@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/model/target/c.aon

@@ -8,6 +8,11 @@ main: kit: target: c: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability tags (docs/design/feature-tags.md): this target vendors
+  # the c port of @voxgig/sekreto (with voxgig/plugin under it) inside its
+  # gated `feature/secrets/` container, so the `secrets` feature applies.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the fused corpus runner, whose engine half is now
   # the vendored omni runner (tests/vendor/omni) and whose support half
@@ -23,8 +28,16 @@ main: kit: target: c: {
   }
 
   # struct is vendored under utility/struct — no external dep. The whole
-  # pipeline is synchronous; the transport uses libcurl when available at
-  # build time (weak, optional) else returns a transport error.
+  # pipeline is synchronous, and the CORE ships no HTTP client at all: a
+  # live request without a caller-supplied `options.system.fetch` returns
+  # a transport error (utility/fetcher.c). The only external dependencies
+  # a c SDK can have arrive with the `secrets` feature, and only when it
+  # is active with a plugin group: the vendored vault kinds link OpenSSL
+  # (-lssl -lcrypto, plugins/tls.c), and the feature's token-exchange
+  # transport of last resort (feature/secrets/kinds.c, generated) links
+  # libcurl. Both are turned on by the generated feature/secrets/kinds.mk
+  # the Makefile includes, so an SDK with secrets inactive, or with no
+  # plugin group, links libc alone.
   deps: {
   }
 }

package/project/.sdk/model/target/clojure.aon

@@ -8,6 +8,16 @@ main: kit: target: clojure: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/clojure/feature/secrets/),
+  # so a feature that resolves secrets through sekreto can apply here.
+  #
+  # That container is ALSO a classpath root: Clojure resolves
+  # `(require 'voxgig.sekreto.chain)` to voxgig/sekreto/chain.clj searched
+  # from each :paths entry, never by relative import, so Package_clojure
+  # adds `feature/secrets` to :paths whenever this feature is active.
+  provides: { sekreto: true }
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/cpp.aon

@@ -8,6 +8,14 @@ main: kit: target: cpp: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability tags (docs/design/feature-tags.md): this target vendors
+  # the cpp port of @voxgig/sekreto (with voxgig/plugin under it) inside
+  # its gated `feature/secrets/` container, so the `secrets` feature
+  # applies. The port is a multi-translation-unit library where the SDK
+  # itself is header-only; tm/cpp/Makefile compiles it into an archive only
+  # through the generated feature/secrets/kinds.mk it `-include`s.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner header
   # (test/runner_support.hpp is support-only — the file/env loaders,
@@ -25,6 +33,16 @@ main: kit: target: cpp: {
   # struct is vendored under utility/voxgigstruct — no external dep. The SDK
   # is header-only; JSON parsing is the vendored struct parser and the mock
   # transport needs no network. Tests need only a C++17 compiler (g++).
+  #
+  # The one external dependency a cpp SDK can have arrives with the
+  # `secrets` feature, and only when it is active WITH a plugin group: the
+  # vendored vault kinds link OpenSSL (-lssl -lcrypto, plugins/Tls.cpp),
+  # and the feature's token-exchange transport of last resort (the
+  # generated feature/secrets/kinds.cpp) rides on the same vendored HTTPS
+  # client rather than adding libcurl - so there is exactly one HTTP stack
+  # and one -l pair. The generated feature/secrets/kinds.mk turns it on
+  # from the model, so an SDK with secrets inactive, or with no plugin
+  # group, links libstdc++ and libc alone.
   deps: {}
 }
 

package/project/.sdk/model/target/csharp.aon

@@ -7,6 +7,11 @@ main: kit: target: csharp: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/csharp/feature/secrets/),
+  # so a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct corpus engine. Runner.cs (class
   # TestRunner) is support-only and RETAINED, name unchanged so emitted

package/project/.sdk/model/target/elixir.aon

@@ -8,6 +8,12 @@ main: kit: target: elixir: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container
+  # (tm/elixir/lib/projectname/feature/secrets/), so a feature that resolves
+  # secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written corpus engine, replaced by the
   # vendored @voxgig/omni runner under test/vendor/omni driven through

package/project/.sdk/model/target/java.aon

@@ -7,6 +7,11 @@ main: kit: target: java: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/java/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner class
   # (test/RunnerSupport.java is support-only and RETAINED, name unchanged

package/project/.sdk/model/target/js.aon

@@ -7,6 +7,11 @@ main: kit: target: js: {
   module: name: '$$name$$'
   base: 'BASE'
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container, so a feature that resolves
+  # secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the single fused runner. `doctor` reports
   # leftovers; `doctor prune` deletes them.

package/project/.sdk/model/target/kotlin.aon

@@ -7,6 +7,13 @@ main: kit: target: kotlin: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md): this target's feature
+  # container carries a vendored sekreto port, so the `secrets` feature —
+  # whose `needs` is exactly this tag — applies here. Without it
+  # featureApplies() refuses the feature and Config emits neither the
+  # import nor the registry entry.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner class
   # (test/RunnerSupport.kt is support-only and RETAINED, name unchanged

package/project/.sdk/model/target/lua.aon

@@ -8,6 +8,23 @@ main: kit: target: lua: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/lua/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  #
+  # What lua ships: the four built-in kinds (env, memory, dotenv, file) in
+  # the vendored core, and every plugin kind as a trimmable group. The
+  # plugin kinds reach `sekreto.plugins.net`, which runs a small COMPILED
+  # helper (feature/secrets/native/sekretonet.c, -lssl -lcrypto) because
+  # Lua 5.4 has no sockets and no TLS. The helper is vendored with the
+  # feature and built by the generated Makefile ONLY when a plugin group is
+  # active (Main_lua emits feature/secrets/native.mk then), so an SDK
+  # without secrets - or with the built-in chain alone - runs no compiler
+  # and links no OpenSSL. `sekreto.plugins.net` finds the binary through
+  # its own adapted helperpath() (vendor/routes.json), at
+  # feature/secrets/native/sekreto-net.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/runner.lua is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/ocaml.aon

@@ -8,6 +8,24 @@ main: kit: target: ocaml: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/ocaml/feature/secrets/:
+  # the sekreto core under sekreto/, the voxgig/plugin host under plugin/
+  # and the provider kinds under plugins/), so a feature that resolves
+  # secrets through sekreto can apply here.
+  #
+  # What ocaml ships: the four built-in kinds (env, memory, dotenv, file)
+  # in the vendored core, and every plugin kind as a trimmable group. The
+  # four HTTPS groups (vault, cloud, saas, aws) reach plugins/http.ml ->
+  # plugins/tls.ml, whose externals are bound in plugins/tls_stubs.c
+  # against OpenSSL (-lssl -lcrypto, and `ocamlc -custom` to carry the
+  # stub). That dependency is scoped INSIDE the gated feature: the
+  # generated feature/secrets/feature.mk (Main_ocaml) compiles the stub
+  # and links OpenSSL ONLY when a plugin group that needs a transport is
+  # active, so an SDK without secrets, or with the built-in chain alone,
+  # or with `secretspec` alone, runs no C compiler and links no OpenSSL.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written corpus engine, replaced by
   # test/omni_resolver.ml over the vendored @voxgig/omni port
@@ -24,6 +42,17 @@ main: kit: target: ocaml: {
   # struct is vendored under utility/ (voxgig_struct.ml + vregex.ml) — the
   # runtime is dependency-free: it compiles with the stock ocamlc, no opam
   # packages, no dune. So there are no manifest dependencies.
+  #
+  # The CORE also bundles no HTTP transport (sdk_runtime.ml
+  # fetch_no_transport): a live request needs a caller-supplied
+  # `options.system.fetch`. The only external dependency an ocaml SDK can
+  # have arrives with the `secrets` feature, and only when a plugin group
+  # needing a transport is active: the vendored HTTPS kinds bind OpenSSL
+  # through plugins/tls_stubs.c, and the feature's token-exchange transport
+  # of last resort rides the same vendored HTTP client. The generated
+  # feature/secrets/feature.mk turns both on from the trimmed tree, so an
+  # SDK with secrets inactive, or with no plugin group, links the OCaml
+  # distribution alone (unix.cma for the dotenv/file built-ins).
   deps: {}
 }
 
