@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/src/cmp/ocaml/Config_ocaml.ts

@@ -26,6 +26,106 @@ import {
 } from './utility_ocaml'
 
 
+// THE SECRETS BUILD MODEL, derived from the model ONCE and read by both the
+// Makefile fragment (Main_ocaml emits feature/secrets/feature.mk from it)
+// and the generated config (the definitions list and the bundled transport
+// below), so the two cannot disagree about which kinds are compiled.
+//
+// Upstream sekreto retired its self-registration registry for voxgig/plugin
+// definitions: a provider kind the caller did not pass in `~plugins` is
+// unknown to that Sekreto. So the model's choice of plugin groups IS the
+// SDK's provider vocabulary, and the generated code names each active
+// group's constructor (`def: ocaml:` in model/feature/secrets.aon -
+// `Hashicorp.plugin`, the `unit -> Defs.definition` each vendored kind
+// module defines) and nothing else. A symbol named here whose module the
+// plugin trim removed is an "Unbound module" at compile time - a loud
+// failure, which is the right kind.
+//
+// MODULE ORDER IS THE DEPENDENCY ORDER, written down (upstream's own
+// Makefile is the source): the voxgig/plugin host, the sekreto core, the
+// shared helpers, the kinds. The helpers are ungrouped in the model (see the
+// ocaml note at the head of its `plugin` block) and are listed here only
+// when a selected kind needs them - the transport chain (crypto, sigv4, tls,
+// http, httpjson) when an active group declares `needs.fetch`, the
+// child-process helper (runcmd) when any kind is on - because OCaml
+// compiles exactly what it is handed: an [env, memory] chain compiles the
+// two cores alone, and `secretspec` alone compiles runcmd.ml and no TLS.
+//
+// Null when the model does not activate `secrets` for this target. Read
+// with `only_active: false` on the plugin map (pluginExcludesFor's
+// subtlety: the feature object a component is handed has already been
+// filtered, so a feature whose groups are all off would look like one
+// with no plugin machinery).
+type SecretsBuild = {
+  groups: string[],
+  tlsGroups: string[],
+  tls: boolean,
+  plugin: string[],
+  core: string[],
+  helpers: string[],
+  kinds: string[],
+  syms: string[],
+}
+
+const SECRETS_PLUGIN_MODULES = [
+  'value', 'types', 'ref', 'version', 'capability', 'resolve', 'env',
+  'config', 'graph', 'order', 'export', 'depend', 'point', 'defs',
+  'catalog', 'host',
+].map((m) => 'feature/secrets/plugin/' + m + '.ml')
+
+const SECRETS_CORE_MODULES = ['json', 'secret', 'provider', 'sekreto']
+  .map((m) => 'feature/secrets/sekreto/' + m + '.ml')
+
+const SECRETS_TLS_HELPERS = ['crypto', 'sigv4', 'tls', 'http', 'httpjson']
+  .map((m) => 'feature/secrets/plugins/' + m + '.ml')
+
+const SECRETS_PROC_HELPERS = ['feature/secrets/plugins/runcmd.ml']
+
+function secretsBuild(model: Model, target: any): SecretsBuild | null {
+  const feature = targetFeatures(model, target)
+  if (null == (feature as any).secrets) return null
+
+  const declared = getModelPath(model,
+    `main.${KIT}.feature.secrets.plugin`,
+    { required: false, only_active: false }) || {}
+
+  const groups: string[] = []
+  const tlsGroups: string[] = []
+  const syms = new Set<string>()
+  const kinds = new Set<string>()
+
+  each(declared, (plugin: any) => {
+    // Filter on `active` HERE rather than trusting the feature object to
+    // arrive filtered (Config_go's note): getting this wrong names a
+    // constructor for a module the trim just deleted.
+    if (true !== plugin.active) return
+    const defs: Record<string, string> = plugin.def?.[target.name] || {}
+    if (0 === Object.keys(defs).length) return
+    groups.push(plugin.name)
+    if (true === plugin.needs?.fetch) tlsGroups.push(plugin.name)
+    for (const [sym, path] of Object.entries(defs)) {
+      syms.add(sym)
+      kinds.add(String(path))
+    }
+  })
+
+  const tls = 0 < tlsGroups.length
+  return {
+    groups: groups.sort(),
+    tlsGroups: tlsGroups.sort(),
+    tls,
+    plugin: SECRETS_PLUGIN_MODULES,
+    core: SECRETS_CORE_MODULES,
+    helpers: [
+      ...(tls ? SECRETS_TLS_HELPERS : []),
+      ...(0 < kinds.size ? SECRETS_PROC_HELPERS : []),
+    ],
+    kinds: Array.from(kinds).sort(),
+    syms: Array.from(syms).sort(),
+  }
+}
+
+
 // sdk_config.ml: make_config () builds the embedded API model as a value;
 // make_feature name is the N-feature-safe factory the client uses to
 // instantiate features named in the options (mirrors go/rust Config).
@@ -40,6 +140,8 @@ const Config = cmp(async function Config(props: any) {
   // helpers/applicability.
   const feature = targetFeatures(model, target)
 
+  const secrets = secretsBuild(model, target)
+
   // The canonical config OBJECT and its JSON, from the shared helper. Both
   // representations render from the same `def`, so they cannot describe
   // different configs - and this target picks up `options.server` (the OpenAPI
@@ -80,9 +182,6 @@ let config_data = "${ocamlString(configJson)}"
 
 let make_config () : value =
   Sdk_json.json_read config_data
-
-let make_feature (name : string) : feature =
-  match name with
 `)
     }
     else {
@@ -99,11 +198,76 @@ open Sdk_features
 
 let make_config () : value =
   ${formatOcamlValue(config, 1)}
+`)
+    }
 
-let make_feature (name : string) : feature =
+    // THE PLUGIN DEFINITIONS the model selected, per feature (the ocaml
+    // peer of Config_go's featurePlugins map). EMITTED UNCONDITIONALLY, so
+    // every generated config answers the same question - but typed as
+    // `Defs.definition list` only when the secrets feature is active: the
+    // `Defs` module is part of the vendored voxgig/plugin tree, which is
+    // compiled only then, so an inactive model gets the polymorphic empty
+    // list instead (`'a list`, which unifies with anything a caller
+    // expects). DELIBERATE DIVERGENCE from the c/lua accessors, whose
+    // untyped return (void**, a table) needs no such split.
+    if (null == secrets) {
+      Content(`
+(* The plugin definitions the model selected, per feature: none - no
+ * plugin-bearing feature is active in this SDK. *)
+let feature_plugins (_name : string) = []
+`)
+    }
+    else {
+      Content(`
+(* The plugin definitions the model selected for the secrets feature's
+ * provider chain${0 === secrets.groups.length ? ': none - the chain can name the four built-in kinds (env, memory, dotenv, file) and a custom provider, and nothing else' : ' (plugin groups: ' + secrets.groups.join(', ') + ')'}.
+ * Built, not held: every call is a fresh list, so two chains never share
+ * a definition. *)
+let feature_plugins (name : string) : Defs.definition list =
   match name with
+  | "secrets" -> [${0 === secrets.syms.length ? '' : '\n' + secrets.syms.map((sym: string) => '      ' + sym + ' ();\n').join('') + '    '}]
+  | _ -> []
+`)
+
+      // THE EXCHANGE TRANSPORT OF LAST RESORT (go's rawExchangeFetch): the
+      // vendored sekreto HTTP client, which the active plugin groups
+      // compile and link anyway (feature/secrets/feature.mk adds the OpenSSL binding on
+      // exactly this condition). It exists so an exchange works with
+      // ordinary SDK options - requiring a custom transport for the COMMON
+      // case would refuse every live token purchase before a request was
+      // made. Same result shape the system.fetch seam promises ({status,
+      // statusText, headers, body, json()}). With no such group the feature
+      // is built without it and a purchase with no options.system.fetch
+      // fails with a named error (see secrets_feature.ml).
+      if (secrets.tls) {
+        Content(`
+(* The token-exchange transport of last resort: the vendored sekreto HTTP
+ * client (plugins/http.ml over plugins/tls.ml), compiled because a plugin
+ * group needing a transport is active (${secrets.tlsGroups.join(', ')}).
+ * A network failure raises sekreto's own Sekreto_error, which the feature
+ * reports as the refusal. *)
+let secrets_transport (url : string) (fetchdef : value) : value =
+  let meth = match getp fetchdef "method" with Str s -> s | _ -> "POST" in
+  let headers = match getp fetchdef "headers" with
+    | Map _ as h ->
+      List.filter_map (fun k -> match getp h k with Str v -> Some (k, v) | _ -> None) (keysof h)
+    | _ -> [] in
+  let body = match getp fetchdef "body" with Str s -> Some s | _ -> None in
+  let res = Http.request meth url headers body in
+  let text = res.Http.body in
+  jo [("status", Num (float_of_int res.Http.status));
+      ("statusText", Str (if res.Http.status >= 400 then "ERR" else "OK"));
+      ("headers", empty_map ());
+      ("body", Str text);
+      ("json", json_thunk (try Sdk_json.json_read text with _ -> Noval))]
 `)
+      }
     }
+    // The factory, AFTER the definitions it names: OCaml binds top to bottom.
+    Content(`
+let make_feature (name : string) : feature =
+  match name with
+`)
 
     // ONLY THE FEATURES THIS PORT ACTUALLY IMPLEMENTS. Emitting an arm for a
     // name with no `<name>_feature` in tm/ocaml/sdk_features.ml is an
@@ -124,12 +288,26 @@ let make_feature (name : string) : feature =
       }
     })
 
+    // The secrets feature is the one ocaml feature that lives OUTSIDE
+    // sdk_features.ml (a container: feature/secrets_feature.ml plus the
+    // vendored trees), so its arm names its own module and hands it the
+    // definitions the model selected and, when a plugin group needing a
+    // transport is active, the bundled exchange transport. Emitted only
+    // when the feature is active: the module is not compiled otherwise
+    // (Main_ocaml's container gate, and the Makefile's feature/secrets/feature.mk).
+    if (null != secrets) {
+      Content(`  | "secrets" -> Secrets_feature.make ~plugins:(feature_plugins "secrets")${secrets.tls ? ' ~transport:secrets_transport' : ''} ()
+`)
+    }
+
     Content(`  | _ -> base_feature ()
 `)
+
   })
 })
 
 
 export {
-  Config
+  Config,
+  secretsBuild,
 }

package/project/.sdk/src/cmp/ocaml/Main_ocaml.ts

@@ -1,8 +1,10 @@
 
 import {
   cmp, each,
-  File, Content, Copy,
+  File, Content, Copy, Folder,
   entityClassName,
+  pluginExcludes,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -18,10 +20,24 @@ import {
 
 
 import { Package } from './Package_ocaml'
-import { Config } from './Config_ocaml'
+import { Config, secretsBuild } from './Config_ocaml'
 import { Gitignore } from './Gitignore_ocaml'
 import { MainEntity } from './MainEntity_ocaml'
 import { SdkError } from './SdkError_ocaml'
+import { entityModule, ocamlString } from './utility_ocaml'
+
+
+// Features whose source is a CONTAINER under the top-level feature/ dir,
+// beside the single template module (sdk_features.ml) every other ocaml
+// feature lives in. Today that is `secrets`: feature/secrets_feature.ml,
+// feature/secrets/ (the vendored @voxgig/sekreto port, the voxgig/plugin
+// host and the provider kinds - some forty modules of key-store,
+// request-signing and child-process code that an SDK which never asked for
+// secrets must not ship) and its shipped suite under test/feature/secrets/.
+// Anything named here is EXCLUDED from the verbatim copy unless the model
+// SELECTS the feature (see the Copy below). The lua and clojure targets gate
+// their containers the same way (Main_lua.ts, Main_clojure.ts).
+const CONTAINED = ['secrets']
 
 
 const Main = cmp(async function Main(props: any) {
@@ -30,6 +46,27 @@ const Main = cmp(async function Main(props: any) {
   const { model } = props.ctx$
 
   const entity: Record<string, ModelEntity> = getModelPath(model, `main.${KIT}.entity`)
+  // Gated by the applicability tags, so this target never names a feature
+  // it has no source for. One rule, one place: helpers/applicability.
+  const feature = targetFeatures(model, target)
+
+  // THE feature/<name>/ CONTAINER IS GATED HERE, at generate time - the
+  // top-level-container peer of the `srcFeatureExcludes` gate ts and js
+  // apply to src/feature/<name>/. `target add` keeps an unselected
+  // feature out of a project's tm/ in the first place (ocaml.aon has
+  // `feature: { trim: true }`); this covers a feature switched off after
+  // it was added, and the generator suite, which copies the whole scaffold
+  // tree. An inactive feature's vendored kind files go with it - every
+  // declared group's, not only the groups marked inactive, because
+  // pluginExcludes below walks only ACTIVE features (Main_c's
+  // inactivePluginExcludes, for the same reason one target over).
+  const containerExcludes = CONTAINED
+    .filter((name: string) => null == (feature as any)[name])
+    .flatMap((name: string) => [
+      new RegExp('(^|/)feature/' + name + '_feature\\.ml$'),
+      new RegExp('(^|/)feature/' + name + '/'),
+      new RegExp('(^|/)test/feature/' + name + '/'),
+    ])
 
   Package({ target })
 
@@ -42,15 +79,108 @@ const Main = cmp(async function Main(props: any) {
   // @voxgig/omni corpus engine) rides along verbatim - the replacements are
   // ProjectName-shaped and the port names nothing project-specific, so it
   // lands byte-identical to its recorded vendored.json digest.
+  //
+  // pluginExcludes: the generate-time plugin trim (an ACTIVE feature's
+  // INACTIVE plugin group's declared files stay out of the tree). The
+  // model's ocaml `path` entries are target-root-relative, which is this
+  // Copy's root - helpers/featureSource documents that getting the root
+  // wrong makes the trim a silent no-op. ocaml has `srcfeature: false`, so
+  // the per-feature Copy in cmp/Feature.ts - where pluginExcludesFor
+  // normally applies this trim - never runs for it, and this whole-tree
+  // Copy is the ONLY copy the target has (Main_go.ts precedent).
   Copy({
     from: 'tm/' + target.name,
     exclude: [/src\//, /\.(cmi|cmo|cmx|cma|cmxa|o|a)$/, /a\.out$/,
-      /run_sdk_test$/, /run_omni_smoke$/, /run_struct_corpus$/, /run_primary_corpus$/],
+      /run_sdk_test$/, /run_omni_smoke$/, /run_struct_corpus$/, /run_primary_corpus$/,
+      ...containerExcludes, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }
   })
 
+  // THE BUILD SEAM: feature/secrets/feature.mk, GENERATED only when the
+  // model activates `secrets` for this target. It is what only the model
+  // knows and only a Makefile can say in OCaml - the module list in
+  // DEPENDENCY ORDER (ocamlc compiles a module before anything that uses
+  // it and has no link-time reordering, so a wildcard over the vendored
+  // directories would not build), the -I paths, unix.cma for the dotenv
+  // and file built-ins, the gated suite, and, ONLY when an active plugin
+  // group declares `needs.fetch`, the OpenSSL binding: plugins/tls_stubs.c
+  // compiled and linked with `-custom -cclib -lssl -cclib -lcrypto`. The
+  // template Makefile includes `$(wildcard feature/*/feature.mk)` - it names
+  // no feature itself - and every variable a fragment sets is empty without
+  // one, so an SDK without secrets - or with the built-in
+  // chain alone, or with `secretspec` alone - runs no C compiler and links
+  // no OpenSSL. The shape lua's native.mk and c's kinds.c take.
+  //
+  // The vendored stub opens with the vendoring tool's three-line `(* *)`
+  // provenance header (every file under tm/ocaml is stamped in ocaml's
+  // comment syntax; the guard holds that), which a C compiler cannot
+  // read - so the rule feeds the compiler from line four, as lua's does.
+  // Compiler line numbers are therefore three lower than in the file.
+  const build = secretsBuild(model, target)
+  if (null != build) {
+    Folder({ name: 'feature' }, () => {
+      Folder({ name: 'secrets' }, () => {
+        File({ name: 'feature.mk' }, () => {
+          Content(`# ${model.const.Name} SDK: the secrets feature build.
+#
+# GENERATED because the model activates \`secrets\` for this target
+# (plugin groups: ${0 === build.groups.length ? 'none - the built-in kinds alone' : build.groups.join(', ')}).
+# An SDK whose model does not has no such file, and its Makefile's optional
+# include of it is a no-op: nothing of the feature is compiled. Do not
+# hand-edit - change the model's plugin groups and regenerate.
+#
+# MODULE ORDER IS THE DEPENDENCY ORDER: the voxgig/plugin host, the sekreto
+# core, the shared helpers the selected kinds open, the kinds, the feature.
+
+FEATURE_INC = -I +unix -I feature -I feature/secrets/plugin \\
+  -I feature/secrets/sekreto -I feature/secrets/plugins
+FEATURE_LIB = unix.cma
+
+SECRETS_PLUGIN = ${build.plugin.join(' \\\n  ')}
+
+SECRETS_CORE = ${build.core.join(' \\\n  ')}
+
+SECRETS_HELPERS =${0 === build.helpers.length ? '' : ' ' + build.helpers.join(' \\\n  ')}
+
+SECRETS_KINDS =${0 === build.kinds.length ? '' : ' ' + build.kinds.join(' \\\n  ')}
+
+FEATURE_SRC = $(SECRETS_PLUGIN) $(SECRETS_CORE) $(SECRETS_HELPERS) $(SECRETS_KINDS) \\
+  feature/secrets_feature.ml
+
+FEATURE_TESTS = test/feature/secrets/t_secrets.ml
+`)
+
+          if (build.tls) {
+            Content(`
+# THE ONE EXTERNAL DEPENDENCY, behind the plugin groups that need a
+# transport (${build.tlsGroups.join(', ')}): plugins/tls.ml's externals live in
+# plugins/tls_stubs.c against OpenSSL, so the stub is compiled here and the
+# bytecode executables are linked \`-custom\` with libssl and libcrypto.
+# The stub is fed from line four (past the provenance header, see above).
+OCAMLLIB = $(shell $(OCAMLC) -where)
+FEATURE_OBJ = feature/secrets/plugins/tls_stubs.o
+FEATURE_LINK = -custom -cclib -lssl -cclib -lcrypto
+
+feature/secrets/plugins/tls_stubs.o: feature/secrets/plugins/tls_stubs.c
+	@command -v $(CC) >/dev/null 2>&1 || { echo "secrets: a C compiler ($(CC)) is needed to build the OpenSSL binding that this SDK's secrets plugin kinds (${build.tlsGroups.join(', ')}) run - install one, or use only the built-in provider kinds" >&2; exit 1; }
+	tail -n +4 $< | $(CC) -std=c11 -O2 -Wall -Wextra -I$(OCAMLLIB) -x c - -c -o $@
+`)
+          }
+          else {
+            Content(`
+# No active plugin group needs a transport, so the OpenSSL binding is not
+# compiled and nothing is linked beyond the OCaml distribution.
+FEATURE_OBJ =
+FEATURE_LINK =
+`)
+          }
+        })
+      })
+    })
+  }
+
   // Generated API config + branded-error re-export.
   Config({ target })
   SdkError({ target })
@@ -109,6 +239,33 @@ let prepare (client : sdk_client) (fetchargs : value) : value =
     each(entity, (entity: ModelEntity) => {
       MainEntity({ target, entity })
     })
+
+    // Entity by NAME. DELIBERATE DIVERGENCE: OCaml has no dynamic dispatch
+    // over module names, so a caller that discovers entities from the config
+    // rather than naming a generated accessor - the shipped feature suites
+    // are templates and know no project's entity names - has no way to reach
+    // one without this. The go peer is the untyped interface go-cli/go-mcp
+    // dispatch through. None for a name this SDK did not generate.
+    const names = each(entity).map((e: ModelEntity) => e.name).sort()
+    if (0 === names.length) {
+      Content(`
+(* Entity by name: this SDK generated no entities. *)
+let entity (_client : sdk_client) (_name : string) (_entopts : value) : entity_obj option =
+  None
+`)
+    }
+    else {
+      Content(`
+(* Entity by name (None for a name this SDK did not generate). *)
+let entity (client : sdk_client) (name : string) (entopts : value) : entity_obj option =
+  match name with
+${names.map((name: string) => {
+        const mod = entityModule(name)
+        const Mod = mod.charAt(0).toUpperCase() + mod.slice(1)
+        return `  | "${ocamlString(name)}" -> Some (${Mod}.make client entopts)\n`
+      }).join('')}  | _ -> None
+`)
+    }
   })
 
 })

package/project/.sdk/src/cmp/ocaml/Package_ocaml.ts

@@ -9,17 +9,41 @@ import {
 
 
 import { packageName } from './utility_ocaml'
+import { secretsBuild } from './Config_ocaml'
 
 
 // <name>.opam — opam package metadata (publish is declared pending in the
 // model; the build itself is stock ocamlc via the Makefile and needs no opam
 // packages). Twin of rust Cargo.toml, but the runtime is dependency-free so
 // there is no depends list beyond the OCaml compiler.
+//
+// The secrets feature's build model is NOT emitted from here, unlike
+// Package_rust's rustls dependency table: the Makefile reads the generated
+// feature/secrets/feature.mk (Main_ocaml), which lists the vendored modules
+// in dependency order and turns the OpenSSL binding on only when a plugin
+// group needing a transport is active. What this manifest CAN state is the
+// system dependency that binding introduces - `depexts`, opam's word for a
+// distribution package - and it states it on exactly the same condition,
+// read from the same helper, so the two cannot drift.
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const target = props.target
   const model = ctx$.model
 
+  const secrets = secretsBuild(model, target)
+  const depexts = null != secrets && secrets.tls
+    ? `# The secrets feature's plugin groups (${secrets.tlsGroups.join(', ')}) bind
+# OpenSSL through the vendored plugins/tls_stubs.c (-lssl -lcrypto), the
+# one external dependency an ocaml SDK can have. Linked only because those
+# groups are active - see feature/secrets/feature.mk.
+depexts: [
+  ["libssl-dev"] {os-family = "debian"}
+  ["openssl-devel"] {os-family = "rhel"}
+  ["openssl"] {os = "macos" & os-distribution = "homebrew"}
+]
+`
+    : ''
+
   // WHO WROTE THIS PACKAGE. Per target, falling back to the model-wide value
   // and then to the publisher — so a manifest cannot go on naming Voxgig
   // while the model names someone else, which is exactly what the hardcoded
@@ -46,7 +70,7 @@ depends: [
 build: [
   [make "build"]
 ]
-`)
+${depexts}`)
   })
 })
 

package/project/.sdk/src/cmp/perl/Config_perl.ts

@@ -4,6 +4,8 @@ import {
   File,
   cmp,
   configDefinition,
+  each,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -12,6 +14,66 @@ import {
 } from '@voxgig/apidef'
 
 
+// PLUGIN DEFINITION IMPORTS AND THE FEATURE_PLUGINS TABLE (the perl peer
+// of cmp/py/Config_py.ts pluginImports/pluginDefs and cmp/go's
+// featurePlugins).
+//
+// Upstream sekreto replaced its self-registration registry with
+// voxgig/plugin definitions: a provider kind the caller did not pass in
+// via `plugins => [...]` is unknown to that Sekreto. So config imports
+// each active plugin's exported definition BY NAME (the model's
+// `def.perl` map) and hands the list to the feature through
+// FEATURE_PLUGINS.
+//
+// The `def` map is declared in the model rather than derived from
+// filenames because one module may export several definitions (sekreto's
+// Aws.pm exports awssecrets AND awsparams). A def value is the module's
+// path under tm/perl ('feature/secrets/plugins/Voxgig/Sekreto/Plugins/
+// Hashicorp.pm'); the vendored tree keeps upstream's PACKAGE layout, so
+// the module NAME is that path with the vendor root and the extension
+// removed and the separators turned into '::'.
+const PLUGIN_ROOT = 'feature/secrets/plugins/'
+
+
+function pluginModule(path: string): string {
+  return String(path)
+    .replace(new RegExp('^' + PLUGIN_ROOT), '')
+    .replace(/\.pm$/, '')
+    .replace(/\//g, '::')
+}
+
+
+// path -> [symbol, ...] for every ACTIVE plugin of every feature, so one
+// `use` line serves a two-definition module.
+function pluginsByPath(feature: any): Record<string, Record<string, string[]>> {
+  const out: Record<string, Record<string, string[]>> = {}
+
+  each(feature, (f: any) => {
+    const bypath: Record<string, string[]> = {}
+
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered: getting it wrong in this direction emits a `use`
+      // for a module the plugin trim just deleted - an SDK that does not
+      // LOAD, rather than one that merely carries too much. Config_py.ts
+      // records the same rule.
+      if (false === plugin.active || null == plugin.active) return
+
+      for (const [sym, one] of Object.entries(plugin.def?.perl || {})) {
+        const path = String(one)
+        ;(bypath[path] = bypath[path] || []).push(sym)
+      }
+    })
+
+    if (0 < Object.keys(bypath).length) {
+      out[f.name] = bypath
+    }
+  })
+
+  return out
+}
+
+
 // The config is emitted as a JSON heredoc parsed at load time by the
 // vendored struct utility (Voxgig::Struct::parse_json). This keeps
 // booleans/nulls faithful (Perl has no native boolean scalar) and yields
@@ -32,6 +94,70 @@ const Config = cmp(async function Config(props: any) {
 
   const configJson = JSON.stringify(configDef, null, 2)
 
+  // Gated by the applicability tags, so this target never imports a
+  // plugin definition it has no source for. One rule, one place:
+  // helpers/applicability.
+  const bypath = pluginsByPath(targetFeatures(model, target))
+  const features = Object.keys(bypath).sort()
+
+  // Every emitted line below is conditional on there being at least one
+  // active plugin definition: an SDK that selected no plugin group (or no
+  // secrets feature at all) gets exactly the config.pm it got before.
+  const vendorInc = 0 === features.length ? '' : `
+# The vendored sekreto and plugin ports keep their UPSTREAM package layout,
+# so they resolve through @INC rather than a file-path require - the same
+# convention feature/secrets_feature.pm and t/omni.pm use. This BEGIN runs
+# before the 'use' lines below, which are compile-time.
+BEGIN {
+  unshift @INC,
+    "$__dir/feature/secrets/sekreto",
+    "$__dir/feature/secrets/plugin",
+    "$__dir/feature/secrets/plugins";
+}
+`
+
+  let pluginUse = ''
+  let pluginTable = ''
+
+  if (0 < features.length) {
+    const lines: string[] = []
+    for (const fname of features) {
+      for (const path of Object.keys(bypath[fname]).sort()) {
+        const syms = Array.from(new Set(bypath[fname][path])).sort()
+        lines.push(`use ${pluginModule(path)} qw(${syms.join(' ')});`)
+      }
+    }
+    // A module shared by two features is imported once.
+    pluginUse = '\n' + Array.from(new Set(lines)).join('\n') + '\n'
+
+    const entries = features.map((fname) => {
+      const syms = Array.from(new Set(
+        Object.values(bypath[fname]).reduce(
+          (a: string[], b: string[]) => a.concat(b), []))).sort()
+      return `  '${fname}' => [ ${syms.map((s) => s + '()').join(', ')} ],`
+    })
+
+    pluginTable = `
+# THE SDK'S PROVIDER VOCABULARY, from the model's active plugin groups.
+#
+# sekreto's core ships four built-in kinds (env, memory, dotenv, file) and
+# nothing else: a kind not passed in here is UNKNOWN to that Sekreto. So
+# this table is what decides which vault, cloud, SaaS or CLI providers a
+# chain in this SDK may name - and an inactive group is not merely
+# unimported, its module is not generated at all.
+our %FEATURE_PLUGINS = (
+${entries.join('\n')}
+);
+
+sub feature_plugins {
+  my ($name) = @_;
+  $name = '' unless defined $name;
+  my $list = $FEATURE_PLUGINS{$name};
+  return defined $list ? $list : [];
+}
+`
+  }
+
   File({ name: 'config.pm' }, () => {
 
     Content(`# ${model.const.Name} SDK configuration
@@ -44,10 +170,10 @@ use Cwd ();
 
 my $__dir;
 BEGIN { $__dir = File::Basename::dirname(Cwd::abs_path(__FILE__)) }
-require(Cwd::abs_path("$__dir/lib/Voxgig/Struct.pm"));
+${vendorInc}require(Cwd::abs_path("$__dir/lib/Voxgig/Struct.pm"));
 
 package ${model.const.Name}Config;
-
+${pluginUse}
 # GENERATED from the API model - do not edit by hand. Parsed fresh on
 # each call so callers can safely mutate their copy.
 my $CONFIG_JSON = <<'END_CONFIG_JSON';
@@ -78,7 +204,7 @@ sub make_feature {
   require(Cwd::abs_path("$__dir/features.pm"));
   return ${model.const.Name}Features::make_feature($name);
 }
-
+${pluginTable}
 1;
 `)
   })