@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/src/cmp/js/fragment/Config.data.fragment.js

@@ -8,6 +8,22 @@ const FEATURE_CLASS = {
 }
 
 
+// Per-feature plugin DEFINITIONS (voxgig/plugin `Definition` values), from
+// the model's active plugin groups. A feature that takes a `plugins` option
+// (secrets over sekreto) reads its own entry; a feature with no plugins has
+// none. Named requires above make each definition statically reachable, so
+// an SDK carries exactly the plugin modules its model selects — the same
+// leanness the old side-effect registry imports bought, without a registry.
+//
+// Read by SecretsFeature through a DEFERRED require of this module: the
+// requires above make the pair circular, and this file replaces
+// module.exports at the end of its body, so anything reading the map at
+// module load would get undefined. See tm/js/src/feature/secrets.
+const FEATURE_PLUGINS = {
+  // #FeaturePlugins
+}
+
+
 // THE API MODEL, EMBEDDED AS DATA (sdkgen rung L1).
 //
 // The literal form of this file declares the whole model as nested object
@@ -53,5 +69,6 @@ class Config {
 const config = Object.assign(new Config(), JSON.parse(CONFIG_DATA))
 
 module.exports = {
-  config
+  config,
+  FEATURE_PLUGINS,
 }

package/project/.sdk/src/cmp/js/fragment/Config.fragment.js

@@ -8,6 +8,22 @@ const FEATURE_CLASS = {
 }
 
 
+// Per-feature plugin DEFINITIONS (voxgig/plugin `Definition` values), from
+// the model's active plugin groups. A feature that takes a `plugins` option
+// (secrets over sekreto) reads its own entry; a feature with no plugins has
+// none. Named requires above make each definition statically reachable, so
+// an SDK carries exactly the plugin modules its model selects — the same
+// leanness the old side-effect registry imports bought, without a registry.
+//
+// Read by SecretsFeature through a DEFERRED require of this module: the
+// requires above make the pair circular, and this file replaces
+// module.exports at the end of its body, so anything reading the map at
+// module load would get undefined. See tm/js/src/feature/secrets.
+const FEATURE_PLUGINS = {
+  // #FeaturePlugins
+}
+
+
 class Config {
 
   makeFeature(fn) {
@@ -54,6 +70,7 @@ class Config {
 const config = new Config()
 
 module.exports = {
-  config
+  config,
+  FEATURE_PLUGINS,
 }
 

package/project/.sdk/src/cmp/js/fragment/Main.fragment.js

@@ -7,6 +7,7 @@ const { ProjectNameEntityBase } = require('./ProjectNameEntityBase')
 
 
 const { BaseFeature } = require('./feature/base/BaseFeature')
+// #SecretsImport
 
 
 const stdutil = new Utility()
@@ -18,6 +19,7 @@ class ProjectNameSDK {
   _utility = new Utility()
   _features
   _rootctx
+  // #SecretsField
 
   constructor(options) {
 
@@ -90,6 +92,8 @@ class ProjectNameSDK {
     return this._utility.struct.clone(this._utility)
   }
 
+  // #SecretsAccessor
+
 
   async prepare(fetchargs) {
     const utility = this._utility
@@ -136,6 +140,8 @@ class ProjectNameSDK {
       }
     }
 
+    // #SecretsResolve
+
     // Apply SDK auth (apikey, auth prefix, etc.)
     const authResult = prepareAuth(ctx)
     if (authResult instanceof Error) {
@@ -332,6 +338,7 @@ const SDK = ProjectNameSDK
 module.exports = {
   stdutil,
   config,
+  // #SecretsExport
 
   BaseFeature,
   ProjectNameEntityBase,

package/project/.sdk/src/cmp/kotlin/Config_kotlin.ts

@@ -87,6 +87,58 @@ const Config = cmp(async function Config(props: any) {
   // while its data config had them. One rule, one place.
   const entityConfig = configDef.entity
 
+  // THE PLUGIN DEFINITIONS the model selected, per feature.
+  //
+  // sekreto's contract since the registry was retired: a kind not passed
+  // in `plugins` is unknown to that Sekreto, so the model's choice of
+  // plugin groups IS the SDK's provider vocabulary. This walks the
+  // catalogue's active `plugin.def.kotlin` entries and hands the list to
+  // the feature through `Config.featurePlugins`.
+  //
+  // Kotlin's Definition symbols are PLAIN TOP-LEVEL VALS
+  // (`val hashicorp: Definition = providerplugin("hashicorp") {...}`), so
+  // the def key is the val name and the import is that name qualified by
+  // the file's package - DERIVED from the def path (`feature/secrets/
+  // sekreto/plugins/Hashicorp.kt` -> `feature.secrets.sekreto.plugins`)
+  // rather than hardcoding `secrets`, exactly as the go emitter does.
+  //
+  // Emitted in core, which already names KOTLINPACKAGE.feature classes in
+  // makeFeature - Kotlin has no package-cycle rule, so nothing here can
+  // introduce one. The feature reads it back as List<Any?> and filters by
+  // type, so a tree with the feature present but no group selected still
+  // compiles with no import at all.
+  const pluginImports = new Set<string>()
+  const featurePlugins: Record<string, string[]> = {}
+
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered: getting this wrong emits an import for a file the
+      // plugin trim just deleted, and the SDK does not compile.
+      if (false === plugin.active || null == plugin.active) return
+      for (const [sym, one] of Object.entries(plugin.def?.kotlin || {})) {
+        const dir = String(one).replace(/\/[^/]+$/, '').replace(/\//g, '.')
+        // A dotted symbol (another language's class-qualified spelling)
+        // imports its HEAD; kotlin's own keys are bare val names.
+        pluginImports.add(
+          kotlinpackage + '.' + dir + '.' + String(sym).split('.')[0])
+        syms.push(sym)
+      }
+    })
+    if (0 < syms.length) {
+      featurePlugins[f.name] = syms.sort()
+    }
+  })
+
+  const pluginImportBlock = Array.from(pluginImports).sort()
+    .map((one: string) => 'import ' + one + '\n').join('')
+
+  const featurePluginsBlock =
+    Object.keys(featurePlugins).sort().map((fname: string) =>
+      '    "' + fname + '" to listOf(' +
+      featurePlugins[fname].join(', ') + '),\n').join('')
+
   const config = {
     main: configDef.main,
     feature: featureConfig,
@@ -99,7 +151,7 @@ const Config = cmp(async function Config(props: any) {
     Content(`package ${kotlinpackage}.core
 
 import ${kotlinpackage}.utility.Json
-
+${pluginImportBlock}
 /** Static SDK configuration and by-name feature construction. */
 @Suppress("UNCHECKED_CAST")
 object Config {
@@ -139,6 +191,16 @@ object Config {
     }
   }
 
+  // The plugin definitions the model selected per feature, as List<Any?>
+  // so core need not name a feature's types. Empty when no active feature
+  // declares active plugin groups for this target - and then no plugin
+  // import is emitted either.
+  private val featurePluginsMap: Map<String, List<Any?>> = mapOf(
+${featurePluginsBlock}  )
+
+  // featurePlugins is the definitions list for one feature's chain.
+  fun featurePlugins(name: String): List<Any?> = featurePluginsMap[name] ?: emptyList()
+
   private fun configJson(): String {
     val b = StringBuilder()
 `)

package/project/.sdk/src/cmp/kotlin/Main_kotlin.ts

@@ -4,7 +4,8 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Copy, Folder, Fragment,
-  TEST_CONTROL_EXCLUDE
+  TEST_CONTROL_EXCLUDE,
+  pluginExcludes
 } from '@voxgig/sdkgen'
 
 
@@ -48,10 +49,39 @@ const Main = cmp(async function Main(props: any) {
   // token used throughout the templates (package/import statements).
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+    // group's declared files stay out of the tree - the model's `path`
+    // entries are target-root-relative, which is this Copy's root). Without
+    // it every plugin group ships regardless of the model and the def maps
+    // decide nothing; an exclude that matches nothing is indistinguishable
+    // from no exclude at all, which is how this went wrong before.
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
       KOTLINPACKAGE: kotlinpackage,
+
+      // The vendored sekreto port carries upstream's own package root, and
+      // a generated SDK must not publish classes in it: a Maven artifact
+      // declaring `com.voxgig.sekreto` collides with the real library on
+      // any consumer classpath. It would not COMPILE either - the vendor
+      // route's `adapt` for this library matches only Sekreto.kt and
+      // Support.kt, so the other fifteen sekreto files still declare
+      // `package com.voxgig.sekreto` while those two moved, and every
+      // cross-file reference is unresolved.
+      //
+      // Done HERE, the way Main_go rewrites the placeholder
+      // `github.com/voxgig/struct` import, because this Copy is the one
+      // seam every vendored file crosses on its way into an SDK. It is a
+      // NO-OP for a file the vendor route already rewrote, so widening
+      // that route's `adapt.match` to the whole `feature/secrets/`
+      // directory simply retires this line.
+      //
+      // (The sibling `voxgig.plugin` rewrite is NOT needed: that route's
+      // adapt already matches the whole `feature/secrets/plugin/` tree,
+      // and the token appears nowhere in tm/kotlin. A replace that matches
+      // nothing is indistinguishable from no replace at all, so it is not
+      // carried "just in case".)
+      'com.voxgig.sekreto': kotlinpackage + '.feature.secrets.sekreto',
     }
   })
 

package/project/.sdk/src/cmp/lua/Config_lua.ts

@@ -33,6 +33,58 @@ import {
 } from './utility_lua'
 
 
+// PLUGIN DEFINITION REQUIRES AND THE FEATURE PLUGINS TABLE (the lua peer
+// of cmp/py/Config_py.ts's pluginImports/pluginDefs).
+//
+// Upstream sekreto replaced its self-registration registry with
+// voxgig/plugin definitions: a provider kind the caller did not pass in via
+// `plugins = { ... }` is unknown to that Sekreto. So the generated
+// config_plugins module requires each active plugin's module and names the
+// FIELD it exports (the model's `def.lua` map - `hashicorp` on
+// plugins/hashicorp.lua, `awssecrets` AND `awsparams` on plugins/aws.lua),
+// handing the list to the feature.
+//
+// A def value is the module's path under tm/lua, this target's root; the
+// require is that path with `.lua` stripped and slashes turned to dots,
+// resolved by the plain `?.lua` searcher every generated lua SDK relies on.
+// One `local` per module, so a two-definition module is required once.
+function pluginRequires(feature: any): { locals: string[], defs: Record<string, string[]> } {
+  const bypath: Record<string, { local: string, syms: string[] }> = {}
+  const defs: Record<string, string[]> = {}
+
+  each(feature, (f: any) => {
+    const syms: string[] = []
+
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered: getting it wrong in this direction emits a
+      // require for a module the plugin trim just deleted - an SDK that
+      // does not load, rather than one that merely carries too much.
+      if (false === plugin.active || null == plugin.active) return
+
+      for (const [sym, one] of Object.entries(plugin.def?.lua || {})) {
+        const path = String(one)
+        const local = path.replace(/^.*\//, '').replace(/\.lua$/, '')
+        const entry = (bypath[path] = bypath[path] || { local: 'plugin_' + local, syms: [] })
+        entry.syms.push(sym)
+        syms.push(entry.local + '.' + sym)
+      }
+    })
+
+    if (0 < syms.length) {
+      defs[f.name] = syms.sort()
+    }
+  })
+
+  const locals = Object.keys(bypath).sort().map((path: string) => {
+    const mod = path.replace(/\.lua$/, '').replace(/\//g, '.')
+    return `local ${bypath[path].local} = require("${mod}")`
+  })
+
+  return { locals, defs }
+}
+
+
 const Config = cmp(async function Config(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -187,6 +239,42 @@ return make_config
 `)
   })
 
