@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/src/cmp/kotlin/Config_kotlin.ts

@@ -87,6 +87,58 @@ const Config = cmp(async function Config(props: any) {
   // while its data config had them. One rule, one place.
   const entityConfig = configDef.entity
 
+  // THE PLUGIN DEFINITIONS the model selected, per feature.
+  //
+  // sekreto's contract since the registry was retired: a kind not passed
+  // in `plugins` is unknown to that Sekreto, so the model's choice of
+  // plugin groups IS the SDK's provider vocabulary. This walks the
+  // catalogue's active `plugin.def.kotlin` entries and hands the list to
+  // the feature through `Config.featurePlugins`.
+  //
+  // Kotlin's Definition symbols are PLAIN TOP-LEVEL VALS
+  // (`val hashicorp: Definition = providerplugin("hashicorp") {...}`), so
+  // the def key is the val name and the import is that name qualified by
+  // the file's package - DERIVED from the def path (`feature/secrets/
+  // sekreto/plugins/Hashicorp.kt` -> `feature.secrets.sekreto.plugins`)
+  // rather than hardcoding `secrets`, exactly as the go emitter does.
+  //
+  // Emitted in core, which already names KOTLINPACKAGE.feature classes in
+  // makeFeature - Kotlin has no package-cycle rule, so nothing here can
+  // introduce one. The feature reads it back as List<Any?> and filters by
+  // type, so a tree with the feature present but no group selected still
+  // compiles with no import at all.
+  const pluginImports = new Set<string>()
+  const featurePlugins: Record<string, string[]> = {}
+
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered: getting this wrong emits an import for a file the
+      // plugin trim just deleted, and the SDK does not compile.
+      if (false === plugin.active || null == plugin.active) return
+      for (const [sym, one] of Object.entries(plugin.def?.kotlin || {})) {
+        const dir = String(one).replace(/\/[^/]+$/, '').replace(/\//g, '.')
+        // A dotted symbol (another language's class-qualified spelling)
+        // imports its HEAD; kotlin's own keys are bare val names.
+        pluginImports.add(
+          kotlinpackage + '.' + dir + '.' + String(sym).split('.')[0])
+        syms.push(sym)
+      }
+    })
+    if (0 < syms.length) {
+      featurePlugins[f.name] = syms.sort()
+    }
+  })
+
+  const pluginImportBlock = Array.from(pluginImports).sort()
+    .map((one: string) => 'import ' + one + '\n').join('')
+
+  const featurePluginsBlock =
+    Object.keys(featurePlugins).sort().map((fname: string) =>
+      '    "' + fname + '" to listOf(' +
+      featurePlugins[fname].join(', ') + '),\n').join('')
+
   const config = {
     main: configDef.main,
     feature: featureConfig,
@@ -99,7 +151,7 @@ const Config = cmp(async function Config(props: any) {
     Content(`package ${kotlinpackage}.core
 
 import ${kotlinpackage}.utility.Json
-
+${pluginImportBlock}
 /** Static SDK configuration and by-name feature construction. */
 @Suppress("UNCHECKED_CAST")
 object Config {
@@ -139,6 +191,16 @@ object Config {
     }
   }
 
+  // The plugin definitions the model selected per feature, as List<Any?>
+  // so core need not name a feature's types. Empty when no active feature
+  // declares active plugin groups for this target - and then no plugin
+  // import is emitted either.
+  private val featurePluginsMap: Map<String, List<Any?>> = mapOf(
+${featurePluginsBlock}  )
+
+  // featurePlugins is the definitions list for one feature's chain.
+  fun featurePlugins(name: String): List<Any?> = featurePluginsMap[name] ?: emptyList()
+
   private fun configJson(): String {
     val b = StringBuilder()
 `)

package/project/.sdk/src/cmp/kotlin/Main_kotlin.ts

@@ -4,7 +4,8 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Copy, Folder, Fragment,
-  TEST_CONTROL_EXCLUDE
+  TEST_CONTROL_EXCLUDE,
+  pluginExcludes
 } from '@voxgig/sdkgen'
 
 
@@ -48,10 +49,39 @@ const Main = cmp(async function Main(props: any) {
   // token used throughout the templates (package/import statements).
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+    // group's declared files stay out of the tree - the model's `path`
+    // entries are target-root-relative, which is this Copy's root). Without
+    // it every plugin group ships regardless of the model and the def maps
+    // decide nothing; an exclude that matches nothing is indistinguishable
+    // from no exclude at all, which is how this went wrong before.
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
       KOTLINPACKAGE: kotlinpackage,
+
+      // The vendored sekreto port carries upstream's own package root, and
+      // a generated SDK must not publish classes in it: a Maven artifact
+      // declaring `com.voxgig.sekreto` collides with the real library on
+      // any consumer classpath. It would not COMPILE either - the vendor
+      // route's `adapt` for this library matches only Sekreto.kt and
+      // Support.kt, so the other fifteen sekreto files still declare
+      // `package com.voxgig.sekreto` while those two moved, and every
+      // cross-file reference is unresolved.
+      //
+      // Done HERE, the way Main_go rewrites the placeholder
+      // `github.com/voxgig/struct` import, because this Copy is the one
+      // seam every vendored file crosses on its way into an SDK. It is a
+      // NO-OP for a file the vendor route already rewrote, so widening
+      // that route's `adapt.match` to the whole `feature/secrets/`
+      // directory simply retires this line.
+      //
+      // (The sibling `voxgig.plugin` rewrite is NOT needed: that route's
+      // adapt already matches the whole `feature/secrets/plugin/` tree,
+      // and the token appears nowhere in tm/kotlin. A replace that matches
+      // nothing is indistinguishable from no replace at all, so it is not
+      // carried "just in case".)
+      'com.voxgig.sekreto': kotlinpackage + '.feature.secrets.sekreto',
     }
   })
 

package/project/.sdk/src/cmp/perl/Config_perl.ts

@@ -4,6 +4,8 @@ import {
   File,
   cmp,
   configDefinition,
+  each,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -12,6 +14,66 @@ import {
 } from '@voxgig/apidef'
 
 
+// PLUGIN DEFINITION IMPORTS AND THE FEATURE_PLUGINS TABLE (the perl peer
+// of cmp/py/Config_py.ts pluginImports/pluginDefs and cmp/go's
+// featurePlugins).
+//
+// Upstream sekreto replaced its self-registration registry with
+// voxgig/plugin definitions: a provider kind the caller did not pass in
+// via `plugins => [...]` is unknown to that Sekreto. So config imports
+// each active plugin's exported definition BY NAME (the model's
+// `def.perl` map) and hands the list to the feature through
+// FEATURE_PLUGINS.
+//
+// The `def` map is declared in the model rather than derived from
+// filenames because one module may export several definitions (sekreto's
+// Aws.pm exports awssecrets AND awsparams). A def value is the module's
+// path under tm/perl ('feature/secrets/plugins/Voxgig/Sekreto/Plugins/
+// Hashicorp.pm'); the vendored tree keeps upstream's PACKAGE layout, so
+// the module NAME is that path with the vendor root and the extension
+// removed and the separators turned into '::'.
+const PLUGIN_ROOT = 'feature/secrets/plugins/'
+
+
+function pluginModule(path: string): string {
+  return String(path)
+    .replace(new RegExp('^' + PLUGIN_ROOT), '')
+    .replace(/\.pm$/, '')
+    .replace(/\//g, '::')
+}
+
+
+// path -> [symbol, ...] for every ACTIVE plugin of every feature, so one
+// `use` line serves a two-definition module.
+function pluginsByPath(feature: any): Record<string, Record<string, string[]>> {
+  const out: Record<string, Record<string, string[]>> = {}
+
+  each(feature, (f: any) => {
+    const bypath: Record<string, string[]> = {}
+
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered: getting it wrong in this direction emits a `use`
+      // for a module the plugin trim just deleted - an SDK that does not
+      // LOAD, rather than one that merely carries too much. Config_py.ts
+      // records the same rule.
+      if (false === plugin.active || null == plugin.active) return
+
+      for (const [sym, one] of Object.entries(plugin.def?.perl || {})) {
+        const path = String(one)
+        ;(bypath[path] = bypath[path] || []).push(sym)
+      }
+    })
+
+    if (0 < Object.keys(bypath).length) {
+      out[f.name] = bypath
+    }
+  })
+
+  return out
+}
+
+
 // The config is emitted as a JSON heredoc parsed at load time by the
 // vendored struct utility (Voxgig::Struct::parse_json). This keeps
 // booleans/nulls faithful (Perl has no native boolean scalar) and yields
@@ -32,6 +94,70 @@ const Config = cmp(async function Config(props: any) {
 
   const configJson = JSON.stringify(configDef, null, 2)
 
+  // Gated by the applicability tags, so this target never imports a
+  // plugin definition it has no source for. One rule, one place:
+  // helpers/applicability.
+  const bypath = pluginsByPath(targetFeatures(model, target))
+  const features = Object.keys(bypath).sort()
+
+  // Every emitted line below is conditional on there being at least one
+  // active plugin definition: an SDK that selected no plugin group (or no
+  // secrets feature at all) gets exactly the config.pm it got before.
+  const vendorInc = 0 === features.length ? '' : `
+# The vendored sekreto and plugin ports keep their UPSTREAM package layout,
+# so they resolve through @INC rather than a file-path require - the same
+# convention feature/secrets_feature.pm and t/omni.pm use. This BEGIN runs
+# before the 'use' lines below, which are compile-time.
+BEGIN {
+  unshift @INC,
+    "$__dir/feature/secrets/sekreto",
+    "$__dir/feature/secrets/plugin",
+    "$__dir/feature/secrets/plugins";
+}
+`
+
+  let pluginUse = ''
+  let pluginTable = ''
+
+  if (0 < features.length) {
+    const lines: string[] = []
+    for (const fname of features) {
+      for (const path of Object.keys(bypath[fname]).sort()) {
+        const syms = Array.from(new Set(bypath[fname][path])).sort()
+        lines.push(`use ${pluginModule(path)} qw(${syms.join(' ')});`)
+      }
+    }
+    // A module shared by two features is imported once.
+    pluginUse = '\n' + Array.from(new Set(lines)).join('\n') + '\n'
+
+    const entries = features.map((fname) => {
+      const syms = Array.from(new Set(
+        Object.values(bypath[fname]).reduce(
+          (a: string[], b: string[]) => a.concat(b), []))).sort()
+      return `  '${fname}' => [ ${syms.map((s) => s + '()').join(', ')} ],`
+    })
+
+    pluginTable = `
+# THE SDK'S PROVIDER VOCABULARY, from the model's active plugin groups.
+#
+# sekreto's core ships four built-in kinds (env, memory, dotenv, file) and
+# nothing else: a kind not passed in here is UNKNOWN to that Sekreto. So
+# this table is what decides which vault, cloud, SaaS or CLI providers a
+# chain in this SDK may name - and an inactive group is not merely
+# unimported, its module is not generated at all.
+our %FEATURE_PLUGINS = (
+${entries.join('\n')}
+);
+
+sub feature_plugins {
+  my ($name) = @_;
+  $name = '' unless defined $name;
+  my $list = $FEATURE_PLUGINS{$name};
+  return defined $list ? $list : [];
+}
+`
+  }
+
   File({ name: 'config.pm' }, () => {
 
     Content(`# ${model.const.Name} SDK configuration
@@ -44,10 +170,10 @@ use Cwd ();
 
 my $__dir;
 BEGIN { $__dir = File::Basename::dirname(Cwd::abs_path(__FILE__)) }
-require(Cwd::abs_path("$__dir/lib/Voxgig/Struct.pm"));
+${vendorInc}require(Cwd::abs_path("$__dir/lib/Voxgig/Struct.pm"));
 
 package ${model.const.Name}Config;
-
+${pluginUse}
 # GENERATED from the API model - do not edit by hand. Parsed fresh on
 # each call so callers can safely mutate their copy.
 my $CONFIG_JSON = <<'END_CONFIG_JSON';
@@ -78,7 +204,7 @@ sub make_feature {
   require(Cwd::abs_path("$__dir/features.pm"));
   return ${model.const.Name}Features::make_feature($name);
 }
-
+${pluginTable}
 1;
 `)
   })

package/project/.sdk/src/cmp/perl/Main_perl.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each, names,
   File, Content, Copy, Folder, Fragment,
+  pluginExcludes,
   targetFeatures,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
@@ -43,6 +44,10 @@ const Main = cmp(async function Main(props: any) {
   // helpers/applicability.
   const feature = targetFeatures(model, target)
 
+  // Does the secrets feature apply here and is it switched on? Both, since
+  // targetFeatures already dropped it for a target with no sekreto port.
+  const secrets = null != (feature as any).secrets
+
   Package({ target })
 
   Gitignore({})
@@ -50,7 +55,14 @@ const Main = cmp(async function Main(props: any) {
   // Copy tm/perl files with replacements
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    // An ACTIVE feature's INACTIVE plugins do not ship. perl has no
+    // src/feature layout (srcfeature: false), so this blanket copy is the
+    // one place the generate-time plugin trim can act; the model's
+    // `plugin.<group>.path` entries name their files relative to THIS
+    // copy's root ('feature/secrets/plugins/Voxgig/Sekreto/Plugins/
+    // <Kind>.pm'). See helpers/featureSource.pluginExcludes, and
+    // Main_go.ts / Main_py.ts, which do the same.
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }
@@ -72,6 +84,34 @@ const Main = cmp(async function Main(props: any) {
             '/(?<indent>[ \\t]*)#[ \\t]*#(?<name>[A-Za-z0-9]+)-Hook[ \\t]*\\n?/':
               ({ name, indent }: any) =>
                 `${indent}$utility->{feature_hook}->($ctx, "${name}");\n`,
+
+            // SECRETS. The accessor is emitted only when the secrets
+            // feature applies to this target AND the model activates it -
+            // with the feature off the marker line is REMOVED, so the
+            // inactive output is byte-identical to pre-migration.
+            //
+            // The LIVE Sekreto, not a clone: sekreto holds provider and
+            // cache state, so a clone would resolve into a copy nothing
+            // else can see.
+            //
+            // There is deliberately NO resolve seam here. Unlike ts and
+            // py, this port resolves at the TRANSPORT (see
+            // feature/secrets_feature.pm), which every wire path -
+            // entity ops, direct() and graphql() - already crosses.
+            '/(?<indent>[ \\t]*)#[ \\t]*#SecretsAccessor[ \\t]*\\n?/':
+              ({ indent }: any) => !secrets ? '' :
+                `${indent}# The LIVE Sekreto instance: for arbitrary secrets and redaction.\n` +
+                `${indent}#\n` +
+                `${indent}#   $sdk->secrets->get('db.password')\n` +
+                `${indent}#   $sdk->secrets->redactall($logline)\n` +
+                `${indent}#\n` +
+                `${indent}# Never a clone: sekreto holds provider state (caches, vault\n` +
+                `${indent}# leases) that has to stay live to be worth anything.\n` +
+                `${indent}sub secrets {\n` +
+                `${indent}  my ($self) = @_;\n` +
+                `${indent}  my $f = $self->{_secrets};\n` +
+                `${indent}  return defined $f ? $f->sekreto : undef;\n` +
+                `${indent}}\n\n`,
           }
         },
 

package/project/.sdk/src/cmp/perl/Package_perl.ts

@@ -5,6 +5,7 @@ import {
   cmp,
   collectDeps,
   pkgDescription,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -27,6 +28,17 @@ const Package = cmp(async function Package(props: any) {
   // (e.g. "Voxgig::SDK::Solar" -> dist voxgig-sdk-solar).
   const Name = model.const.Name
 
+  // THE PERL FLOOR IS A FUNCTION OF THE FEATURE SET, not a constant.
+  //
+  // The base SDK is pure 5.018 perl. The secrets feature is not: the
+  // vendored voxgig/plugin runtime it depends on opens with
+  // `use builtin qw(is_bool)`, which is 5.36's and is the only way that
+  // port can tell `true` from `1`. Shipping 5.018 in the manifest of an
+  // SDK that cannot run on 5.018 installs cleanly and then dies at
+  // require time, so the floor moves with the feature.
+  const secrets = null != (targetFeatures(model, target) as any).secrets
+  const minperl = secrets ? '5.036' : '5.018'
+
   const deps = collectDeps(model, target.name, target.deps, ctx$.log)
   const prereq = deps
     .map((d: any) => `        '${d.name}' => '${d.version || '0'}',`)
@@ -51,7 +63,7 @@ WriteMakefile(
     ABSTRACT         => '${pkgDescription(model, target.name)}',
     AUTHOR           => 'Voxgig',
     LICENSE          => 'mit',
-    MIN_PERL_VERSION => '5.018',
+    MIN_PERL_VERSION => '${minperl}',
 ${prereq ? `    PREREQ_PM        => {\n${prereq}\n    },\n` : ''});
 `)
   })

package/project/.sdk/src/cmp/perl/fragment/Main.fragment.pm

@@ -116,6 +116,7 @@ sub get_root_ctx {
   return $self->{_rootctx};
 }
 
+# #SecretsAccessor
 sub prepare {
   my ($self, $fetchargs) = @_;
   my $utility = $self->{_utility};

package/project/.sdk/src/cmp/php/Config_php.ts

@@ -33,6 +33,77 @@ import {
 } from './utility_php'
 
 
+// PLUGIN DEFINITION REQUIRES AND THE feature_plugins ACCESSOR (the php peer
+// of cmp/rb/Config_rb.ts's rbPlugins and cmp/py/Config_py.ts's
+// pluginImports/pluginDefs).
+//
+// Upstream sekreto replaced its self-registration registry with
+// voxgig/plugin definitions: a provider kind the caller did not pass in via
+// `plugins: [...]` is unknown to that Sekreto. So config names each active
+// plugin's exported DEFINITION FUNCTION (the model's `def.php` map) and
+// hands the list to the feature.
+//
+// A METHOD rather than a constant, and this is php's own constraint: a
+// plugin definition holds CLOSURES (sekreto's Providers.php says so where
+// it declares `builtins()`), and php has no constant that can. The
+// `require_once` calls live INSIDE the method for the same reason upstream
+// puts them inside plugins.php's own accessors - a plugin file is read only
+// when a feature actually asks for its definitions.
+//
+// The `def` map is declared in the model rather than derived from filenames
+// because one file may export several definitions (sekreto's aws.php
+// exports awssecrets AND awsparams) - hence the de-duplication by path, so
+// a two-definition file yields ONE require_once. A def value is the file's
+// path under tm/php, which is this target's root and also config.php's own
+// directory, so the require is that path verbatim.
+//
+// GATED, like rb: the whole block is emitted only when an active feature
+// DECLARES a plugin catalogue for this target. An SDK that does not carry
+// the secrets feature must be byte-identical to what it was before the
+// feature existed, and an unread accessor is not a thing a simple SDK
+// should have to explain. The feature reads it through `method_exists`, so
+// its absence is not a load error.
+function phpPlugins(model: any, feature: any) {
+  const defs: Record<string, { paths: string[], syms: string[] }> = {}
+  let declared = false
+
+  each(feature, (f: any) => {
+    // `only_active: false`, and this is the whole subtlety: the feature
+    // object a component is handed has ALREADY been filtered, so asking it
+    // whether a catalogue EXISTS answers no as soon as every group is off.
+    // (Same trap helpers/featureSource documents one level down.)
+    const all = getModelPath(model, `main.${KIT}.feature.${f.name}.plugin`,
+      { required: false, only_active: false }) || {}
+
+    if (0 < Object.keys(all).length) {
+      declared = true
+    }
+
+    const paths: Record<string, true> = {}
+    const syms: string[] = []
+
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered: getting it wrong in this direction emits a
+      // require_once for a file the plugin trim just deleted - an SDK that
+      // does not load, rather than one that merely carries too much.
+      if (false === plugin.active || null == plugin.active) return
+
+      for (const [sym, one] of Object.entries(plugin.def?.php || {})) {
+        paths[String(one)] = true
+        syms.push(sym)
+      }
+    })
+
+    if (0 < syms.length) {
+      defs[f.name] = { paths: Object.keys(paths).sort(), syms: syms.sort() }
+    }
+  })
+
+  return { defs, declared }
+}
+
+
 const Config = cmp(async function Config(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -79,6 +150,39 @@ const Config = cmp(async function Config(props: any) {
   const { def: configDef, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
+  const { defs: pluginDefs, declared: pluginDeclared } = phpPlugins(model, feature)
+  const pluginFeatures = Object.keys(pluginDefs).sort()
+
+  // Emitted whenever a catalogue is declared, even with every group off:
+  // the feature asks for the list unconditionally, and an SDK whose chain
+  // is all built-ins still has to be answered with an empty one.
+  const featurePluginsBlock = !pluginDeclared ? '' : `
+    /**
+     * The sekreto plugin DEFINITIONS the model selected per feature, from
+     * the files the catalogue's active \`plugin.def\` entries declare.
+     * Handed to each feature (secrets builds its Sekreto with them): a
+     * provider kind not listed here is unknown to this SDK.
+     *
+     * A method rather than a constant: a definition holds closures, and PHP
+     * has no constant that can. The requires are INSIDE it, so a plugin
+     * file is read only when a feature asks for its definitions.
+     */
+    public static function feature_plugins(string $name): array
+    {
+` + (0 === pluginFeatures.length ? '' : `        switch ($name) {
+` + pluginFeatures.map((fname: string) => `            case "${fname}":
+` + pluginDefs[fname].paths.map(
+    (one: string) => `                require_once __DIR__ . '/${one}';\n`).join('') +
+`                return [
+` + pluginDefs[fname].syms.map(
+    (sym: string) => `                    \\Voxgig\\Sekreto\\Plugins\\${sym}(),\n`).join('') +
+`                ];
+`).join('') + `        }
+
+`) + `        return [];
+    }
+`
+
   File({ name: 'config.' + target.ext }, () => {
 
     Content(`<?php
@@ -248,7 +352,7 @@ configDef.entity, 3)},
     }
 
     Content(`
-
+${featurePluginsBlock}
     public static function make_feature(string $name)
     {
         require_once __DIR__ . '/features.php';

package/project/.sdk/src/cmp/php/Gitignore_php.ts

@@ -8,8 +8,10 @@ import {
 
 const Gitignore = cmp(async function Gitignore(_props: any) {
   File({ name: '.gitignore' }, () => {
-    Content(`# Composer
-vendor/
+    Content(`# Composer (the package root only: test/vendor/ is the vendored
+# omni test runner, generated output that a checkout must carry, and an
+# unanchored vendor/ silently kept it out of every commit and so out of CI)
+/vendor/
 composer.phar
 
 # PHPUnit

package/project/.sdk/src/cmp/php/Main_php.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
+  pluginExcludes,
   targetFeatures,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
@@ -45,7 +46,21 @@ const Main = cmp(async function Main(props: any) {
   // Copy tm/php files with replacements
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    // ANCHORED at the template root. Copy's exclude matches the
+    // SOURCE-RELATIVE path, so the old unanchored /src\// also pruned
+    // `feature/secrets/sekreto/src/` - the vendored sekreto core, whose
+    // directory depth is fixed by upstream and by the vendoring guard. The
+    // anchored form prunes the same top-level `tm/php/src/` placeholder
+    // tree (a `src` directory entry matches on the `$` arm, so the whole
+    // subtree is still pruned at the directory) and nothing else.
+    //
+    // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+    // group's declared files stay out of the tree - the model's `path`
+    // entries are target-root-relative, which is this Copy's root). With
+    // no active feature declaring a plugin catalogue it is EMPTY, so a
+    // simple SDK's output is unchanged. The FEATURE-level trim for php
+    // stays an add-time concern (vendor-tag rollout, Decision 5).
+    exclude: [/^src(\/|$)/, TEST_CONTROL_EXCLUDE, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }