@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/model/feature/secrets.aon

@@ -65,7 +65,87 @@ main: kit: feature: secrets: {
     #
     # plugins/httpjson.ts is likewise in no group: it is the shared HTTP
     # helper eight plugins import, so it ships with the feature core.
+    #
+    # php has a SECOND such file: plugins/runcmd.php, the child-process
+    # helper that boru.php (`vault`) and secretspec.php (`secretspec`)
+    # both require. It spans two groups, so no group may own it - trimming
+    # either one would delete a file the other group's plugin requires.
+    #
+    # java has THREE such files, and the third is the surprising one.
+    # plugins/Httpjson.java is the shared HTTP helper (eight plugins
+    # import it) and plugins/Proc.java the child-process helper Boru
+    # (`vault`) and Secretspec (`secretspec`) both use - the php story,
+    # one language over. plugins/Sigv4.java is NOT aws-only in this port:
+    # its package-private `uriescape` is also called by Doppler and
+    # Infisical and Onepassword (`saas`) and by Azuresecrets (`cloud`), so
+    # listing it under `aws` would let a saas-only trim delete a file
+    # three other kinds compile against - and javac, which does no
+    # dead-code elimination, fails the whole build on it. All three ship
+    # with the java feature core and belong to NO group. The cost is real
+    # and stated rather than hidden: a secrets-enabled java SDK links
+    # HMAC-SHA256 and a ProcessBuilder call even with no group active.
+    #
+    # scala repeats the java Sigv4 story exactly, and it was got WRONG
+    # first: plugins/Sigv4.scala was listed under `aws`, and its
+    # `private[plugins] def uriescape` is called by Doppler, Infisical and
+    # Onepassword (`saas`) and by Azuresecrets (`cloud`). A saas-only trim
+    # then deleted it and scalac failed the SDK with four "Not found:
+    # uriescape"; a cloud-only trim, with two. It ships with the scala
+    # feature core and belongs to NO group. plugins/Httpjson.scala is the
+    # other ungrouped scala file, and it is BOTH helpers in one: `fetchjson`
+    # (eight plugins) and `runcmd`, the ProcessBuilder helper Boru (`vault`)
+    # and Secretspec (`secretspec`) share, which is why scala needs two
+    # ungrouped files where java needs three. Those two are the whole set:
+    # every `private[plugins]` symbol crossing a file boundary is defined in
+    # Httpjson.scala or Sigv4.scala, and nothing else is shared.
 
+    #
+    # c has the shared-helper shape too, and five files of it, every one
+    # verified by a symbol scan of the port at the tag rather than read off
+    # a comment: plugins/httpjson.c (the socket HTTP client eight kinds
+    # call), plugins/tls.c (its OpenSSL binding - the ONLY file that names
+    # OpenSSL), plugins/encode.c (`sek_uriescape` for four stores and
+    # base64 for two), plugins/clock.c (token renewal time, SigV4's
+    # timestamp) and plugins/proc.c (`sek_runcmd`, for boru in `vault` AND
+    # secretspec in `secretspec`). All five belong to NO group. The two
+    # plugin headers (sekretoplugins.h, support.h) are ungrouped for the
+    # same reason. What makes c different from java/scala is that the
+    # Makefile can see the trim: it compiles these helpers, and links
+    # OpenSSL, only when at least one KIND file survived, so an
+    # [env, memory] chain compiles the sekreto and voxgig/plugin cores
+    # alone and links libc alone. sha256.c and sigv4.c are NOT shared in c
+    # (aws.c is their only caller) and go with `aws`.
+    #
+    # ocaml has the java/scala Sigv4 shape AND the c Makefile-visible
+    # trim, verified by an `open`/qualifier scan of the port at the tag:
+    # plugins/sigv4.ml's `uriescape` is called by azuresecrets (`cloud`)
+    # and by doppler, infisical and onepassword (`saas`), plugins/crypto.ml
+    # is sigv4.ml's only caller but must compile before it, and
+    # plugins/runcmd.ml (the child-process helper) is opened by boru
+    # (`vault`) AND secretspec (`secretspec`). The transport chain
+    # plugins/httpjson.ml -> http.ml -> tls.ml (+ tls_stubs.c, the OpenSSL
+    # binding) is opened by every HTTPS kind. All seven belong to NO
+    # group. What makes the cost zero when no kind needs them is the
+    # generated feature/secrets/feature.mk (Main_ocaml): OCaml compiles
+    # exactly the modules it is handed, in the order it is handed them, so
+    # the fragment lists the transport helpers (and compiles the stub,
+    # linking OpenSSL) only when an active group declares `needs.fetch`,
+    # and runcmd.ml only when any kind is active. A chain of built-ins,
+    # or `secretspec` alone, compiles neither and links no OpenSSL.
+    #
+    # cpp has four ungrouped shared helpers, read off the port's own
+    # include lines at the tag rather than off a comment: plugins/Httpjson
+    # .cpp (the socket HTTP client eight kinds include), plugins/Tls.cpp
+    # (its OpenSSL binding, included by Httpjson.cpp - the ONLY file that
+    # names OpenSSL), plugins/Crypto.cpp (SHA-256/HMAC, included by Tls.cpp
+    # AND Sigv4.cpp) and plugins/Proc.cpp (`runcmd`, for Boru in `vault`
+    # AND Secretspec in `secretspec`). All four belong to NO group, .hpp
+    # and .cpp alike. Sigv4.{cpp,hpp} is included by Aws.cpp alone
+    # (upstream's own `make lean` asserts only aws needs a digest) and goes
+    # with `aws`. As in c, the Makefile can see the trim: it compiles the
+    # helpers, and links OpenSSL, only when at least one KIND file survived,
+    # so an [env, memory] chain compiles the sekreto and voxgig/plugin cores
+    # alone and links libstdc++ alone.
     vault: {
       title: 'HashiCorp Vault and boru'
       needs: { fs: true, fetch: true }
@@ -74,8 +154,48 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/boru.ts'
         'feature/secrets/plugins/hashicorp/hashicorp.go'
         'feature/secrets/plugins/boru/boru.go'
+        'feature/secrets/plugins/hashicorp.rs'
+        'feature/secrets/plugins/boru.rs'
         'feature/secrets/voxgig_sekreto/plugins/hashicorp.py'
         'feature/secrets/voxgig_sekreto/plugins/boru.py'
+        'src/feature/secrets/sekreto/plugins/hashicorp.js'
+        'src/feature/secrets/sekreto/plugins/boru.js'
+        'feature/secrets/voxgig_sekreto/plugins/hashicorp.rb'
+        'feature/secrets/voxgig_sekreto/plugins/boru.rb'
+        'feature/secrets/sekreto/plugins/hashicorp.php'
+        'feature/secrets/sekreto/plugins/boru.php'
+        'feature/secrets/plugins/Hashicorp.cs'
+        'feature/secrets/plugins/Boru.cs'
+        'feature/secrets/sekreto/plugins/Hashicorp.java'
+        'feature/secrets/sekreto/plugins/Boru.java'
+        'feature/secrets/sekreto/plugins/Hashicorp.scala'
+        'feature/secrets/sekreto/plugins/Boru.scala'
+        'feature/secrets/sekreto/plugins/Hashicorp.kt'
+        'feature/secrets/sekreto/plugins/Boru.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Hashicorp.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Boru.pm'
+        'lib/feature/secrets/sekreto/plugins/hashicorp.dart'
+        'lib/feature/secrets/sekreto/plugins/boru.dart'
+        'feature/secrets/sekreto/plugins/hashicorp.ex'
+        'feature/secrets/sekreto/plugins/boru.ex'
+        'feature/secrets/voxgig/sekreto/plugins/hashicorp.clj'
+        'feature/secrets/voxgig/sekreto/plugins/boru.clj'
+        'feature/secrets/plugins/Hashicorp.swift'
+        'feature/secrets/plugins/Boru.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Hashicorp.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Boru.lean'
+        'feature/secrets/plugins/hashicorp.c'
+        'feature/secrets/plugins/boru.c'
+        'feature/secrets/sekreto/plugins/hashicorp.lua'
+        'feature/secrets/sekreto/plugins/boru.lua'
+        'feature/secrets/plugins/hashicorp.zig'
+        'feature/secrets/plugins/boru.zig'
+        'feature/secrets/plugins/hashicorp.ml'
+        'feature/secrets/plugins/boru.ml'
+        'feature/secrets/plugins/Hashicorp.cpp'
+        'feature/secrets/plugins/Hashicorp.hpp'
+        'feature/secrets/plugins/Boru.cpp'
+        'feature/secrets/plugins/Boru.hpp'
       ]
       def: ts: {
         hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.ts'
@@ -87,6 +207,14 @@ main: kit: feature: secrets: {
         'hashicorp.Plugin': 'feature/secrets/plugins/hashicorp/hashicorp.go'
         'boru.Plugin': 'feature/secrets/plugins/boru/boru.go'
       }
+      # rust: module-qualified `pub fn` paths under
+      # feature/secrets/plugins/ (Main_rust emits the plugins.rs module
+      # index from these, one `pub mod` per owning file). The path is
+      # target-root-relative, as go's is.
+      def: rust: {
+        'hashicorp::plugin': 'feature/secrets/plugins/hashicorp.rs'
+        'boru::plugin': 'feature/secrets/plugins/boru.rs'
+      }
       # py: module paths relative to the SDK package root (Main_py copies
       # tm/py/pkg INTO <name>_sdk/, so the trim patterns drop the leading
       # pkg/ while Config_py derives the import module from it).
@@ -94,6 +222,220 @@ main: kit: feature: secrets: {
         hashicorp: 'pkg/feature/secrets/voxgig_sekreto/plugins/hashicorp.py'
         boru: 'pkg/feature/secrets/voxgig_sekreto/plugins/boru.py'
       }
+      # rb: constant names under VoxgigSekreto::Plugins, and the module
+      # path under tm/rb that config.rb turns into a require_relative
+      # (target-root-relative, as go's are).
+      def: rb: {
+        'VoxgigSekreto::Plugins::HASHICORP': 'feature/secrets/voxgig_sekreto/plugins/hashicorp.rb'
+        'VoxgigSekreto::Plugins::BORU': 'feature/secrets/voxgig_sekreto/plugins/boru.rb'
+      }
+      # js: the same symbol set as ts, CommonJS module paths (Config_js
+      # strips the leading src/ and the .js extension to build a require).
+      def: js: {
+        hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.js'
+        boru: 'src/feature/secrets/sekreto/plugins/boru.js'
+      }
+      # php: the plugin FUNCTION each file exports (a definition holds
+      # closures, so php cannot name it with a constant), and the module
+      # path under tm/php - this target's root, which is also config.php's
+      # own directory, so the emitted require_once is that path verbatim.
+      def: php: {
+        hashicorp: 'feature/secrets/sekreto/plugins/hashicorp.php'
+        boru: 'feature/secrets/sekreto/plugins/boru.php'
+      }
+      # csharp: the static class and Definition FIELD each file exports,
+      # under namespace Voxgig.Sekreto.Plugins (Config_csharp emits the
+      # symbol `global::`-qualified, so an inactive group leaves no
+      # reference and no dangling using). The path is target-root-relative,
+      # as go's is.
+      def: csharp: {
+        'Hashicorp.Plugin': 'feature/secrets/plugins/Hashicorp.cs'
+        'Boru.Plugin': 'feature/secrets/plugins/Boru.cs'
+      }
+      # java: class-qualified Definition symbols (one class per kind),
+      # and the file path under tm/java - this target's root, which is
+      # also Main_java's Copy root, so the emitted exclude matches it.
+      def: java: {
+        'Hashicorp.PLUGIN': 'feature/secrets/sekreto/plugins/Hashicorp.java'
+        'Boru.PLUGIN': 'feature/secrets/sekreto/plugins/Boru.java'
+      }
+      # scala: fully-qualified top-level `val`s (the scala port makes each
+      # plugin a package-level Definition), so Config_scala names them
+      # without an import. The path is target-root-relative, as go's is.
+      def: scala: {
+        'com.voxgig.sekreto.plugins.hashicorp': 'feature/secrets/sekreto/plugins/Hashicorp.scala'
+        'com.voxgig.sekreto.plugins.boru': 'feature/secrets/sekreto/plugins/Boru.scala'
+      }
+      # kotlin: PLAIN TOP-LEVEL VALS (`val hashicorp: Definition = ...`),
+      # imported by simple name - so ts-shaped keys, not java's
+      # class-qualified ones. The path is target-root-relative, as go's is,
+      # because Main_kotlin's Copy is rooted at tm/kotlin.
+      def: kotlin: {
+        hashicorp: 'feature/secrets/sekreto/plugins/Hashicorp.kt'
+        boru: 'feature/secrets/sekreto/plugins/Boru.kt'
+      }
+      # perl: the bare sub each module exports (`@EXPORT_OK`), and the
+      # module file under tm/perl - this target's root, which is also
+      # Main_perl's Copy root, so the emitted exclude matches it. The
+      # vendored tree keeps upstream's PACKAGE layout because perl
+      # resolves by @INC, hence the Voxgig/Sekreto/Plugins/ depth.
+      #
+      # plugins/Proc.pm does NOT go with Boru: perl has a SECOND shared
+      # helper (php's runcmd story, one language over). Proc.pm is used by
+      # Boru (`vault`) AND Secretspec (`secretspec`), so it ships with the
+      # feature core alongside Httpjson.pm and belongs to NO group -
+      # listing it here would let a secretspec-only trim delete a file
+      # Boru's `use` line needs, which is a load failure, not a degraded
+      # chain.
+      def: perl: {
+        hashicorp: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Hashicorp.pm'
+        boru: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Boru.pm'
+      }
+      # dart: PLAIN TOP-LEVEL FINALS (`final Definition hashicorp = ...`),
+      # imported by simple name with a `show` clause - so ts-shaped keys.
+      # The path is target-root-relative, as go's is, because Main_dart's
+      # Copy is rooted at tm/dart; `lib/` is part of it because dart's
+      # feature container is lib/feature/<name>/, not a src/ tree.
+      def: dart: {
+        hashicorp: 'lib/feature/secrets/sekreto/plugins/hashicorp.dart'
+        boru: 'lib/feature/secrets/sekreto/plugins/boru.dart'
+      }
+      # clojure: FULLY-QUALIFIED VARS (`voxgig.sekreto.plugins.hashicorp/hashicorp`)
+      # - the clojure spelling of go's package-qualified symbol.
+      # Config_clojure derives the `:require` namespace from the part before
+      # the `/`. The path is target-root-relative, as go's is, because
+      # Main_clojure's Copy is rooted at tm/clojure.
+      def: clojure: {
+        'voxgig.sekreto.plugins.hashicorp/hashicorp': 'feature/secrets/voxgig/sekreto/plugins/hashicorp.clj'
+        'voxgig.sekreto.plugins.boru/boru': 'feature/secrets/voxgig/sekreto/plugins/boru.clj'
+      }
+      # elixir: fully-qualified CALLS - each plugin module answers its
+      # definition from a zero-arity function (`Sekreto.Plugins.Hashicorp
+      # .hashicorp()`), so Config_elixir emits the key with `()` appended
+      # and needs no import at all: Elixir resolves modules globally, by
+      # their `defmodule`, not by path. The `def` path is target-root
+      # relative, while the `path` above is relative to Main_elixir's
+      # `lib/projectname` Copy - the root the plugin trim matches against -
+      # which is the same split py uses.
+      #
+      # plugins/proc.ex is NOT listed here: see the elixir note in the
+      # `secretspec` group. It is a feature-core file both groups use.
+      def: elixir: {
+        'Sekreto.Plugins.Hashicorp.hashicorp': 'lib/projectname/feature/secrets/sekreto/plugins/hashicorp.ex'
+        'Sekreto.Plugins.Boru.boru': 'lib/projectname/feature/secrets/sekreto/plugins/boru.ex'
+      }
+      # swift: PLAIN TOP-LEVEL LETS (`public let hashicorp: Definition = ...`)
+      # in the vendored SekretoPlugins MODULE, named by simple symbol - so
+      # ts-shaped keys. The `def` path is target-root-relative (tm/swift/...),
+      # while the `path` entries above are relative to Main_swift's
+      # Sources/ProjectNameSDK Copy - the root the plugin trim matches
+      # against - which is the same split py uses.
+      #
+      # plugins/Proc.swift does NOT go with Boru: swift has the php/perl
+      # SHARED-HELPER shape. `runcmd` lives in Proc.swift and is called by
+      # Boru (`vault`) AND Secretspec (`secretspec`), so it ships with the
+      # feature core beside plugins/Httpjson.swift and belongs to NO group -
+      # a path listed in two groups is trimmed as soon as EITHER is off,
+      # which would break the other. Upstream's own `make lean` builds every
+      # non-AWS kind as `<Kind>.swift Httpjson.swift Proc.swift`.
+      def: swift: {
+        hashicorp: 'Sources/ProjectNameSDK/feature/secrets/plugins/Hashicorp.swift'
+        boru: 'Sources/ProjectNameSDK/feature/secrets/plugins/Boru.swift'
+      }
+      # lean: QUALIFIED DEFINITIONS (`Sekreto.hashicorp`) - the value each
+      # vendored SekretoPlugins module defines; Main_lean derives the import
+      # (`import SekretoPlugins.Hashicorp`) from the path's module tail. The
+      # path is target-root-relative, as go's is, because Main_lean's Copy is
+      # rooted at tm/lean. Httpjson.lean and Proc.lean are in NO group: the
+      # shared HTTP round-trip and child-process helpers ship with the
+      # feature core (Boru reaches both), like php's runcmd.php. They cost
+      # nothing when no kind imports them - Lake compiles an import closure,
+      # not a directory - and the libcurl link goes with the plugin groups,
+      # not with the core (see model/target/lean.aon).
+      def: lean: {
+        'Sekreto.hashicorp': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Hashicorp.lean'
+        'Sekreto.boru': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Boru.lean'
+      }
+      # c: the `Definition *sek_plugin_<kind>(void)` constructor each
+      # vendored plugin file defines (plugins/sekretoplugins.h declares all
+      # ten; only the objects the link line names are carried). The path is
+      # target-root-relative, as go's is, because Main_c's Copy is rooted
+      # at tm/c. The generated feature/secrets/kinds.c (Config_c) calls
+      # these and hands the list to the feature through feature_plugins().
+      #
+      # plugins/proc.c does NOT go with boru: it is the php/perl
+      # SHARED-HELPER shape - `sek_runcmd` is called by boru (`vault`) AND
+      # secretspec (`secretspec`), so it ships with the feature core
+      # beside httpjson.c, tls.c, encode.c and clock.c and belongs to NO
+      # group. The Makefile compiles the ungrouped helpers only when a
+      # kind file is present, so they cost nothing (and need no OpenSSL
+      # headers) in a chain that is [env, memory].
+      def: c: {
+        sek_plugin_hashicorp: 'feature/secrets/plugins/hashicorp.c'
+        sek_plugin_boru: 'feature/secrets/plugins/boru.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        hashicorp: 'feature/secrets/sekreto/plugins/hashicorp.lua'
+        boru: 'feature/secrets/sekreto/plugins/boru.lua'
+      }
+      # zig: the BARE export names upstream's plugins/all.zig re-exports
+      # (`pub const hashicorp = @import("hashicorp.zig").hashicorp;`), so the
+      # symbol is what Config_zig re-exports from the generated
+      # feature/secrets/plugins.zig - the root of the `sekretoplugins` build
+      # module, which is what makes the trim REAL in zig: the compiler
+      # analyses only what a module root reaches, so a kind this file does
+      # not name is neither compiled nor in the vocabulary. The path is
+      # target-root-relative, as go's is, because Main_zig's Copy is rooted
+      # at tm/zig. plugins/httpjson.zig is in NO group (eight kinds import
+      # it by relative path, and the exchange's fetch of last resort is its
+      # fetchjson), so it ships with the feature core.
+      def: zig: {
+        hashicorp: 'feature/secrets/plugins/hashicorp.zig'
+        boru: 'feature/secrets/plugins/boru.zig'
+      }
+      # ocaml: MODULE-QUALIFIED FUNCTIONS (`Hashicorp.plugin`), the
+      # `unit -> Defs.definition` each vendored kind module defines
+      # (upstream's allplugins.ml names exactly these); Config_ocaml
+      # appends `()`. OCaml's namespace is flat and resolved by -I, so the
+      # symbol needs no import and the path is only what the plugin trim
+      # matches and what feature/secrets/feature.mk compiles. The path is target-root
+      # relative, as go's is, because Main_ocaml's Copy is rooted at
+      # tm/ocaml.
+      #
+      # plugins/runcmd.ml does NOT go with boru: it is the php/perl
+      # SHARED-HELPER shape (secretspec opens it too), so it ships with the
+      # feature core and belongs to NO group - see the ocaml note at the
+      # head of this `plugin` block.
+      def: ocaml: {
+        'Hashicorp.plugin': 'feature/secrets/plugins/hashicorp.ml'
+        'Boru.plugin': 'feature/secrets/plugins/boru.ml'
+      }
+      # cpp: the bare `Definition <kind>()` factory each vendored kind file
+      # defines in namespace sekreto (Hashicorp.hpp: `Definition hashicorp();`),
+      # so the key is the unqualified function name; the generated
+      # feature/secrets/kinds.cpp (Config_cpp) qualifies it as
+      # `sekreto::hashicorp()` and includes the owning file's header. The path
+      # is target-root-relative, as go's is, because Main_cpp's Copy is rooted
+      # at tm/cpp; the .hpp rides in `path` beside its .cpp so the trim removes
+      # the pair, and the .cpp is what the def names because it is what the
+      # Makefile compiles.
+      #
+      # plugins/Proc.cpp does NOT go with Boru: it is the php/perl
+      # SHARED-HELPER shape - `runcmd` is called by Boru (`vault`) AND
+      # Secretspec (`secretspec`), so it ships with the feature core beside
+      # Httpjson.cpp, Tls.cpp and Crypto.cpp and belongs to NO group. The
+      # Makefile compiles the ungrouped helpers only when a kind file is
+      # present, so they cost nothing (and need no OpenSSL headers) in a chain
+      # that is [env, memory].
+      def: cpp: {
+        hashicorp: 'feature/secrets/plugins/Hashicorp.cpp'
+        boru: 'feature/secrets/plugins/Boru.cpp'
+      }
     }
 
     cloud: {
@@ -104,8 +446,48 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/azuresecrets.ts'
         'feature/secrets/plugins/gcpsecrets/gcpsecrets.go'
         'feature/secrets/plugins/azuresecrets/azuresecrets.go'
+        'feature/secrets/plugins/gcpsecrets.rs'
+        'feature/secrets/plugins/azuresecrets.rs'
         'feature/secrets/voxgig_sekreto/plugins/gcpsecrets.py'
         'feature/secrets/voxgig_sekreto/plugins/azuresecrets.py'
+        'src/feature/secrets/sekreto/plugins/gcpsecrets.js'
+        'src/feature/secrets/sekreto/plugins/azuresecrets.js'
+        'feature/secrets/voxgig_sekreto/plugins/gcpsecrets.rb'
+        'feature/secrets/voxgig_sekreto/plugins/azuresecrets.rb'
+        'feature/secrets/sekreto/plugins/gcpsecrets.php'
+        'feature/secrets/sekreto/plugins/azuresecrets.php'
+        'feature/secrets/plugins/GcpSecrets.cs'
+        'feature/secrets/plugins/AzureSecrets.cs'
+        'feature/secrets/sekreto/plugins/Gcpsecrets.java'
+        'feature/secrets/sekreto/plugins/Azuresecrets.java'
+        'feature/secrets/sekreto/plugins/Gcpsecrets.scala'
+        'feature/secrets/sekreto/plugins/Azuresecrets.scala'
+        'feature/secrets/sekreto/plugins/Gcpsecrets.kt'
+        'feature/secrets/sekreto/plugins/Azuresecrets.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Gcpsecrets.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Azuresecrets.pm'
+        'lib/feature/secrets/sekreto/plugins/gcpsecrets.dart'
+        'lib/feature/secrets/sekreto/plugins/azuresecrets.dart'
+        'feature/secrets/sekreto/plugins/gcpsecrets.ex'
+        'feature/secrets/sekreto/plugins/azuresecrets.ex'
+        'feature/secrets/voxgig/sekreto/plugins/gcpsecrets.clj'
+        'feature/secrets/voxgig/sekreto/plugins/azuresecrets.clj'
+        'feature/secrets/plugins/Gcpsecrets.swift'
+        'feature/secrets/plugins/Azuresecrets.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Gcpsecrets.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Azuresecrets.lean'
+        'feature/secrets/plugins/gcpsecrets.c'
+        'feature/secrets/plugins/azuresecrets.c'
+        'feature/secrets/sekreto/plugins/gcpsecrets.lua'
+        'feature/secrets/sekreto/plugins/azuresecrets.lua'
+        'feature/secrets/plugins/gcpsecrets.zig'
+        'feature/secrets/plugins/azuresecrets.zig'
+        'feature/secrets/plugins/gcpsecrets.ml'
+        'feature/secrets/plugins/azuresecrets.ml'
+        'feature/secrets/plugins/Gcpsecrets.cpp'
+        'feature/secrets/plugins/Gcpsecrets.hpp'
+        'feature/secrets/plugins/Azuresecrets.cpp'
+        'feature/secrets/plugins/Azuresecrets.hpp'
       ]
       def: ts: {
         gcpsecrets: 'src/feature/secrets/sekreto/plugins/gcpsecrets.ts'
@@ -115,10 +497,92 @@ main: kit: feature: secrets: {
         'gcpsecrets.Plugin': 'feature/secrets/plugins/gcpsecrets/gcpsecrets.go'
         'azuresecrets.Plugin': 'feature/secrets/plugins/azuresecrets/azuresecrets.go'
       }
+      def: rust: {
+        'gcpsecrets::plugin': 'feature/secrets/plugins/gcpsecrets.rs'
+        'azuresecrets::plugin': 'feature/secrets/plugins/azuresecrets.rs'
+      }
       def: py: {
         gcpsecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/gcpsecrets.py'
         azuresecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/azuresecrets.py'
       }
+      def: rb: {
+        'VoxgigSekreto::Plugins::GCPSECRETS': 'feature/secrets/voxgig_sekreto/plugins/gcpsecrets.rb'
+        'VoxgigSekreto::Plugins::AZURESECRETS': 'feature/secrets/voxgig_sekreto/plugins/azuresecrets.rb'
+      }
+      def: js: {
+        gcpsecrets: 'src/feature/secrets/sekreto/plugins/gcpsecrets.js'
+        azuresecrets: 'src/feature/secrets/sekreto/plugins/azuresecrets.js'
+      }
+      def: php: {
+        gcpsecrets: 'feature/secrets/sekreto/plugins/gcpsecrets.php'
+        azuresecrets: 'feature/secrets/sekreto/plugins/azuresecrets.php'
+      }
+      def: csharp: {
+        'GcpSecrets.Plugin': 'feature/secrets/plugins/GcpSecrets.cs'
+        'AzureSecrets.Plugin': 'feature/secrets/plugins/AzureSecrets.cs'
+      }
+      def: java: {
+        'Gcpsecrets.PLUGIN': 'feature/secrets/sekreto/plugins/Gcpsecrets.java'
+        'Azuresecrets.PLUGIN': 'feature/secrets/sekreto/plugins/Azuresecrets.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.gcpsecrets': 'feature/secrets/sekreto/plugins/Gcpsecrets.scala'
+        'com.voxgig.sekreto.plugins.azuresecrets': 'feature/secrets/sekreto/plugins/Azuresecrets.scala'
+      }
+      def: kotlin: {
+        gcpsecrets: 'feature/secrets/sekreto/plugins/Gcpsecrets.kt'
+        azuresecrets: 'feature/secrets/sekreto/plugins/Azuresecrets.kt'
+      }
+      def: perl: {
+        gcpsecrets: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Gcpsecrets.pm'
+        azuresecrets: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Azuresecrets.pm'
+      }
+      def: dart: {
+        gcpsecrets: 'lib/feature/secrets/sekreto/plugins/gcpsecrets.dart'
+        azuresecrets: 'lib/feature/secrets/sekreto/plugins/azuresecrets.dart'
+      }
+      def: clojure: {
+        'voxgig.sekreto.plugins.gcpsecrets/gcpsecrets': 'feature/secrets/voxgig/sekreto/plugins/gcpsecrets.clj'
+        'voxgig.sekreto.plugins.azuresecrets/azuresecrets': 'feature/secrets/voxgig/sekreto/plugins/azuresecrets.clj'
+      }
+      def: elixir: {
+        'Sekreto.Plugins.Gcpsecrets.gcpsecrets': 'lib/projectname/feature/secrets/sekreto/plugins/gcpsecrets.ex'
+        'Sekreto.Plugins.Azuresecrets.azuresecrets': 'lib/projectname/feature/secrets/sekreto/plugins/azuresecrets.ex'
+      }
+      def: swift: {
+        gcpsecrets: 'Sources/ProjectNameSDK/feature/secrets/plugins/Gcpsecrets.swift'
+        azuresecrets: 'Sources/ProjectNameSDK/feature/secrets/plugins/Azuresecrets.swift'
+      }
+      def: lean: {
+        'Sekreto.gcpsecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Gcpsecrets.lean'
+        'Sekreto.azuresecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Azuresecrets.lean'
+      }
+      def: c: {
+        sek_plugin_gcpsecrets: 'feature/secrets/plugins/gcpsecrets.c'
+        sek_plugin_azuresecrets: 'feature/secrets/plugins/azuresecrets.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        gcpsecrets: 'feature/secrets/sekreto/plugins/gcpsecrets.lua'
+        azuresecrets: 'feature/secrets/sekreto/plugins/azuresecrets.lua'
+      }
+      def: zig: {
+        gcpsecrets: 'feature/secrets/plugins/gcpsecrets.zig'
+        azuresecrets: 'feature/secrets/plugins/azuresecrets.zig'
+      }
+      def: ocaml: {
+        'Gcpsecrets.plugin': 'feature/secrets/plugins/gcpsecrets.ml'
+        'Azuresecrets.plugin': 'feature/secrets/plugins/azuresecrets.ml'
+      }
+      # cpp: see the vault group.
+      def: cpp: {
+        gcpsecrets: 'feature/secrets/plugins/Gcpsecrets.cpp'
+        azuresecrets: 'feature/secrets/plugins/Azuresecrets.cpp'
+      }
     }
 
     saas: {
@@ -131,9 +595,69 @@ main: kit: feature: secrets: {
         'feature/secrets/plugins/onepassword/onepassword.go'
         'feature/secrets/plugins/doppler/doppler.go'
         'feature/secrets/plugins/infisical/infisical.go'
+        'feature/secrets/plugins/onepassword.rs'
+        'feature/secrets/plugins/doppler.rs'
+        'feature/secrets/plugins/infisical.rs'
         'feature/secrets/voxgig_sekreto/plugins/onepassword.py'
         'feature/secrets/voxgig_sekreto/plugins/doppler.py'
         'feature/secrets/voxgig_sekreto/plugins/infisical.py'
+        'src/feature/secrets/sekreto/plugins/onepassword.js'
+        'src/feature/secrets/sekreto/plugins/doppler.js'
+        'src/feature/secrets/sekreto/plugins/infisical.js'
+        'feature/secrets/voxgig_sekreto/plugins/onepassword.rb'
+        'feature/secrets/voxgig_sekreto/plugins/doppler.rb'
+        'feature/secrets/voxgig_sekreto/plugins/infisical.rb'
+        'feature/secrets/sekreto/plugins/onepassword.php'
+        'feature/secrets/sekreto/plugins/doppler.php'
+        'feature/secrets/sekreto/plugins/infisical.php'
+        'feature/secrets/plugins/OnePassword.cs'
+        'feature/secrets/plugins/Doppler.cs'
+        'feature/secrets/plugins/Infisical.cs'
+        'feature/secrets/sekreto/plugins/Onepassword.java'
+        'feature/secrets/sekreto/plugins/Doppler.java'
+        'feature/secrets/sekreto/plugins/Infisical.java'
+        'feature/secrets/sekreto/plugins/Onepassword.scala'
+        'feature/secrets/sekreto/plugins/Doppler.scala'
+        'feature/secrets/sekreto/plugins/Infisical.scala'
+        'feature/secrets/sekreto/plugins/Onepassword.kt'
+        'feature/secrets/sekreto/plugins/Doppler.kt'
+        'feature/secrets/sekreto/plugins/Infisical.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Onepassword.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Doppler.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Infisical.pm'
+        'lib/feature/secrets/sekreto/plugins/onepassword.dart'
+        'lib/feature/secrets/sekreto/plugins/doppler.dart'
+        'lib/feature/secrets/sekreto/plugins/infisical.dart'
+        'feature/secrets/voxgig/sekreto/plugins/onepassword.clj'
+        'feature/secrets/voxgig/sekreto/plugins/doppler.clj'
+        'feature/secrets/voxgig/sekreto/plugins/infisical.clj'
+        'feature/secrets/sekreto/plugins/onepassword.ex'
+        'feature/secrets/sekreto/plugins/doppler.ex'
+        'feature/secrets/sekreto/plugins/infisical.ex'
+        'feature/secrets/plugins/Onepassword.swift'
+        'feature/secrets/plugins/Doppler.swift'
+        'feature/secrets/plugins/Infisical.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Onepassword.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Doppler.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Infisical.lean'
+        'feature/secrets/plugins/onepassword.c'
+        'feature/secrets/plugins/doppler.c'
+        'feature/secrets/plugins/infisical.c'
+        'feature/secrets/sekreto/plugins/onepassword.lua'
+        'feature/secrets/sekreto/plugins/doppler.lua'
+        'feature/secrets/sekreto/plugins/infisical.lua'
+        'feature/secrets/plugins/onepassword.zig'
+        'feature/secrets/plugins/doppler.zig'
+        'feature/secrets/plugins/infisical.zig'
+        'feature/secrets/plugins/onepassword.ml'
+        'feature/secrets/plugins/doppler.ml'
+        'feature/secrets/plugins/infisical.ml'
+        'feature/secrets/plugins/Onepassword.cpp'
+        'feature/secrets/plugins/Onepassword.hpp'
+        'feature/secrets/plugins/Doppler.cpp'
+        'feature/secrets/plugins/Doppler.hpp'
+        'feature/secrets/plugins/Infisical.cpp'
+        'feature/secrets/plugins/Infisical.hpp'
       ]
       def: ts: {
         onepassword: 'src/feature/secrets/sekreto/plugins/onepassword.ts'
@@ -145,11 +669,119 @@ main: kit: feature: secrets: {
         'doppler.Plugin': 'feature/secrets/plugins/doppler/doppler.go'
         'infisical.Plugin': 'feature/secrets/plugins/infisical/infisical.go'
       }
+      def: rust: {
+        'onepassword::plugin': 'feature/secrets/plugins/onepassword.rs'
+        'doppler::plugin': 'feature/secrets/plugins/doppler.rs'
+        'infisical::plugin': 'feature/secrets/plugins/infisical.rs'
+      }
       def: py: {
         onepassword: 'pkg/feature/secrets/voxgig_sekreto/plugins/onepassword.py'
         doppler: 'pkg/feature/secrets/voxgig_sekreto/plugins/doppler.py'
         infisical: 'pkg/feature/secrets/voxgig_sekreto/plugins/infisical.py'
       }
+      def: rb: {
+        'VoxgigSekreto::Plugins::ONEPASSWORD': 'feature/secrets/voxgig_sekreto/plugins/onepassword.rb'
+        'VoxgigSekreto::Plugins::DOPPLER': 'feature/secrets/voxgig_sekreto/plugins/doppler.rb'
+        'VoxgigSekreto::Plugins::INFISICAL': 'feature/secrets/voxgig_sekreto/plugins/infisical.rb'
+      }
+      def: js: {
+        onepassword: 'src/feature/secrets/sekreto/plugins/onepassword.js'
+        doppler: 'src/feature/secrets/sekreto/plugins/doppler.js'
+        infisical: 'src/feature/secrets/sekreto/plugins/infisical.js'
+      }
+      def: php: {
+        onepassword: 'feature/secrets/sekreto/plugins/onepassword.php'
+        doppler: 'feature/secrets/sekreto/plugins/doppler.php'
+        infisical: 'feature/secrets/sekreto/plugins/infisical.php'
+      }
+      def: csharp: {
+        'OnePassword.Plugin': 'feature/secrets/plugins/OnePassword.cs'
+        'Doppler.Plugin': 'feature/secrets/plugins/Doppler.cs'
+        'Infisical.Plugin': 'feature/secrets/plugins/Infisical.cs'
+      }
+      def: java: {
+        'Onepassword.PLUGIN': 'feature/secrets/sekreto/plugins/Onepassword.java'
+        'Doppler.PLUGIN': 'feature/secrets/sekreto/plugins/Doppler.java'
+        'Infisical.PLUGIN': 'feature/secrets/sekreto/plugins/Infisical.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.onepassword': 'feature/secrets/sekreto/plugins/Onepassword.scala'
+        'com.voxgig.sekreto.plugins.doppler': 'feature/secrets/sekreto/plugins/Doppler.scala'
+        'com.voxgig.sekreto.plugins.infisical': 'feature/secrets/sekreto/plugins/Infisical.scala'
+      }
+      def: kotlin: {
+        onepassword: 'feature/secrets/sekreto/plugins/Onepassword.kt'
+        doppler: 'feature/secrets/sekreto/plugins/Doppler.kt'
+        infisical: 'feature/secrets/sekreto/plugins/Infisical.kt'
+      }
+      def: perl: {
+        onepassword: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Onepassword.pm'
+        doppler: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Doppler.pm'
+        infisical: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Infisical.pm'
+      }
+      def: dart: {
+        onepassword: 'lib/feature/secrets/sekreto/plugins/onepassword.dart'
+        doppler: 'lib/feature/secrets/sekreto/plugins/doppler.dart'
+        infisical: 'lib/feature/secrets/sekreto/plugins/infisical.dart'
+      }
+      def: clojure: {
+        'voxgig.sekreto.plugins.onepassword/onepassword': 'feature/secrets/voxgig/sekreto/plugins/onepassword.clj'
+        'voxgig.sekreto.plugins.doppler/doppler': 'feature/secrets/voxgig/sekreto/plugins/doppler.clj'
+        'voxgig.sekreto.plugins.infisical/infisical': 'feature/secrets/voxgig/sekreto/plugins/infisical.clj'
+      }
+      # elixir: fully-qualified CALLS - each plugin module answers its
+      # definition from a zero-arity function, so Config_elixir emits the
+      # key with `()` appended and needs no import at all (Elixir resolves
+      # modules globally, by their `defmodule`). The `def` path is
+      # target-root relative; the `path` above is relative to Main_elixir's
+      # `lib/projectname` Copy, which is the root the plugin trim matches
+      # against - the same split py uses.
+      def: elixir: {
+        'Sekreto.Plugins.Onepassword.onepassword': 'lib/projectname/feature/secrets/sekreto/plugins/onepassword.ex'
+        'Sekreto.Plugins.Doppler.doppler': 'lib/projectname/feature/secrets/sekreto/plugins/doppler.ex'
+        'Sekreto.Plugins.Infisical.infisical': 'lib/projectname/feature/secrets/sekreto/plugins/infisical.ex'
+      }
+      def: swift: {
+        onepassword: 'Sources/ProjectNameSDK/feature/secrets/plugins/Onepassword.swift'
+        doppler: 'Sources/ProjectNameSDK/feature/secrets/plugins/Doppler.swift'
+        infisical: 'Sources/ProjectNameSDK/feature/secrets/plugins/Infisical.swift'
+      }
+      def: lean: {
+        'Sekreto.onepassword': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Onepassword.lean'
+        'Sekreto.doppler': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Doppler.lean'
+        'Sekreto.infisical': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Infisical.lean'
+      }
+      def: c: {
+        sek_plugin_onepassword: 'feature/secrets/plugins/onepassword.c'
+        sek_plugin_doppler: 'feature/secrets/plugins/doppler.c'
+        sek_plugin_infisical: 'feature/secrets/plugins/infisical.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        onepassword: 'feature/secrets/sekreto/plugins/onepassword.lua'
+        doppler: 'feature/secrets/sekreto/plugins/doppler.lua'
+        infisical: 'feature/secrets/sekreto/plugins/infisical.lua'
+      }
+      def: zig: {
+        onepassword: 'feature/secrets/plugins/onepassword.zig'
+        doppler: 'feature/secrets/plugins/doppler.zig'
+        infisical: 'feature/secrets/plugins/infisical.zig'
+      }
+      def: ocaml: {
+        'Onepassword.plugin': 'feature/secrets/plugins/onepassword.ml'
+        'Doppler.plugin': 'feature/secrets/plugins/doppler.ml'
+        'Infisical.plugin': 'feature/secrets/plugins/infisical.ml'
+      }
+      # cpp: see the vault group.
+      def: cpp: {
+        onepassword: 'feature/secrets/plugins/Onepassword.cpp'
+        doppler: 'feature/secrets/plugins/Doppler.cpp'
+        infisical: 'feature/secrets/plugins/Infisical.cpp'
+      }
     }
 
     # The only plugin that costs node:crypto: AWS request signing.
@@ -164,8 +796,50 @@ main: kit: feature: secrets: {
         'src/feature/secrets/sekreto/plugins/sigv4.ts'
         'feature/secrets/plugins/aws/aws.go'
         'feature/secrets/plugins/aws/sigv4.go'
+        'feature/secrets/plugins/aws.rs'
+        'feature/secrets/plugins/aws/sigv4.rs'
+        'feature/secrets/plugins/aws/crypto.rs'
         'feature/secrets/voxgig_sekreto/plugins/aws.py'
         'feature/secrets/voxgig_sekreto/plugins/sigv4.py'
+        'src/feature/secrets/sekreto/plugins/aws.js'
+        'src/feature/secrets/sekreto/plugins/sigv4.js'
+        'feature/secrets/voxgig_sekreto/plugins/aws.rb'
+        'feature/secrets/voxgig_sekreto/plugins/sigv4.rb'
+        'feature/secrets/sekreto/plugins/aws.php'
+        'feature/secrets/sekreto/plugins/sigv4.php'
+        'feature/secrets/plugins/Aws.cs'
+        'feature/secrets/plugins/Sigv4.cs'
+        'feature/secrets/sekreto/plugins/Aws.java'
+        'feature/secrets/sekreto/plugins/Aws.scala'
+        'feature/secrets/sekreto/plugins/Aws.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Sigv4.pm'
+        'lib/feature/secrets/sekreto/plugins/aws.dart'
+        'lib/feature/secrets/sekreto/plugins/sigv4.dart'
+        'lib/feature/secrets/sekreto/plugins/crypto.dart'
+        'feature/secrets/voxgig/sekreto/plugins/aws.clj'
+        'feature/secrets/voxgig/sekreto/plugins/sigv4.clj'
+        'feature/secrets/sekreto/plugins/aws.ex'
+        'feature/secrets/sekreto/plugins/sigv4.ex'
+        'feature/secrets/plugins/Aws.swift'
+        'feature/secrets/plugins/Sigv4.swift'
+        'feature/secrets/plugins/Crypto.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Sigv4.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Crypto.lean'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Clock.lean'
+        'feature/secrets/plugins/aws.c'
+        'feature/secrets/plugins/sigv4.c'
+        'feature/secrets/plugins/sha256.c'
+        'feature/secrets/sekreto/plugins/aws.lua'
+        'feature/secrets/sekreto/plugins/sigv4.lua'
+        'feature/secrets/plugins/aws.zig'
+        'feature/secrets/plugins/sigv4.zig'
+        'feature/secrets/plugins/aws.ml'
+        'feature/secrets/plugins/Aws.cpp'
+        'feature/secrets/plugins/Aws.hpp'
+        'feature/secrets/plugins/Sigv4.cpp'
+        'feature/secrets/plugins/Sigv4.hpp'
       ]
       def: ts: {
         awssecrets: 'src/feature/secrets/sekreto/plugins/aws.ts'
@@ -176,12 +850,197 @@ main: kit: feature: secrets: {
         'aws.Secrets': 'feature/secrets/plugins/aws/aws.go'
         'aws.Params': 'feature/secrets/plugins/aws/aws.go'
       }
+      # ONE module, TWO definitions - rust's spelling of the ts aws.ts
+      # pair (upstream exports `pub fn secrets()` and `pub fn params()`).
+      # plugins/aws/sigv4.rs and plugins/aws/crypto.rs go with it, and go
+      # only with it: nothing outside aws.rs reaches into either.
+      def: rust: {
+        'aws::secrets': 'feature/secrets/plugins/aws.rs'
+        'aws::params': 'feature/secrets/plugins/aws.rs'
+      }
       # ONE module, TWO definitions - py's spelling of the ts aws.ts pair.
       # plugins/sigv4.py goes with it, and goes only with it.
       def: py: {
         awssecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
         awsparams: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
       }
+      # ONE module, TWO definitions - rb's spelling of the ts aws.ts
+      # pair. plugins/sigv4.rb goes with it, and goes only with it.
+      def: rb: {
+        'VoxgigSekreto::Plugins::AWSSECRETS': 'feature/secrets/voxgig_sekreto/plugins/aws.rb'
+        'VoxgigSekreto::Plugins::AWSPARAMS': 'feature/secrets/voxgig_sekreto/plugins/aws.rb'
+      }
+      # ONE module, TWO definitions - js's spelling of the ts aws.ts pair.
+      # plugins/sigv4.js goes with it, and goes only with it.
+      def: js: {
+        awssecrets: 'src/feature/secrets/sekreto/plugins/aws.js'
+        awsparams: 'src/feature/secrets/sekreto/plugins/aws.js'
+      }
+      # ONE file, TWO definitions - php's spelling of the ts aws.ts pair.
+      # plugins/sigv4.php goes with it, and goes only with it.
+      def: php: {
+        awssecrets: 'feature/secrets/sekreto/plugins/aws.php'
+        awsparams: 'feature/secrets/sekreto/plugins/aws.php'
+      }
+      # ONE file, TWO definitions - csharp's spelling of the ts aws.ts
+      # pair. The class is `AwsPlugins`, not `Aws`: the provider TYPES in
+      # Aws.cs are named AwsSecretsProvider/AwsParamsProvider and the
+      # definition holder cannot collide with them.
+      # plugins/Sigv4.cs goes with it, and goes only with it.
+      def: csharp: {
+        'AwsPlugins.Secrets': 'feature/secrets/plugins/Aws.cs'
+        'AwsPlugins.Params': 'feature/secrets/plugins/Aws.cs'
+      }
+      # ONE class, TWO definitions - java's spelling of the ts aws.ts
+      # pair. plugins/Sigv4.java does NOT go with it: see the java note
+      # at the head of this `plugin` block.
+      def: java: {
+        'Aws.SECRETS': 'feature/secrets/sekreto/plugins/Aws.java'
+        'Aws.PARAMS': 'feature/secrets/sekreto/plugins/Aws.java'
+      }
+      # ONE file, TWO definitions - scala's spelling of the ts aws.ts pair.
+      # plugins/Sigv4.scala does NOT go with it: the java story repeats here
+      # exactly (see the java note at the head of this `plugin` block),
+      # because Sigv4.scala's `private[plugins] def uriescape` is also called
+      # by Azuresecrets (`cloud`) and by Doppler, Infisical and Onepassword
+      # (`saas`) - so listing it under `aws` let a saas-only or cloud-only
+      # trim delete a file four other kinds compile against, and scalac fails
+      # the whole build on it ("Not found: uriescape", x4 for saas, x2 for
+      # cloud - measured, not predicted).
+      def: scala: {
+        'com.voxgig.sekreto.plugins.awssecrets': 'feature/secrets/sekreto/plugins/Aws.scala'
+        'com.voxgig.sekreto.plugins.awsparams': 'feature/secrets/sekreto/plugins/Aws.scala'
+      }
+      # ONE file, TWO definitions - kotlin's spelling of the ts aws.ts
+      # pair. plugins/Sigv4.kt does NOT go with it: the java story repeats
+      # here exactly (see the java note at the head of this `plugin`
+      # block), because Sigv4.kt's `internal fun uriescape` is also called
+      # by Azuresecrets (`cloud`) and by Doppler, Infisical and
+      # Onepassword (`saas`) - so listing it under `aws` would let a
+      # saas-only trim delete a file four other kinds compile against, and
+      # kotlinc fails the whole module on it.
+      def: kotlin: {
+        awssecrets: 'feature/secrets/sekreto/plugins/Aws.kt'
+        awsparams: 'feature/secrets/sekreto/plugins/Aws.kt'
+      }
+      # ONE module, TWO definitions - perl's spelling of the ts aws.ts
+      # pair (Aws.pm's `@EXPORT_OK` is `awssecrets awsparams sigv4`).
+      # plugins/Sigv4.pm goes with it, and goes only with it: nothing
+      # outside Aws.pm calls into it in this port.
+      def: perl: {
+        awssecrets: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
+        awsparams: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Aws.pm'
+      }
+      # ONE file, TWO definitions - dart's spelling of the ts aws.ts pair.
+      # plugins/sigv4.dart goes with it, and so does plugins/crypto.dart:
+      # this port has no crypto library to lean on, so SHA-256 and HMAC are
+      # its own, and sigv4.dart is their only caller. Listing crypto.dart
+      # anywhere else would let an aws-only trim delete the file sigv4.dart
+      # compiles against - and `dart analyze` runs over the whole package,
+      # so that is a hard build failure, not a degraded chain.
+      def: dart: {
+        awssecrets: 'lib/feature/secrets/sekreto/plugins/aws.dart'
+        awsparams: 'lib/feature/secrets/sekreto/plugins/aws.dart'
+      }
+      # ONE module, TWO definitions - clojure's spelling of the ts aws.ts
+      # pair (upstream's aws.clj carries `awssecrets` and `awsparams`).
+      # plugins/sigv4.clj goes with it, and goes only with it: nothing
+      # outside aws.clj requires it in this port.
+      def: clojure: {
+        'voxgig.sekreto.plugins.aws/awssecrets': 'feature/secrets/voxgig/sekreto/plugins/aws.clj'
+        'voxgig.sekreto.plugins.aws/awsparams': 'feature/secrets/voxgig/sekreto/plugins/aws.clj'
+      }
+      # ONE file, TWO definitions - elixir's spelling of the ts aws.ts pair.
+      # plugins/sigv4.ex goes with it, and goes only with it: it holds
+      # Sekreto.Plugins.Signing and Sekreto.Plugins.Sigv4, and aws.ex is
+      # this port's only caller of either.
+      def: elixir: {
+        'Sekreto.Plugins.Aws.awssecrets': 'lib/projectname/feature/secrets/sekreto/plugins/aws.ex'
+        'Sekreto.Plugins.Aws.awsparams': 'lib/projectname/feature/secrets/sekreto/plugins/aws.ex'
+      }
+      # ONE file, TWO definitions - swift's spelling of the ts aws.ts pair
+      # (Aws.swift:258,264 at the tag). plugins/Sigv4.swift goes with it, and
+      # goes only with it: `sigv4` is called from Aws.swift alone - this port
+      # has no java/kotlin/scala `uriescape` story, checked at the tag. And so
+      # does plugins/Crypto.swift: swift has no hashing in its standard
+      # library (CryptoKit is Apple-only, swift-crypto a package), so SHA-256
+      # and HMAC are the port's own and Sigv4.swift is their only caller (the
+      # one other `hex` under plugins/ is a comment in Httpjson.swift).
+      # Listing Crypto.swift anywhere else would let an aws-only trim delete
+      # the file Sigv4.swift compiles against - swiftc fails the whole
+      # SekretoPlugins module on it.
+      def: swift: {
+        awssecrets: 'Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift'
+        awsparams: 'Sources/ProjectNameSDK/feature/secrets/plugins/Aws.swift'
+      }
+      # ONE file, TWO definitions - lean's spelling of the ts aws.ts pair.
+      # Sigv4.lean, Crypto.lean AND Clock.lean travel with it: in this port
+      # Aws.lean is their only importer (no saas/cloud kind reaches
+      # `uriescape`, which lives in Httpjson.lean), so an aws-off trim
+      # leaves nothing dangling. Clock.lean is the `sekreto_epoch_seconds`
+      # extern's only caller; its two-line C stub is compiled with the curl
+      # one whenever any plugin group is on, and is dead weight otherwise.
+      def: lean: {
+        'Sekreto.awssecrets': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
+        'Sekreto.awsparams': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Aws.lean'
+      }
+      # c: ONE file, TWO definitions - the c spelling of the ts aws.ts
+      # pair, as go spells it aws.Secrets/aws.Params. plugins/sigv4.c AND
+      # plugins/sha256.c ride with it and only with it: upstream's own
+      # plugins/support.h says "sha256.c and nothing else. The aws plugin is
+      # the only thing in the library that names these", and a symbol scan
+      # of the port at the tag confirms aws.c is the sole caller of
+      # sek_sigv4 / sek_sha256 / sek_hmac_sha256. Unlike java's and scala's
+      # Sigv4, the c percent-encoder the other stores use (`sek_uriescape`)
+      # lives in the ungrouped encode.c, so nothing outside this group
+      # compiles against sigv4.c.
+      def: c: {
+        sek_plugin_awssecrets: 'feature/secrets/plugins/aws.c'
+        sek_plugin_awsparams: 'feature/secrets/plugins/aws.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      # sigv4.lua is required by aws.lua ALONE in the lua port (checked at the
+      # tag: gcpsecrets.lua reaches crypto.lua directly, never sigv4), so it
+      # belongs to this group. crypto.lua is shared by aws and cloud and
+      # ships ungrouped with the feature core.
+      def: lua: {
+        awssecrets: 'feature/secrets/sekreto/plugins/aws.lua'
+        awsparams: 'feature/secrets/sekreto/plugins/aws.lua'
+      }
+      # ONE file, TWO definitions - zig's spelling of the ts aws.ts pair
+      # (upstream all.zig: `awssecrets` and `awsparams`, both from aws.zig).
+      # plugins/sigv4.zig goes with it, and goes only with it: at the tag
+      # aws.zig is the ONLY file that `@import("sigv4.zig")` - the zig port
+      # has no java/kotlin/scala `uriescape` story (checked by grep at the
+      # tag), so an aws-off trim leaves nothing dangling.
+      def: zig: {
+        awssecrets: 'feature/secrets/plugins/aws.zig'
+        awsparams: 'feature/secrets/plugins/aws.zig'
+      }
+      # ONE module, TWO definitions - ocaml's spelling of the ts aws.ts
+      # pair (aws.ml defines `secretsplugin` and `paramsplugin`).
+      # plugins/sigv4.ml and plugins/crypto.ml do NOT go with it: the
+      # java/scala story repeats here (see the ocaml note at the head of
+      # this `plugin` block), because `Sigv4.uriescape` is also called by
+      # azuresecrets (`cloud`) and by doppler, infisical and onepassword
+      # (`saas`), and crypto.ml has to compile before sigv4.ml.
+      def: ocaml: {
+        'Aws.secretsplugin': 'feature/secrets/plugins/aws.ml'
+        'Aws.paramsplugin': 'feature/secrets/plugins/aws.ml'
+      }
+      # cpp: ONE file, TWO definitions (`Definition awssecrets();` and
+      # `Definition awsparams();`, both in Aws.hpp) - the ts/go/py shape. The
+      # SigV4 signer is aws-only in this port: Sigv4.hpp is included by Aws.cpp
+      # and nothing else, so Sigv4.{cpp,hpp} go with `aws`; Crypto.cpp, which
+      # Sigv4.cpp AND Tls.cpp include, stays with the feature core.
+      def: cpp: {
+        awssecrets: 'feature/secrets/plugins/Aws.cpp'
+        awsparams: 'feature/secrets/plugins/Aws.cpp'
+      }
     }
 
     # The only plugin that runs a CHILD PROCESS: the secretspec CLI
@@ -193,7 +1052,27 @@ main: kit: feature: secrets: {
       path: [
         'src/feature/secrets/sekreto/plugins/secretspec.ts'
         'feature/secrets/plugins/secretspec/secretspec.go'
+        'feature/secrets/plugins/secretspec.rs'
         'feature/secrets/voxgig_sekreto/plugins/secretspec.py'
+        'src/feature/secrets/sekreto/plugins/secretspec.js'
+        'feature/secrets/voxgig_sekreto/plugins/secretspec.rb'
+        'feature/secrets/sekreto/plugins/secretspec.php'
+        'feature/secrets/plugins/SecretSpec.cs'
+        'feature/secrets/sekreto/plugins/Secretspec.java'
+        'feature/secrets/sekreto/plugins/Secretspec.scala'
+        'feature/secrets/sekreto/plugins/Secretspec.kt'
+        'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Secretspec.pm'
+        'lib/feature/secrets/sekreto/plugins/secretspec.dart'
+        'feature/secrets/voxgig/sekreto/plugins/secretspec.clj'
+        'feature/secrets/sekreto/plugins/secretspec.ex'
+        'feature/secrets/plugins/Secretspec.swift'
+        'src/feature/secrets/sekreto/plugins/SekretoPlugins/Secretspec.lean'
+        'feature/secrets/plugins/secretspec.c'
+        'feature/secrets/sekreto/plugins/secretspec.lua'
+        'feature/secrets/plugins/secretspec.zig'
+        'feature/secrets/plugins/secretspec.ml'
+        'feature/secrets/plugins/Secretspec.cpp'
+        'feature/secrets/plugins/Secretspec.hpp'
       ]
       def: ts: {
         secretspec: 'src/feature/secrets/sekreto/plugins/secretspec.ts'
@@ -201,12 +1080,134 @@ main: kit: feature: secrets: {
       def: go: {
         'secretspec.Plugin': 'feature/secrets/plugins/secretspec/secretspec.go'
       }
+      def: rust: {
+        'secretspec::plugin': 'feature/secrets/plugins/secretspec.rs'
+      }
       def: py: {
         secretspec: 'pkg/feature/secrets/voxgig_sekreto/plugins/secretspec.py'
       }
+      def: rb: {
+        'VoxgigSekreto::Plugins::SECRETSPEC': 'feature/secrets/voxgig_sekreto/plugins/secretspec.rb'
+      }
+      def: js: {
+        secretspec: 'src/feature/secrets/sekreto/plugins/secretspec.js'
+      }
+      def: php: {
+        secretspec: 'feature/secrets/sekreto/plugins/secretspec.php'
+      }
+      def: csharp: {
+        'SecretSpec.Plugin': 'feature/secrets/plugins/SecretSpec.cs'
+      }
+      def: java: {
+        'Secretspec.PLUGIN': 'feature/secrets/sekreto/plugins/Secretspec.java'
+      }
+      def: scala: {
+        'com.voxgig.sekreto.plugins.secretspec': 'feature/secrets/sekreto/plugins/Secretspec.scala'
+      }
+      def: kotlin: {
+        secretspec: 'feature/secrets/sekreto/plugins/Secretspec.kt'
+      }
+      # plugins/Proc.pm is NOT listed here either - see the perl note in
+      # the `vault` group: it is a feature-core file both groups use.
+      def: perl: {
+        secretspec: 'feature/secrets/plugins/Voxgig/Sekreto/Plugins/Secretspec.pm'
+      }
+      # dart has the php/perl SHARED-HELPER shape, and worse. `runcmd`
+      # (Process.runSync) lives in plugins/httpjson.dart, which every
+      # HTTP plugin imports, so it ships with the FEATURE CORE and cannot
+      # be gated here at all - this group's `needs: { fs: true }` buys back
+      # the CLI kind, not the child-process call itself. Stated rather than
+      # hidden: a dart SDK with secrets active and a `[dotenv, env]` chain
+      # links HttpClient and a Process.runSync it never reaches. Dead code,
+      # not a defect, and an upstream shape issue (boru.dart calls runcmd
+      # too, so it is not secretspec-only there either).
+      def: dart: {
+        secretspec: 'lib/feature/secrets/sekreto/plugins/secretspec.dart'
+      }
+      # clojure: plugins/proc.clj is NOT listed here (nor under `vault`).
+      # It is the shared child-process helper BOTH boru.clj and
+      # secretspec.clj require - php's runcmd.php story, one language over -
+      # so it ships with the feature core and belongs to NO group.
+      def: clojure: {
+        'voxgig.sekreto.plugins.secretspec/secretspec': 'feature/secrets/voxgig/sekreto/plugins/secretspec.clj'
+      }
+      # plugins/proc.ex is NOT listed here - the php/perl SHARED-HELPER
+      # story, one language over. The elixir port factors the child-process
+      # spawn out of the two plugins that need it, so proc.ex is used by
+      # Boru (`vault`) AND Secretspec (`secretspec`); listing its path in
+      # either group would delete a file the other group's plugin calls.
+      # It ships with the feature core instead, alongside http.ex and
+      # httpjson.ex. Stated rather than hidden: a secrets-enabled elixir
+      # SDK carries a `System.cmd("/bin/sh", ...)` source line even with
+      # this group off. The code is unreachable without a plugin that calls
+      # it, and it is an upstream shape issue rather than a local one.
+      def: elixir: {
+        'Sekreto.Plugins.Secretspec.secretspec': 'lib/projectname/feature/secrets/sekreto/plugins/secretspec.ex'
+      }
+      # plugins/Proc.swift is NOT listed here either - see the swift note in
+      # the `vault` group: it is a feature-core file both groups use.
+      def: swift: {
+        secretspec: 'Sources/ProjectNameSDK/feature/secrets/plugins/Secretspec.swift'
+      }
+      # Proc.lean is NOT listed here - the php/perl SHARED-HELPER story:
+      # Boru (`vault`) imports it too, so it ships with the feature core.
+      def: lean: {
+        'Sekreto.secretspec': 'src/feature/secrets/sekreto/plugins/SekretoPlugins/Secretspec.lean'
+      }
+      # plugins/proc.c is NOT listed here either - see the c note in the
+      # `vault` group: it is a feature-core file both groups use.
+      def: c: {
+        sek_plugin_secretspec: 'feature/secrets/plugins/secretspec.c'
+      }
+      # lua: the FIELD each module exports (`require('...hashicorp').hashicorp`
+      # is upstream's own spelling; aws.lua exports awssecrets AND awsparams),
+      # and the module path under tm/lua - this target's root, which is also
+      # Main_lua's Copy root, so the emitted exclude matches it. Config_lua
+      # turns the path into a require (strip .lua, slashes to dots).
+      def: lua: {
+        secretspec: 'feature/secrets/sekreto/plugins/secretspec.lua'
+      }
+      def: zig: {
+        secretspec: 'feature/secrets/plugins/secretspec.zig'
+      }
+      # plugins/runcmd.ml is NOT listed here either - see the ocaml note in
+      # the `vault` group: it is a feature-core file both groups open.
+      # This is the one ocaml group that needs NO transport (`needs` has no
+      # `fetch`), so feature/secrets/feature.mk compiles runcmd.ml beside it and nothing of
+      # the TLS chain: a secretspec-only ocaml SDK links no OpenSSL.
+      def: ocaml: {
+        'Secretspec.plugin': 'feature/secrets/plugins/secretspec.ml'
+      }
+      # cpp: see the vault group. plugins/Proc.cpp (`runcmd`) is shared with
+      # Boru and ships with the feature core, not here.
+      def: cpp: {
+        secretspec: 'feature/secrets/plugins/Secretspec.cpp'
+      }
     }
   }
 
+  # rust: the TLS the vendored HTTP helper speaks.
+  #
+  # plugins/httpjson/http.rs opens its own sockets and names rustls
+  # directly, so cargo needs the crates as DIRECT dependencies even though
+  # both are already in the closure of the target's existing `ureq` dep
+  # (rustls 0.23 + webpki-roots 0.26). `default: false` is load-bearing,
+  # not tidiness: rustls with DEFAULT features pulls aws-lc-rs/aws-lc-sys
+  # and a cmake C build, while the ring feature set below is what ureq
+  # already compiles - so a secrets-enabled rust SDK adds no build at all.
+  # Package_rust renders the dependency-TABLE form when either key is set.
+  #
+  # Feature deps are `active: true` by explicit opt-in (collectDeps), so an
+  # SDK that does not select this feature names neither crate.
+  deps: rust: {
+    'rustls': {
+      active: true, version: '0.23', kind: prod
+      default: false, features: ['std', 'ring', 'tls12']
+    }
+    'webpki-roots': { active: true, version: '0.26', kind: prod }
+  }
+
+
   # Transport role (station design §8.4).
   #
   # 'wrap', because the access-token exchange below has to SEE the response: