@voxgig/sdkgen 3.5.1 → 3.7.0

package/project/.sdk/tm/perl/utility/make_point.pm

@@ -17,6 +17,27 @@ package ProjectNameUtilities;
 
 our %REGISTRY;
 
+# How many path segments a point has.
+sub _parts_len {
+  my ($point) = @_;
+  my $parts = ProjectNameHelpers::gp($point, 'parts');
+  return Voxgig::Struct::islist($parts) ? scalar(@$parts) : 0;
+}
+
+# Does this point's path end in a parameter? A record route ends in the
+# record's identifier (/boards/{id}); a cross-reference that also returns the
+# entity ends in the relationship's name (/posts/{id}/author). That, then
+# fewest segments, is what tells the entity's own route from a
+# cross-reference. The same rule runs at generation time, in
+# helpers/opShape.ts — both sides must move together.
+sub _terminal_param {
+  my ($point) = @_;
+  my $parts = ProjectNameHelpers::gp($point, 'parts');
+  return 0 unless Voxgig::Struct::islist($parts) && 0 < scalar(@$parts);
+  my $last = $parts->[-1];
+  return (defined $last && !ref $last && $last =~ /^\{/) ? 1 : 0;
+}
+
 $REGISTRY{make_point} = sub {
   my ($ctx) = @_;
 
@@ -54,8 +75,8 @@ $REGISTRY{make_point} = sub {
     my $selector = ('data' eq $op->{input}) ? $ctx->{data} : $ctx->{match};
 
     my $point;
+    my $matched = 0;
     for my $p (@{ $op->{points} }) {
-      $point = $p;
       my $select_def = ProjectNameHelpers::to_map(ProjectNameHelpers::gp($p, 'select'));
       my $found = 1;
 
@@ -79,7 +100,39 @@ $REGISTRY{make_point} = sub {
         $found = 0 unless ProjectNameHelpers::eqv($req_action, $select_action);
       }
 
-      last if $found;
+      if ($found) {
+        $point = $p;
+        $matched = 1;
+        last;
+      }
+    }
+
+    # select.exist can list more than the params needed to pick a point, so
+    # nothing matches — fall back to the entity's own route rather than
+    # whichever point came last.
+    unless ($matched) {
+      # A request naming an action reaches here only because that action's
+      # own point failed its exist test, so it is unbuildable whatever we
+      # pick. Refuse it BEFORE choosing a fallback: the guard below compares
+      # the chosen point's $action and would wave the request through
+      # whenever the fallback lands on the action point itself.
+      my $unmatched_action = $reqselector
+        ? ProjectNameHelpers::gp($reqselector, '$action') : undef;
+      if (defined $unmatched_action) {
+        return (undef, $ctx->make_error('point_action_invalid',
+          'Operation "' . $op->{name} . '" action "' .
+          Voxgig::Struct::stringify($unmatched_action) . '" is not valid.'));
+      }
+
+      $point = $op->{points}[0];
+      for my $p (@{ $op->{points} }) {
+        if (_terminal_param($p) != _terminal_param($point)) {
+          $point = $p if _terminal_param($p);
+        }
+        elsif (_parts_len($p) < _parts_len($point)) {
+          $point = $p;
+        }
+      }
     }
 
     if ($reqselector) {

package/project/.sdk/tm/php/feature/TestFeature.php

@@ -369,11 +369,40 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
         // any missing piece falls back to "no required params".
         $reqd_names = [];
         if (is_string($opname) && is_string($entityName) && isset($ctx->config)) {
+            // Pick the entity's own endpoint, not a cross-reference from
+            // another resource that also returns it — the same rule
+            // MakePoint falls back to, so the seed-data query is built from
+            // the endpoint the request will actually be sent to: a terminal
+            // `{id}` marks a record route, and failing that the shallower
+            // path wins.
             $points = \Voxgig\Struct\Struct::getpath(
                 ['entity', $entityName, 'op', $opname, 'points'],
                 $ctx->config
             );
-            $point = \Voxgig\Struct\Struct::getelem($points, -1);
+            $point = \Voxgig\Struct\Struct::getelem($points, 0);
+            if (is_array($points)) {
+                $point_parts_len = function ($p) {
+                    $parts = \Voxgig\Struct\Struct::getprop($p, 'parts');
+                    return is_array($parts) ? count($parts) : 0;
+                };
+                $point_terminal_param = function ($p) {
+                    $parts = \Voxgig\Struct\Struct::getprop($p, 'parts');
+                    if (!is_array($parts) || 0 === count($parts)) {
+                        return false;
+                    }
+                    $last = $parts[count($parts) - 1];
+                    return is_string($last) && 0 === strpos($last, '{');
+                };
+                foreach ($points as $cand) {
+                    if ($point_terminal_param($cand) !== $point_terminal_param($point)) {
+                        if ($point_terminal_param($cand)) {
+                            $point = $cand;
+                        }
+                    } elseif ($point_parts_len($cand) < $point_parts_len($point)) {
+                        $point = $cand;
+                    }
+                }
+            }
             $params = is_array($point) ? ($point['args']['params'] ?? null) : null;
             if (is_array($params)) {
                 foreach ($params as $p) {

package/project/.sdk/tm/php/test/PipelineTest.php

@@ -154,6 +154,26 @@ class PipelineTest extends TestCase
         ]));
     }
 
+    // Station special case, mirroring test's: its transport wrap must sit
+    // immediately outside the base transport, so map-form activation hoists
+    // it to just after test - or first, when no test entry exists.
+    public function test_feature_order_map_hoists_station_after_test(): void
+    {
+        $this->assertSame('test,station,metrics', self::resolve_order([
+            'metrics' => ['active' => true],
+            'station' => ['active' => true],
+            'test' => ['active' => true],
+        ]));
+    }
+
+    public function test_feature_order_map_hoists_station_first_without_test(): void
+    {
+        $this->assertSame('station,metrics', self::resolve_order([
+            'metrics' => ['active' => true],
+            'station' => ['active' => true],
+        ]));
+    }
+
     public function test_feature_order_no_test_deterministic(): void
     {
         $this->assertSame('cache,retry', self::resolve_order([

package/project/.sdk/tm/php/utility/Fetcher.php

@@ -35,7 +35,8 @@ class ProjectNameFetcher
         // Prefer cURL when available — its header capture is reliable across
         // PHP versions, while file_get_contents + custom stream wrappers
         // don't propagate $http_response_header for user-defined wrappers
-        // in PHP 8.3+.
+        // in PHP 8.3+. (cURL is configured with FOLLOWLOCATION off, so the
+        // manual-redirect annotation below holds there by construction.)
         if (function_exists('curl_init')) {
             return self::curlFetch($fullurl, $method_str, $body_str, $header_lines);
         }
@@ -47,6 +48,16 @@ class ProjectNameFetcher
             ],
         ];
 
+        // Honour a redirect annotation on the fetch definition (set by the
+        // station feature's middleware under a hosts policy): "manual"
+        // surfaces a 3xx as an ordinary response instead of auto-following
+        // it — the http stream wrapper otherwise replays the request,
+        // headers included, against whatever host Location names, carrying
+        // injected credentials to a host no policy approved.
+        if (($fetchdef['redirect'] ?? null) === 'manual') {
+            $opts['http']['follow_location'] = 0;
+        }
+
         if (is_string($body_str)) {
             $opts['http']['content'] = $body_str;
         }

package/project/.sdk/tm/php/utility/MakeOptions.php

@@ -37,6 +37,34 @@ class ProjectNameMakeOptions
         // Preserve system.fetch before merge/validate.
         $sys_fetch = \Voxgig\Struct\Struct::getpath($options, 'system.fetch');
 
+        // Feature INSTANCES supplied at construction (the station adopt path)
+        // are consumed by the constructor's feature-add loop straight from the
+        // RAW construction options - extend is consumed exactly once, at
+        // construction. Strip it here so it never enters the cloned option
+        // map: Struct::clone flattens arbitrary objects, and options_map()
+        // re-clones $this->options on every request.
+        if (isset($options['extend'])) {
+            unset($options['extend']);
+        }
+
+        // The station feature's binding handle and caller opts are live
+        // values (connect/adopt/st->options() plant them): hold them aside so
+        // the clone below cannot flatten them, and reattach after validate.
+        $station_handle = null;
+        $station_caller = null;
+        $station_has_caller = false;
+        if (is_array($options['feature']['station'] ?? null)) {
+            if (is_object($options['feature']['station']['station'] ?? null)) {
+                $station_handle = $options['feature']['station']['station'];
+                unset($options['feature']['station']['station']);
+            }
+            if (array_key_exists('calleropts', $options['feature']['station'])) {
+                $station_caller = $options['feature']['station']['calleropts'];
+                $station_has_caller = true;
+                unset($options['feature']['station']['calleropts']);
+            }
+        }
+
         $opts = \Voxgig\Struct\Struct::clone($options);
         $opts = self::to_array_deep($opts);
         if (!is_array($opts)) {
@@ -106,6 +134,24 @@ class ProjectNameMakeOptions
             $opts = [];
         }
 
+        // Reattach the station binding handle held aside above (the feature
+        // optspec is `$OPEN`, so the extra keys are legal; they were only
+        // kept out of the clone/validate round-trip).
+        if (null !== $station_handle || $station_has_caller) {
+            if (!is_array($opts['feature'] ?? null)) {
+                $opts['feature'] = [];
+            }
+            if (!is_array($opts['feature']['station'] ?? null)) {
+                $opts['feature']['station'] = [];
+            }
+            if (null !== $station_handle) {
+                $opts['feature']['station']['station'] = $station_handle;
+            }
+            if ($station_has_caller) {
+                $opts['feature']['station']['calleropts'] = $station_caller;
+            }
+        }
+
         // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
         // Every placeholder must resolve to a non-empty value: from
         // $options['server'] (user), else the config default. A placeholder
@@ -181,6 +227,18 @@ class ProjectNameMakeOptions
             } else {
                 $featureorder = $names;
             }
+            // Station special case, mirroring test's: its transport wrap must
+            // sit immediately outside the base transport (inside retry/cache/
+            // netsim), so map-form activation hoists it to just after test -
+            // or first, when no test entry exists. Without this the sorted
+            // default would init station last and wrap OUTSIDE the recording
+            // features, turning its wire-truth events into fiction.
+            $si = array_search('station', $featureorder, true);
+            if (false !== $si) {
+                array_splice($featureorder, $si, 1);
+                $ti = array_search('test', $featureorder, true);
+                array_splice($featureorder, false === $ti ? 0 : $ti + 1, 0, ['station']);
+            }
         }
 
         $derived = ['clean' => $keyre === '' ? [] : ['keyre' => $keyre]];

package/project/.sdk/tm/php/utility/MakePoint.php

@@ -42,8 +42,8 @@ class ProjectNameMakePoint
             $selector = $op->input === 'data' ? $ctx->data : $ctx->match;
 
             $point = null;
+            $matched = false;
             foreach ($op->points as $p) {
-                $point = $p;
                 $select_def = ProjectNameHelpers::to_map(\Voxgig\Struct\Struct::getprop($p, 'select'));
                 $found = true;
 
@@ -70,10 +70,58 @@ class ProjectNameMakePoint
                 }
 
                 if ($found) {
+                    $point = $p;
+                    $matched = true;
                     break;
                 }
             }
 
+            // select.exist can list more than the params needed to pick a
+            // point, so nothing matches — fall back to the entity's own
+            // route rather than the last point.
+            if (!$matched) {
+                // A request naming an action reaches here only because that
+                // action's own point failed its exist test, so it is
+                // unbuildable whatever we pick. Refuse it BEFORE choosing a
+                // fallback: the guard below compares the chosen point's
+                // $action and would wave the request through whenever the
+                // fallback lands on the action point itself.
+                $unmatched_action = $reqselector
+                    ? \Voxgig\Struct\Struct::getprop($reqselector, '$action') : null;
+                if (null !== $unmatched_action) {
+                    return [null, $ctx->make_error('point_action_invalid',
+                        "Operation \"{$op->name}\" action \"" .
+                        \Voxgig\Struct\Struct::stringify($unmatched_action) .
+                        "\" is not valid.")];
+                }
+
+                // A terminal parameter marks a record route (/boards/{id});
+                // a cross-reference ends in the relationship's name
+                // (/posts/{id}/author). Failing that, the shallower wins.
+                $parts_len = function ($p) {
+                    $parts = \Voxgig\Struct\Struct::getprop($p, 'parts');
+                    return is_array($parts) ? count($parts) : 0;
+                };
+                $terminal_param = function ($p) {
+                    $parts = \Voxgig\Struct\Struct::getprop($p, 'parts');
+                    if (!is_array($parts) || 0 === count($parts)) {
+                        return false;
+                    }
+                    $last = $parts[count($parts) - 1];
+                    return is_string($last) && 0 === strpos($last, '{');
+                };
+                $point = $op->points[0];
+                foreach ($op->points as $p) {
+                    if ($terminal_param($p) !== $terminal_param($point)) {
+                        if ($terminal_param($p)) {
+                            $point = $p;
+                        }
+                    } elseif ($parts_len($p) < $parts_len($point)) {
+                        $point = $p;
+                    }
+                }
+            }
+
             if ($reqselector) {
                 $req_action = \Voxgig\Struct\Struct::getprop($reqselector, '$action');
                 if ($req_action && $point) {

package/project/.sdk/tm/py/pkg/utility/fetcher.py

@@ -35,8 +35,20 @@ def _default_http_fetch(fullurl, fetchdef):
     if not has_ua:
         req.add_header("User-Agent", _DEFAULT_USER_AGENT)
 
+    # Manual redirects: fetchdef["redirect"] == "manual" surfaces a 3xx as
+    # an ordinary response instead of auto-following it — urllib would
+    # otherwise replay the request, headers included, against whatever host
+    # Location names. Set by the station feature's transport middleware
+    # under an egress hosts policy (mirrors the ts fetch option).
+    opener = None
+    if fetchdef.get("redirect") == "manual":
+        class _NoRedirect(urllib.request.HTTPRedirectHandler):
+            def redirect_request(self, req, fp, code, msg, headers, newurl):
+                return None
+        opener = urllib.request.build_opener(_NoRedirect)
+
     try:
-        resp = urllib.request.urlopen(req)
+        resp = opener.open(req) if opener is not None else urllib.request.urlopen(req)
         body = resp.read().decode("utf-8")
         resp_headers = {}
         for k, v in resp.getheaders():

package/project/.sdk/tm/py/pkg/utility/make_options.py

@@ -15,6 +15,15 @@ def make_options_util(ctx):
             for key, val in custom_utils.items():
                 utility.custom[key] = val
 
+    # Feature INSTANCES supplied at construction (the station adopt path)
+    # are consumed by the constructor's feature-add loop straight from the
+    # RAW construction options - extend is consumed exactly once, at
+    # construction. They are stripped here so they never enter the cloned
+    # option map: vs.clone flattens arbitrary objects, and options_map()
+    # re-clones self.options on every request.
+    if isinstance(options, dict) and options.get("extend") is not None:
+        options = {k: v for k, v in options.items() if k != "extend"}
+
     opts = vs.clone(options)
     if not isinstance(opts, dict):
         opts = {}
@@ -74,6 +83,10 @@ def make_options_util(ctx):
             },
         },
         "utility": {},
+        # Extension feature instances (see above) - stripped before the
+        # clone, but the key stays legal so a passed-through map cannot
+        # fail validation.
+        "extend": "`$ANY`",
         "system": {},
         "test": {
             "active": False,
@@ -171,6 +184,16 @@ def make_options_util(ctx):
             featureorder = ["test"] + [n for n in names if n != "test"]
         else:
             featureorder = names
+        # Station special case, mirroring test's: its transport wrap must
+        # sit immediately outside the base transport (inside retry/cache/
+        # netsim), so map-form activation hoists it to just after test -
+        # or first, when no test entry exists. Without this the sorted
+        # default would init station last and wrap OUTSIDE the recording
+        # features, turning its wire-truth events into fiction.
+        if "station" in featureorder:
+            featureorder = [n for n in featureorder if n != "station"]
+            at = featureorder.index("test") + 1 if "test" in featureorder else 0
+            featureorder.insert(at, "station")
 
     derived = {"clean": {}}
     if keyre != "":

package/project/.sdk/tm/py/pkg/utility/make_point.py

@@ -5,6 +5,38 @@ from projectname_sdk.utility.voxgig_struct import voxgig_struct as vs
 from projectname_sdk.core.helpers import to_map
 
 
+def _parts_len(point):
+    parts = vs.getprop(point, "parts")
+    return len(parts) if isinstance(parts, list) else 0
+
+
+def _terminal_param(point):
+    # A record route ends in the record's identifier (/boards/{id}); a
+    # cross-reference that also returns the entity ends in the
+    # relationship's name (/posts/{id}/author).
+    parts = vs.getprop(point, "parts")
+    if not isinstance(parts, list) or 0 == len(parts):
+        return False
+    return str(parts[-1]).startswith("{")
+
+
+def _own_point(points):
+    # The entity's OWN route: a terminal parameter first, then the fewest
+    # path segments. Ties keep the earlier point, so the model's sorted-key
+    # order decides. The same rule runs at generation time, in
+    # helpers/opShape.ts — both sides must move together.
+    best = points[0]
+    for cand in points:
+        cand_term = _terminal_param(cand)
+        best_term = _terminal_param(best)
+        if cand_term != best_term:
+            if cand_term:
+                best = cand
+        elif _parts_len(cand) < _parts_len(best):
+            best = cand
+    return best
+
+
 def make_point_util(ctx):
     pre = ctx.out.get("point")
     if pre is not None:
@@ -40,9 +72,10 @@ def make_point_util(ctx):
             selector = ctx.match
 
         point = None
+        matched = False
         for i in range(len(op.points)):
-            point = op.points[i]
-            select_def = to_map(vs.getprop(point, "select"))
+            cand = op.points[i]
+            select_def = to_map(vs.getprop(cand, "select"))
             found = True
 
             if selector is not None and select_def is not None:
@@ -63,8 +96,29 @@ def make_point_util(ctx):
                     found = False
 
             if found:
+                point = cand
+                matched = True
                 break
 
+        # select.exist can list more than the params needed to pick a point,
+        # so nothing matches — fall back to the entity's own route rather
+        # than whichever point came last.
+        if not matched:
+            # A request naming an action reaches here only because that
+            # action's own point failed its exist test, so it is unbuildable
+            # whatever we pick. Refuse it BEFORE choosing a fallback: the
+            # guard below compares the chosen point's $action and would wave
+            # the request through whenever the fallback lands on the action
+            # point itself.
+            req_action = vs.getprop(reqselector, "$action") \
+                if reqselector is not None else None
+            if req_action is not None:
+                return None, ctx.make_error("point_action_invalid",
+                    'Operation "' + op.name + '" action "' +
+                    vs.stringify(req_action) + '" is not valid.')
+
+            point = _own_point(op.points)
+
         if reqselector is not None:
             req_action = vs.getprop(reqselector, "$action")
             if req_action is not None and point is not None:

package/project/.sdk/tm/rb/utility/make_options.rb

@@ -49,6 +49,12 @@ module ProjectNameUtilities
       "entity" => { "`$CHILD`" => { "`$OPEN`" => true, "active" => false, "alias" => {} } },
       "feature" => { "`$CHILD`" => { "`$OPEN`" => true, "active" => false } },
       "utility" => {},
+      # Feature INSTANCES supplied at construction (the station adopt
+      # path): consumed by the constructor's feature_add loop, so they are
+      # class instances, not data — `$ANY` accepts them verbatim. Without
+      # this entry the seam is dead: the constructor reads
+      # options["extend"], but validate rejected the key.
+      "extend" => "`$ANY`",
       "system" => {},
       "test" => { "active" => false, "entity" => { "`$OPEN`" => true } },
       "clean" => { "keys" => "key,token,id" },
@@ -122,6 +128,18 @@ module ProjectNameUtilities
       else
         featureorder = names
       end
+      # Station special case, mirroring test's: its transport wrap must
+      # sit immediately outside the base transport (inside retry/cache/
+      # netsim), so map-form activation hoists it to just after test -
+      # or first, when no test entry exists. Without this the sorted
+      # default would init station last and wrap OUTSIDE the recording
+      # features, turning its wire-truth events into fiction.
+      si = featureorder.index("station")
+      unless si.nil?
+        featureorder.delete_at(si)
+        ti = featureorder.index("test")
+        featureorder.insert(ti.nil? ? 0 : ti + 1, "station")
+      end
     end
 
     derived = { "clean" => keyre.empty? ? {} : { "keyre" => keyre } }

package/project/.sdk/tm/rb/utility/make_point.rb

@@ -35,8 +35,8 @@ module ProjectNameUtilities
       selector = op.input == "data" ? ctx.data : ctx.match
 
       point = nil
+      matched = false
       op.points.each do |p|
-        point = p
         select_def = ProjectNameHelpers.to_map(VoxgigStruct.getprop(p, "select"))
         found = true
 
@@ -60,7 +60,47 @@ module ProjectNameUtilities
           found = false if req_action != select_action
         end
 
-        break if found
+        if found
+          point = p
+          matched = true
+          break
+        end
+      end
+
+      # select.exist can list more than the params needed to pick a point, so
+      # nothing matches — fall back to the entity's own route rather than
+      # whichever point came last.
+      unless matched
+        # A request naming an action reaches here only because that action's
+        # own point failed its exist test, so it is unbuildable whatever we
+        # pick. Refuse it BEFORE choosing a fallback: the guard below
+        # compares the chosen point's $action and would wave the request
+        # through whenever the fallback lands on the action point itself.
+        req_action = reqselector ? VoxgigStruct.getprop(reqselector, "$action") : nil
+        if req_action
+          return nil, ctx.make_error("point_action_invalid",
+            "Operation \"#{op.name}\" action \"#{VoxgigStruct.stringify(req_action)}\" is not valid.")
+        end
+
+        # A terminal parameter marks a record route (/boards/{id}); a
+        # cross-reference ends in the relationship's name
+        # (/posts/{id}/author). Failing that, the shallower path wins.
+        parts_len = ->(p) {
+          parts = VoxgigStruct.getprop(p, "parts")
+          parts.is_a?(Array) ? parts.length : 0
+        }
+        terminal_param = ->(p) {
+          parts = VoxgigStruct.getprop(p, "parts")
+          parts.is_a?(Array) && parts.length > 0 && parts[-1].to_s.start_with?("{")
+        }
+        point = op.points[0]
+        op.points.each do |p|
+          if terminal_param.call(p) != terminal_param.call(point)
+            point = p if terminal_param.call(p)
+          elsif parts_len.call(p) < parts_len.call(point)
+            point = p
+          end
+        end
       end
 
       if reqselector

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -295,7 +295,7 @@ pub fn match_deep(check: &Value, base: &Value) -> Option<String> {
 // (.sdk/test/primary/<name>.aontu carries a PENDING header). Everything else
 // MUST contribute cases.
 pub const PENDING_SECTIONS: &[&str] = &[
-    "fetcher", "makeFetchDef", "makePoint", "makeResult", "featureAdd",
+    "fetcher", "makeFetchDef", "makeResult", "featureAdd",
     "featureHook", "featureInit",
 ];
 

package/project/.sdk/tm/rust/tests/feature_test.rs

@@ -1826,6 +1826,33 @@ fn feature_proxy_inactive_does_not_wrap() {
     );
 }
 
+// --- station --------------------------------------------------------------------
+
+// The station adapter (installed by @voxgig/sdkgen-station) with NO open
+// station must be an inert no-op that emits nothing and fails nothing
+// (station design 3.1). Constructed through the generated make_feature
+// factory - never a compile-time module reference - so this file stays
+// compilable both with and without the station feature installed: absent,
+// the factory answers with the inert BaseFeature and fh_present skips the
+// assertions. Bound behaviour (registration, injection, wire events) is
+// exercised by the station library's own suite and the consumer-side
+// station validation, not here.
+#[test]
+fn feature_station_inert_without_open_station() {
+    if !fh_present(&["station"]) {
+        return;
+    }
+    let f = RUSTCRATE::make_feature("station");
+    assert_eq!(
+        "station",
+        f.borrow().name(),
+        "generated factory has a station arm"
+    );
+    let h = fh_make(None, vec![(f, Value::Noval)]);
+    let res = h.op(opspec("load"));
+    assert!(res.ok, "expected inert station to pass the op through");
+}
+
 // --- composition ----------------------------------------------------------------
 
 #[test]

package/project/.sdk/tm/rust/utility/fetcher.rs

@@ -19,6 +19,14 @@ fn default_http_fetch(fullurl: &str, fetchdef: &Value) -> Result<Value, ProjectN
             builder = builder.proxy(p);
         }
     }
+    // A `redirect: "manual"` annotation (set by the station feature when a
+    // hosts policy is active - the same in-band channel as `proxy` above)
+    // disables automatic redirect following, so a 3xx rides back as a normal
+    // response: a Location pointing off an egress allowlist must never pull
+    // an automatic credentialed follow-up request.
+    if get_str(fetchdef, "redirect").as_deref() == Some("manual") {
+        builder = builder.redirects(0);
+    }
     let agent = builder.build();
 
     let mut req = agent.request(&method, fullurl);

package/project/.sdk/tm/rust/utility/make_options.rs

@@ -228,6 +228,21 @@ pub fn make_options_util(ctx: &Rc<Context>) -> Value {
             } else {
                 feature_order = names;
             }
+            // Station special case, mirroring test's: its transport wrap must
+            // sit immediately outside the base transport (inside retry/cache/
+            // netsim), so map-form activation hoists it to just after test -
+            // or first, when no test entry exists. Without this the sorted
+            // default would init station last and wrap OUTSIDE the recording
+            // features, turning its wire-truth events into fiction.
+            if let Some(si) = feature_order.iter().position(|n| n == "station") {
+                feature_order.remove(si);
+                let at = feature_order
+                    .iter()
+                    .position(|n| n == "test")
+                    .map(|ti| ti + 1)
+                    .unwrap_or(0);
+                feature_order.insert(at, "station".to_string());
+            }
         }
     }
     let order_list =