@voxgig/sdkgen 0.44.0 → 1.0.1

package/project/.sdk/tm/php/feature/TestFeature.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 // ProjectName SDK test feature
 
 require_once __DIR__ . '/BaseFeature.php';
+require_once __DIR__ . '/../utility/Param.php';
 
 class ProjectNameTestFeature extends ProjectNameBaseFeature
 {
@@ -45,7 +46,7 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
         $entity->data = $entity_data;
 
         $test_fetcher = function (ProjectNameContext $fctx, string $_fullurl, array $_fetchdef) use ($entity): array {
-            $respond = function (int $status, mixed $data, ?array $extra): array {
+            $respond = function (int $status, mixed $data, ?array $extra = null): array {
                 $out = [
                     'status' => $status,
                     'statusText' => 'OK',
@@ -64,53 +65,115 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
             $entname = $op->entity;
             $entmap = is_array($entity->data[$entname] ?? null) ? $entity->data[$entname] : [];
 
-            // Extract id from context: reqmatch for load/remove, reqdata for update/create.
-            $get_id = function () use ($fctx) {
-                $sources = [$fctx->reqmatch, $fctx->reqdata, $fctx->data];
-                foreach ($sources as $src) {
-                    if (is_array($src) && isset($src['id']) && $src['id'] !== '__UNDEFINED__') {
-                        return $src['id'];
+            // PHP-portable equivalent of TS buildArgs+select: a flat-key
+            // filter that matches by exact-equality on each provided key,
+            // with alias fallback. Empty match matches all entries — load
+            // with empty match returns the first fixture entry (or last
+            // create), list returns all entries.
+            $find_first = function (array $entmap, $match, $alias) {
+                if (!is_array($match) || empty($match)) {
+                    foreach ($entmap as $e) {
+                        if (is_array($e)) return $e;
+                    }
+                    return null;
+                }
+                foreach ($entmap as $e) {
+                    if (!is_array($e)) continue;
+                    $ok = true;
+                    foreach ($match as $k => $v) {
+                        if ($v === null || $v === '__UNDEFINED__') continue;
+                        $ev = $e[$k] ?? null;
+                        if ($ev !== $v) {
+                            // Try alias key if any
+                            $ka = is_array($alias) ? ($alias[$k] ?? null) : null;
+                            $aliased = ($ka !== null) ? ($e[$ka] ?? null) : null;
+                            if ($aliased !== $v) {
+                                $ok = false;
+                                break;
+                            }
+                        }
                     }
+                    if ($ok) return $e;
                 }
                 return null;
             };
 
-            if ($op->name === 'load') {
-                $id = $get_id();
-                $ent = ($id !== null && isset($entmap[$id])) ? $entmap[$id] : null;
-                if (!$ent) {
-                    // Fallback: search by id field value
-                    foreach ($entmap as $e) {
-                        if (is_array($e) && ($e['id'] ?? null) === $id) { $ent = $e; break; }
+            $find_all = function (array $entmap, $match, $alias) use ($find_first) {
+                if (!is_array($match) || empty($match)) {
+                    return array_values(array_filter($entmap, 'is_array'));
+                }
+                $out = [];
+                foreach ($entmap as $e) {
+                    if (!is_array($e)) continue;
+                    $ok = true;
+                    foreach ($match as $k => $v) {
+                        if ($v === null || $v === '__UNDEFINED__') continue;
+                        $ev = $e[$k] ?? null;
+                        if ($ev !== $v) {
+                            $ka = is_array($alias) ? ($alias[$k] ?? null) : null;
+                            $aliased = ($ka !== null) ? ($e[$ka] ?? null) : null;
+                            if ($aliased !== $v) { $ok = false; break; }
+                        }
+                    }
+                    if ($ok) $out[] = $e;
+                }
+                return $out;
+            };
+
+            $alias = is_object($op) ? ($op->alias ?? null) : \Voxgig\Struct\Struct::getprop($op, 'alias');
+
+            // For single-entity ops (load, remove) with an empty explicit
+            // match, fall back to the id the entity client already knows from a
+            // prior create/load (carried in $fctx->match / $fctx->data). This
+            // mirrors the TS mock where param() resolves the id from that
+            // accumulated state — e.g. `create()` then `remove([])` removes the
+            // just-created entity, not an arbitrary fixture.
+            $resolve_match = function ($explicit) use ($fctx) {
+                if (is_array($explicit) && !empty($explicit)) return $explicit;
+                foreach ([$fctx->match, $fctx->data] as $src) {
+                    $arr = is_array($src) ? $src : (is_object($src) ? (array) $src : []);
+                    if (isset($arr['id']) && $arr['id'] !== null && $arr['id'] !== '__UNDEFINED__') {
+                        return ['id' => $arr['id']];
                     }
                 }
-                if (!$ent) {
+                return [];
+            };
+
+            if ($op->name === 'load') {
+                $ent = $find_first($entmap, $resolve_match($fctx->reqmatch), $alias);
+                if ($ent === null) {
                     return $respond(404, null, ['statusText' => 'Not found']);
                 }
+                if (is_array($ent)) unset($ent['$KEY']);
                 $out = \Voxgig\Struct\Struct::clone($ent);
-                if (is_array($out)) { unset($out['$KEY']); }
-                return $respond(200, $out, null);
+                return $respond(200, $out);
 
             } elseif ($op->name === 'list') {
-                $out = [];
-                foreach ($entmap as $e) {
-                    if (is_array($e)) {
-                        $copy = $e;
-                        unset($copy['$KEY']);
-                        $out[] = $copy;
-                    }
+                $found = $find_all($entmap, $fctx->reqmatch, $alias);
+                $cleaned = [];
+                foreach ($found as $e) {
+                    if (is_array($e)) unset($e['$KEY']);
+                    $cleaned[] = $e;
                 }
-                return $respond(200, $out, null);
+                $out = \Voxgig\Struct\Struct::clone($cleaned);
+                return $respond(200, $out);
 
             } elseif ($op->name === 'update') {
-                $id = $get_id();
-                $ent = ($id !== null && isset($entmap[$id])) ? $entmap[$id] : null;
-                if (!$ent) {
-                    foreach ($entmap as $e) {
-                        if (is_array($e) && ($e['id'] ?? null) === $id) { $ent = $e; break; }
+                // Match the existing entity by id only (or its alias). reqdata
+                // also contains the new field values, which would otherwise
+                // cause find_first to filter out the entity we want to update.
+                $update_match = [];
+                if (is_array($fctx->reqdata)) {
+                    if (array_key_exists('id', $fctx->reqdata)) {
+                        $update_match['id'] = $fctx->reqdata['id'];
+                    }
+                    $id_alias = is_array($alias) ? ($alias['id'] ?? null) : null;
+                    if ($id_alias !== null && array_key_exists($id_alias, $fctx->reqdata)) {
+                        $update_match[$id_alias] = $fctx->reqdata[$id_alias];
                     }
                 }
-                if (!$ent) {
+                $ent = $find_first($entmap, $update_match, $alias);
+                if ($ent === null) {
                     return $respond(404, null, ['statusText' => 'Not found']);
                 }
                 if (is_array($fctx->reqdata)) {
@@ -118,33 +181,42 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
                         $ent[$k] = $v;
                     }
                 }
-                $entmap[$id] = $ent;
-                $entity->data[$entname] = $entmap;
+                $id = is_array($ent) ? ($ent['id'] ?? null) : null;
+                if ($id !== null) {
+                    $entmap[$id] = $ent;
+                    $entity->data[$entname] = $entmap;
+                }
+                if (is_array($ent)) unset($ent['$KEY']);
                 $out = \Voxgig\Struct\Struct::clone($ent);
-                if (is_array($out)) { unset($out['$KEY']); }
-                return $respond(200, $out, null);
+                return $respond(200, $out);
 
             } elseif ($op->name === 'remove') {
-                $id = $get_id();
-                if ($id !== null && isset($entmap[$id])) {
+                $ent = $find_first($entmap, $resolve_match($fctx->reqmatch), $alias);
+                if ($ent === null) {
+                    return $respond(404, null, ['statusText' => 'Not found']);
+                }
+                $id = is_array($ent) ? ($ent['id'] ?? null) : null;
+                if ($id !== null) {
                     unset($entmap[$id]);
                     $entity->data[$entname] = $entmap;
                 }
-                return $respond(200, null, null);
+                return $respond(200, null);
 
             } elseif ($op->name === 'create') {
-                $id = $get_id();
-                if ($id === null) {
-                    $id = sprintf('%04x%04x%04x%04x', random_int(0, 0xFFFF), random_int(0, 0xFFFF), random_int(0, 0xFFFF), random_int(0, 0xFFFF));
+                $id = ProjectNameParam::call($fctx, 'id');
+                if ($id === null || $id === '__UNDEFINED__') {
+                    $id = sprintf('%04x%04x%04x%04x',
+                        random_int(0, 0xFFFF), random_int(0, 0xFFFF),
+                        random_int(0, 0xFFFF), random_int(0, 0xFFFF));
                 }
 
                 $ent = is_array($fctx->reqdata) ? $fctx->reqdata : [];
                 $ent['id'] = $id;
                 $entmap[$id] = $ent;
                 $entity->data[$entname] = $entmap;
+                if (is_array($ent)) unset($ent['$KEY']);
                 $out = \Voxgig\Struct\Struct::clone($ent);
-                if (is_array($out)) { unset($out['$KEY']); }
-                return $respond(200, $out, null);
+                return $respond(200, $out);
 
             } else {
                 return $respond(404, null, ['statusText' => 'Unknown operation']);
@@ -153,4 +225,74 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
 
         $ctx->utility->fetcher = $test_fetcher;
     }
+
+    /**
+     * Build a structured `$AND` query from the request match/data dict,
+     * matching the TS test feature's buildArgs. Mirrors ts/src/feature/test/TestFeature.ts:158-204.
+     *
+     * For each key in $args that is 'id' OR a required-param key on the
+     * current operation point, emit a `$OR` clause matching the key (and
+     * its alias, if any) against the supplied value.
+     */
+    public function buildArgs(ProjectNameContext $ctx, $op, $args): array
+    {
+        // If args is empty/missing, return an empty $AND so select() matches
+        // every entry — the TS test feature relies on this for empty-match
+        // load against fixture entries.
+        $keys = is_array($args) ? \Voxgig\Struct\Struct::keysof($args) : [];
+        if (empty($keys)) {
+            return ['$AND' => []];
+        }
+
+        $opname = is_object($op) ? ($op->name ?? null) : (\Voxgig\Struct\Struct::getprop($op, 'name'));
+        $entityName = null;
+        if (isset($ctx->entity)) {
+            $entityName = is_object($ctx->entity)
+                ? ($ctx->entity->name ?? null)
+                : (is_array($ctx->entity) ? ($ctx->entity['name'] ?? null) : null);
+        }
+
+        // Resolve required-param names from the op's last point. Defensive:
+        // any missing piece falls back to "no required params".
+        $reqd_names = [];
+        if (is_string($opname) && is_string($entityName) && isset($ctx->config)) {
+            $points = \Voxgig\Struct\Struct::getpath(
+                ['entity', $entityName, 'op', $opname, 'points'],
+                $ctx->config
+            );
+            $point = \Voxgig\Struct\Struct::getelem($points, -1);
+            $params = is_array($point) ? ($point['args']['params'] ?? null) : null;
+            if (is_array($params)) {
+                foreach ($params as $p) {
+                    if (is_array($p) && (($p['reqd'] ?? false) === true)) {
+                        $n = $p['name'] ?? null;
+                        if ($n !== null) {
+                            $reqd_names[] = $n;
+                        }
+                    }
+                }
+            }
+        }
+
+        $alias = is_object($op) ? ($op->alias ?? null) : \Voxgig\Struct\Struct::getprop($op, 'alias');
+        $qand = [];
+
+        foreach ($keys as $k) {
+            $is_id = ($k === 'id');
+            $in_reqd = in_array($k, $reqd_names, true);
+            if ($is_id || $in_reqd) {
+                $v = ProjectNameParam::call($ctx, $k);
+                $ka = \Voxgig\Struct\Struct::getprop($alias, $k);
+
+                $qor = [[$k => $v]];
+                if ($ka !== null) {
+                    $qor[] = [$ka => $v];
+                }
+
+                $qand[] = ['$OR' => $qor];
+            }
+        }
+
+        return ['$AND' => $qand];
+    }
 }

package/project/.sdk/tm/php/test/Runner.php

@@ -86,6 +86,68 @@ class ProjectNameTestRunner
         }
         return $out;
     }
+
+    private static $test_control = null;
+
+    /**
+     * Load sdk-test-control.json from this test dir; cache. Returns an
+     * empty-skip default if the file is missing or invalid.
+     */
+    public static function load_test_control(): array
+    {
+        if (self::$test_control !== null) {
+            return self::$test_control;
+        }
+        $ctrl_path = __DIR__ . '/sdk-test-control.json';
+        $default = [
+            'version' => 1,
+            'test' => ['skip' => [
+                'live' => ['direct' => [], 'entityOp' => []],
+                'unit' => ['direct' => [], 'entityOp' => []],
+            ]],
+        ];
+        if (!file_exists($ctrl_path)) {
+            self::$test_control = $default;
+            return self::$test_control;
+        }
+        $content = file_get_contents($ctrl_path);
+        $parsed = json_decode($content, true);
+        self::$test_control = is_array($parsed) ? $parsed : $default;
+        return self::$test_control;
+    }
+
+    /**
+     * Check sdk-test-control.json for a skip entry. Returns [skip, reason].
+     */
+    public static function is_control_skipped(string $kind, string $name, string $mode): array
+    {
+        $ctrl = self::load_test_control();
+        $skip = $ctrl['test']['skip'][$mode] ?? [];
+        $items = $skip[$kind] ?? [];
+        foreach ($items as $item) {
+            if ($kind === 'direct' && ($item['test'] ?? null) === $name) {
+                return [true, $item['reason'] ?? null];
+            }
+            if ($kind === 'entityOp') {
+                $key = ($item['entity'] ?? '') . '.' . ($item['op'] ?? '');
+                if ($key === $name) {
+                    return [true, $item['reason'] ?? null];
+                }
+            }
+        }
+        return [false, null];
+    }
+
+    /** Per-test live pacing delay (ms); default 500. */
+    public static function live_delay_ms(): int
+    {
+        $ctrl = self::load_test_control();
+        $v = $ctrl['test']['live']['delayMs'] ?? null;
+        if (is_int($v) && $v >= 0) {
+            return $v;
+        }
+        return 500;
+    }
 }
 
 // Aliases for test convenience.

package/project/.sdk/tm/php/test/sdk-test-control.json

@@ -0,0 +1,19 @@
+{
+  "version": 1,
+  "_doc": "Per-SDK test control. Lists tests/operations to skip in unit and live modes; tunes per-test pacing. Edit by hand. Loaded by php test runner.",
+  "test": {
+    "skip": {
+      "live": {
+        "direct": [],
+        "entityOp": []
+      },
+      "unit": {
+        "direct": [],
+        "entityOp": []
+      }
+    },
+    "live": {
+      "delayMs": 500
+    }
+  }
+}

package/project/.sdk/tm/php/utility/Fetcher.php

@@ -5,25 +5,47 @@ declare(strict_types=1);
 
 class ProjectNameFetcher
 {
+    // Default User-Agent — many CDNs (notably Cloudflare) reject requests
+    // with PHP's default UA (which file_get_contents doesn't even set),
+    // returning 403 before the request reaches the origin. Set a Mozilla-
+    // shaped UA so the SDK behaves like every other HTTP client by default.
+    // Users can override by passing a User-Agent header in fetchdef.
+    public const DEFAULT_USER_AGENT = 'Mozilla/5.0 (compatible; ProjectNameSDK/1.0)';
+
     public static function defaultHttpFetch(string $fullurl, array $fetchdef): array
     {
-        $method_str = $fetchdef['method'] ?? 'GET';
+        $method_str = strtoupper($fetchdef['method'] ?? 'GET');
         $body_str = $fetchdef['body'] ?? null;
         $headers = $fetchdef['headers'] ?? [];
 
-        $opts = [
-            'http' => [
-                'method' => strtoupper($method_str),
-                'ignore_errors' => true,
-            ],
-        ];
-
         $header_lines = [];
+        $has_ua = false;
         foreach ($headers as $k => $v) {
             if (is_string($v)) {
+                if (strcasecmp($k, 'user-agent') === 0) {
+                    $has_ua = true;
+                }
                 $header_lines[] = "{$k}: {$v}";
             }
         }
+        if (!$has_ua) {
+            $header_lines[] = 'User-Agent: ' . self::DEFAULT_USER_AGENT;
+        }
+
+        // Prefer cURL when available — its header capture is reliable across
+        // PHP versions, while file_get_contents + custom stream wrappers
+        // don't propagate $http_response_header for user-defined wrappers
+        // in PHP 8.3+.
+        if (function_exists('curl_init')) {
+            return self::curlFetch($fullurl, $method_str, $body_str, $header_lines);
+        }
+
+        $opts = [
+            'http' => [
+                'method' => $method_str,
+                'ignore_errors' => true,
+            ],
+        ];
 
         if (is_string($body_str)) {
             $opts['http']['content'] = $body_str;
@@ -78,6 +100,101 @@ class ProjectNameFetcher
         ];
     }
 
+    private static function curlFetch(string $fullurl, string $method, $body_str, array $header_lines): array
+    {
+        // GET-only guard for live tests — set by pub-live-test. We respect
+        // it here at the SDK level since cURL bypasses PHP stream wrappers
+        // (so the wrapper-based guard wouldn't see this call).
+        if (getenv('VOXGIG_GETONLY_GUARD') === 'TRUE' && $method !== 'GET') {
+            fwrite(STDERR, "[GET-ONLY GUARD] blocked {$method} {$fullurl}\n");
+            return [
+                [
+                    'status' => 0,
+                    'statusText' => 'Blocked',
+                    'headers' => [],
+                    'json' => function () { return null; },
+                    'body' => '',
+                ],
+                "GET-only guard blocked {$method} {$fullurl}",
+            ];
+        }
+
+        $ch = curl_init($fullurl);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_HEADER, false);
+        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
+        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
+        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
+        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
+        if (!empty($header_lines)) {
+            curl_setopt($ch, CURLOPT_HTTPHEADER, $header_lines);
+        }
+        if (is_string($body_str)) {
+            curl_setopt($ch, CURLOPT_POSTFIELDS, $body_str);
+        }
+
+        $resp_headers = [];
+        curl_setopt($ch, CURLOPT_HEADERFUNCTION,
+            function ($_ch, $hdr) use (&$resp_headers) {
+                $trimmed = trim($hdr);
+                if ($trimmed !== '') {
+                    $resp_headers[] = $trimmed;
+                }
+                return strlen($hdr);
+            });
+
+        $response_body = curl_exec($ch);
+        if ($response_body === false) {
+            $err = curl_error($ch) ?: 'curl_exec failed';
+            curl_close($ch);
+            return [
+                [
+                    'status' => 0,
+                    'statusText' => 'Error',
+                    'headers' => [],
+                    'json' => function () { return null; },
+                    'body' => '',
+                ],
+                $err,
+            ];
+        }
+        curl_close($ch);
+
+        $status = 0;
+        $status_text = '';
+        $resp_kv = [];
+        foreach ($resp_headers as $h) {
+            if (preg_match('/^HTTP\/\S+\s+(\d+)\s*(.*)$/i', $h, $m)) {
+                $status = (int)$m[1];
+                $status_text = trim($m[2]);
+            } else {
+                $parts = explode(':', $h, 2);
+                if (count($parts) === 2) {
+                    $resp_kv[strtolower(trim($parts[0]))] = trim($parts[1]);
+                }
+            }
+        }
+
+        $json_body = null;
+        if ($response_body !== '' && $response_body !== false) {
+            $decoded = json_decode($response_body, true);
+            if (json_last_error() === JSON_ERROR_NONE) {
+                $json_body = $decoded;
+            }
+        }
+
+        return [
+            [
+                'status' => $status,
+                'statusText' => $status_text,
+                'headers' => $resp_kv,
+                'json' => function () use ($json_body) { return $json_body; },
+                'body' => (string)$response_body,
+            ],
+            null,
+        ];
+    }
+
     public static function call(ProjectNameContext $ctx, string $fullurl, array $fetchdef): array
     {
         if ($ctx->client->mode !== 'live') {
@@ -93,7 +210,13 @@ class ProjectNameFetcher
 
         $sys_fetch = \Voxgig\Struct\Struct::getpath($options, 'system.fetch');
 
-        if ($sys_fetch === null) {
+        // Treat null OR an empty stdClass/array as "no fetcher provided" and
+        // fall through to the default HTTP fetcher. The options builder
+        // sometimes materializes `system.fetch` as an empty stdClass even
+        // when the user didn't set one — that's a placeholder, not a value.
+        $is_empty_obj = ($sys_fetch instanceof \stdClass) && empty(get_object_vars($sys_fetch));
+        $is_empty_arr = is_array($sys_fetch) && empty($sys_fetch);
+        if ($sys_fetch === null || $is_empty_obj || $is_empty_arr) {
             return self::defaultHttpFetch($fullurl, $fetchdef);
         }
         if (is_callable($sys_fetch)) {

package/project/.sdk/tm/php/utility/MakeUrl.php

@@ -35,6 +35,22 @@ class ProjectNameMakeUrl
             }
         }
 
+        // Append query string from spec.query.
+        $qsep = '?';
+        $query_items = \Voxgig\Struct\Struct::items($spec->query ?? null);
+        if ($query_items) {
+            foreach ($query_items as $item) {
+                $key = $item[0];
+                $val = $item[1];
+                if ($val !== null && is_string($key)) {
+                    $val_str = is_string($val) ? $val : (string)$val;
+                    $url .= $qsep . \Voxgig\Struct\Struct::escurl($key) . '=' . \Voxgig\Struct\Struct::escurl($val_str);
+                    $qsep = '&';
+                    $resmatch[$key] = $val;
+                }
+            }
+        }
+
         $result->resmatch = $resmatch;
         return [$url, null];
     }

package/project/.sdk/tm/php/utility/PrepareAuth.php

@@ -18,9 +18,19 @@ class ProjectNamePrepareAuth
 
         $headers = &$spec->headers;
         $options = $ctx->client->options_map();
+
+        // Public APIs that need no auth omit the options.auth block entirely.
+        if (!isset($options['auth']) || $options['auth'] === null) {
+            unset($headers[self::HEADER_AUTH]);
+            return [$spec, null];
+        }
+
         $apikey = \Voxgig\Struct\Struct::getprop($options, self::OPTION_APIKEY, self::NOT_FOUND);
 
-        if (is_string($apikey) && $apikey === self::NOT_FOUND) {
+        if (
+            (is_string($apikey) && ($apikey === self::NOT_FOUND || $apikey === ''))
+            || $apikey === null
+        ) {
             unset($headers[self::HEADER_AUTH]);
         } else {
             $auth_prefix = \Voxgig\Struct\Struct::getpath($options, 'auth.prefix') ?? '';

package/project/.sdk/tm/py/feature/test_feature.py

@@ -52,8 +52,21 @@ class ProjectNameTestFeature(ProjectNameBaseFeature):
             if not isinstance(entmap, dict):
                 entmap = {}
 
+            # For single-entity ops (load, remove) with an empty explicit
+            # match, fall back to the id the entity client already knows from a
+            # prior create/load (in fctx.match / fctx.data). Mirrors the TS
+            # mock where param() resolves the id from that accumulated state.
+            def _resolve_match(explicit):
+                if isinstance(explicit, dict) and len(explicit) > 0:
+                    return explicit
+                for src in (getattr(fctx, "match", None), getattr(fctx, "data", None)):
+                    v = vs.getprop(src, "id") if src is not None else None
+                    if v is not None and v != "__UNDEFINED__":
+                        return {"id": v}
+                return {}
+
             if op.name == "load":
-                args = test_self.build_args(fctx, op, fctx.reqmatch)
+                args = test_self.build_args(fctx, op, _resolve_match(fctx.reqmatch))
                 found = vs.select(entmap, args)
                 ent = vs.getelem(found, 0)
                 if ent is None:
@@ -74,9 +87,28 @@ class ProjectNameTestFeature(ProjectNameBaseFeature):
                 return respond(200, out)
 
             elif op.name == "update":
-                args = test_self.build_args(fctx, op, fctx.reqdata)
+                # Match the existing entity by id only (or its alias). reqdata
+                # also contains the new field values, which would otherwise
+                # cause select to filter out the entity we want to update.
+                # Falls back to first entity when no match found, mirroring
+                # the TS mock.
+                update_match = {}
+                if isinstance(fctx.reqdata, dict):
+                    if "id" in fctx.reqdata:
+                        update_match["id"] = fctx.reqdata["id"]
+                    alias_map = getattr(op, "alias_map", None)
+                    if alias_map is not None:
+                        alias_id = vs.getprop(alias_map, "id")
+                        if alias_id is not None and alias_id in fctx.reqdata:
+                            update_match[alias_id] = fctx.reqdata[alias_id]
+                args = test_self.build_args(fctx, op, update_match)
                 found = vs.select(entmap, args)
                 ent = vs.getelem(found, 0)
+                if ent is None and isinstance(entmap, dict):
+                    for e in entmap.values():
+                        if isinstance(e, dict):
+                            ent = e
+                            break
                 if ent is None:
                     return respond(404, None, {"statusText": "Not found"})
                 if isinstance(ent, dict):
@@ -89,7 +121,7 @@ class ProjectNameTestFeature(ProjectNameBaseFeature):
                 return respond(200, out)
 
             elif op.name == "remove":
-                args = test_self.build_args(fctx, op, fctx.reqmatch)
+                args = test_self.build_args(fctx, op, _resolve_match(fctx.reqmatch))
                 found = vs.select(entmap, args)
                 ent = vs.getelem(found, 0)
                 if ent is None: