@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/src/cmp/clojure/featureextra_clojure.ts

@@ -0,0 +1,130 @@
+
+import {
+  targetFeatures,
+} from '@voxgig/sdkgen'
+
+
+import {
+  KIT,
+  Model,
+  getModelPath,
+} from '@voxgig/apidef'
+
+
+// FEATURES WHOSE CLOJURE SOURCE LIVES OUTSIDE src/sdk/features.clj.
+//
+// Every ordinary feature is one arm of the hand-written `make-feature`
+// factory in that single module. A feature that vendors a LIBRARY cannot
+// be: `secrets` carries a whole @voxgig/sekreto port, and that port has to
+// be droppable for a project that did not ask for it. So its
+// implementation lives in the gated feature container instead
+// (`feature/secrets/sdk/feature/secrets.clj`, namespace
+// `sdk.feature.secrets`) and the generated config wires it in.
+//
+// The container is ALSO a classpath root. Clojure resolves
+// `(require 'voxgig.sekreto.chain)` to `voxgig/sekreto/chain.clj` searched
+// from each `:paths` entry - never by relative import - so the directory
+// holding `voxgig/` must itself be on the classpath. Package_clojure adds
+// `feature/<name>` to `:paths` for exactly the entries below that are
+// active. (`test/vendor/omni` is the same rule, already in that file.)
+//
+// A map rather than a convention because both halves are decisions:
+// WHICH namespace the container publishes, and WHAT the constructor is
+// called. A new one is added here, and nowhere else.
+const EXTRA: Record<string, { ns: string, ctor: string }> = {
+  secrets: { ns: 'sdk.feature.secrets', ctor: 'secrets-feature' },
+}
+
+
+type ExtraFeature = {
+  // Feature name, as the model and make-feature spell it.
+  name: string
+  // The namespace the feature container publishes.
+  ns: string
+  // The constructor var in it, taking the feature's plugin definitions.
+  ctor: string
+  // The classpath root the container needs (target-root-relative).
+  path: string
+}
+
+
+// The extra features this model actually selects, applicability included.
+// Sorted, so the emitted requires and maps are byte-stable.
+function extraFeatures(model: Model, target: any): ExtraFeature[] {
+  const active = targetFeatures(model, target)
+
+  return Object.keys(EXTRA).sort()
+    .filter((name: string) => null != active[name])
+    .map((name: string) => ({
+      name,
+      ns: EXTRA[name].ns,
+      ctor: EXTRA[name].ctor,
+      path: 'feature/' + name,
+    }))
+}
+
+
+// The plugin DEFINITIONS the model selected, per feature.
+//
+// `def.clojure` keys are FULLY-QUALIFIED vars
+// (`voxgig.sekreto.plugins.aws/awssecrets`); the namespace is the part
+// before the `/`, and one namespace may export several definitions (aws
+// exports two). Emitted as `(:require [<ns> :as p-<tail>])` plus
+// `p-<tail>/<var>` references, so an INACTIVE group leaves no require and
+// no reference - which is what makes the generate-time file trim safe.
+//
+// `only_active: false` is NOT used here, deliberately: this reads the
+// ACTIVE plugins, because these become references to files that must
+// exist. The trim (pluginExcludes, in Main_clojure) reads the unfiltered
+// map instead. Getting that backwards emits a require for a namespace the
+// trim just deleted.
+function pluginRequires(model: Model, target: any): {
+  requires: { ns: string, alias: string }[],
+  plugins: Record<string, string[]>,
+} {
+  const feature = targetFeatures(model, target)
+
+  const aliases: Record<string, string> = {}
+  const plugins: Record<string, string[]> = {}
+
+  for (const fname of Object.keys(feature).sort()) {
+    const syms: string[] = []
+
+    const pmap = getModelPath(model,
+      `main.${KIT}.feature.${fname}.plugin`, { required: false }) || {}
+
+    for (const pname of Object.keys(pmap).sort()) {
+      const plugin = pmap[pname]
+      if (false === plugin?.active || null == plugin?.active) continue
+
+      for (const sym of Object.keys(plugin.def?.clojure || {}).sort()) {
+        const cut = String(sym).lastIndexOf('/')
+        if (0 > cut) continue
+        const ns = String(sym).slice(0, cut)
+        const varname = String(sym).slice(cut + 1)
+        const alias = 'p-' + ns.split('.').pop()
+        aliases[ns] = alias
+        syms.push(alias + '/' + varname)
+      }
+    }
+
+    if (0 < syms.length) {
+      plugins[fname] = Array.from(new Set(syms)).sort()
+    }
+  }
+
+  const requires = Object.keys(aliases).sort()
+    .map((ns: string) => ({ ns, alias: aliases[ns] }))
+
+  return { requires, plugins }
+}
+
+
+export type {
+  ExtraFeature,
+}
+
+export {
+  extraFeatures,
+  pluginRequires,
+}

package/project/.sdk/src/cmp/cpp/Config_cpp.ts

@@ -1,7 +1,7 @@
-
 import {
   Content,
   File,
+  Folder,
   cmp,
   configDefinition,
   each,
@@ -21,6 +21,291 @@ import {
 } from './utility_cpp'
 
 
+// PLUGIN DEFINITIONS PER FEATURE (the cpp peer of Config_c's
+// pluginDefinitions and Config_go's featurePlugins map).
+//
+// Upstream sekreto retired its self-registration registry for voxgig/plugin
+// definitions: a provider kind the caller did not pass in
+// `SekretoOptions::plugins` is unknown to that Sekreto. So the model's
+// choice of plugin groups IS the SDK's provider vocabulary, and the
+// generated code names each active group's factory (`def: cpp:` in
+// model/feature/secrets.aon - `hashicorp`, the `Definition hashicorp()`
+// each vendored kind header declares in namespace sekreto) and nothing
+// else. A symbol named here whose file the plugin trim removed is an
+// unresolved reference at link time - a loud failure, which is the right
+// kind. The owning file is kept per symbol because the generated
+// translation unit has to include that file's header.
+//
+// One entry per ACTIVE feature that declares a `plugin` map at all, read
+// with `only_active: false` (pluginExcludesFor's subtlety: the feature
+// object a component is handed has already been filtered, so a feature
+// whose groups are all off would otherwise look like one with no plugin
+// machinery, and its kinds.cpp - which the Makefile reads as the feature's
+// WIRING - would not be emitted).
+function pluginDefinitions(model: Model, target: any):
+  Record<string, { syms: Record<string, string>, groups: number }> {
+  const out: Record<string, { syms: Record<string, string>, groups: number }> = {}
+  const feature = targetFeatures(model, target)
+
+  each(feature, (f: any) => {
+    const declared = getModelPath(model,
+      `main.${KIT}.feature.${f.name}.plugin`,
+      { required: false, only_active: false }) || {}
+    if (0 === Object.keys(declared).length) return
+
+    const syms: Record<string, string> = {}
+    let groups = 0
+    each(declared, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered (Config_go's note): getting this wrong names a
+      // factory for a file the trim just deleted.
+      if (true !== plugin.active) return
+      const defs = plugin.def?.[target.name] || {}
+      if (0 < Object.keys(defs).length) groups++
+      for (const sym of Object.keys(defs)) syms[sym] = String(defs[sym])
+    })
+
+    out[f.name] = { syms, groups }
+  })
+
+  return out
+}
+
+
+// feature/<name>/kinds.cpp - GENERATED, one per plugin-bearing active
+// feature, and the ONE translation unit this otherwise header-only target
+// generates.
+//
+// It cannot live in core/config.hpp: that header is included by every test
+// translation unit, and it must not name the vendored voxgig/plugin's
+// `Definition` type - the same reason go hides its list behind []any and c
+// behind void**. So config.hpp's accessor is type-erased
+// (std::shared_ptr<void>), and this file, which may include the kind
+// headers, produces the erased list. It sits one level ABOVE the vendored
+// sekreto/, plugin/ and plugins/ directories on purpose: the vendoring
+// guard fails any non-vendored file inside a vendor dir, and this one is
+// generated.
+//
+// Beside it goes feature/<name>/kinds.mk, the feature's BUILD WIRING: a
+// generated make fragment that tm/cpp/Makefile reads through
+// `-include $(wildcard feature/*/kinds.mk)`. The Makefile itself names no
+// feature (the `nothing left behind names a dropped feature` guard holds a
+// trimmed template tree to that), so everything the payload needs from the
+// build is stated here, from the model: this translation unit and the
+// vendored cores to compile into libsdkfeature.a, the suite to build, and
+// - only when a plugin group is active - the plugin layer with the OpenSSL
+// it brings. A tree whose model never activated the feature has no
+// fragment, compiles none of the payload and links libstdc++ alone. Both
+// files are emitted for an active feature with NO active group as well -
+// an [env, memory] chain still needs the sekreto core - with an empty
+// definitions list and no plugin layer.
+//
+// For `secrets` it additionally carries `secrets_rawfetch`, the
+// token-exchange transport of last resort (go's rawExchangeFetch). The cpp
+// core ships no HTTP client (utility/pipeline.hpp fetcher: "provide
+// options.system.fetch"), and the decision for this target - as for c - is
+// to bundle one INSIDE the gated feature, compiled in only when a plugin
+// group is active, so an SDK without secrets, or with a chain of built-ins,
+// still ships zero external dependencies. DELIBERATE DIVERGENCE from c,
+// which bundles libcurl: the cpp sekreto port exports its own HTTPS client
+// (`sekreto::httprequest`, plugins/Httpjson.cpp over plugins/Tls.cpp), and
+// it is already compiled and linked - OpenSSL and all - on exactly the
+// condition this transport needs. Reusing it means one HTTP stack and one
+// -l pair (-lssl -lcrypto) instead of two; kinds.mk links OpenSSL on the
+// same condition (a plugin group active), so the two cannot disagree.
+// With no group active the exchange still works through a caller-supplied
+// options.system.fetch, which every live cpp request already lives under;
+// only the fallback is missing, and it says so.
+const FeaturePlugins = cmp(async function FeaturePlugins(props: any) {
+  const ctx$ = props.ctx$
+  const target = props.target
+  const model: Model = ctx$.model
+
+  const defs = pluginDefinitions(model, target)
+  if (0 === Object.keys(defs).length) return
+
+  Folder({ name: 'feature' }, () => {
+    for (const fname of Object.keys(defs).sort()) {
+      const { syms, groups } = defs[fname]
+      const symnames = Object.keys(syms).sort()
+
+      // The header each selected kind file declares its factory in,
+      // relative to this file (feature/<fname>/): `feature/<fname>/
+      // plugins/Hashicorp.cpp` -> `plugins/Hashicorp.hpp`. Deduplicated,
+      // because aws declares two factories in one header.
+      const headers = Array.from(new Set(symnames.map((sym) =>
+        syms[sym]
+          .replace(new RegExp('^feature/' + fname + '/'), '')
+          .replace(/\.cpp$/, '.hpp')))).sort()
+
+      Folder({ name: fname }, () => {
+        // The build wiring (see above). Paths are SDK-root-relative, as the
+        // Makefile's own globs are. kinds.cpp itself is listed: nothing
+        // else in the tree is a .cpp the Makefile would otherwise compile.
+        File({ name: 'kinds.mk' }, () => {
+          Content(`# Generated beside kinds.cpp: what the \`${fname}\` feature needs from the
+# build, read by the Makefile through \`-include $(wildcard feature/*/kinds.mk)\`.
+# Without this file none of the feature's vendored payload is compiled or
+# linked. Do not hand-edit - change the model and regenerate.
+
+# The wiring translation unit, the vendored cores every chain needs (sekreto
+# and the voxgig/plugin host it is built on), and the feature's gated suite.
+FEATURE_SRCS += feature/${fname}/kinds.cpp \\
+  $(wildcard feature/${fname}/sekreto/*.cpp feature/${fname}/plugin/*.cpp)
+FEATURE_TEST_SRCS += $(wildcard test/feature/${fname}/*.cpp)
+`)
+          if (0 === groups) {
+            Content(`
+# No plugin group is active: the plugin layer (the kinds, the socket HTTPS
+# client and its OpenSSL binding, the digests and the child-process
+# launcher) is on disk but NOT compiled - plugins/Tls.cpp hard-includes
+# <openssl/ssl.h> - and nothing beyond libstdc++ is linked. A chain of
+# built-ins needs none of it.
+`)
+          }
+          else {
+            Content(`
+# A plugin group is active: the selected kinds and the four shared helpers
+# they call (the socket HTTPS client, its OpenSSL binding, the digests and
+# the child-process launcher), with the one external library they bring -
+# OpenSSL, for the vault kinds' TLS and for the token-exchange transport of
+# last resort in kinds.cpp, which rides on the same vendored client.
+FEATURE_SRCS += $(wildcard feature/${fname}/plugins/*.cpp)
+FEATURE_LIBS += -lssl -lcrypto
+`)
+          }
+        })
+
+        File({ name: 'kinds.cpp' }, () => {
+          Content(`// Generated: the plugin definitions the model selected for the \`${fname}\`
+// feature's provider chain (the cpp peer of go's core.FeaturePlugins),
+// read back by core/config.hpp's featurePlugins("${fname}") and by the
+// feature itself through ${fname}_plugins().
+//
+// GENERATED beside kinds.mk, the build wiring tm/cpp/Makefile includes. Do
+// not hand-edit - change the model's plugin groups and regenerate.
+//
+// The one non-header translation unit this SDK generates: it includes the
+// header-only SDK (for the declarations feature/${fname}.hpp makes) and the
+// vendored kind headers, which core/config.hpp must never name.
+
+#include "../../core/sdk.hpp"
+
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
+${headers.map((h) => `#include "${h}"
+`).join('')}
+namespace sdk {
+
+${0 === symnames.length ?
+`// No plugin group is active: the chain can name the four built-in kinds
+// (env, memory, dotenv, file) and a custom provider, and nothing else.
+std::vector<std::shared_ptr<void>> ${fname}_plugins() {
+  return {};
+}
+` :
+`// One factory call per selected kind, type-erased for config.hpp (the
+// feature casts each back to plugin::DefinitionPtr).
+std::vector<std::shared_ptr<void>> ${fname}_plugins() {
+  return {
+${symnames.map((sym) => `    std::static_pointer_cast<void>(sekreto::${sym}()),
+`).join('')}  };
+}
+`}`)
+
+          if ('secrets' !== fname) {
+            Content(`
+} // namespace sdk
+`)
+            return
+          }
+
+          if (0 === groups) {
+            Content(`
+// THE EXCHANGE TRANSPORT OF LAST RESORT, when no plugin group is active:
+// there is none. The cpp core ships no HTTP client, and the vendored HTTPS
+// client (plugins/Httpjson.cpp, OpenSSL) is compiled with the plugin
+// groups only (see kinds.mk beside this file), so a token purchase needs
+// options.system.fetch - the seam every live cpp request already uses.
+// Reached only by an exchange whose caller supplied no transport; a chain
+// that resolves a static credential never comes here.
+SecretsRawResponse secrets_rawfetch(
+    const std::string& method, const std::string& url,
+    const std::vector<std::pair<std::string, std::string>>& headers,
+    const std::string& body) {
+  (void)method; (void)headers; (void)body;
+  SecretsRawResponse out;
+  out.ok = false;
+  out.err = "secrets: the token exchange has no HTTP transport: this SDK selected "
+    "no secrets plugin group, so the vendored HTTPS client is not compiled; "
+    "supply options.system.fetch or activate a plugin group (URL was: \\"" +
+    url + "\\")";
+  return out;
+}
+
+} // namespace sdk
+`)
+            return
+          }
+
+          Content(`
+// THE EXCHANGE TRANSPORT OF LAST RESORT (go's rawExchangeFetch): the
+// vendored sekreto HTTPS client, answering the status and raw body the
+// feature turns into the transport-shaped map the system.fetch seam
+// promises. It exists so an exchange works with ordinary SDK options -
+// requiring a custom transport for the COMMON case would refuse every
+// live token purchase before a request was made. Deliberately NOT the SDK
+// transport: that is what the secrets feature wraps, and sending the
+// token request back through it would recurse on the first expiry.
+//
+// \`sekreto::httprequest\` RETURNS a non-2xx status rather than raising (a
+// 401 from a token endpoint is an answer), raises only on a transport
+// failure, follows no redirect and consults no proxy - the properties a
+// credential-bearing request wants. It is compiled because a plugin group
+// is active in this model; kinds.mk links OpenSSL on exactly that
+// condition. (c bundles libcurl here instead - see the note on
+// FeaturePlugins in Config_cpp.ts for why cpp reuses the vendored client.)
+
+} // namespace sdk
+
+#include "plugins/Httpjson.hpp"
+
+namespace sdk {
+
+SecretsRawResponse secrets_rawfetch(
+    const std::string& method, const std::string& url,
+    const std::vector<std::pair<std::string, std::string>>& headers,
+    const std::string& body) {
+  SecretsRawResponse out;
+  try {
+    sekreto::Ordered h;
+    for (const auto& kv : headers) h.set(kv.first, kv.second);
+    std::optional<std::string> reqbody;
+    if (!body.empty()) reqbody = body;
+    sekreto::Response res = sekreto::httprequest(method, url, h, reqbody);
+    out.ok = true;
+    out.status = res.status;
+    out.body = res.body;
+  } catch (const std::exception& e) {
+    out.ok = false;
+    out.err = std::string("secrets: token exchange transport failed: ") + e.what() +
+      " (URL was: \\"" + url + "\\")";
+  }
+  return out;
+}
+
+} // namespace sdk
+`)
+        })
+      })
+    }
+  })
+})
+
+
 // core/config.hpp: makeConfig() rebuilds the embedded API model by parsing a
 // chunked JSON literal with the vendored struct parser; makeFeature(name) is
 // the N-feature-safe by-name factory the client uses (mirrors Config_java /
@@ -53,6 +338,7 @@ const Config = cmp(async function Config(props: any) {
 
 #include <memory>
 #include <string>
+#include <vector>
 
 #include "../core/struct.hpp"
 #include "../core/types.hpp"
@@ -107,6 +393,40 @@ inline FeaturePtr makeFeature(const std::string& name) {
 
     Content(`  return std::make_shared<BaseFeature>();
 }
+`)
+
+    // The plugin-definitions accessor, EMITTED UNCONDITIONALLY so a caller
+    // can always ask, and EMPTY unless a plugin-bearing feature is active:
+    // each such feature's list lives in its generated
+    // feature/<name>/kinds.cpp (see FeaturePlugins above), which this
+    // dispatches to by name, so this header never names the vendored
+    // plugin's types - the list is type-erased (std::shared_ptr<void>; the
+    // feature casts back to plugin::DefinitionPtr), the way go returns
+    // []any and c void**. The per-feature function is an ordinary extern
+    // declaration here and in the feature header alike; kinds.cpp defines
+    // it, and the generated kinds.mk has the Makefile compile it.
+    const plugged = Object.keys(pluginDefinitions(model, target)).sort()
+
+    Content(`
+// The plugin definitions the model selected per feature (type-erased; see
+// feature/<name>/kinds.cpp). Empty for a feature with none, and for a
+// model with no plugin-bearing feature active.
+`)
+    for (const fname of plugged) {
+      Content(`std::vector<std::shared_ptr<void>> ${fname}_plugins();
+`)
+    }
+
+    Content(`
+inline std::vector<std::shared_ptr<void>> featurePlugins(const std::string& name) {
+`)
+    for (const fname of plugged) {
+      Content(`  if (name == "${fname}") return ${fname}_plugins();
+`)
+    }
+    Content(`  (void)name;
+  return {};
+}
 
 } // namespace sdk
 
@@ -117,5 +437,7 @@ inline FeaturePtr makeFeature(const std::string& name) {
 
 
 export {
-  Config
+  Config,
+  FeaturePlugins,
+  pluginDefinitions,
 }

package/project/.sdk/src/cmp/cpp/Gitignore_cpp.ts

@@ -12,6 +12,8 @@ const Gitignore = cmp(async function Gitignore(_props: any) {
 test/*.out
 *.o
 *.out
+# The gated secrets feature's vendored archive (tm/cpp/Makefile)
+*.a
 
 # Struct-corpus run report (written by test/struct_corpus_test.cpp)
 corpus-scoreboard.json

package/project/.sdk/src/cmp/cpp/Main_cpp.ts

@@ -3,8 +3,10 @@ import * as Path from 'node:path'
 
 import {
   cmp, each,
-  File, Content, Copy, Folder, Fragment,
-  TEST_CONTROL_EXCLUDE
+  File, Copy, Folder, Fragment,
+  TEST_CONTROL_EXCLUDE,
+  pluginExcludes,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -20,7 +22,7 @@ import {
 
 
 import { Package } from './Package_cpp'
-import { Config } from './Config_cpp'
+import { Config, FeaturePlugins } from './Config_cpp'
 import { Gitignore } from './Gitignore_cpp'
 import { MainEntity } from './MainEntity_cpp'
 import { EntityBase } from './EntityBase_cpp'
@@ -34,15 +36,65 @@ const Main = cmp(async function Main(props: any) {
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
 
+  // THE PLUGIN TRIM FOR A FEATURE THAT IS ITSELF OFF (Main_c's and
+  // Main_scala's inactivePluginExcludes, for the same reason).
+  //
+  // pluginExcludes(model) below walks only the model's ACTIVE features, so
+  // a `secrets` declared `active: false` keeps every declared group's
+  // vendored kind file in the tree. For cpp that is not merely untidy: the
+  // Makefile decides whether to compile the plugin layer - and to link
+  // OpenSSL - from whether a KIND FILE is present under
+  // feature/secrets/plugins/, so the files have to go. Every declared group
+  // of an inactive feature goes, not only the groups marked inactive: a
+  // feature that is off has no active plugins whatever its `plugin` map
+  // says (targetFeatures drops it before Config ever reads a group). The
+  // feature's own header and the vendored cores are left to the Makefile's
+  // wiring gate (feature/secrets/kinds.cpp is generated only for an active
+  // feature; without it nothing of the feature is compiled, and
+  // core/config.hpp includes no feature/secrets.hpp) and to `target add`,
+  // which trims the whole container for a real project.
+  //
+  // Rooting matches pluginExcludes': cpp's declared paths are
+  // target-root-relative, which is this Copy's root, and the other
+  // targets' paths in the same list cannot match anything in a cpp tree
+  // (every pattern is anchored at its own extension).
+  const feature = targetFeatures(model, target)
+  const esc = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const allfeature = getModelPath(model, `main.${KIT}.feature`,
+    { required: false, only_active: false }) || {}
+  const inactivePluginExcludes: RegExp[] = []
+  for (const fname of Object.keys(allfeature)) {
+    if (null != (feature as any)[fname]) continue
+    const groups = getModelPath(model, `main.${KIT}.feature.${fname}.plugin`,
+      { required: false, only_active: false }) || {}
+    for (const gname of Object.keys(groups)) {
+      for (const one of (groups[gname].path || [])) {
+        const pat = esc(String(one))
+        inactivePluginExcludes.push(new RegExp('(^|/)' +
+          pat.replace(/\\\/$/, '') + (/\/$/.test(String(one)) ? '/' : '$')))
+      }
+    }
+  }
+
   Package({ target })
 
   Gitignore({})
 
   // Copy tm/cpp verbatim (with placeholder substitution). The tm src/ subtree
   // only stages the per-feature custom-source dirs (target add), so exclude it.
+  //
+  // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+  // group's declared files stay out of the tree - the model's `path`
+  // entries are target-root-relative, which is this Copy's root). cpp has
+  // `srcfeature: false`, so the per-feature Copy in cmp/Feature.ts - where
+  // pluginExcludesFor normally applies this trim - never runs for it, and
+  // this whole-tree Copy is the ONLY copy the target has: without the
+  // exclude an active secrets feature would ship every inactive kind, and
+  // the Makefile would compile and link them all (Main_go.ts precedent).
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE,
+      ...pluginExcludes(model), ...inactivePluginExcludes],
     replace: {
       ...props.ctx$.stdrep,
     }
@@ -82,6 +134,12 @@ const Main = cmp(async function Main(props: any) {
     })
   })
 
+  // feature/<name>/kinds.cpp — the plugin definitions an active
+  // plugin-bearing feature selected, and the Makefile's wiring gate for that
+  // feature's vendored payload (see Config_cpp). Nothing is emitted when no
+  // such feature is active.
+  FeaturePlugins({ target })
+
 })
 
 

package/project/.sdk/src/cmp/cpp/Package_cpp.ts

@@ -8,6 +8,16 @@ import {
 // verbatim); there is no package manifest to generate (unlike pom.xml /
 // Cargo.toml / go.mod). This component is a no-op kept for parity with the
 // other targets' Main -> Package call.
+//
+// The Makefile stays a TEMPLATE even now that the gated `secrets` feature
+// brings a multi-translation-unit payload: the Makefile names no feature
+// and reads `-include $(wildcard feature/*/kinds.mk)`, so the same verbatim
+// file is right for every model, and everything that differs per API -
+// which payload to compile, which suite to build, which kinds were
+// selected, whether OpenSSL is linked - is emitted by Config_cpp's
+// FeaturePlugins as feature/secrets/kinds.mk and kinds.cpp, not here. (c
+// makes the same choice; rust generates a module index instead because
+// cargo has no wildcard.)
 const Package = cmp(async function Package(_props: any) {
 })