@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/src/cmp/c/Config_c.ts

@@ -2,6 +2,7 @@
 import {
   Content,
   File,
+  Folder,
   cmp,
   configDefinition,
   configReprSetting,
@@ -26,6 +27,312 @@ import {
 } from './utility_c'
 
 
+// PLUGIN DEFINITIONS PER FEATURE (the c peer of Config_go's featurePlugins
+// map and Main_rust's generated plugins.rs).
+//
+// Upstream sekreto retired its self-registration registry for voxgig/plugin
+// definitions: a provider kind the caller did not pass in `sek_options.
+// plugins` is unknown to that Sekreto. So the model's choice of plugin
+// groups IS the SDK's provider vocabulary, and the generated code names each
+// active group's constructor symbol (`def: c:` in model/feature/secrets.aon
+// - `sek_plugin_hashicorp`, the `Definition *(void)` each vendored kind
+// file defines) and nothing else. A symbol named here whose file the plugin
+// trim removed is an unresolved reference at link time - a loud failure,
+// which is the right kind.
+//
+// One entry per ACTIVE feature that declares a `plugin` map at all, read
+// with `only_active: false` (pluginExcludesFor's subtlety: the feature
+// object a component is handed has already been filtered, so a feature
+// whose groups are all off would otherwise look like one with no plugin
+// machinery, and its kinds.c - which the Makefile reads as the feature's
+// WIRING - would not be emitted).
+function pluginDefinitions(model: Model, target: any):
+  Record<string, { syms: string[], groups: number }> {
+  const out: Record<string, { syms: string[], groups: number }> = {}
+  const feature = targetFeatures(model, target)
+
+  each(feature, (f: any) => {
+    const declared = getModelPath(model,
+      `main.${KIT}.feature.${f.name}.plugin`,
+      { required: false, only_active: false }) || {}
+    if (0 === Object.keys(declared).length) return
+
+    const syms = new Set<string>()
+    let groups = 0
+    each(declared, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered (Config_go's note): getting this wrong names a
+      // constructor for a file the trim just deleted.
+      if (true !== plugin.active) return
+      const defs = Object.keys(plugin.def?.[target.name] || {})
+      if (0 < defs.length) groups++
+      for (const sym of defs) syms.add(sym)
+    })
+
+    out[f.name] = { syms: Array.from(syms).sort(), groups }
+  })
+
+  return out
+}
+
+
+// feature/<name>/kinds.c - GENERATED, one per plugin-bearing active feature.
+//
+// It cannot live in core/config.c: that translation unit must not name the
+// vendored voxgig/plugin's `Definition` type, which is why sdk.h types the
+// accessor as void** (the same reason go hides its list behind []any). It
+// sits one level ABOVE the vendored sekreto/, plugin/ and plugins/
+// directories on purpose: the vendoring guard fails any non-vendored file
+// inside a vendor dir, and this one is generated.
+//
+// Beside it goes feature/<name>/kinds.mk, the feature's BUILD WIRING: a
+// generated make fragment that tm/c/Makefile reads through
+// `-include $(wildcard feature/*/kinds.mk)`. The Makefile itself names no
+// feature (the `nothing left behind names a dropped feature` guard holds a
+// trimmed template tree to that), so everything a payload needs from the
+// build is stated here, from the model: the vendored cores to compile, the
+// suite to run, and - only when a plugin group is active - the plugin layer
+// with the external libraries it brings. A tree whose model never
+// activated the feature has no fragment, compiles none of the payload and
+// links libc alone. Both files are emitted for an active feature with NO
+// active group as well - an [env, memory] chain still needs the sekreto
+// core - with an empty definitions list and no plugin layer.
+//
+// For `secrets` it additionally carries `secrets_rawfetch`, the
+// token-exchange transport of last resort (go's rawExchangeFetch). The c
+// core ships no HTTP client (utility/fetcher.c), and the decision for this
+// target is to bundle one INSIDE the gated feature: libcurl, compiled in
+// only when a plugin group is active, so that an SDK without secrets - or
+// with secrets and a chain of built-ins - still ships zero external
+// dependencies. The Makefile adds -lcurl on the same condition (a kind file
+// present), so the two cannot disagree. With no group active the exchange
+// still works through a caller-supplied options.system.fetch, which every
+// live c request already lives under; only the fallback is missing, and it
+// says so.
+const FeaturePlugins = cmp(async function FeaturePlugins(props: any) {
+  const ctx$ = props.ctx$
+  const target = props.target
+  const model: Model = ctx$.model
+
+  const defs = pluginDefinitions(model, target)
+  if (0 === Object.keys(defs).length) return
+
+  Folder({ name: 'feature' }, () => {
+    for (const fname of Object.keys(defs).sort()) {
+      const { syms, groups } = defs[fname]
+
+      Folder({ name: fname }, () => {
+        // The build wiring (see above). Paths are SDK-root-relative, as the
+        // Makefile's own globs are. `feature/<name>.c` is NOT listed: the
+        // Makefile's feature/*.c glob already compiles every feature's own
+        // file, and its headers are on INC through the generic payload
+        // -I paths.
+        File({ name: 'kinds.mk' }, () => {
+          Content(`# Generated beside kinds.c: what the \`${fname}\` feature needs from the
+# build, read by the Makefile through \`-include $(wildcard feature/*/kinds.mk)\`.
+# Without this file none of the feature's vendored payload is compiled or
+# linked. Do not hand-edit - change the model and regenerate.
+
+# The vendored cores every chain needs (sekreto and the voxgig/plugin host it
+# is built on), and the feature's gated suite.
+FEATURE_SRCS += $(wildcard feature/${fname}/sekreto/*.c feature/${fname}/plugin/*.c)
+FEATURE_TEST_SRCS += $(wildcard tests/feature/${fname}/*.c)
+`)
+          if (0 === groups) {
+            Content(`
+# No plugin group is active: the plugin layer (the kinds, the socket HTTP
+# client and its OpenSSL binding, the encoders, the clock and the
+# child-process launcher) is on disk but NOT compiled, and nothing beyond
+# libc is linked. A chain of built-ins needs none of it.
+`)
+          }
+          else {
+            Content(`
+# A plugin group is active: the selected kinds and the five shared helpers
+# they call (the socket HTTP client and its OpenSSL binding, the encoders,
+# the clock and the child-process launcher), with the two external
+# libraries they bring - OpenSSL for the vault kinds' TLS, libcurl for the
+# token-exchange transport of last resort in kinds.c.
+FEATURE_SRCS += $(wildcard feature/${fname}/plugins/*.c)
+LDLIBS += -lssl -lcrypto -lcurl
+`)
+          }
+        })
+
+        File({ name: 'kinds.c' }, () => {
+          Content(`// Generated: the plugin definitions the model selected for the \`${fname}\`
+// feature's provider chain (the c peer of go's core.FeaturePlugins), read
+// back by core/config.c's feature_plugins("${fname}", &n).
+//
+// GENERATED beside kinds.mk, the build wiring tm/c/Makefile includes. Do
+// not hand-edit - change the model's plugin groups and regenerate.
+
+#include "sdk.h"
+
+#include "sekreto.h"
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+// One prototype per selected kind: the \`Definition *(void)\` constructor
+// its vendored file defines (plugins/sekretoplugins.h declares all ten;
+// naming only these keeps the link line the boundary upstream intends).
+${syms.map((sym: string) => `Definition* ${sym}(void);
+`).join('')}
+${0 === syms.length ?
+`// No plugin group is active: the chain can name the four built-in kinds
+// (env, memory, dotenv, file) and a custom provider, and nothing else.
+void** ${fname}_plugins(size_t* n) {
+  *n = 0;
+  return NULL;
+}
+` :
+`static void* ${fname.toUpperCase()}_KINDS[${syms.length}];
+
+void** ${fname}_plugins(size_t* n) {
+${syms.map((sym: string, i: number) => `  ${fname.toUpperCase()}_KINDS[${i}] = ${sym}();
+`).join('')}  *n = ${syms.length};
+  return ${fname.toUpperCase()}_KINDS;
+}
+`}`)
+
+          if ('secrets' !== fname) return
+
+          if (0 === groups) {
+            Content(`
+// THE EXCHANGE TRANSPORT OF LAST RESORT, when no plugin group is active:
+// there is none. The c core ships no HTTP client, and libcurl is bundled
+// with the plugin groups only (see tm/c/Makefile), so a token purchase
+// needs options.system.fetch - the seam every live c request already uses.
+// Reached only by an exchange whose caller supplied no transport; a chain
+// that resolves a static credential never comes here.
+voxgig_value* secrets_rawfetch(Context* ctx, const char* url,
+                               voxgig_value* fetchdef, PNError** err) {
+  (void)url; (void)fetchdef;
+  *err = context_make_error(ctx, "secrets_no_transport",
+    "secrets: the token exchange has no HTTP transport: this SDK selected no "
+    "secrets plugin group, so libcurl is not linked; supply "
+    "options.system.fetch or activate a plugin group");
+  return NULL;
+}
+`)
+            return
+          }
+
+          Content(`
+// THE EXCHANGE TRANSPORT OF LAST RESORT (go's rawExchangeFetch): plain
+// libcurl, answering the same transport-shaped map the system.fetch seam
+// promises ({status, statusText, headers, json(), body}). It exists so an
+// exchange works with ordinary SDK options - requiring a custom transport
+// for the COMMON case would refuse every live token purchase before a
+// request was made. Deliberately NOT the SDK transport: that is what the
+// secrets feature wraps, and sending the token request back through it
+// would recurse on the first expiry.
+//
+// libcurl is linked because a plugin group is active in this model; the
+// Makefile adds -lcurl on exactly that condition.
+
+#include <curl/curl.h>
+
+typedef struct {
+  char* data;
+  size_t len;
+} SecretsBuf;
+
+static size_t secrets_curl_write(char* ptr, size_t size, size_t nmemb, void* ud) {
+  SecretsBuf* b = (SecretsBuf*)ud;
+  size_t add = size * nmemb;
+  char* grown = (char*)realloc(b->data, b->len + add + 1);
+  if (NULL == grown) return 0;
+  b->data = grown;
+  memcpy(b->data + b->len, ptr, add);
+  b->len += add;
+  b->data[b->len] = '\\0';
+  return add;
+}
+
+voxgig_value* secrets_rawfetch(Context* ctx, const char* url,
+                               voxgig_value* fetchdef, PNError** err) {
+  static bool inited = false;
+  *err = NULL;
+  if (!inited) {
+    curl_global_init(CURL_GLOBAL_DEFAULT);
+    inited = true;
+  }
+
+  CURL* curl = curl_easy_init();
+  if (NULL == curl) {
+    *err = context_make_error(ctx, "secrets_transport", "secrets: curl_easy_init failed");
+    return NULL;
+  }
+
+  const char* method = get_str(fetchdef, "method");
+  if (NULL == method || '\\0' == method[0]) method = "POST";
+
+  struct curl_slist* hdrs = NULL;
+  voxgig_value* headers = getp(fetchdef, "headers");
+  if (voxgig_is_map(headers)) {
+    voxgig_map* hm = voxgig_as_map(headers);
+    for (size_t i = 0; i < hm->len; i++) {
+      if (!voxgig_is_string(hm->entries[i].value)) continue;
+      size_t klen = strlen(hm->entries[i].key);
+      const char* v = voxgig_as_string(hm->entries[i].value);
+      char* line = (char*)malloc(klen + 2 + strlen(v) + 1);
+      sprintf(line, "%s: %s", hm->entries[i].key, v);
+      hdrs = curl_slist_append(hdrs, line);
+      free(line);
+    }
+  }
+
+  SecretsBuf body = {NULL, 0};
+  curl_easy_setopt(curl, CURLOPT_URL, url);
+  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, method);
+  curl_easy_setopt(curl, CURLOPT_HTTPHEADER, hdrs);
+  curl_easy_setopt(curl, CURLOPT_TIMEOUT, 30L);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, secrets_curl_write);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, &body);
+  const char* reqbody = get_str(fetchdef, "body");
+  if (NULL != reqbody) {
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, reqbody);
+  }
+
+  CURLcode rc = curl_easy_perform(curl);
+  long status = 0;
+  if (CURLE_OK == rc) {
+    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &status);
+  }
+  curl_slist_free_all(hdrs);
+  curl_easy_cleanup(curl);
+
+  if (CURLE_OK != rc) {
+    char msg[512];
+    snprintf(msg, sizeof(msg), "secrets: token exchange transport failed: %s (URL was: \\"%s\\")",
+             curl_easy_strerror(rc), url);
+    free(body.data);
+    *err = context_make_error(ctx, "secrets_transport", msg);
+    return NULL;
+  }
+
+  const char* text = body.data ? body.data : "";
+  voxgig_value* parsed = json_parse(text);
+  voxgig_value* out = cmap(5,
+    "status", v_num((double)status),
+    "statusText", v_str(status >= 400 ? "ERR" : "OK"),
+    "headers", v_map(),
+    "json", json_thunk(parsed),
+    "body", v_str(text));
+  free(body.data);
+  return out;
+}
+`)
+        })
+      })
+    }
+  })
+})
+
+
 // core/config.c: make_config() builds the embedded API model as a Value;
 // make_feature(name) is the N-feature-safe factory the client uses to
 // instantiate features named in the options (mirrors Config_rust).
@@ -226,11 +533,41 @@ Feature* make_feature(const char* name) {
 
     Content(`  return feature_base_new();
 }
+`)
+
+    // The plugin-definitions accessor (sdk.h feature_plugins), EMITTED
+    // UNCONDITIONALLY so the prototype in sdk.h always has a definition,
+    // and EMPTY unless a plugin-bearing feature is active: each such
+    // feature's list lives in its generated feature/<name>/kinds.c (see
+    // FeaturePlugins above), which this dispatches to by name, so this
+    // translation unit never names the vendored plugin's types.
+    const plugged = Object.keys(pluginDefinitions(model, target)).sort()
+
+    Content(`
+`)
+    for (const fname of plugged) {
+      Content(`void** ${fname}_plugins(size_t* n);
+`)
+    }
+
+    Content(`
+void** feature_plugins(const char* name, size_t* n) {
+`)
+    for (const fname of plugged) {
+      Content(`  if (strcmp(name, "${fname}") == 0) return ${fname}_plugins(n);
+`)
+    }
+    Content(`  (void)name;
+  *n = 0;
+  return NULL;
+}
 `)
   })
 })
 
 
 export {
-  Config
+  Config,
+  FeaturePlugins,
+  pluginDefinitions,
 }

package/project/.sdk/src/cmp/c/Main_c.ts

@@ -4,6 +4,8 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Copy, Folder, Fragment,
+  pluginExcludes,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -19,7 +21,7 @@ import {
 
 
 import { Package } from './Package_c'
-import { Config } from './Config_c'
+import { Config, FeaturePlugins } from './Config_c'
 import { Gitignore } from './Gitignore_c'
 import { MainEntity } from './MainEntity_c'
 import { EntityBase } from './EntityBase_c'
@@ -33,15 +35,62 @@ const Main = cmp(async function Main(props: any) {
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
 
+  // THE PLUGIN TRIM FOR A FEATURE THAT IS ITSELF OFF (Main_scala's
+  // inactivePluginExcludes, for the same reason one target over).
+  //
+  // pluginExcludes(model) below walks only the model's ACTIVE features, so
+  // a `secrets` declared `active: false` keeps every declared group's
+  // vendored kind file in the tree. For c that is not merely untidy: the
+  // Makefile decides whether to compile the plugin layer - and to link
+  // OpenSSL and libcurl - from whether a KIND FILE is present under
+  // feature/secrets/plugins/, so the files have to go. Every declared group
+  // of an inactive feature goes, not only the groups marked inactive: a
+  // feature that is off has no active plugins whatever its `plugin` map
+  // says (targetFeatures drops it before Config ever reads a group). The
+  // feature's own source and the vendored cores are left to the Makefile's
+  // wiring gate (feature/secrets/kinds.c is generated only for an active
+  // feature; without it nothing of the feature is compiled) and to
+  // `target add`, which trims the whole container for a real project.
+  //
+  // Rooting matches pluginExcludes': c's declared paths are
+  // target-root-relative, which is this Copy's root, and the other
+  // targets' paths in the same list cannot match anything in a c tree.
+  const feature = targetFeatures(model, target)
+  const esc = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const allfeature = getModelPath(model, `main.${KIT}.feature`,
+    { required: false, only_active: false }) || {}
+  const inactivePluginExcludes: RegExp[] = []
+  for (const fname of Object.keys(allfeature)) {
+    if (null != (feature as any)[fname]) continue
+    const groups = getModelPath(model, `main.${KIT}.feature.${fname}.plugin`,
+      { required: false, only_active: false }) || {}
+    for (const gname of Object.keys(groups)) {
+      for (const one of (groups[gname].path || [])) {
+        const pat = esc(String(one))
+        inactivePluginExcludes.push(new RegExp('(^|/)' +
+          pat.replace(/\\\/$/, '') + (/\/$/.test(String(one)) ? '/' : '$')))
+      }
+    }
+  }
+
   Package({ target })
 
   Gitignore({})
 
   // Copy tm/c files with replacements. The tm src/ subtree only stages the
   // per-feature custom-source dirs (target add), so it is excluded here.
+  //
+  // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+  // group's declared files stay out of the tree - the model's `path`
+  // entries are target-root-relative, which is this Copy's root). c has
+  // `srcfeature: false`, so the per-feature Copy in cmp/Feature.ts - where
+  // pluginExcludesFor normally applies this trim - never runs for it, and
+  // this whole-tree Copy is the ONLY copy the target has: without the
+  // exclude an active secrets feature would ship every inactive kind, and
+  // the Makefile would compile and link them all (Main_go.ts precedent).
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//],
+    exclude: [/src\//, ...pluginExcludes(model), ...inactivePluginExcludes],
     replace: {
       ...props.ctx$.stdrep,
     }
@@ -73,6 +122,12 @@ const Main = cmp(async function Main(props: any) {
     Config({ target })
   })
 
+  // feature/<name>/kinds.c — the plugin definitions an active plugin-bearing
+  // feature selected, and the Makefile's wiring gate for that feature's
+  // vendored payload (see Config_c). Nothing is emitted when no such
+  // feature is active.
+  FeaturePlugins({ target })
+
   // core/api.h — the per-API public header (entity constructors + accessors).
   EntityBase({ target })
 

package/project/.sdk/src/cmp/c/Package_c.ts

@@ -5,8 +5,18 @@ import {
 
 
 // C has no package manifest — the build is driven by the template Makefile
-// (copied verbatim). Package is a no-op for the C target, kept so the Main
-// component can call it uniformly across targets.
+// (tm/c/Makefile, copied verbatim). Package is a no-op for the C target,
+// kept so the Main component can call it uniformly across targets.
+//
+// This is also why the secrets feature's build model is not emitted from
+// here, unlike Package_rust's rustls dependency table or Package_swift's
+// targets: the Makefile is feature-agnostic (a trimmed template tree must
+// name no feature) and `-include`s a GENERATED feature/<name>/kinds.mk that
+// Config_c emits only when the model activates the feature for this
+// target - the vendored payload to compile, the suite to run, and the
+// plugin layer with its OpenSSL and libcurl only when a plugin group is
+// active. Nothing here has to restate the model's choice, so nothing here
+// can drift from it.
 const Package = cmp(async function Package(_props: any) {
   // intentionally empty
 })

package/project/.sdk/src/cmp/clojure/Config_clojure.ts

@@ -25,6 +25,12 @@ import {
 } from './utility_clojure'
 
 
+import {
+  extraFeatures,
+  pluginRequires,
+} from './featureextra_clojure'
+
+
 // sdk/config.clj: make-config builds the embedded API model as a vendored
 // struct value node (LinkedHashMap/ArrayList) via vs/jm and vs/jt. The whole
 // config is assembled as a JSON-shaped object and rendered once through
@@ -45,6 +51,47 @@ const Config = cmp(async function Config(props: any) {
   const { def: config, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
+  // THE FEATURE WIRING (the clojure peer of Config_go's pluginImports /
+  // FeaturePlugins, and of Config_ts's pluginDefs).
+  //
+  // Two maps, both always emitted so sdk.features can name them without
+  // knowing whether this SDK selected anything:
+  //
+  //   feature-plugins  the voxgig/plugin DEFINITIONS the model's plugin
+  //                    groups selected, per feature. Upstream sekreto's
+  //                    contract since the registry was retired is that a
+  //                    provider kind not passed in is unknown to that
+  //                    Sekreto - so this map IS the SDK's provider
+  //                    vocabulary, and an inactive group leaves neither a
+  //                    require nor a reference behind.
+  //
+  //   feature-extra    the constructor for each feature whose source lives
+  //                    outside src/sdk/features.clj. make-feature consults
+  //                    it rather than requiring the container directly,
+  //                    which is what keeps the ~35 vendored namespaces out
+  //                    of every clojure SDK's load graph.
+  //
+  // Emitted HERE (not in the feature container) so the load order is
+  // core -> feature/secrets -> config -> features -> client, with no cycle.
+  const extra = extraFeatures(model, target)
+  const { requires: plugreq, plugins: featplugins } = pluginRequires(model, target)
+
+  const wireRequires =
+    plugreq.map((r: any) => `\n            [${r.ns} :as ${r.alias}]`).join('') +
+    extra.map((f: any) => `\n            [${f.ns} :as fx-${f.name}]`).join('')
+
+  const wireBlock = `
+(def feature-plugins
+  {${Object.keys(featplugins).sort()
+      .map((fname: string) =>
+        `"${fname}" [${featplugins[fname].join(' ')}]`).join('\n   ')}})
+
+(def feature-extra
+  {${extra.map((f: any) =>
+        `"${f.name}" (fn [] (${f.ns}/${f.ctor} (get feature-plugins "${f.name}")))`)
+      .join('\n   ')}})
+`
+
   File({ name: 'config.clj' }, () => {
 
     // ABOVE THE THRESHOLD: emit the model as DATA.
@@ -65,24 +112,24 @@ const Config = cmp(async function Config(props: any) {
 ;; threshold, or when main.kit.config.repr pins it: for a small model the
 ;; literal is smaller and far easier to read when debugging.
 (ns sdk.config
-  (:require [sdk.core :as core]))
+  (:require [sdk.core :as core]${wireRequires}))
 
 (def ^:private config-data
   (str ${cljStringChunks(configJson).map((c: string) => JSON.stringify(c)).join('\n       ')}))
 
 (defn make-config []
   (core/json-parse config-data))
-`)
+${wireBlock}`)
       return
     }
 
     Content(`;; ${model.const.Name} SDK configuration (generated by @voxgig/sdkgen).
 (ns sdk.config
-  (:require [voxgig.struct :as vs]))
+  (:require [voxgig.struct :as vs]${wireRequires}))
 
 (defn make-config []
   ${formatCljValue(config, 1)})
-`)
+${wireBlock}`)
   })
 })
 

package/project/.sdk/src/cmp/clojure/Main_clojure.ts

@@ -2,6 +2,7 @@
 import {
   cmp, each,
   File, Content, Copy, Folder,
+  pluginExcludes,
 } from '@voxgig/sdkgen'
 
 
@@ -16,12 +17,21 @@ import {
 } from '@voxgig/apidef'
 
 
+import { extraFeatures } from './featureextra_clojure'
 import { Package } from './Package_clojure'
 import { Config } from './Config_clojure'
 import { Gitignore } from './Gitignore_clojure'
 import { MainEntity } from './MainEntity_clojure'
 
 
+// Features that ship a top-level `feature/<name>/` container in
+// tm/clojure. Listed rather than discovered: a component cannot walk the
+// template tree, and the list is short and changes with the templates it
+// describes. Anything named here is EXCLUDED from the verbatim copy unless
+// the model selects it (see the Copy below).
+const CONTAINED = ['secrets']
+
+
 const Main = cmp(async function Main(props: any) {
 
   const { target } = props
@@ -36,9 +46,41 @@ const Main = cmp(async function Main(props: any) {
   // Copy tm/clojure verbatim (runtime under src/, the test suite under test/,
   // Makefile/LICENSE/VERSION). The feature-add scaffolding under src/feature
   // is excluded — the clojure target does not use per-feature custom source.
+  //
+  // THE TOP-LEVEL feature/ CONTAINER IS GATED HERE, at generate time.
+  //
+  // clojure declares `feature: trim: false` (model/target/clojure.aon)
+  // because every ordinary feature lives in the single generated module
+  // src/sdk/features.clj, so `target add` copies the whole template tree.
+  // That was harmless while nothing per-feature existed. It stopped being
+  // harmless with `secrets`: its container holds a vendored
+  // @voxgig/sekreto port and the voxgig/plugin runtime, and an SDK that
+  // never asked for secrets would otherwise ship ~35 files of key-store,
+  // request-signing and child-process code. So the container is excluded
+  // unless the model SELECTS the feature — the top-level-container peer of
+  // the `srcFeatureExcludes` gate ts and js apply to src/feature/<name>/.
+  //
+  // pluginExcludes: one level deeper, the generate-time plugin trim. An
+  // INACTIVE plugin group's declared files stay out of the tree; the
+  // model's `path` entries are target-root-relative, which is this Copy's
+  // root. It runs independently of `feature.trim`, so the group trim works
+  // while that decision stands.
+  //
+  // The gated feature's own TEST suite goes with it, and is named
+  // separately: it lives at test/sdk/test/feature/<name>.clj (a file, so
+  // the container pattern's trailing slash does not reach it) because
+  // Clojure resolves `sdk.test.feature.<name>` to that exact path.
+  const featureGate = extraFeatures(model, target).map((f: any) => f.name)
+  const containerExcludes = CONTAINED
+    .filter((name: string) => !featureGate.includes(name))
+    .flatMap((name: string) => [
+      new RegExp('(^|/)feature/' + name + '/'),
+      new RegExp('(^|/)test/sdk/test/feature/' + name + '\\.clj$'),
+    ])
+
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\/feature\//],
+    exclude: [/src\/feature\//, ...containerExcludes, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }

package/project/.sdk/src/cmp/clojure/Package_clojure.ts

@@ -11,6 +11,11 @@ import type {
 } from '@voxgig/apidef'
 
 
+import {
+  extraFeatures,
+} from './featureextra_clojure'
+
+
 // deps.edn — the tools.deps manifest. The vendored voxgig struct port needs no
 // external dependency; the library itself only needs org.clojure/clojure. The
 // tools.deps shim used to run the tests supports `-M:alias` reading :paths /
@@ -23,13 +28,24 @@ import type {
 // the classpath. Rooting it at `test` instead would demand the namespace
 // `vendor.omni.voxgig.omni.runner`, which the vendored file cannot carry -
 // it is read-only, resynced from upstream.
+//
+// A feature whose source ships as its own tree - `secrets`, which vendors
+// a whole @voxgig/sekreto port - needs the SAME treatment for the SAME
+// reason: the vendored files declare `voxgig.sekreto.chain`, so they
+// resolve only when the directory holding `voxgig/` is on the classpath.
+// So `feature/<name>` joins :paths, and only when the model selects that
+// feature: an SDK that did not ask for secrets gets the deps.edn it always
+// had, naming no directory that is not there.
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
+  const target = props.target
   const model: Model = ctx$.model
 
+  const roots = ['src', ...extraFeatures(model, target).map((f: any) => f.path)]
+
   File({ name: 'deps.edn' }, () => {
     Content(`;; ${model.const.Name} SDK for Clojure (generated by @voxgig/sdkgen).
-{:paths ["src"]
+{:paths [${roots.map((r: string) => JSON.stringify(r)).join(' ')}]
  :deps {org.clojure/clojure {:mvn/version "1.12.5"}}
  :aliases
  {:test