+  // The plugin definitions the model selected per feature, as a module of
+  // the config family. ALWAYS emitted, even with nothing declared: the
+  // secrets feature requires it (a missing module and a broken one must
+  // read differently there), and a feature source arrives in the tree by
+  // Main's blanket copy whether or not the model declares the feature.
+  //
+  // A sibling module rather than a member of `config`, for the reason
+  // config_shared is: `config` returns a bare function.
+  const plugins = pluginRequires(feature)
+
+  File({ name: 'config_plugins.' + target.ext }, () => {
+    Content(`-- ${model.const.Name} SDK feature plugin definitions
+--
+-- The sekreto plugin DEFINITIONS the model selected per feature, required
+-- below from the modules the catalogue's active \`plugin.def\` entries
+-- declare. Handed to each feature (secrets builds its Sekreto with them):
+-- a provider kind not listed here is unknown to this SDK - the four
+-- built-in kinds (env, memory, dotenv, file) come with the core and never
+-- appear here.
+${0 < plugins.locals.length ? '\n' + plugins.locals.join('\n') + '\n' : ''}
+
+local FEATURE_PLUGINS = {
+${Object.keys(plugins.defs).sort().map((fname: string) =>
+  `  ["${fname}"] = {\n` +
+  plugins.defs[fname].map((sym: string) => `    ${sym},\n`).join('') +
+  `  },\n`).join('')}}
+
+
+-- The definitions list for one feature's chain; empty when the model
+-- selected no plugin group for it.
+return function(name)
+  return FEATURE_PLUGINS[name] or {}
+end
+`)
+  })
+
   // A sibling module rather than a member of `config`: `config` returns a
   // bare function (`require("config")()`), and turning it into a table would
   // change its observable type for any consumer holding it as a factory.

package/project/.sdk/src/cmp/lua/Gitignore_lua.ts

@@ -16,6 +16,10 @@ const Gitignore = cmp(async function Gitignore(_props: any) {
 *.dylib
 *.dll
 
+# The sekreto transport helper the secrets feature's plugin kinds run,
+# compiled by \`make build\` from feature/secrets/native/sekretonet.c
+feature/secrets/native/sekreto-net
+
 # LuaRocks
 .luarocks/
 lua_modules/

package/project/.sdk/src/cmp/lua/Main_lua.ts

@@ -4,7 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
-  targetFeatures,
+  targetFeatures, pluginExcludes,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
 
@@ -27,6 +27,18 @@ import { MainEntity } from './MainEntity_lua'
 import { EntityTypes } from './EntityTypes_lua'
 
 
+// Features whose source is a CONTAINER under the top-level feature/ dir,
+// beside the flat `<name>_feature.lua` every other lua feature is. Today
+// that is `secrets`: its folder holds a vendored @voxgig/sekreto port, the
+// voxgig/plugin runtime and the C transport helper - some forty files of
+// key-store, request-signing and child-process code that an SDK which never
+// asked for secrets must not ship. Anything named here is EXCLUDED from the
+// verbatim copy unless the model SELECTS the feature (see the Copy below);
+// its shipped test suite under test/feature/<name>/ goes with it. The
+// clojure target gates its container the same way (Main_clojure.ts).
+const CONTAINED = ['secrets']
+
+
 const Main = cmp(async function Main(props: any) {
 
   const { target } = props
@@ -42,15 +54,93 @@ const Main = cmp(async function Main(props: any) {
 
   Gitignore({})
 
-  // Copy tm/lua files with replacements
+  // THE feature/<name>/ CONTAINER IS GATED HERE, at generate time - the
+  // top-level-container peer of the `srcFeatureExcludes` gate ts and js
+  // apply to src/feature/<name>/. `target add` keeps an unselected
+  // feature out of a project's tm/ in the first place; this covers a
+  // feature switched off after it was added, and the generator suite,
+  // which copies the whole scaffold tree.
+  const containerExcludes = CONTAINED
+    .filter((name: string) => null == feature[name])
+    .flatMap((name: string) => [
+      new RegExp('(^|/)feature/' + name + '_feature\\.lua$'),
+      new RegExp('(^|/)feature/' + name + '/'),
+      new RegExp('(^|/)test/feature/' + name + '/'),
+    ])
+
+  // Copy tm/lua files with replacements.
+  //
+  // pluginExcludes: the generate-time plugin trim (an ACTIVE feature's
+  // INACTIVE plugin group's declared files stay out of the tree). The
+  // model's lua `path` entries are target-root-relative, which is this
+  // Copy's root - helpers/featureSource documents that getting the root
+  // wrong makes the trim a silent no-op.
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE,
+      ...containerExcludes, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }
   })
 
+  // THE NATIVE BUILD SEAM. sekreto's lua PLUGIN kinds (hashicorp, aws, ...)
+  // run a small compiled transport helper, because Lua 5.4 has no sockets
+  // and no TLS; the four built-in kinds never reach it. The helper's
+  // source is vendored with the feature (feature/secrets/native/
+  // sekretonet.c) and the template Makefile `-include`s this fragment, so
+  // it is compiled - and OpenSSL linked - ONLY when the model activates a
+  // plugin group that lua has definitions for. An SDK without secrets, or
+  // with the built-in chain alone, gets no fragment, no compiler run and
+  // no OpenSSL dependency.
+  //
+  // The vendored file opens with the vendoring tool's three-line `--`
+  // provenance header (every file under tm/lua is stamped in lua's comment
+  // syntax; the guard holds that), which the C compiler cannot read - so
+  // the rule feeds the compiler from line four. Line numbers in a compiler
+  // diagnostic are therefore three lower than in the file.
+  const nativeGroups: string[] = []
+  each(feature, (f: any) => {
+    each(f.plugin, (plugin: any) => {
+      if (false === plugin.active || null == plugin.active) return
+      if (0 < Object.keys(plugin.def?.lua || {}).length) {
+        nativeGroups.push(f.name + '.' + plugin.name)
+      }
+    })
+  })
+
+  if (0 < nativeGroups.length) {
+    Folder({ name: 'feature' }, () => {
+      Folder({ name: 'secrets' }, () => {
+        File({ name: 'native.mk' }, () => {
+          Content(`# ${model.const.Name} SDK: the sekreto transport helper build.
+#
+# GENERATED because a secrets plugin group is active
+# (${nativeGroups.sort().join(', ')}): the plugin provider kinds run this
+# helper for every socket and child process, since Lua 5.4 has none. An
+# SDK without an active plugin group has no such file, and its Makefile's
+# optional include of it is a no-op - nothing is compiled and OpenSSL is
+# not linked.
+#
+# The source carries the vendoring tool's three-line provenance header in
+# lua comment syntax, which the compiler cannot read: it is fed the file
+# from line four. Compiler line numbers are therefore three lower than the
+# file's.
+NATIVE := feature/secrets/native/sekreto-net
+
+CC ?= cc
+CFLAGS ?= -std=c11 -O2 -Wall -Wextra
+LDLIBS ?= -lssl -lcrypto
+
+feature/secrets/native/sekreto-net: feature/secrets/native/sekretonet.c
+	@command -v $(CC) >/dev/null 2>&1 || { echo "secrets: a C compiler ($(CC)) is needed to build the sekreto transport helper that this SDK's plugin provider kinds run - install one, or use only the built-in provider kinds" >&2; exit 1; }
+	tail -n +4 $< | $(CC) $(CFLAGS) -x c - -o $@ $(LDLIBS)
+`)
+        })
+      })
+    })
+  }
+
   // Generate main SDK file
   File({ name: model.name + '_sdk.' + target.ext }, () => {
 

package/project/.sdk/src/cmp/lua/Package_lua.ts

@@ -23,6 +23,43 @@ import type {
 } from '@voxgig/apidef'
 
 
+// The vendored modules the secrets feature needs whatever its chain names
+// (ts/vendor/routes.json `sekreto/lua` and `plugin/lua`, minus the plugin
+// KINDS, which are listed per active group from the model). Held to the
+// vendored tree by ts/test/generate.test.ts's lua secrets case.
+const SECRETS_CORE_MODULES = [
+  'feature/secrets/sekreto',
+  'feature/secrets/sekreto/addr',
+  'feature/secrets/sekreto/err',
+  'feature/secrets/sekreto/name',
+  'feature/secrets/sekreto/providers',
+  // The shared plugin helpers, in no group: httpjson (eight kinds), net
+  // (httpjson, boru, secretspec), json and support (every kind), crypto
+  // (aws AND gcpsecrets - two groups, so neither may own it).
+  'feature/secrets/sekreto/plugins/crypto',
+  'feature/secrets/sekreto/plugins/httpjson',
+  'feature/secrets/sekreto/plugins/json',
+  'feature/secrets/sekreto/plugins/net',
+  'feature/secrets/sekreto/plugins/support',
+  'feature/secrets/plugin',
+  'feature/secrets/plugin/capability',
+  'feature/secrets/plugin/catalog',
+  'feature/secrets/plugin/config',
+  'feature/secrets/plugin/depend',
+  'feature/secrets/plugin/env',
+  'feature/secrets/plugin/export',
+  'feature/secrets/plugin/graph',
+  'feature/secrets/plugin/host',
+  'feature/secrets/plugin/json',
+  'feature/secrets/plugin/order',
+  'feature/secrets/plugin/point',
+  'feature/secrets/plugin/ref',
+  'feature/secrets/plugin/resolve',
+  'feature/secrets/plugin/types',
+  'feature/secrets/plugin/version',
+]
+
+
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
@@ -81,6 +118,15 @@ dependencies = {
     // rock exists to depend on - station design 9.2's registry-less tier).
     // Gated: a feature that does not apply to lua must not be listed
     // as a rockspec module — the require would not resolve.
+    //
+    // The secrets feature carries the VENDORED sekreto core, the
+    // voxgig/plugin runtime and the shared plugin helpers (no sekreto or
+    // plugin rock exists to depend on); the plugin KINDS themselves are
+    // listed from the model's active `def.lua` entries, so a trimmed
+    // group's modules are not claimed. The compiled transport helper the
+    // plugin kinds run is NOT a rock module: `build.type = "builtin"`
+    // cannot produce an executable, so an install-from-rock carries the
+    // helper's source and `make build` compiles it where the SDK runs.
     const feature = targetFeatures(model, target)
     let featureModules = `    ["feature.base_feature"] = "feature/base_feature.lua",\n`
     each(feature, (f: any) => {
@@ -90,6 +136,19 @@ dependencies = {
         featureModules +=
           `    ["feature.station.voxgig_station"] = "feature/station/voxgig_station.lua",\n`
       }
+      if ('secrets' === f.name) {
+        const mods = [...SECRETS_CORE_MODULES]
+        each(f.plugin, (plugin: any) => {
+          if (false === plugin.active || null == plugin.active) return
+          for (const one of Object.values(plugin.def?.lua || {})) {
+            mods.push(String(one).replace(/\.lua$/, ''))
+          }
+        })
+        for (const mod of Array.from(new Set(mods)).sort()) {
+          featureModules +=
+            `    ["${mod.replace(/\//g, '.')}"] = "${mod}.lua",\n`
+        }
+      }
     })
 
     Content(`}
@@ -99,6 +158,7 @@ build = {
     ["${model.name}_sdk"] = "${model.name}_sdk.lua",
     ["config"] = "config.lua",
     ["config_shared"] = "config_shared.lua",
+    ["config_plugins"] = "config_plugins.lua",
     ["features"] = "features.lua",
 ${featureModules}  }
 }

package/project/.sdk/src/cmp/lua/fragment/Main.fragment.lua

@@ -85,6 +85,16 @@ function ProjectNameSDK.new(options)
     end
   end
 
+  -- CONSUMED, not kept. `extend` holds feature INSTANCES, and every shipped
+  -- feature's init stores `self.client = ctx.client` - so leaving the list
+  -- in self.options makes the options map CYCLIC (client.options.extend[1]
+  -- .client == client), and options_map()'s vs.clone, which has no cycle
+  -- guard, blew the stack on the first prepare_auth of any client built with
+  -- an extend feature. The instances live on self.features from here on,
+  -- which is the only place anything reads them; the SAME table is
+  -- self._rootctx.options, so the root context loses the key too.
+  self.options["extend"] = nil
+
   -- Initialize features.
   for _, f in ipairs(self.features) do
     utility.feature_init(self._rootctx, f)