@@ -59,10 +88,24 @@ main: kit: target: ocaml: publish: {
 }
 
 
-# Feature source is NOT trimmed to the model's selection here: every
-# feature lives inside a single generated module (sdk_features.ml), not in
-# per-feature source files, so there is nothing per-feature to leave out.
-# Trimming waits on that module becoming model-driven.
+# Feature source IS trimmed to the model's selection. The eighteen pipeline
+# features live inside one template module (sdk_features.ml), which is not
+# feature source and is never a trim candidate - so for a long time there
+# was nothing per-feature to leave out and trim stayed off. `secrets`
+# changed that: it is the first ocaml feature carried as a CONTAINER
+# (feature/secrets_feature.ml, feature/secrets/ with the vendored sekreto
+# and voxgig/plugin trees, test/feature/secrets/), some 5.5k lines that a
+# project which never selected the feature must not carry. With trim on,
+# `target add ocaml` copies that container only when the project's model
+# selects `secrets`; the per-feature placeholder dirs under src/feature/
+# (never generated - Main_ocaml excludes src/) are trimmed on the same
+# rule, which is what every trim:true target does.
+#
+# fullset is EMPTY on purpose: test/t_feature.ml gates every block on
+# `has_feature`, and the harness only constructs features the generated
+# config knows, so the cross-feature suite compiles and runs against any
+# trimmed set. Nothing else references a feature by name.
 main: kit: target: ocaml: feature: {
-  trim: false
+  trim: true
+  fullset: []
 }

package/project/.sdk/model/target/perl.aon

@@ -8,6 +8,11 @@ main: kit: target: perl: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/perl/feature/secrets/),
+  # so a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (t/runner.pm is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/php.aon

@@ -8,6 +8,11 @@ main: kit: target: php: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/php/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/Runner.php is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/rb.aon

@@ -8,6 +8,11 @@ main: kit: target: rb: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/rb/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the struct-corpus runner (test/runner.rb is
   # support-only and RETAINED). `doctor` reports leftovers; `doctor

package/project/.sdk/model/target/rust.aon

@@ -8,6 +8,11 @@ main: kit: target: rust: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/rust/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written struct corpus runner, superseded
   # by the vendored @voxgig/omni engine driven through

package/project/.sdk/model/target/scala.aon

@@ -7,6 +7,11 @@ main: kit: target: scala: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container, so a feature that resolves
+  # secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
   # Retired by the move to the vendored @voxgig/omni corpus runner
   # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so
   # rather than leaving the key off.
@@ -72,8 +77,39 @@ main: kit: target: scala: publish: {
 
 # Feature source is NOT trimmed to the model's selection here: the cross-
 # feature tests live inside sdktest/SdkTestMain.scala, the single test
-# entry point, so they cannot be dropped without losing every other test
-# too. Trimming stays off until that suite is split per feature.
+# entry point, and that file constructs fifteen feature classes BY NAME
+# (NetsimFeature, RetryFeature, TimeoutFeature, RatelimitFeature,
+# CacheFeature, ...), so a trim that dropped an unselected feature's source
+# would stop the whole suite compiling. Every other target that trims has a
+# `fullset` file to drop with it (java's test/FeatureTest.java, go's
+# test/feature_test.go); scala's equivalent is fused into SdkTestMain, so
+# `fullset: ['sdktest/SdkTestMain.scala']` would take 137 runtime assertions
+# with it. Trimming stays off until that suite is split per feature.
+#
+# WHAT THAT COSTS, stated rather than left to be discovered. Every feature's
+# source ships to every scala SDK whatever the model selected, and the
+# secrets feature is by far the largest: measured on a feature-OFF SDK it
+# adds 26 files / 6,443 lines - SecretsFeature.scala, the vendored sekreto
+# core (6 files) and voxgig/plugin core (16), and the two UNGROUPED plugin
+# files. Those two are the ones with teeth: plugins/Sigv4.scala links
+# javax.crypto for AWS HMAC-SHA256 request signing, and
+# plugins/Httpjson.scala carries both the shared HTTP client and `runcmd`,
+# a ProcessBuilder child-process launcher. Neither can join a plugin group -
+# four and eight provider kinds respectively compile against them, so any
+# group owning them would let another group's trim delete them (which is
+# exactly how Sigv4.scala broke the saas and cloud groups once).
+#
+# The NINE provider clients ARE trimmed, in both directions: Main_scala
+# applies pluginExcludes for an active feature's inactive groups, and every
+# declared group of a feature that is itself off - so a secrets-off SDK
+# carries no vault, cloud, saas, aws or secretspec client. Both ends are
+# pinned, in ts/test/generate.test.ts and in the generated suite itself
+# (SecretsTestMain's vocabulary case reads the compiled module set).
+#
+# Flipping trim on is therefore a THREE-part change, not a one-line one:
+# split the feature tests out of SdkTestMain.scala into a `fullset` file,
+# stop the Makefile naming a per-feature suite that may not have shipped,
+# and re-measure. It is deliberately not part of the secrets work.
 main: kit: target: scala: feature: {
   trim: false
 }

package/project/.sdk/model/target/swift.aon

@@ -7,6 +7,16 @@ main: kit: target: swift: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container
+  # (tm/swift/Sources/ProjectNameSDK/feature/secrets/{plugin,sekreto,plugins}),
+  # so a feature that resolves secrets through sekreto can apply here. The
+  # three vendored trees are SEPARATE SwiftPM modules (VoxgigPlugin, Sekreto,
+  # SekretoPlugins - upstream's own module boundary, and load-bearing: the
+  # SDK, plugin and sekreto each declare a `Value`, a `Point` or a `Json`),
+  # which Package_swift declares only when the feature is active.
+  provides: { sekreto: true }
+
   # Retired by the move to the vendored @voxgig/omni corpus runner
   # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so
   # rather than leaving the key off.

package/project/.sdk/model/target/zig.aon

@@ -8,6 +8,17 @@ main: kit: target: zig: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md): the `secrets` feature is a
+  # thin layer over a VENDORED sekreto port and declares `needs: { sekreto:
+  # true }`; a target that does not say it carries one never gets the
+  # feature. This target does: tm/zig/feature/secrets/{sekreto,plugin,
+  # plugins} are the zig ports of @voxgig/sekreto and voxgig/plugin at the
+  # shared vendor tag, wired as the named build modules `sekreto`, `plugin`
+  # and `sekretoplugins` by the generated build.zig (Main_zig) - and ONLY
+  # when the feature is active, so an SDK without secrets declares none of
+  # them and compiles nothing of it. Mirrors ts.aon / go.aon / rust.aon.
+  provides: { sekreto: true }
+
   # Files earlier toolchains generated that this target has RETIRED
   # (vendor-tag rollout): the hand-written struct runner, whose engine half
   # AND assertion half are now the vendored omni port driven through
@@ -61,10 +72,25 @@ main: kit: target: zig: publish: {
 
 
 # Feature source is NOT trimmed to the model's selection here: root.zig
-# re-exports every feature type with @import("feature/<name>.zig"), and
-# build.zig names test/feature_test.zig explicitly, so a trimmed tree
-# fails to build. Trimming stays off until root.zig's feature exports are
-# driven from the model.
+# re-exports every BUILT-IN feature type with @import("feature/<name>.zig"),
+# and build.zig names test/feature_test.zig explicitly, so a trimmed tree
+# fails to build. Trimming stays off until those static exports are driven
+# from the model too.
+#
+# THE FORCING CASE is `secrets`, the first GATED feature this target
+# carries. With the trim off, its whole tree - feature/secrets.zig, the
+# vendored sekreto and voxgig/plugin cores and the provider plugins - ships
+# in EVERY zig SDK whatever the model says. What keeps that honest is that
+# zig compiles only what a module root reaches, so the generated build.zig
+# and root.zig (Main_zig, from the marker-slotted fragments) name the
+# feature's modules, its root export and its test step ONLY when the
+# feature is active: a secrets-off SDK carries the files as dead weight and
+# compiles none of them, and `make lint` (`zig fmt --check .`) is the one
+# gate that still reads them. Main_zig also drops the provider plugins of
+# an INACTIVE feature and the inactive groups of an active one (the scala
+# shape), so the dead weight is the two cores plus the ungrouped
+# httpjson/sigv4 helpers, never the nine vault clients. When the feature
+# trim lands here, that second exclude list becomes redundant, not wrong.
 main: kit: target: zig: feature: {
   trim: false
 }