @@ main: kit: feature: secrets: {
         hashicorp: 'pkg/feature/secrets/voxgig_sekreto/plugins/hashicorp.py'
         boru: 'pkg/feature/secrets/voxgig_sekreto/plugins/boru.py'
       }
+      # rb: constant names under VoxgigSekreto::Plugins, and the module
+      # path under tm/rb that config.rb turns into a require_relative
+      # (target-root-relative, as go's are).
+      def: rb: {
+        'VoxgigSekreto::Plugins::HASHICORP': 'feature/secrets/voxgig_sekreto/plugins/hashicorp.rb'
+        'VoxgigSekreto::Plugins::BORU': 'feature/secrets/voxgig_sekreto/plugins/boru.rb'
+      }
+      # js: the same symbol set as ts, CommonJS module paths (Config_js
+      # strips the leading src/ and the .js extension to build a require).
+      def: js: {
+        hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.js'
+        boru: 'src/feature/secrets/sekreto/plugins/boru.js'
+      }
+      # php: the plugin FUNCTION each file exports (a definition holds
+      # closures, so php cannot name it with a constant), and the module
+      # path under tm/php - this target's root, which is also config.php's
+      # own directory, so the emitted require_once is that path verbatim.
+      def: php: {
+        hashicorp: 'feature/secrets/sekreto/plugins/hashicorp.php'
+        boru: 'feature/secrets/sekreto/plugins/boru.php'
+      }
+      # csharp: the static class and Definition FIELD each file exports,
+      # under namespace Voxgig.Sekreto.Plugins (Config_csharp emits the
+      # symbol `global::`-qualified, so an inactive group leaves no
+      # reference and no dangling using). The path is target-root-relative,
+      # as go's is.
+      def: csharp: {
+        'Hashicorp.Plugin': 'feature/secrets/plugins/Hashicorp.cs'
+        'Boru.Plugin': 'feature/secrets/plugins/Boru.cs'
+      }
+      # java: class-qualified Definition symbols (one class per kind),
+      # and the file path under tm/java - this target's root, which is
+      # also Main_java's Copy root, so the emitted exclude matches it.
+      def: java: {
+        'Hashicorp.PLUGIN': 'feature/secrets/sekreto/plugins/Hashicorp.java'
+        'Boru.PLUGIN': 'feature/secrets/sekreto/plugins/Boru.java'
+      }
+      # scala: fully-qualified top-level `val`s (the scala port makes each
+      # plugin a package-level Definition), so Config_scala names them
+      # without an import. The path is target-root-relative, as go's is.
+      def: scala: {
+        'com.voxgig.sekreto.plugins.hashicorp': 'feature/secrets/sekreto/plugins/Hashicorp.scala'
+        'com.voxgig.sekreto.plugins.boru': 'feature/secrets/sekreto/plugins/Boru.scala'
+      }
+      # kotlin: PLAIN TOP-LEVEL VALS (`val hashicorp: Definition = ...`),
+      # imported by simple name - so ts-shaped keys, not java's
+      # class-qualified ones. The path is target-root-relative, as go's is,
+      # because Main_kotlin's Copy is rooted at tm/kotlin.
+      def: kotlin: {
+        hashicorp: 'feature/secrets/sekreto/plugins/Hashicorp.kt'
+        boru: 'feature/secrets/sekreto/plugins/Boru.kt'
+      }
+      # perl: the bare sub each module exports (`@EXPORT_OK`), and the
+      # module file under tm/perl - this target's root, which is also
+      # Main_perl's Copy root, so the emitted exclude matches it. The
+      # vendored tree keeps upstream's PACKAGE layout because perl
+      # resolves by @INC, hence the Voxgig/Sekreto/Plugins/ depth.
+      #
+      # plugins/Proc.pm does NOT go with Boru: perl has a SECOND shared
+      # helper (php's runcmd story, one language over). Proc.pm is used by
+      # Boru (`vault`) AND Secretspec (`secretspec`), so it ships with the
+      # feature core alongside Httpjson.pm and belongs to NO group -
+      # listing it here would let a secretspec-only trim delete a file
+      # Boru's `use` line needs, which is a load failure, not a degraded
+      # chain.
+      def: perl: {
+        hashicorp: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Hashicorp.pm'
+        boru: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Boru.pm'
+      }
+      # dart: PLAIN TOP-LEVEL FINALS (`final Definition hashicorp = ...`),
+      # imported by simple name with a `show` clause - so ts-shaped keys.
+      # The path is target-root-relative, as go's is, because Main_dart's
+      # Copy is rooted at tm/dart; `lib/` is part of it because dart's
+      # feature container is lib/feature/<name>/, not a src/ tree.
+      def: dart: {
+        hashicorp: 'lib/feature/secrets/sekreto/plugins/hashicorp.dart'
+        boru: 'lib/feature/secrets/sekreto/plugins/boru.dart'
+      }
+      # clojure: FULLY-QUALIFIED VARS (`voxgig.sekreto.plugins.hashicorp/hashicorp`)
+      # - the clojure spelling of go's package-qualified symbol.
+      # Config_clojure derives the `:require` namespace from the part before
+      # the `/`. The path is target-root-relative, as go's is, because
+      # Main_clojure's Copy is rooted at tm/clojure.
+      def: clojure: {
+        'voxgig.sekreto.plugins.hashicorp/hashicorp': 'feature/secrets/voxgig/sekreto/plugins/hashicorp.clj'
+        'voxgig.sekreto.plugins.boru/boru': 'feature/secrets/voxgig/sekreto/plugins/boru.clj'
+      }
+      # elixir: fully-qualified CALLS - each plugin module answers its
+      # definition from a zero-arity function (`Sekreto.Plugins.Hashicorp
+      # .hashicorp()`), so Config_elixir emits the key with `()` appended
+      # and needs no import at all: Elixir resolves modules globally, by
+      # their `defmodule`, not by path. The `def` path is target-root
+      # relative, while the `path` above is relative to Main_elixir's
+      # `lib/projectname` Copy - the root the plugin trim matches against -
+      # which is the same split py uses.
+      #
+      # plugins/proc.ex is NOT listed here: see the elixir note in the
+      # `secretspec` group. It is a feature-core file both groups use.
+      def: elixir: {
+        'Sekreto.Plugins.Hashicorp.hashicorp': 'lib/projectname/feature/secrets/sekreto/plugins/hashicorp.ex'
+        'Sekreto.Plugins.Boru.boru': 'lib/projectname/feature/secrets/sekreto/plugins/boru.ex'
+      }
+      # swift: PLAIN TOP-LEVEL LETS (`public let hashicorp: Definition = ...`)
+      # in the vendored SekretoPlugins MODULE, named by simple symbol - so
+      # ts-shaped keys. The `def` path is target-root-relative (tm/swift/...),
+      # while the `path` entries above are relative to Main_swift's
+      # Sources/ProjectNameSDK Copy - the root the plugin trim matches
+      # against - which is the same split py uses.
+      #
+      # plugins/Proc.swift does NOT go with Boru: swift has the php/perl
+      # SHARED-HELPER shape. `runcmd` lives in Proc.swift and is called by
+      # Boru (`vault`) AND Secretspec (`secretspec`), so it ships with the
+      # feature core beside plugins/Httpjson.swift and belongs to NO group -
+      # a path listed in two groups is trimmed as soon as EITHER is off,
+      # which would break the other. Upstream's own `make lean` builds every
+      # non-AWS kind as `<Kind>.swift Httpjson.swift Proc.swift`.
+      def: swift: {
+        hashicorp: 'Sources/ProjectNameSDK/feature/secrets/plugins/Hashicorp.swift'
+        boru: 'Sources/ProjectNameSDK/feature/secrets/plugins/Boru.swift'
+      }
+      # lean: QUALIFIED DEFINITIONS (`Sekreto.hashicorp`) - the value each
+      # vendored SekretoPlugins module defines; Main_lean derives the import
+      # (`import SekretoPlugins.Hashicorp`) from the path's module tail. The
+      # path is target-root-relative, as go's is, because Main_lean's Copy is
+      # rooted at tm/lean. Httpjson.lean and Proc.lean are in NO group: the
+      # shared HTTP round-trip and child-process helpers ship with the
+      # feature core (Boru reaches both), like php's runcmd.php. They cost
+      # nothing when no kind imports them - Lake compiles an import closure,
+      # not a directory - and the libcurl link goes with the plugin groups,
+      # not with the core (see model/target/lean.aon).
+      def: lean: {
+        'Sekreto.hashicorp': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Hashicorp.lean'
+        'Sekreto.boru': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Boru.lean'
+      }
     }
     cloud: {
@@ -104,8 +307,36 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/azuresecrets.ts'
         'feature/secrets/plugins/gcpsecrets/gcpsecrets.go'
         'feature/secrets/plugins/azuresecrets/azuresecrets.go'
+        'feature/secrets/plugins/gcpsecrets.rs'
+        'feature/secrets/plugins/azuresecrets.rs'
         'feature/secrets/voxgig_sekreto/plugins/gcpsecrets.py'
         'feature/secrets/voxgig_sekreto/plugins/azuresecrets.py'
+        'src/feature/secrets/sekreto/plugins/gcpsecrets.js'
+        'src/feature/secrets/sekreto/plugins/azuresecrets.js'
+        'feature/secrets/voxgig_sekreto/plugins/gcpsecrets.rb'
+        'feature/secrets/voxgig_sekreto/plugins/azuresecrets.rb'
+        'feature/secrets/sekreto/plugins/gcpsecrets.php'
+        'feature/secrets/sekreto/plugins/azuresecrets.php'
+        'feature/secrets/plugins/GcpSecrets.cs'
+        'feature/secrets/plugins/AzureSecrets.cs'
+        'feature/secrets/sekreto/plugins/Gcpsecrets.java'
+        'feature/secrets/sekreto/plugins/Azuresecrets.java'
+        'feature/secrets/sekreto/plugins/Gcpsecrets.scala'
+        'feature/secrets/sekreto/plugins/Azuresecrets.scala'
+        'feature/secrets/sekreto/plugins/Gcpsecrets.kt'
+        'feature/secrets/sekreto/plugins/Azuresecrets.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Gcpsecrets.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Azuresecrets.pm'
+        'lib/feature/secrets/sekreto/plugins/gcpsecrets.dart'
+        'lib/feature/secrets/sekreto/plugins/azuresecrets.dart'
+        'feature/secrets/sekreto/plugins/gcpsecrets.ex'
+        'feature/secrets/sekreto/plugins/azuresecrets.ex'
+        'feature/secrets/voxgig/sekreto/plugins/gcpsecrets.clj'
+        'feature/secrets/voxgig/sekreto/plugins/azuresecrets.clj'
+        'feature/secrets/plugins/Gcpsecrets.swift'
+        'feature/secrets/plugins/Azuresecrets.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Gcpsecrets.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Azuresecrets.lean'
       ]
       def: ts: {
         gcpsecrets: 'src/feature/secrets/sekreto/plugins/gcpsecrets.ts'
@@ -115,10 +346,66 @@ main: kit: feature: secrets: {
         'gcpsecrets.Plugin': 'feature/secrets/plugins/gcpsecrets/gcpsecrets.go'
         'azuresecrets.Plugin': 'feature/secrets/plugins/azuresecrets/azuresecrets.go'
       }
+      def: rust: {
+        'gcpsecrets::plugin': 'feature/secrets/plugins/gcpsecrets.rs'
+        'azuresecrets::plugin': 'feature/secrets/plugins/azuresecrets.rs'
+      }
       def: py: {
         gcpsecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/gcpsecrets.py'
         azuresecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/azuresecrets.py'
       }
+      def: rb: {
+        'VoxgigSekreto::Plugins::GCPSECRETS': 'feature/secrets/voxgig_sekreto/plugins/gcpsecrets.rb'
+        'VoxgigSekreto::Plugins::AZURESECRETS': 'feature/secrets/voxgig_sekreto/plugins/azuresecrets.rb'
+      }
+      def: js: {
+        gcpsecrets: 'src/feature/secrets/sekreto/plugins/gcpsecrets.js'
+        azuresecrets: 'src/feature/secrets/sekreto/plugins/azuresecrets.js'
+      }
+      def: php: {
+        gcpsecrets: 'feature/secrets/sekreto/plugins/gcpsecrets.php'
+        azuresecrets: 'feature/secrets/sekreto/plugins/azuresecrets.php'
+      }
+      def: csharp: {
+        'GcpSecrets.Plugin': 'feature/secrets/plugins/GcpSecrets.cs'
+        'AzureSecrets.Plugin': 'feature/secrets/plugins/AzureSecrets.cs'
+      }
+      def: java: {
+        'Gcpsecrets.PLUGIN': 'feature/secrets/sekreto/plugins/Gcpsecrets.java'
+        'Azuresecrets.PLUGIN': 'feature/secrets/sekreto/plugins/Azuresecrets.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.gcpsecrets': 'feature/secrets/sekreto/plugins/Gcpsecrets.scala'
+        'com.voxgig.sekreto.plugins.azuresecrets': 'feature/secrets/sekreto/plugins/Azuresecrets.scala'
+      }
+      def: kotlin: {
+        gcpsecrets: 'feature/secrets/sekreto/plugins/Gcpsecrets.kt'
+        azuresecrets: 'feature/secrets/sekreto/plugins/Azuresecrets.kt'
+      }
+      def: perl: {
+        gcpsecrets: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Gcpsecrets.pm'
+        azuresecrets: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Azuresecrets.pm'
+      }
+      def: dart: {
+        gcpsecrets: 'lib/feature/secrets/sekreto/plugins/gcpsecrets.dart'
+        azuresecrets: 'lib/feature/secrets/sekreto/plugins/azuresecrets.dart'
+      }
+      def: clojure: {
+        'voxgig.sekreto.plugins.gcpsecrets/gcpsecrets': 'feature/secrets/voxgig/sekreto/plugins/gcpsecrets.clj'
+        'voxgig.sekreto.plugins.azuresecrets/azuresecrets': 'feature/secrets/voxgig/sekreto/plugins/azuresecrets.clj'
+      }
+      def: elixir: {
+        'Sekreto.Plugins.Gcpsecrets.gcpsecrets': 'lib/projectname/feature/secrets/sekreto/plugins/gcpsecrets.ex'
+        'Sekreto.Plugins.Azuresecrets.azuresecrets': 'lib/projectname/feature/secrets/sekreto/plugins/azuresecrets.ex'
+      }
+      def: swift: {
+        gcpsecrets: 'Sources/ProjectNameSDK/feature/secrets/plugins/Gcpsecrets.swift'
+        azuresecrets: 'Sources/ProjectNameSDK/feature/secrets/plugins/Azuresecrets.swift'
+      }
+      def: lean: {
+        'Sekreto.gcpsecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Gcpsecrets.lean'
+        'Sekreto.azuresecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Azuresecrets.lean'
+      }
     }
     saas: {
@@ -131,9 +418,51 @@ main: kit: feature: secrets: {
         'feature/secrets/plugins/onepassword/onepassword.go'
         'feature/secrets/plugins/doppler/doppler.go'
         'feature/secrets/plugins/infisical/infisical.go'
+        'feature/secrets/plugins/onepassword.rs'
+        'feature/secrets/plugins/doppler.rs'
+        'feature/secrets/plugins/infisical.rs'
         'feature/secrets/voxgig_sekreto/plugins/onepassword.py'
         'feature/secrets/voxgig_sekreto/plugins/doppler.py'
         'feature/secrets/voxgig_sekreto/plugins/infisical.py'
+        'src/feature/secrets/sekreto/plugins/onepassword.js'
+        'src/feature/secrets/sekreto/plugins/doppler.js'
+        'src/feature/secrets/sekreto/plugins/infisical.js'
+        'feature/secrets/voxgig_sekreto/plugins/onepassword.rb'
+        'feature/secrets/voxgig_sekreto/plugins/doppler.rb'
+        'feature/secrets/voxgig_sekreto/plugins/infisical.rb'
+        'feature/secrets/sekreto/plugins/onepassword.php'
+        'feature/secrets/sekreto/plugins/doppler.php'
+        'feature/secrets/sekreto/plugins/infisical.php'
+        'feature/secrets/plugins/OnePassword.cs'
+        'feature/secrets/plugins/Doppler.cs'
+        'feature/secrets/plugins/Infisical.cs'
+        'feature/secrets/sekreto/plugins/Onepassword.java'
+        'feature/secrets/sekreto/plugins/Doppler.java'
+        'feature/secrets/sekreto/plugins/Infisical.java'
+        'feature/secrets/sekreto/plugins/Onepassword.scala'
+        'feature/secrets/sekreto/plugins/Doppler.scala'
+        'feature/secrets/sekreto/plugins/Infisical.scala'
+        'feature/secrets/sekreto/plugins/Onepassword.kt'
+        'feature/secrets/sekreto/plugins/Doppler.kt'
+        'feature/secrets/sekreto/plugins/Infisical.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Onepassword.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Doppler.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Infisical.pm'
+        'lib/feature/secrets/sekreto/plugins/onepassword.dart'
+        'lib/feature/secrets/sekreto/plugins/doppler.dart'
+        'lib/feature/secrets/sekreto/plugins/infisical.dart'
+        'feature/secrets/voxgig/sekreto/plugins/onepassword.clj'
+        'feature/secrets/voxgig/sekreto/plugins/doppler.clj'
+        'feature/secrets/voxgig/sekreto/plugins/infisical.clj'
+        'feature/secrets/sekreto/plugins/onepassword.ex'
+        'feature/secrets/sekreto/plugins/doppler.ex'
+        'feature/secrets/sekreto/plugins/infisical.ex'
+        'feature/secrets/plugins/Onepassword.swift'
+        'feature/secrets/plugins/Doppler.swift'
+        'feature/secrets/plugins/Infisical.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Onepassword.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Doppler.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Infisical.lean'
       ]
       def: ts: {
         onepassword: 'src/feature/secrets/sekreto/plugins/onepassword.ts'
@@ -145,11 +474,88 @@ main: kit: feature: secrets: {
         'doppler.Plugin': 'feature/secrets/plugins/doppler/doppler.go'
         'infisical.Plugin': 'feature/secrets/plugins/infisical/infisical.go'
       }
+      def: rust: {
+        'onepassword::plugin': 'feature/secrets/plugins/onepassword.rs'
+        'doppler::plugin': 'feature/secrets/plugins/doppler.rs'
+        'infisical::plugin': 'feature/secrets/plugins/infisical.rs'
+      }
       def: py: {
         onepassword: 'pkg/feature/secrets/voxgig_sekreto/plugins/onepassword.py'
         doppler: 'pkg/feature/secrets/voxgig_sekreto/plugins/doppler.py'
         infisical: 'pkg/feature/secrets/voxgig_sekreto/plugins/infisical.py'
       }
+      def: rb: {
+        'VoxgigSekreto::Plugins::ONEPASSWORD': 'feature/secrets/voxgig_sekreto/plugins/onepassword.rb'
+        'VoxgigSekreto::Plugins::DOPPLER': 'feature/secrets/voxgig_sekreto/plugins/doppler.rb'
+        'VoxgigSekreto::Plugins::INFISICAL': 'feature/secrets/voxgig_sekreto/plugins/infisical.rb'
+      }
+      def: js: {
+        onepassword: 'src/feature/secrets/sekreto/plugins/onepassword.js'
+        doppler: 'src/feature/secrets/sekreto/plugins/doppler.js'
+        infisical: 'src/feature/secrets/sekreto/plugins/infisical.js'
+      }
+      def: php: {
+        onepassword: 'feature/secrets/sekreto/plugins/onepassword.php'
+        doppler: 'feature/secrets/sekreto/plugins/doppler.php'
+        infisical: 'feature/secrets/sekreto/plugins/infisical.php'
+      }
+      def: csharp: {
+        'OnePassword.Plugin': 'feature/secrets/plugins/OnePassword.cs'
+        'Doppler.Plugin': 'feature/secrets/plugins/Doppler.cs'
+        'Infisical.Plugin': 'feature/secrets/plugins/Infisical.cs'
+      }
+      def: java: {
+        'Onepassword.PLUGIN': 'feature/secrets/sekreto/plugins/Onepassword.java'
+        'Doppler.PLUGIN': 'feature/secrets/sekreto/plugins/Doppler.java'
+        'Infisical.PLUGIN': 'feature/secrets/sekreto/plugins/Infisical.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.onepassword': 'feature/secrets/sekreto/plugins/Onepassword.scala'
+        'com.voxgig.sekreto.plugins.doppler': 'feature/secrets/sekreto/plugins/Doppler.scala'
+        'com.voxgig.sekreto.plugins.infisical': 'feature/secrets/sekreto/plugins/Infisical.scala'
+      }
+      def: kotlin: {
+        onepassword: 'feature/secrets/sekreto/plugins/Onepassword.kt'
+        doppler: 'feature/secrets/sekreto/plugins/Doppler.kt'
+        infisical: 'feature/secrets/sekreto/plugins/Infisical.kt'
+      }
+      def: perl: {
+        onepassword: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Onepassword.pm'
+        doppler: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Doppler.pm'
+        infisical: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Infisical.pm'
+      }
+      def: dart: {
+        onepassword: 'lib/feature/secrets/sekreto/plugins/onepassword.dart'
+        doppler: 'lib/feature/secrets/sekreto/plugins/doppler.dart'
+        infisical: 'lib/feature/secrets/sekreto/plugins/infisical.dart'
+      }
+      def: clojure: {
+        'voxgig.sekreto.plugins.onepassword/onepassword': 'feature/secrets/voxgig/sekreto/plugins/onepassword.clj'
+        'voxgig.sekreto.plugins.doppler/doppler': 'feature/secrets/voxgig/sekreto/plugins/doppler.clj'
+        'voxgig.sekreto.plugins.infisical/infisical': 'feature/secrets/voxgig/sekreto/plugins/infisical.clj'
+      }
+      # elixir: fully-qualified CALLS - each plugin module answers its
+      # definition from a zero-arity function, so Config_elixir emits the
+      # key with `()` appended and needs no import at all (Elixir resolves
+      # modules globally, by their `defmodule`). The `def` path is
+      # target-root relative; the `path` above is relative to Main_elixir's
+      # `lib/projectname` Copy, which is the root the plugin trim matches
+      # against - the same split py uses.
+      def: elixir: {
+        'Sekreto.Plugins.Onepassword.onepassword': 'lib/projectname/feature/secrets/sekreto/plugins/onepassword.ex'
+        'Sekreto.Plugins.Doppler.doppler': 'lib/projectname/feature/secrets/sekreto/plugins/doppler.ex'
+        'Sekreto.Plugins.Infisical.infisical': 'lib/projectname/feature/secrets/sekreto/plugins/infisical.ex'
+      }
+      def: swift: {
+        onepassword: 'Sources/ProjectNameSDK/feature/secrets/plugins/Onepassword.swift'
+        doppler: 'Sources/ProjectNameSDK/feature/secrets/plugins/Doppler.swift'
+        infisical: 'Sources/ProjectNameSDK/feature/secrets/plugins/Infisical.swift'
+      }
+      def: lean: {
+        'Sekreto.onepassword': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Onepassword.lean'
+        'Sekreto.doppler': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Doppler.lean'
+        'Sekreto.infisical': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Infisical.lean'
+      }
     }
     # The only plugin that costs node:crypto: AWS request signing.
@@ -164,8 +570,38 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/sigv4.ts'
         'feature/secrets/plugins/aws/aws.go'
         'feature/secrets/plugins/aws/sigv4.go'
+        'feature/secrets/plugins/aws.rs'
+        'feature/secrets/plugins/aws/sigv4.rs'
+        'feature/secrets/plugins/aws/crypto.rs'
         'feature/secrets/voxgig_sekreto/plugins/aws.py'
         'feature/secrets/voxgig_sekreto/plugins/sigv4.py'
+        'src/feature/secrets/sekreto/plugins/aws.js'
+        'src/feature/secrets/sekreto/plugins/sigv4.js'
+        'feature/secrets/voxgig_sekreto/plugins/aws.rb'
+        'feature/secrets/voxgig_sekreto/plugins/sigv4.rb'
+        'feature/secrets/sekreto/plugins/aws.php'
+        'feature/secrets/sekreto/plugins/sigv4.php'
+        'feature/secrets/plugins/Aws.cs'
+        'feature/secrets/plugins/Sigv4.cs'
+        'feature/secrets/sekreto/plugins/Aws.java'
+        'feature/secrets/sekreto/plugins/Aws.scala'
+        'feature/secrets/sekreto/plugins/Aws.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Sigv4.pm'
+        'lib/feature/secrets/sekreto/plugins/aws.dart'
+        'lib/feature/secrets/sekreto/plugins/sigv4.dart'
+        'lib/feature/secrets/sekreto/plugins/crypto.dart'
+        'feature/secrets/voxgig/sekreto/plugins/aws.clj'
+        'feature/secrets/voxgig/sekreto/plugins/sigv4.clj'
+        'feature/secrets/sekreto/plugins/aws.ex'
+        'feature/secrets/sekreto/plugins/sigv4.ex'
+        'feature/secrets/plugins/Aws.swift'
+        'feature/secrets/plugins/Sigv4.swift'
+        'feature/secrets/plugins/Crypto.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Sigv4.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Crypto.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Clock.lean'
       ]
       def: ts: {
         awssecrets: 'src/feature/secrets/sekreto/plugins/aws.ts'
@@ -176,12 +612,140 @@ main: kit: feature: secrets: {
         'aws.Secrets': 'feature/secrets/plugins/aws/aws.go'
         'aws.Params': 'feature/secrets/plugins/aws/aws.go'
       }
+      # ONE module, TWO definitions - rust's spelling of the ts aws.ts
+      # pair (upstream exports `pub fn secrets()` and `pub fn params()`).
+      # plugins/aws/sigv4.rs and plugins/aws/crypto.rs go with it, and go
+      # only with it: nothing outside aws.rs reaches into either.
+      def: rust: {
+        'aws::secrets': 'feature/secrets/plugins/aws.rs'
+        'aws::params': 'feature/secrets/plugins/aws.rs'
+      }
       # ONE module, TWO definitions - py's spelling of the ts aws.ts pair.
       # plugins/sigv4.py goes with it, and goes only with it.
       def: py: {
         awssecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
         awsparams: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
       }
+      # ONE module, TWO definitions - rb's spelling of the ts aws.ts
+      # pair. plugins/sigv4.rb goes with it, and goes only with it.
+      def: rb: {
+        'VoxgigSekreto::Plugins::AWSSECRETS': 'feature/secrets/voxgig_sekreto/plugins/aws.rb'
+        'VoxgigSekreto::Plugins::AWSPARAMS': 'feature/secrets/voxgig_sekreto/plugins/aws.rb'
+      }
+      # ONE module, TWO definitions - js's spelling of the ts aws.ts pair.
+      # plugins/sigv4.js goes with it, and goes only with it.
+      def: js: {
+        awssecrets: 'src/feature/secrets/sekreto/plugins/aws.js'
+        awsparams: 'src/feature/secrets/sekreto/plugins/aws.js'
+      }
+      # ONE file, TWO definitions - php's spelling of the ts aws.ts pair.
+      # plugins/sigv4.php goes with it, and goes only with it.
+      def: php: {
+        awssecrets: 'feature/secrets/sekreto/plugins/aws.php'
+        awsparams: 'feature/secrets/sekreto/plugins/aws.php'
+      }
+      # ONE file, TWO definitions - csharp's spelling of the ts aws.ts
+      # pair. The class is `AwsPlugins`, not `Aws`: the provider TYPES in
+      # Aws.cs are named AwsSecretsProvider/AwsParamsProvider and the
+      # definition holder cannot collide with them.
+      # plugins/Sigv4.cs goes with it, and goes only with it.
+      def: csharp: {
+        'AwsPlugins.Secrets': 'feature/secrets/plugins/Aws.cs'
+        'AwsPlugins.Params': 'feature/secrets/plugins/Aws.cs'
+      }
+      # ONE class, TWO definitions - java's spelling of the ts aws.ts
+      # pair. plugins/Sigv4.java does NOT go with it: see the java note
+      # at the head of this `plugin` block.
+      def: java: {
+        'Aws.SECRETS': 'feature/secrets/sekreto/plugins/Aws.java'
+        'Aws.PARAMS': 'feature/secrets/sekreto/plugins/Aws.java'
+      }
+      # ONE file, TWO definitions - scala's spelling of the ts aws.ts pair.
+      # plugins/Sigv4.scala does NOT go with it: the java story repeats here
+      # exactly (see the java note at the head of this `plugin` block),
+      # because Sigv4.scala's `private[plugins] def uriescape` is also called
+      # by Azuresecrets (`cloud`) and by Doppler, Infisical and Onepassword
+      # (`saas`) - so listing it under `aws` let a saas-only or cloud-only
+      # trim delete a file four other kinds compile against, and scalac fails
+      # the whole build on it ("Not found: uriescape", x4 for saas, x2 for
+      # cloud - measured, not predicted).
+      def: scala: {
+        'com.voxgig.sekreto.plugins.awssecrets': 'feature/secrets/sekreto/plugins/Aws.scala'
+        'com.voxgig.sekreto.plugins.awsparams': 'feature/secrets/sekreto/plugins/Aws.scala'
+      }
+      # ONE file, TWO definitions - kotlin's spelling of the ts aws.ts
+      # pair. plugins/Sigv4.kt does NOT go with it: the java story repeats
+      # here exactly (see the java note at the head of this `plugin`
+      # block), because Sigv4.kt's `internal fun uriescape` is also called
+      # by Azuresecrets (`cloud`) and by Doppler, Infisical and
+      # Onepassword (`saas`) - so listing it under `aws` would let a
+      # saas-only trim delete a file four other kinds compile against, and
+      # kotlinc fails the whole module on it.
+      def: kotlin: {
+        awssecrets: 'feature/secrets/sekreto/plugins/Aws.kt'
+        awsparams: 'feature/secrets/sekreto/plugins/Aws.kt'
+      }
+      # ONE module, TWO definitions - perl's spelling of the ts aws.ts
+      # pair (Aws.pm's `@EXPORT_OK` is `awssecrets awsparams sigv4`).
+      # plugins/Sigv4.pm goes with it, and goes only with it: nothing
+      # outside Aws.pm calls into it in this port.
+      def: perl: {
+        awssecrets: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
+        awsparams: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
+      }
+      # ONE file, TWO definitions - dart's spelling of the ts aws.ts pair.
+      # plugins/sigv4.dart goes with it, and so does plugins/crypto.dart:
+      # this port has no crypto library to lean on, so SHA-256 and HMAC are
+      # its own, and sigv4.dart is their only caller. Listing crypto.dart
+      # anywhere else would let an aws-only trim delete the file sigv4.dart
+      # compiles against - and `dart analyze` runs over the whole package,
+      # so that is a hard build failure, not a degraded chain.
+      def: dart: {
+        awssecrets: 'lib/feature/secrets/sekreto/plugins/aws.dart'
+        awsparams: 'lib/feature/secrets/sekreto/plugins/aws.dart'
+      }
+      # ONE module, TWO definitions - clojure's spelling of the ts aws.ts
+      # pair (upstream's aws.clj carries `awssecrets` and `awsparams`).
+      # plugins/sigv4.clj goes with it, and goes only with it: nothing
+      # outside aws.clj requires it in this port.
+      def: clojure: {
+        'voxgig.sekreto.plugins.aws/awssecrets': 'feature/secrets/voxgig/sekreto/plugins/aws.clj'
+        'voxgig.sekreto.plugins.aws/awsparams': 'feature/secrets/voxgig/sekreto/plugins/aws.clj'
+      }
+      # ONE file, TWO definitions - elixir's spelling of the ts aws.ts pair.
+      # plugins/sigv4.ex goes with it, and goes only with it: it holds
+      # Sekreto.Plugins.Signing and Sekreto.Plugins.Sigv4, and aws.ex is
+      # this port's only caller of either.
+      def: elixir: {
+        'Sekreto.Plugins.Aws.awssecrets': 'lib/projectname/feature/secrets/sekreto/plugins/aws.ex'
+        'Sekreto.Plugins.Aws.awsparams': 'lib/projectname/feature/secrets/sekreto/plugins/aws.ex'
+      }
+      # ONE file, TWO definitions - swift's spelling of the ts aws.ts pair
+      # (Aws.swift:258,264 at the tag). plugins/Sigv4.swift goes with it, and
+      # goes only with it: `sigv4` is called from Aws.swift alone - this port
+      # has no java/kotlin/scala `uriescape` story, checked at the tag. And so
+      # does plugins/Crypto.swift: swift has no hashing in its standard
+      # library (CryptoKit is Apple-only, swift-crypto a package), so SHA-256
+      # and HMAC are the port's own and Sigv4.swift is their only caller (the
+      # one other `hex` under plugins/ is a comment in Httpjson.swift).
+      # Listing Crypto.swift anywhere else would let an aws-only trim delete
+      # the file Sigv4.swift compiles against - swiftc fails the whole
+      # SekretoPlugins module on it.
+      def: swift: {
+        awssecrets: 'Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift'
+        awsparams: 'Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift'
+      }
+      # ONE file, TWO definitions - lean's spelling of the ts aws.ts pair.
+      # Sigv4.lean, Crypto.lean AND Clock.lean travel with it: in this port
+      # Aws.lean is their only importer (no saas/cloud kind reaches
+      # `uriescape`, which lives in Httpjson.lean), so an aws-off trim
+      # leaves nothing dangling. Clock.lean is the `sekreto_epoch_seconds`
+      # extern's only caller; its two-line C stub is compiled with the curl
+      # one whenever any plugin group is on, and is dead weight otherwise.
+      def: lean: {
+        'Sekreto.awssecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
+        'Sekreto.awsparams': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
+      }
     }
     # The only plugin that runs a CHILD PROCESS: the secretspec CLI
@@ -193,7 +757,21 @@ main: kit: feature: secrets: {
       path: [
         'src/feature/secrets/sekreto/plugins/secretspec.ts'
         'feature/secrets/plugins/secretspec/secretspec.go'
+        'feature/secrets/plugins/secretspec.rs'
         'feature/secrets/voxgig_sekreto/plugins/secretspec.py'
+        'src/feature/secrets/sekreto/plugins/secretspec.js'
+        'feature/secrets/voxgig_sekreto/plugins/secretspec.rb'
+        'feature/secrets/sekreto/plugins/secretspec.php'
+        'feature/secrets/plugins/SecretSpec.cs'
+        'feature/secrets/sekreto/plugins/Secretspec.java'
+        'feature/secrets/sekreto/plugins/Secretspec.scala'
+        'feature/secrets/sekreto/plugins/Secretspec.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Secretspec.pm'
+        'lib/feature/secrets/sekreto/plugins/secretspec.dart'
+        'feature/secrets/voxgig/sekreto/plugins/secretspec.clj'
+        'feature/secrets/sekreto/plugins/secretspec.ex'
+        'feature/secrets/plugins/Secretspec.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Secretspec.lean'
       ]
       def: ts: {
         secretspec: 'src/feature/secrets/sekreto/plugins/secretspec.ts'
@@ -201,12 +779,105 @@ main: kit: feature: secrets: {
       def: go: {
         'secretspec.Plugin': 'feature/secrets/plugins/secretspec/secretspec.go'
       }
+      def: rust: {
+        'secretspec::plugin': 'feature/secrets/plugins/secretspec.rs'
+      }
       def: py: {
         secretspec: 'pkg/feature/secrets/voxgig_sekreto/plugins/secretspec.py'
       }
+      def: rb: {
+        'VoxgigSekreto::Plugins::SECRETSPEC': 'feature/secrets/voxgig_sekreto/plugins/secretspec.rb'
+      }
+      def: js: {
+        secretspec: 'src/feature/secrets/sekreto/plugins/secretspec.js'
+      }
+      def: php: {
+        secretspec: 'feature/secrets/sekreto/plugins/secretspec.php'
+      }
+      def: csharp: {
+        'SecretSpec.Plugin': 'feature/secrets/plugins/SecretSpec.cs'
+      }
+      def: java: {
+        'Secretspec.PLUGIN': 'feature/secrets/sekreto/plugins/Secretspec.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.secretspec': 'feature/secrets/sekreto/plugins/Secretspec.scala'
+      }
+      def: kotlin: {
+        secretspec: 'feature/secrets/sekreto/plugins/Secretspec.kt'
+      }
+      # plugins/Proc.pm is NOT listed here either - see the perl note in
+      # the `vault` group: it is a feature-core file both groups use.
+      def: perl: {
+        secretspec: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Secretspec.pm'
+      }
+      # dart has the php/perl SHARED-HELPER shape, and worse. `runcmd`
+      # (Process.runSync) lives in plugins/httpjson.dart, which every
+      # HTTP plugin imports, so it ships with the FEATURE CORE and cannot
+      # be gated here at all - this group's `needs: { fs: true }` buys back
+      # the CLI kind, not the child-process call itself. Stated rather than
+      # hidden: a dart SDK with secrets active and a `[dotenv, env]` chain
+      # links HttpClient and a Process.runSync it never reaches. Dead code,
+      # not a defect, and an upstream shape issue (boru.dart calls runcmd
+      # too, so it is not secretspec-only there either).
+      def: dart: {
+        secretspec: 'lib/feature/secrets/sekreto/plugins/secretspec.dart'
+      }
+      # clojure: plugins/proc.clj is NOT listed here (nor under `vault`).
+      # It is the shared child-process helper BOTH boru.clj and
+      # secretspec.clj require - php's runcmd.php story, one language over -
+      # so it ships with the feature core and belongs to NO group.
+      def: clojure: {
+        'voxgig.sekreto.plugins.secretspec/secretspec': 'feature/secrets/voxgig/sekreto/plugins/secretspec.clj'
+      }
+      # plugins/proc.ex is NOT listed here - the php/perl SHARED-HELPER
+      # story, one language over. The elixir port factors the child-process
+      # spawn out of the two plugins that need it, so proc.ex is used by
+      # Boru (`vault`) AND Secretspec (`secretspec`); listing its path in
+      # either group would delete a file the other group's plugin calls.
+      # It ships with the feature core instead, alongside http.ex and
+      # httpjson.ex. Stated rather than hidden: a secrets-enabled elixir
+      # SDK carries a `System.cmd("/bin/sh", ...)` source line even with
+      # this group off. The code is unreachable without a plugin that calls
+      # it, and it is an upstream shape issue rather than a local one.
+      def: elixir: {
+        'Sekreto.Plugins.Secretspec.secretspec': 'lib/projectname/feature/secrets/sekreto/plugins/secretspec.ex'
+      }
+      # plugins/Proc.swift is NOT listed here either - see the swift note in
+      # the `vault` group: it is a feature-core file both groups use.
+      def: swift: {
+        secretspec: 'Sources/ProjectNameSDK/feature/secrets/plugins/Secretspec.swift'
+      }
+      # Proc.lean is NOT listed here - the php/perl SHARED-HELPER story:
+      # Boru (`vault`) imports it too, so it ships with the feature core.
+      def: lean: {
+        'Sekreto.secretspec': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Secretspec.lean'
+      }
+    }
+  }
+  # rust: the TLS the vendored HTTP helper speaks.
+  #
+  # plugins/httpjson/http.rs opens its own sockets and names rustls
+  # directly, so cargo needs the crates as DIRECT dependencies even though
+  # both are already in the closure of the target's existing `ureq` dep
+  # (rustls 0.23 + webpki-roots 0.26). `default: false` is load-bearing,
+  # not tidiness: rustls with DEFAULT features pulls aws-lc-rs/aws-lc-sys
+  # and a cmake C build, while the ring feature set below is what ureq
+  # already compiles - so a secrets-enabled rust SDK adds no build at all.
+  # Package_rust renders the dependency-TABLE form when either key is set.
+  #
+  # Feature deps are `active: true` by explicit opt-in (collectDeps), so an
+  # SDK that does not select this feature names neither crate.
+  deps: rust: {
+    'rustls': {
+      active: true, version: '0.23', kind: prod
+      default: false, features: ['std', 'ring', 'tls12']
     }
+    'webpki-roots': { active: true, version: '0.26', kind: prod }
   }
   # Transport role (station design §8.4).
   #
   # 'wrap', because the access-token exchange below has to SEE the response: