@voxgig/sdkgen 3.6.0 → 3.7.2

package/project/.sdk/src/cmp/ts/Entity_ts.ts

@@ -4,7 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each, camelify, names,
   File, Content, Folder, Fragment, Line, FeatureHook, Slot,
-  opTypeName, entityClassName, entityCollection,
+  opTypeName, entityClassName, entityCollection, tsSafeTypeName,
 } from '@voxgig/sdkgen'
 
 import {
@@ -33,9 +33,14 @@ const Entity = cmp(function Entity(props: any) {
 
   names(entrep, entity.Name, 'EntityName')
 
+  // A TS/JS global (Record, Array, Promise, ...) would shadow itself for
+  // the rest of the file — see tsSafeTypeName. The runtime `this.Name`
+  // string stays entity.Name; only the TYPE reference is ever renamed.
+  const dataType = tsSafeTypeName(entity.Name)
+
   // Import exactly the typed models this entity references: its data type plus
   // one request type per ACTIVE op (matches what EntityTypes_ts.ts emits).
-  const typeNames = [entity.Name]
+  const typeNames = [dataType]
   const opnamesAll = Object.keys(entity.op || {})
   ;['load', 'list', 'create', 'update', 'remove'].forEach((opname: string) => {
     if (opnamesAll.includes(opname)) {
@@ -69,6 +74,7 @@ const Entity = cmp(function Entity(props: any) {
           entityname: entity.name,
           SdkName: model.const.Name,
           EntityName: entity.Name,
+          EntityDataType: dataType,
 
           // Class token decoupled from the EntityName data-type token in
           // Entity.fragment.ts so the class can be renamed independently.

package/project/.sdk/src/cmp/ts/Package_ts.ts

@@ -124,7 +124,9 @@ const Package = cmp(async function Package(props: any) {
   }
 
   File({ name: 'package.json' }, () => {
-    Content(JSON.stringify(pkg, null, 2))
+    // Trailing newline: POSIX wants one, and without it every diff of a
+    // regenerated package.json reports "".
+    Content(JSON.stringify(pkg, null, 2) + '\n')
   })
 })
 

package/project/.sdk/src/cmp/ts/ReadmeIntro_ts.ts

@@ -33,6 +33,24 @@ const ReadmeIntro = cmp(function ReadmeIntro(props: any) {
   const opList = (opNames.length ? opNames : ['list', 'load'])
     .map((o) => '`' + o + '`').join(', ')
 
+  // Sibling surfaces, MODEL-DRIVEN. This line used to hardcode "the CLI, and
+  // MCP server" — those are the `go-cli` and `go-mcp` targets, and this project
+  // has neither. So both per-language READMEs advertised surfaces nothing here
+  // generates, while the top-level Surfaces table (which does gate on active
+  // targets) listed only ts/ and go/. Name what is actually active, and drop
+  // the sentence entirely when this is the only surface, so it cannot outrun
+  // the model again.
+  const targets = getModelPath(model, `main.${KIT}.target`) || {}
+  const siblings = Object.entries(targets)
+    .filter(([name, t]: any) => name !== target.name && false !== t.active)
+    .map(([name]: any) => name)
+    .sort()
+
+  const siblingNote = 0 === siblings.length ? '' : `
+> Also generated from this model: ${siblings.map((s: string) => '`' + s + '`').join(', ')} — see
+> the [top-level README](../README.md).
+`
+
   Content(`# ${model.Name} ${target.title} SDK
 
 ${tagline}
@@ -43,10 +61,7 @@ The API is exposed as capitalised, semantic **Entities** — e.g.
 \`client.${eName}()\` — each with a small set of operations (${opList})
 instead of raw URL paths and query parameters. This keeps the surface
 predictable and low-friction for both humans and AI agents.
-
-> Other languages, the CLI, and MCP server live alongside this one — see
-> the [top-level README](../README.md).
-
+${siblingNote}
 `)
 })
 

package/project/.sdk/src/cmp/ts/fragment/Config.data.fragment.ts

@@ -34,6 +34,13 @@ class Config {
     return fi
   }
 
+  // False for a feature added at runtime via options.extend (station's
+  // adopt path) - the constructor uses this to skip makeFeature for names
+  // no generated class backs.
+  hasFeature(this: any, fn: string) {
+    return null != FEATURE_CLASS[fn]
+  }
+
 }
 
 

package/project/.sdk/src/cmp/ts/fragment/Config.fragment.ts

@@ -17,9 +17,17 @@ class Config {
     return fi
   }
 
+  // False for a feature added at runtime via options.extend (station's
+  // adopt path) - the constructor uses this to skip makeFeature for names
+  // no generated class backs.
+  hasFeature(this: any, fn: string) {
+    return null != FEATURE_CLASS[fn]
+  }
+
 
   main = {
     name: '$$const.Name$$',
+    // #MainMeta
   }
 
 

package/project/.sdk/src/cmp/ts/fragment/Entity.fragment.ts

@@ -18,7 +18,7 @@ import type {
 
 
 // TODO: needs Entity superclass
-class EntyClass extends ProjectNameEntityBase<EntityName> {
+class EntyClass extends ProjectNameEntityBase<EntityDataType> {
 
   constructor(client: ProjectNameSDK, entopts: any) {
     super(client, entopts)

package/project/.sdk/src/cmp/ts/fragment/Main.fragment.ts

@@ -52,18 +52,26 @@ class ProjectNameSDK {
     // the `test` feature installs the base mock transport and the transport
     // features (retry/cache/netsim/proxy/ratelimit) wrap whatever is current,
     // so `test` must be added before them to sit at the base of the chain.
+    const extend = this._options.extend || []
+
     const featureorder = getpath(this._options, '__derived__.featureorder') || []
     for (const fname of featureorder) {
       const fopts = this._options.feature[fname] || {}
       if (fopts.active) {
+        // An active name with no generated class is legal when an
+        // extend-supplied instance carries that name (station's adopt
+        // path): the instance is added below, positioned by its own
+        // __after__ entry, so skip it here rather than fail construction.
+        if (!this._rootctx.config.hasFeature(fname) &&
+          extend.some((f: any) => fname === f.name)) {
+          continue
+        }
         featureAdd(this._rootctx, this._rootctx.config.makeFeature(fname))
       }
     }
 
-    if (null != this._options.extend) {
-      for (let f of this._options.extend) {
-        featureAdd(this._rootctx, f)
-      }
+    for (let f of extend) {
+      featureAdd(this._rootctx, f)
     }
 
     for (let f of this._features) {

package/project/.sdk/tm/c/Makefile

@@ -7,7 +7,12 @@ CFLAGS ?= -std=c11 -Wall -Wextra -Wno-unused-parameter -D_GNU_SOURCE -O0 -g
 INC := -I core -I utility/struct
 LDLIBS := -lm
 
-LIB_SRCS := $(wildcard core/*.c utility/*.c utility/struct/*.c feature/*.c entity/*.c)
+# feature/*/*.c: a feature may carry a vendored library payload in its own
+# subdirectory (the station feature vendors voxgig_station there - C has no
+# package registry, so tier-C libraries ride the feature source; see
+# utility/struct/ for the same precedent at the utility level). Empty when
+# no feature ships one.
+LIB_SRCS := $(wildcard core/*.c utility/*.c utility/struct/*.c feature/*.c feature/*/*.c entity/*.c)
 LIB_OBJS := $(LIB_SRCS:.c=.o)
 
 TEST_SRCS := $(wildcard tests/*.c)

package/project/.sdk/tm/c/utility/make_options.c

@@ -166,8 +166,19 @@ voxgig_value* make_options_util(Context* ctx) {
         if (has_test) {
           voxgig_list_push(voxgig_as_list(feature_order), v_str("test"));
         }
+        // Station special case, mirroring test's: its transport wrap must
+        // sit immediately outside the base transport (inside retry/cache/
+        // netsim), so map-form activation hoists it to just after test -
+        // or first, when no test entry exists. Without this the sorted
+        // default would init station last and wrap OUTSIDE the recording
+        // features, turning its wire-truth events into fiction.
         for (size_t i = 0; i < fn; i++) {
-          if (strcmp(names[i], "test") != 0) {
+          if (strcmp(names[i], "station") == 0) {
+            voxgig_list_push(voxgig_as_list(feature_order), v_str("station"));
+          }
+        }
+        for (size_t i = 0; i < fn; i++) {
+          if (strcmp(names[i], "test") != 0 && strcmp(names[i], "station") != 0) {
             voxgig_list_push(voxgig_as_list(feature_order), v_str(names[i]));
           }
         }

package/project/.sdk/tm/cpp/utility/pipeline.hpp

@@ -1211,8 +1211,16 @@ inline Value makeOptions(CtxPtr ctx) {
       std::sort(names.begin(), names.end());
       bool hasTest = std::find(names.begin(), names.end(), "test") != names.end();
       if (hasTest) featureOrder.push_back("test");
+      // Station special case, mirroring test's: its transport wrap must
+      // sit immediately outside the base transport (inside retry/cache/
+      // netsim), so map-form activation hoists it to just after test -
+      // or first, when no test entry exists. Without this the sorted
+      // default would init station last and wrap OUTSIDE the recording
+      // features, turning its wire-truth events into fiction.
+      bool hasStation = std::find(names.begin(), names.end(), "station") != names.end();
+      if (hasStation) featureOrder.push_back("station");
       for (const auto& n : names) {
-        if (n != "test") featureOrder.push_back(n);
+        if (n != "test" && n != "station") featureOrder.push_back(n);
       }
     }
   }

package/project/.sdk/tm/csharp/utility/Fetcher.cs

@@ -13,30 +13,48 @@ public static partial class SdkUtility
 {
     private static readonly HttpClient DefaultHttpClient = new();
 
-    // Proxy-routed clients, cached per proxy URL (see the proxy feature's
-    // fetchdef annotation).
+    // Non-following twin of DefaultHttpClient. The station feature's
+    // middleware sets `redirect: manual` on the fetch definition under a
+    // hosts egress policy: a 3xx must come back as a response like any
+    // other, because an automatic follow would carry injected credentials
+    // to a Location no policy approved (the ts donor's fetch honours the
+    // same key natively; redirect policy is per-handler in .NET, hence a
+    // second client).
+    private static readonly HttpClient ManualRedirectHttpClient = new(
+        new HttpClientHandler
+        {
+            AllowAutoRedirect = false,
+        });
+
+    // Proxy-routed clients, cached per proxy URL and redirect policy (see
+    // the proxy feature's fetchdef annotation).
     private static readonly Dictionary<string, HttpClient> ProxyClients = new();
     private static readonly object ProxyClientsLock = new();
 
     private static HttpClient ClientFor(Dictionary<string, object?> fetchdef)
     {
+        var manual = fetchdef.TryGetValue("redirect", out var rraw) &&
+            rraw is string redirect && redirect == "manual";
+
         if (fetchdef.TryGetValue("proxy", out var raw) && raw is string proxy && proxy != "")
         {
             lock (ProxyClientsLock)
             {
-                if (!ProxyClients.TryGetValue(proxy, out var client))
+                var key = (manual ? "manual|" : "auto|") + proxy;
+                if (!ProxyClients.TryGetValue(key, out var client))
                 {
                     client = new HttpClient(new HttpClientHandler
                     {
                         Proxy = new System.Net.WebProxy(proxy),
                         UseProxy = true,
+                        AllowAutoRedirect = !manual,
                     });
-                    ProxyClients[proxy] = client;
+                    ProxyClients[key] = client;
                 }
                 return client;
             }
         }
-        return DefaultHttpClient;
+        return manual ? ManualRedirectHttpClient : DefaultHttpClient;
     }
 
     internal static Dictionary<string, object?> DefaultHttpFetch(

package/project/.sdk/tm/csharp/utility/MakeOptions.cs

@@ -248,6 +248,19 @@ public static partial class SdkUtility
                     featureorder.Add(n);
                 }
             }
+
+            // Station special case, mirroring test's: its transport wrap must
+            // sit immediately outside the base transport (inside retry/cache/
+            // netsim), so map-form activation hoists it to just after test -
+            // or first, when no test entry exists. Without this the sorted
+            // default would init station last and wrap OUTSIDE the recording
+            // features, turning its wire-truth events into fiction.
+            var si = featureorder.IndexOf("station");
+            if (si >= 0)
+            {
+                featureorder.RemoveAt(si);
+                featureorder.Insert(featureorder.IndexOf("test") + 1, "station");
+            }
         }
 
         var derived = new Dictionary<string, object?>

package/project/.sdk/tm/dart/lib/utility/FetcherUtility.dart

@@ -46,6 +46,15 @@ Future<dynamic> httpFetch(dynamic fullurl, dynamic fetchdef) async {
 
     final req = await client.openUrl(method, uri);
 
+    // Manual redirects: fetchdef['redirect'] == 'manual' surfaces a 3xx as
+    // an ordinary response instead of auto-following it — HttpClient would
+    // otherwise replay the request, headers included, against whatever host
+    // Location names. Set by the station feature's transport middleware
+    // under an egress hosts policy (mirrors the ts fetch option).
+    if ('manual' == vs.getprop(fetchdef, 'redirect')) {
+      req.followRedirects = false;
+    }
+
     final headers = vs.getprop(fetchdef, 'headers');
     if (headers is Map) {
       headers.forEach((k, v) {

package/project/.sdk/tm/dart/lib/utility/MakeOptionsUtility.dart

@@ -47,6 +47,12 @@ dynamic makeOptions(dynamic ctx) {
       },
     },
     'utility': {},
+    // Feature INSTANCES supplied at construction (the station adopt
+    // path): consumed by the constructor's featureAdd loop, so they are
+    // class instances, not data - `$ANY` accepts them verbatim. Without
+    // this entry the seam is dead: the constructor reads
+    // options.extend, but validate rejected the key.
+    'extend': '`\$ANY`',
     'system': {},
     'test': {
       'active': false,
@@ -177,6 +183,17 @@ dynamic makeOptions(dynamic ctx) {
     } else {
       featureorder.addAll(names);
     }
+    // Station special case, mirroring test's: its transport wrap must
+    // sit immediately outside the base transport (inside retry/cache/
+    // netsim), so map-form activation hoists it to just after test -
+    // or first, when no test entry exists. Without this the sorted
+    // default would init station last and wrap OUTSIDE the recording
+    // features, turning its wire-truth events into fiction.
+    if (featureorder.contains('station')) {
+      featureorder.remove('station');
+      final ti = featureorder.indexOf('test');
+      featureorder.insert(-1 == ti ? 0 : ti + 1, 'station');
+    }
   }
 
   opts['__derived__'] = {

package/project/.sdk/tm/elixir/lib/projectname/utility.ex

@@ -261,6 +261,12 @@ defmodule ProjectName.Utility do
         "entity" => %{"`$CHILD`" => %{"`$OPEN`" => true, "active" => false, "alias" => %{}}},
         "feature" => %{"`$CHILD`" => %{"`$OPEN`" => true, "active" => false}},
         "utility" => %{},
+        # Feature INSTANCES supplied at construction (the station adopt
+        # path): consumed by the constructor's extend loop, so they are
+        # struct feature nodes, not data - `$ANY` accepts them verbatim.
+        # Without this entry the seam is dead: the constructor reads
+        # options.extend, but validate rejected the key.
+        "extend" => "`$ANY`",
         "system" => %{},
         "test" => %{"active" => false, "entity" => %{"`$OPEN`" => true}},
         "clean" => %{"keys" => "key,token,id"},
@@ -359,8 +365,29 @@ defmodule ProjectName.Utility do
           fmap = if S.ismap(fmap), do: fmap, else: S.jm([])
           names = S.keysof(fmap)
 
-          if Enum.member?(names, "test") do
-            ["test" | Enum.reject(names, &(&1 == "test"))]
+          names =
+            if Enum.member?(names, "test") do
+              ["test" | Enum.reject(names, &(&1 == "test"))]
+            else
+              names
+            end
+
+          # Station special case, mirroring test's: its transport wrap must
+          # sit immediately outside the base transport (inside retry/cache/
+          # netsim), so map-form activation hoists it to just after test -
+          # or first, when no test entry exists. Without this the sorted
+          # default would init station last and wrap OUTSIDE the recording
+          # features, turning its wire-truth events into fiction.
+          if Enum.member?(names, "station") do
+            rest = Enum.reject(names, &(&1 == "station"))
+
+            at =
+              case Enum.find_index(rest, &(&1 == "test")) do
+                nil -> 0
+                ti -> ti + 1
+              end
+
+            List.insert_at(rest, at, "station")
           else
             names
           end
@@ -1518,7 +1545,16 @@ defmodule ProjectName.Utility do
         {url, hlist}
       end
 
-    case :httpc.request(method, request, [], body_format: :binary) do
+    # A `redirect: "manual"` annotation (set by the station feature when a
+    # hosts egress policy is active - the same in-band channel go and rust
+    # use) disables :httpc's automatic redirect following, so a 3xx rides
+    # back as a normal response: a Location pointing off an egress
+    # allowlist must never pull an automatic credentialed follow-up
+    # request.
+    http_opts =
+      if S.getprop(fetchdef, "redirect") == "manual", do: [autoredirect: false], else: []
+
+    case :httpc.request(method, request, http_opts, body_format: :binary) do
       {:ok, {{_v, status, _reason}, resp_headers, resp_body}} ->
         rh =
           Enum.reduce(resp_headers, S.jm([]), fn {k, v}, acc ->

package/project/.sdk/tm/elixir/test/feature_test.exs

@@ -50,6 +50,25 @@ defmodule ProjectName.FeatureTest do
     assert has?("test")
   end
 
+  # === station ===
+
+  # The station adapter (installed by @voxgig/sdkgen-station) with NO open
+  # station must be an inert no-op that emits nothing and fails nothing
+  # (station design 3.1). Driven through the generated factory - never a
+  # compile-time module reference - so this file stays green both with and
+  # without the feature installed (absent, the harness simply adds no
+  # feature). Bound behaviour (registration, injection, wire events) is
+  # exercised by the station library's own suite and the consumer-side
+  # station validation, not here.
+  test "station adapter with no open station is an inert no-op" do
+    h = harness([fspec("station")])
+    res = FH.op(h, %{})
+    assert res.ok == true
+
+    # Inert: the transport is neither wrapped nor marked.
+    assert S.getprop(h.utility, "__station_wrap__") == nil
+  end
+
   # === netsim ===
 
   test "netsim fixed latency then delegate" do

package/project/.sdk/tm/elixir/test/primary_utility_test.exs

@@ -112,6 +112,78 @@ defmodule ProjectName.PrimaryUtilityTest do
     assert S.getpath(opts, "__derived__.clean.keyre") == "key|token|id"
   end
 
+  # --- feature add-order ----------------------------------------------------
+  # options.feature accepts an ordered LIST (developer add-order) or a map
+  # (defaults test-first); make_options records the resolved order in
+  # __derived__.featureorder. Driven with a synthetic ctx (empty config
+  # options) so the assertions do not depend on this SDK's own features.
+
+  defp resolve_order(feature) do
+    ctx =
+      S.jm([
+        "utility", Utility.new(),
+        "options", H.deep(%{"feature" => feature}),
+        "config", H.deep(%{"options" => %{}})
+      ])
+
+    fo = S.getpath(Utility.make_options(ctx), "__derived__.featureorder")
+    n = S.size(fo)
+    order = if n == 0, do: [], else: Enum.map(0..(n - 1), fn i -> S.getelem(fo, i) end)
+    Enum.join(order, ",")
+  end
+
+  test "feature order: map form is test-first" do
+    assert "test,metrics" ==
+             resolve_order(%{"metrics" => %{"active" => true}, "test" => %{"active" => true}})
+  end
+
+  test "feature order: an explicit list preserves its order" do
+    assert "metrics,test" ==
+             resolve_order([
+               %{"name" => "metrics", "active" => true},
+               %{"name" => "test", "active" => true}
+             ])
+  end
+
+  # Station special case, mirroring test's: its transport wrap must sit
+  # immediately outside the base transport, so map-form activation hoists
+  # it to just after test - or first, when no test entry exists.
+  test "feature order: map form hoists station after test" do
+    assert "test,station,metrics" ==
+             resolve_order(%{
+               "metrics" => %{"active" => true},
+               "station" => %{"active" => true},
+               "test" => %{"active" => true}
+             })
+  end
+
+  test "feature order: station first when no test entry exists" do
+    assert "station,metrics" ==
+             resolve_order(%{
+               "metrics" => %{"active" => true},
+               "station" => %{"active" => true}
+             })
+  end
+
+  # The extend seam (feature INSTANCES supplied at construction - the
+  # station adopt path): validate must accept the key verbatim, or the
+  # constructor's extend loop reads a stripped option and the seam is dead.
+  test "make_options preserves options.extend through validation" do
+    marker = S.jm(["name", "station"])
+
+    ctx =
+      S.jm([
+        "utility", Utility.new(),
+        "options", S.jm(["extend", S.jt([marker])]),
+        "config", H.deep(%{"options" => %{}})
+      ])
+
+    extend = S.getprop(Utility.make_options(ctx), "extend")
+    assert S.islist(extend)
+    assert S.size(extend) == 1
+    assert S.getprop(S.getelem(extend, 0), "name") == "station"
+  end
+
   test "make_error formats a namespaced message and raises by default" do
     c = client()
     ctx = ctx(c, "load")

package/project/.sdk/tm/go/test/primary_utility_test.go

@@ -1,6 +1,7 @@
 package sdktest
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 	"testing"
@@ -556,27 +557,48 @@ func TestPrimaryUtility(t *testing.T) {
 		})
 	})
 
+	// Was one hand-written case (the single-point path) covering one of this
+	// utility's seven branches, which is how the corpus fixture came to be
+	// marked deferred as "needs a real client". It does not: NewContext
+	// rebuilds Op from opname + entity + config, and Options can be supplied
+	// literally. Driven from the corpus now, so TS and Go assert the same
+	// branches.
+	//
+	// TS returns the error AS the value; Go returns it as a second result. The
+	// corpus says `match: out: code` for both, so the error is normalised to a
+	// map carrying its code here rather than forking the fixture per language.
 	t.Run("makePoint-basic", func(t *testing.T) {
-		ctx := makeTestCtx(client, utility, nil)
-		point := map[string]any{
-			"parts":     []any{"items", "{id}"},
-			"args":      map[string]any{"params": []any{}},
-			"params":    []any{},
-			"alias":     map[string]any{},
-			"select":    map[string]any{},
-			"active":    true,
-			"transform": map[string]any{},
-		}
-		ctx.Op.Points = []map[string]any{point}
-
-		_, err := utility.MakePoint(ctx)
-		if err != nil {
-			t.Errorf("expected no error, got: %v", err)
-			return
-		}
-		if ctx.Point == nil {
-			t.Error("expected point to be set")
-		}
+		runsetNamed(t, "makePoint", getSpec(primary, "makePoint", "basic"), func(entry map[string]any) (any, error) {
+			ctxmap, _ := entry["ctx"].(map[string]any)
+
+			// NewContext resolves Op from the ENTITY NAME, and reaches it
+			// through the Entity interface — a literal {name:...} map from the
+			// fixture is not one, so entname would be "" and every lookup would
+			// miss, reporting point_no_points for all seven cases. TS reads the
+			// same field with getprop and accepts the plain map. Swap in the
+			// package's minimal Entity so both ports resolve the same op.
+			if em, ok := ctxmap["entity"].(map[string]any); ok {
+				name, _ := em["name"].(string)
+				made := []any{}
+				swapped := map[string]any{}
+				for k, v := range ctxmap {
+					swapped[k] = v
+				}
+				swapped["entity"] = &plEntity{name: name, made: &made}
+				ctxmap = swapped
+			}
+
+			ctx := makeCtxFromMap(ctxmap, client, utility)
+			point, err := utility.MakePoint(ctx)
+			if err != nil {
+				var sdkErr *sdk.ProjectNameError
+				if errors.As(err, &sdkErr) {
+					return map[string]any{"code": sdkErr.Code}, nil
+				}
+				return nil, err
+			}
+			return point, nil
+		})
 	})
 
 	t.Run("makeUrl-basic", func(t *testing.T) {

package/project/.sdk/tm/go/test/runner_test.go

@@ -218,7 +218,7 @@ type RunSubject func(entry map[string]any) (any, error)
 // PENDING sections are the ones deliberately left empty in the shared corpus
 // (.sdk/test/primary/<name>.aontu). Everything else MUST contribute cases.
 var pendingSections = map[string]bool{
-	"fetcher": true, "makeFetchDef": true, "makePoint": true, "makeResult": true,
+	"fetcher": true, "makeFetchDef": true, "makeResult": true,
 	"featureAdd": true, "featureHook": true, "featureInit": true,
 }
 

package/project/.sdk/tm/go/utility/fetcher.go

@@ -57,6 +57,20 @@ func defaultHTTPFetch(fullurl string, fetchdef map[string]any) (map[string]any,
 		}
 	}
 
+	// Honour a redirect annotation: "manual" surfaces a 3xx as an ordinary
+	// response instead of auto-following it. In the ts/js targets fetchdef
+	// rides straight into fetch(), where `redirect` is a native option -
+	// this is the same seam for Go's auto-following http.Client. The
+	// station feature sets it under a hosts egress policy, so a Location
+	// off the allowlist cannot pull an automatic credentialed follow-up.
+	if redirect, ok := fetchdef["redirect"].(string); ok && redirect == "manual" {
+		manual := *client
+		manual.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		}
+		client = &manual
+	}
+
 	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err