@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/src/cmp/csharp/Config_csharp.ts

@@ -52,6 +52,49 @@ const Config = cmp(async function Config(props: any) {
   const { def: configDef, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
+  // THE FEATURE PLUGIN MAP (the csharp peer of Config_go's featurePlugins).
+  //
+  // Upstream sekreto replaced its self-registration registry with
+  // voxgig/plugin definitions: a provider kind the caller did not pass in
+  // via `Plugins: [...]` is unknown to that Sekreto. So the config names
+  // each active plugin's exported Definition (the model's per-target `def`
+  // map - `AwsPlugins.Secrets`, a C# static field) and hands the list to
+  // the feature through SdkConfig.FeaturePlugins.
+  //
+  // FULLY QUALIFIED with `global::`, which is what makes an inactive model
+  // cost nothing: no `using` is emitted, so a config for a project with no
+  // plugin groups names no sekreto type at all and the generated file is
+  // byte-identical to one from a tree that has never heard of the feature.
+  const featurePlugins: Record<string, string[]> = {}
+
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered (see Config_go: getting this wrong emits a
+      // reference to a file the plugin trim has just deleted, and the SDK
+      // does not compile).
+      if (false === plugin.active || null == plugin.active) return
+      for (const sym of Object.keys(plugin.def?.csharp || {})) {
+        syms.push(sym)
+      }
+    })
+    if (0 < syms.length) {
+      featurePlugins[f.name] = syms.sort()
+    }
+  })
+
+  const featurePluginCases = Object.keys(featurePlugins).sort()
+    .map((fname: string) =>
+      `            case ${JSON.stringify(fname)}:
+                return new List<object?>
+                {
+` + featurePlugins[fname]
+        .map((sym: string) => `                    global::Voxgig.Sekreto.Plugins.${sym},
+`).join('') +
+      `                };
+`).join('')
+
   File({ name: 'Config.' + target.ext }, () => {
 
     Content(`// ${model.const.Name} SDK - generated model configuration and feature
@@ -186,6 +229,33 @@ public static class SdkConfig
     }
 `)
 
+    // ALWAYS EMITTED, even with no case at all - the same rule Config_py
+    // states for FEATURE_PLUGINS, and for the same reason. csharp's feature
+    // source is copied by Main's blanket `tm/<target>` copy whether or not
+    // the model declares the feature (only `target add` trims it, and only
+    // for a project that runs it), so SecretsFeature.cs can be present in a
+    // tree whose model has secrets switched off. Emitting this
+    // conditionally was tried and it breaks exactly there: `error CS0117:
+    // 'SdkConfig' does not contain a definition for 'FeaturePlugins'`,
+    // which takes the whole assembly down rather than leaving one unused
+    // class behind.
+    //
+    // The cost of always emitting is five inert lines and NO type
+    // reference: the return is List<object?>, so a Config.cs for a project
+    // with no plugin groups names nothing from the vendored trees and needs
+    // no `using`. The feature reads the list back and type-tests, which is
+    // go's shape too.
+    Content(`
+    public static List<object?> FeaturePlugins(string name)
+    {
+        switch (name)
+        {
+${featurePluginCases}            default:
+                return new List<object?>();
+        }
+    }
+`)
+
     Content(`
     public static Feature.BaseFeature MakeFeature(string name)
     {

package/project/.sdk/src/cmp/csharp/Main_csharp.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Content, Copy, Folder, Fragment,
+  pluginExcludes,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
 
@@ -41,9 +42,16 @@ const Main = cmp(async function Main(props: any) {
 
   // Copy tm/csharp files with replacements. `src/` holds only the
   // per-feature extension folders (not shipped into the SDK output).
+  //
+  // pluginExcludes: the generate-time plugin trim (a DECLARED-but-INACTIVE
+  // plugin group's files are never copied). Without it every group's files
+  // ship regardless of the model, and an SDK whose chain is [dotenv, env]
+  // carries AWS request signing and seven HTTP vault clients - the whole
+  // point of the trim. Feature-level trimming happens at `target add`
+  // time; this is the per-plugin cut inside a feature that IS selected.
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
     }

package/project/.sdk/src/cmp/csharp/Package_csharp.ts

@@ -16,6 +16,12 @@ import type {
 } from '@voxgig/apidef'
 
 
+import {
+  KIT,
+  getModelPath,
+} from '@voxgig/apidef'
+
+
 // Emits the two MSBuild project files (the C# twin of Package_go's go.mod):
 //   <Name>SDK.csproj       - the library, compiling everything except test/
 //   test/<Name>SDKTest.csproj - the xunit test project (mirrors the
@@ -44,6 +50,24 @@ const Package = cmp(async function Package(props: any) {
     ? `  <ItemGroup>\n${depRefs}\n  </ItemGroup>\n`
     : ''
 
+  // CS8619, and ONLY when the secrets feature's `aws` plugin group is
+  // selected. Upstream sekreto builds its plugin assembly with <Nullable>
+  // disabled; vendored into an SDK that enables it, plugins/Aws.cs:87
+  // reports one nullability mismatch on a tuple conversion. It is a
+  // VENDORED file, so it cannot be fixed here (a silent tweak to vendored
+  // source is exactly what the vendoring guard exists to prevent), and it
+  // is the only such warning in the whole vendored set.
+  //
+  // Gated rather than added to the standing list because the standing list
+  // is a promise about EVERY generated SDK: CS8619 catches a real class of
+  // bug in ordinary code, and switching it off for everyone to quiet one
+  // line in one vendored file would be paying for a feature that is off by
+  // default. `getModelPath` is active-filtered, so this reads as present
+  // only when the group is really on.
+  const awsPlugin = getModelPath(model,
+    `main.${KIT}.feature.secrets.plugin.aws`, { required: false })
+  const vendorNoWarn = null == awsPlugin ? '' : ';CS8619'
+
   File({ name: Name + 'SDK.csproj' }, () => {
     Content(`<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
@@ -54,7 +78,7 @@ const Package = cmp(async function Package(props: any) {
     <AssemblyName>${Name}SDK</AssemblyName>
     <RootNamespace>${Name}Sdk</RootNamespace>
     <!-- Loose-object-model port: suppress repetitive nullability noise. -->
-    <NoWarn>$(NoWarn);CS8600;CS8601;CS8602;CS8603;CS8604;CS8618;CS8625;CS1591</NoWarn>
+    <NoWarn>$(NoWarn);CS8600;CS8601;CS8602;CS8603;CS8604;CS8618;CS8625;CS1591${vendorNoWarn}</NoWarn>
 
     <!-- NuGet package metadata (publication pending; see Makefile). -->
     <Version>${packageVersion(model, target.name)}</Version>

package/project/.sdk/src/cmp/elixir/Config_elixir.ts

@@ -52,6 +52,72 @@ const Config = cmp(async function Config(props: any) {
     ? `        "auth" => %{"prefix" => ${elixirString(authPrefix)}},\n`
     : ''
 
+  // THE PLUGIN DEFINITIONS PER FEATURE (the elixir peer of Config_go's
+  // FeaturePlugins and Config_ts's pluginDefs).
+  //
+  // Upstream sekreto replaced its self-registration registry with
+  // voxgig/plugin definitions: a provider kind the caller did not pass in
+  // via `plugins: [...]` is unknown to that Sekreto, so the model's choice
+  // of plugin groups IS the SDK's provider vocabulary. Each active plugin's
+  // `def` key is a fully-qualified elixir CALL (`Sekreto.Plugins.Hashicorp
+  // .hashicorp`), emitted here as `...()` and handed to the feature.
+  //
+  // The smallest of the four emitters: Elixir resolves modules globally, by
+  // their `defmodule`, so there is no import block to keep in step with the
+  // trim - naming the call is the whole of it.
+  //
+  // Filter on `active` HERE rather than trusting the feature object to
+  // arrive filtered (the trap Config_ts and Config_go both carry a warning
+  // about): emitting a call into a module the plugin trim just deleted is
+  // an `UndefinedFunctionError` at the first client construction.
+  const featurePlugins: Record<string, string[]> = {}
+
+  // DECLARED at all, active or not - the emit gate. An SDK that selects no
+  // plugin-bearing feature gets no function, so config.ex is byte-identical
+  // to what it was before this feature existed: inactive costs nothing.
+  // (`only_active: false` for the same reason pluginExcludes needs it - the
+  // feature object a component is handed has ALREADY been filtered, so its
+  // `plugin` map holds only the ACTIVE groups and a project with the feature
+  // on but every group off would read as "no plugins declared" and lose the
+  // function the feature calls.)
+  let declared = false
+
+  each(feature, (f: any) => {
+    const all = getModelPath(model, `main.${KIT}.feature.${f.name}.plugin`,
+      { required: false, only_active: false }) || {}
+    if (0 < Object.keys(all).length) {
+      declared = true
+    }
+
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      if (false === plugin.active || null == plugin.active) return
+      for (const sym of Object.keys(plugin.def?.elixir || {})) {
+        syms.push(sym)
+      }
+    })
+    if (0 < syms.length) {
+      featurePlugins[f.name] = syms.sort()
+    }
+  })
+
+  const featurePluginNames = Object.keys(featurePlugins).sort()
+
+  const featurePluginsBlock = !declared ? '' :
+    `
+  # The plugin definitions the model selected per feature. Empty when no
+  # active feature declares active plugin groups for this target.
+  def feature_plugins(name) do
+    case name do
+` +
+    featurePluginNames.map((fname: string) =>
+      `      ${elixirString(fname)} -> [${featurePlugins[fname]
+        .map((s: string) => s + '()').join(', ')}]\n`).join('') +
+    `      _ -> []
+    end
+  end
+`
+
   Folder({ name: 'lib' }, () => {
     // The same config as an OBJECT, built by the shared helper so this
     // target's literal and the data that replaces it above the threshold are
@@ -156,7 +222,7 @@ defmodule ${Name}.Config do
   rescue
     ArgumentError -> false
   end
-end
+${featurePluginsBlock}end
 `)
         return
       }
@@ -222,7 +288,7 @@ defmodule ${Name}.Config do
   rescue
     ArgumentError -> false
   end
-end
+${featurePluginsBlock}end
 `)
     })
   })

package/project/.sdk/src/cmp/elixir/Main_elixir.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Folder, Content, Copy, Fragment,
+  pluginExcludes,
   targetFeatures,
 } from '@voxgig/sdkgen'
 
@@ -74,6 +75,21 @@ const Main = cmp(async function Main(props: any) {
     Copy({
       from: 'tm/' + target.name + '/lib/projectname',
       to: model.const.name,
+      // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+      // group's vendored files, declared per-target in the feature model).
+      // Rooted HERE, on lib/projectname, because that is this Copy's root
+      // and jostraca matches a candidate against the path relative to it -
+      // which is why the model's elixir plugin paths read
+      // `feature/secrets/sekreto/plugins/<kind>.ex` and not the full
+      // `lib/projectname/...`.
+      //
+      // AND THE TRIM IS INVISIBLE TO THE COMPILER HERE, unlike everywhere
+      // else. mix compiles everything under lib/ and Elixir needs no
+      // import, so a plugin file this exclude failed to remove compiles
+      // silently and SHIPS - where go fails on an unused import, py on a
+      // missing module and ts on an unresolved one. Only the parity and
+      // vendored guards can catch a broken trim in this target.
+      exclude: [...pluginExcludes(model)],
       replace: {
         ...stdrep,
       }

package/project/.sdk/src/cmp/go-cli/Main_go-cli.ts

@@ -70,10 +70,23 @@ const Main = cmp(function Main(props: any) {
 
   const FRAGMENT = Path.normalize(__dirname + '/../../../src/cmp/go-cli/fragment')
 
-  // .gitignore — build output (dist/) and any stray top-level binaries.
+  // .gitignore — build output (dist/), any stray top-level binaries, and
+  // jostraca's bookkeeping.
+  //
+  // `.jostraca/` matters only when this target is generated OUT OF TREE
+  // (`output: path`), which is a mode every target has: jostraca drops its
+  // meta log and a full duplicate of the last generated output at the output
+  // ROOT, and the destination is a different repository that nothing here
+  // puts under version control — so without this line the first regeneration
+  // leaves that repo dirty with hundreds of untracked files. In-tree the SDK
+  // repo's own ignore file already covers it, which is why this was missed:
+  // only `seneca-provider` was ever generated out of tree, and it was the
+  // only target whose ignore file carried the line. The other 21 targets
+  // still do not — see docs/design/seneca-provider-package.md.
   File({ name: '.gitignore' }, () => Content(`/dist/
 /${model.name}-cli
 /go-cli
+.jostraca/
 `))
 
   // ==========================================================================

package/project/.sdk/src/cmp/java/Config_java.ts

@@ -63,6 +63,87 @@ const Config = cmp(async function Config(props: any) {
   // station design §4) — passing target.name is what opts this target in.
   const { def: configDef } = configDefinition(model, target.name)
 
+  // PLUGIN DEFINITIONS, per feature — the java peer of Config_go's
+  // featurePlugins map (and of Config_ts's pluginImports/pluginDefs).
+  //
+  // Upstream sekreto replaced its self-registration registry with
+  // voxgig/plugin definitions: a provider kind the caller did not pass in
+  // via `plugins(...)` is unknown to that Sekreto. So the config imports
+  // each active plugin's exported Definition BY NAME (the model's
+  // per-target `def` map — `Hashicorp.PLUGIN`, a class-qualified java
+  // symbol) and hands the list to the feature through
+  // Config.featurePlugins.
+  //
+  // Emitted in core (not in the feature package) so the dependency runs
+  // core -> plugins -> sekreto -> plugin with no cycle; the feature reads
+  // it back as List<Object> and instanceof-tests, so core never names a
+  // vendored type.
+  const pluginImports = new Set<string>()
+  const featurePlugins: Record<string, string[]> = {}
+
+  // featurePlugins is emitted UNCONDITIONALLY — the method always exists,
+  // and answers List.of() for a name with no active groups. This is the go
+  // donor's shape (Config_go emits `var featurePlugins = map[string][]any`
+  // with no gate) and it is not a stylistic choice: java is a flat-container
+  // target (srcfeature: false), so Main's blanket Copy carries
+  // feature/SecretsFeature.java into the tree whenever tm/ holds it —
+  // including for a model that never DECLARED the feature at all, which is
+  // every project whose `target add` predates it or which dropped the
+  // feature afterwards. Gating the method on the model (on ACTIVE or on
+  // DECLARED, either way) leaves that copied source calling a method that
+  // was never emitted, and javac — which does no dead-code elimination —
+  // refuses the whole SDK on `cannot find symbol: featurePlugins`. An
+  // always-present method costs one empty switch; a conditional one costs
+  // the build.
+  //
+  // The SYMBOLS come from the ACTIVE view: an inactive feature's plugin
+  // files were removed by the generate-time trim, so importing them would
+  // be the same hard build failure from the other side.
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered (see Config_ts.pluginImports / Config_go): getting
+      // this wrong emits an import for a class the trim just deleted, and
+      // javac does no dead-code elimination — it is a hard build failure.
+      if (false === plugin.active || null == plugin.active) return
+      for (const [sym, one] of Object.entries(plugin.def?.java || {})) {
+        // 'feature/secrets/sekreto/plugins/Hashicorp.java' -> the package
+        // directory; 'Hashicorp.PLUGIN' -> the class to import.
+        const dir = String(one).replace(/\/[^/]+$/, '').replace(/\//g, '.')
+        pluginImports.add(javapackage + '.' + dir + '.' + sym.split('.')[0])
+        syms.push(sym)
+      }
+    })
+
+    if (0 < syms.length) {
+      featurePlugins[f.name] = Array.from(new Set(syms)).sort()
+    }
+  })
+
+  const pluginImportBlock = Array.from(pluginImports).sort()
+    .map((p: string) => `import ${p};\n`).join('')
+
+  const featurePluginsBlock =
+    `  /**
+   * The plugin definitions the model selected for one feature's chain, as
+   * List&lt;Object&gt; so core never names a vendored type. Empty for a
+   * feature whose model declares no active plugin group.
+   */
+  public static List<Object> featurePlugins(String name) {
+    switch (name) {
+` +
+    Object.keys(featurePlugins).sort().map((fname: string) =>
+      `      case "${fname}":
+        return List.of(${featurePlugins[fname].join(', ')});
+`).join('') +
+    `      default:
+        return List.of();
+    }
+  }
+
+`
+
   // Assemble the config shape (mirrors Config_go's emitted map). The
   // feature block comes from configDefinition's def, not from f.config,
   // so it carries each feature's `transport` role (station design §8.4)
@@ -118,10 +199,11 @@ const Config = cmp(async function Config(props: any) {
 
     Content(`package ${javapackage}.core;
 
+import java.util.List;
 import java.util.Map;
 
 import ${javapackage}.utility.Json;
-
+${pluginImportBlock}
 /** Static SDK configuration and by-name feature construction. */
 @SuppressWarnings({"unchecked"})
 public final class Config {
@@ -171,7 +253,7 @@ public final class Config {
     }
   }
 
-  private static String configJson() {
+${featurePluginsBlock}  private static String configJson() {
     StringBuilder b = new StringBuilder();
 `)
 

package/project/.sdk/src/cmp/java/Main_java.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Content, Copy, Folder, Fragment,
+  pluginExcludes,
   targetFeatures,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
@@ -53,7 +54,15 @@ const Main = cmp(async function Main(props: any) {
   // token used throughout the templates (package/import statements).
   Copy({
     from: 'tm/' + target.name,
-    exclude: [/src\//, TEST_CONTROL_EXCLUDE],
+    // pluginExcludes: the generate-time plugin trim (an INACTIVE plugin
+    // group's declared files stay out of the tree - the model's `path`
+    // entries are target-root-relative, which is this Copy's root).
+    // javac performs no dead-code elimination and the trim deletes whole
+    // .java files, so a surviving reference to a trimmed class is a hard
+    // build failure - which is why Config_java imports only the ACTIVE
+    // plugin symbols. The FEATURE-level trim stays an add-time concern
+    // (vendor-tag rollout, Decision 5), as it does for go and py.
+    exclude: [/src\//, TEST_CONTROL_EXCLUDE, ...pluginExcludes(model)],
     replace: {
       ...props.ctx$.stdrep,
       JAVAPACKAGE: javapackage,

package/project/.sdk/src/cmp/js/Config_js.ts

@@ -95,15 +95,20 @@ const Config = cmp(async function Config(props: any) {
 
         replace: {
 
-          '// #ImportFeatures': () => each(feature, (f: any) => {
-            Line(`const { ${nom(f, 'Name')}Feature } = ` +
-              `require('./feature/${f.name}/${nom(f, 'Name')}Feature')`)
-          }),
+          '// #ImportFeatures': () => {
+            each(feature, (f: any) => {
+              Line(`const { ${nom(f, 'Name')}Feature } = ` +
+                `require('./feature/${f.name}/${nom(f, 'Name')}Feature')`)
+            })
+            pluginImports(feature)
+          },
 
           '// #FeatureClasses': () => each(feature, (f: any) => {
             Line(` ${f.name}: ${nom(f, 'Name')}Feature,`)
           }),
 
+          '// #FeaturePlugins': () => pluginDefs(feature),
+
           // A JS string literal, so the JSON survives verbatim. JSON.stringify
           // escapes the quotes and backslashes the model contains (values like
           // `$STRING` carry backticks, which a template literal could not).
@@ -126,10 +131,13 @@ const Config = cmp(async function Config(props: any) {
 
         "'HEADERS'": indent(JSON.stringify(headers, null, 2), 4).trim(),
 
-        '// #ImportFeatures': () => each(feature, (f: any) => {
-          Line(`const { ${nom(f, 'Name')}Feature } = ` +
-            `require('./feature/${f.name}/${nom(f, 'Name')}Feature')`)
-        }),
+        '// #ImportFeatures': () => {
+          each(feature, (f: any) => {
+            Line(`const { ${nom(f, 'Name')}Feature } = ` +
+              `require('./feature/${f.name}/${nom(f, 'Name')}Feature')`)
+          })
+          pluginImports(feature)
+        },
 
         // Values from configDefinition's def, not re-derived here, so the
         // literal rep and the data rep cannot disagree on identity.
@@ -145,6 +153,8 @@ const Config = cmp(async function Config(props: any) {
           Line(` ${f.name}: ${nom(f, 'Name')}Feature,`)
         }),
 
+        '// #FeaturePlugins': () => pluginDefs(feature),
+
         // Rendered from configDefinition's def, not from f.config, so the
         // literal carries the feature's `transport` role (station design
         // §8.4) beside its options and cannot drift from the data rep.
@@ -173,6 +183,63 @@ const Config = cmp(async function Config(props: any) {
 })
 
 
+// PLUGIN DEFINITION REQUIRES AND THE FEATURE_PLUGINS MAP.
+//
+// Upstream sekreto replaced its self-registration registry with
+// voxgig/plugin definitions: a provider kind the caller did not pass in
+// via `plugins: [...]` is unknown to that Sekreto. So Config no longer
+// requires provider modules for their side effects — it requires each
+// active plugin's exported Definition BY NAME (the model's `def` map)
+// and hands the list to the feature through FEATURE_PLUGINS.
+//
+// Emitted here because Config already requires every active feature from
+// the model, and this is the same list one level down. The `def` map is
+// declared in the model rather than derived from filenames because one
+// file may export several definitions (sekreto's aws.js exports
+// awssecrets AND awsparams).
+function pluginImports(feature: any) {
+  each(feature, (f: any) => {
+    // path -> [symbol, ...], so one require line serves a two-definition
+    // module.
+    const bypath: Record<string, string[]> = {}
+
+    each(f.plugin, (plugin: any) => {
+      // Filter on `active` HERE rather than trusting the feature object to
+      // arrive filtered. Whether a model path was read with `only_active`
+      // varies by call site, and getting it wrong in this direction emits
+      // a require for a module the trim just deleted — an SDK that throws
+      // on load, rather than one that merely carries too much.
+      if (false === plugin.active || null == plugin.active) return
+
+      for (const [sym, one] of Object.entries(plugin.def?.js || {})) {
+        const path = String(one)
+        ; (bypath[path] = bypath[path] || []).push(sym)
+      }
+    })
+
+    for (const path of Object.keys(bypath).sort()) {
+      const spec = './' + path.replace(/^src\//, '').replace(/\.js$/, '')
+      Line(`const { ${bypath[path].sort().join(', ')} } = require('${spec}')`)
+    }
+  })
+}
+
+// The FEATURE_PLUGINS entries: one line per feature that has any active
+// plugin definitions, listing the required symbols.
+function pluginDefs(feature: any) {
+  each(feature, (f: any) => {
+    const syms: string[] = []
+    each(f.plugin, (plugin: any) => {
+      if (false === plugin.active || null == plugin.active) return
+      syms.push(...Object.keys(plugin.def?.js || {}))
+    })
+    if (0 < syms.length) {
+      Line(` ${f.name}: [${syms.sort().join(', ')}],`)
+    }
+  })
+}
+
+
 export {
   Config
 }

package/project/.sdk/src/cmp/js/Main_js.ts

@@ -4,7 +4,8 @@ import * as Path from 'node:path'
 import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
-  entityClassName, entityCollection, srcFeatureExcludes, stationLibrary,
+  entityClassName, entityCollection, srcFeatureExcludes, pluginExcludes,
+  stationLibrary,
   targetFeatures,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
@@ -42,6 +43,10 @@ const Main = cmp(async function Main(props: any) {
   // helpers/applicability.
   const feature = targetFeatures(model, target)
 
+  // Does the secrets feature apply here and is it switched on? Both, since
+  // targetFeatures already dropped it for a target with no sekreto port.
+  const secrets = null != feature.secrets
+
   Package({ target })
 
   Gitignore({})
@@ -50,7 +55,18 @@ const Main = cmp(async function Main(props: any) {
     from: 'tm/' + target.name,
     // Root copies src/feature/<name>/ per ACTIVE feature; keep this blanket
     // copy from restoring one that was switched off after `target add`.
-    exclude: [...srcFeatureExcludes(model), TEST_CONTROL_EXCLUDE],
+    // A feature's inactive plugins go too - same rule, one level
+    // deeper. See helpers/featureSource.pluginExcludes.
+    //
+    // pluginExcludes is REQUIRED, not cosmetic: Feature() renders before
+    // Main(), so its per-feature Copy applies pluginExcludesFor and then
+    // this blanket copy runs — and without the same patterns here it puts
+    // every trimmed plugin straight back.
+    exclude: [
+      ...srcFeatureExcludes(model),
+      ...pluginExcludes(model),
+      TEST_CONTROL_EXCLUDE,
+    ],
     replace: {
       ...props.ctx$.stdrep,
     }
@@ -75,6 +91,54 @@ const Main = cmp(async function Main(props: any) {
           replace: {
             ...props.ctx$.stdrep,
 
+            // SECRETS. All five slots are emitted only when the secrets
+            // feature applies to this target AND the model activates it.
+            // An unconditional edit here would land in every generated SDK
+            // and break the inactive-output gate: a model without the
+            // feature must generate byte-identically to pre-migration.
+            //
+            // `feature` is already gated by targetFeatures, so a target
+            // that does not provide 'sekreto' never reaches these.
+            '// #SecretsImport': () => secrets ?
+              Line(`const sekreto = require('./feature/secrets/sekreto')`) : undefined,
+
+            '// #SecretsField': ({ indent }: any) => secrets ?
+              Line({ indent }, '_secrets') : undefined,
+
+            // The LIVE instance, not a clone: sekreto holds provider and
+            // cache state, so a clone would resolve into a copy that
+            // prepareAuth never sees.
+            '// #SecretsAccessor': ({ indent }: any) => secrets ?
+              Content({ indent }, `
+secrets() {
+  return this._secrets && this._secrets.sekreto()
+}
+`) : undefined,
+
+            // prepare() bypasses the feature hook pipeline, so the PreSpec
+            // hook that resolves the secret for entity ops never runs on
+            // this path and the resolve has to be explicit. This is also
+            // what defends direct() and graphql(), which run no feature
+            // hooks at all and reach the wire through prepare().
+            //
+            // It RETURNS the Error rather than rejecting: _rawRequest
+            // awaits prepare() outside its try, and direct()/graphql() are
+            // documented to return a value or an Error, never reject.
+            '// #SecretsResolve': ({ indent }: any) => secrets ?
+              Content({ indent }, `
+if (null != this._secrets) {
+  try {
+    await this._secrets.resolve()
+  }
+  catch (err) {
+    return err instanceof Error ? err : new Error(String(err))
+  }
+}
+`) : undefined,
+
+            '// #SecretsExport': ({ indent }: any) => secrets ?
+              Line({ indent }, 'sekreto,') : undefined,
+
             '#BuildFeatures': ({ indent }: any) => {
               List({ item: feature, line: false }, ({ item }: any) =>
                 Line({ indent },