@voxgig/sdkgen 3.6.0 → 3.7.2

package/project/.sdk/tm/go/utility/make_options.go

@@ -217,17 +217,44 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 				hasTest = true
 			}
 		}
+		ordered := make([]string, 0, len(names))
 		if hasTest {
-			featureorder = append(featureorder, "test")
+			ordered = append(ordered, "test")
 			for _, n := range names {
 				if n != "test" {
-					featureorder = append(featureorder, n)
+					ordered = append(ordered, n)
 				}
 			}
 		} else {
-			for _, n := range names {
-				featureorder = append(featureorder, n)
+			ordered = append(ordered, names...)
+		}
+		// Station special case, mirroring test's: its transport wrap must
+		// sit immediately outside the base transport (inside retry/cache/
+		// netsim), so map-form activation hoists it to just after test -
+		// or first, when no test entry exists. Without this the sorted
+		// default would init station last and wrap OUTSIDE the recording
+		// features, turning its wire-truth events into fiction.
+		si := -1
+		for i, n := range ordered {
+			if n == "station" {
+				si = i
+				break
+			}
+		}
+		if si >= 0 {
+			ordered = append(ordered[:si], ordered[si+1:]...)
+			ti := 0
+			for i, n := range ordered {
+				if n == "test" {
+					ti = i + 1
+					break
+				}
 			}
+			ordered = append(ordered[:ti],
+				append([]string{"station"}, ordered[ti:]...)...)
+		}
+		for _, n := range ordered {
+			featureorder = append(featureorder, n)
 		}
 	}
 

package/project/.sdk/tm/java/utility/Fetcher.java

@@ -59,10 +59,20 @@ final class Fetcher {
       reqb.setHeader("User-Agent", "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)");
     }
 
+    // Honour a redirect annotation on the fetch definition (set by the
+    // station feature's middleware under a hosts policy): "manual" returns
+    // a 3xx like any other response instead of following it — the ts
+    // donor's fetch honours the same key natively, and an automatic follow
+    // would carry injected credentials to a host no policy approved.
+    HttpClient.Redirect redirectPolicy =
+        "manual".equals(fetchdef.get("redirect"))
+            ? HttpClient.Redirect.NEVER
+            : HttpClient.Redirect.NORMAL;
+
     // Honour a proxy annotation on the fetch definition (set by the proxy
     // feature): route the request through a proxied HttpClient.
     HttpClient.Builder clientb = HttpClient.newBuilder()
-        .followRedirects(HttpClient.Redirect.NORMAL);
+        .followRedirects(redirectPolicy);
     Object proxy = fetchdef.get("proxy");
     if (proxy instanceof String && !"".equals(proxy)) {
       try {

package/project/.sdk/tm/java/utility/MakeOptions.java

@@ -156,6 +156,17 @@ final class MakeOptions {
       else {
         featureorder.addAll(names);
       }
+      // Station special case, mirroring test's: its transport wrap must
+      // sit immediately outside the base transport (inside retry/cache/
+      // netsim), so map-form activation hoists it to just after test -
+      // or first, when no test entry exists. Without this the sorted
+      // default would init station last and wrap OUTSIDE the recording
+      // features, turning its wire-truth events into fiction.
+      int si = featureorder.indexOf("station");
+      if (0 <= si) {
+        featureorder.remove(si);
+        featureorder.add(featureorder.indexOf("test") + 1, "station");
+      }
     }
 
     Map<String, Object> derived = new LinkedHashMap<>();

package/project/.sdk/tm/js/src/utility/MakeOptionsUtility.js

@@ -68,6 +68,12 @@ function makeOptions(ctx) {
       }
     },
     utility: {},
+    // Feature INSTANCES supplied at construction (the station adopt
+    // path): consumed by the constructor's featureAdd loop, so they are
+    // class instances, not data - `$ANY` accepts them verbatim. Without
+    // this entry the seam is dead: the constructor reads
+    // options.extend, but validate rejected the key.
+    extend: '`$ANY`',
     system: {
       fetch: undefined
     },
@@ -131,10 +137,22 @@ function makeOptions(ctx) {
   // otherwise order the map test-first, then the remaining names sorted, so
   // the outcome is deterministic and `test` is always the base transport.
   if (0 === featureorder.length) {
-    const names = Object.keys(opts.feature || {}).sort()
-    featureorder = names.indexOf('test') < 0
+    let names = Object.keys(opts.feature || {}).sort()
+    names = names.indexOf('test') < 0
       ? names
       : ['test'].concat(names.filter((n) => 'test' !== n))
+    // Station special case, mirroring test's: its transport wrap must
+    // sit immediately outside the base transport (inside retry/cache/
+    // netsim), so map-form activation hoists it to just after test -
+    // or first, when no test entry exists. Without this the sorted
+    // default would init station last and wrap OUTSIDE the recording
+    // features, turning its wire-truth events into fiction.
+    const si = names.indexOf('station')
+    if (0 <= si) {
+      names.splice(si, 1)
+      names.splice(names.indexOf('test') + 1, 0, 'station')
+    }
+    featureorder = names
   }
 
   opts.__derived__ = {

package/project/.sdk/tm/kotlin/utility/Fetcher.kt

@@ -50,9 +50,18 @@ fun defaultHttpFetch(fullurl: String, fetchdef: MutableMap<String, Any?>): Mutab
     reqb.setHeader("User-Agent", "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)")
   }
 
+  // Honour a redirect annotation on the fetch definition (set by the
+  // station feature's middleware under a hosts policy): "manual" returns
+  // a 3xx like any other response instead of following it — the ts
+  // donor's fetch honours the same key natively, and an automatic follow
+  // would carry injected credentials to a host no policy approved.
+  val redirectPolicy =
+    if ("manual" == fetchdef["redirect"]) HttpClient.Redirect.NEVER
+    else HttpClient.Redirect.NORMAL
+
   // Honour a proxy annotation on the fetch definition (set by the proxy
   // feature): route the request through a proxied HttpClient.
-  val clientb = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NORMAL)
+  val clientb = HttpClient.newBuilder().followRedirects(redirectPolicy)
   val proxy = fetchdef["proxy"]
   if (proxy is String && "" != proxy) {
     try {

package/project/.sdk/tm/kotlin/utility/MakeOptions.kt

@@ -141,6 +141,17 @@ fun makeOptions(ctx: Context): MutableMap<String, Any?> {
     } else {
       featureorder.addAll(names)
     }
+    // Station special case, mirroring test's: its transport wrap must
+    // sit immediately outside the base transport (inside retry/cache/
+    // netsim), so map-form activation hoists it to just after test -
+    // or first, when no test entry exists. Without this the sorted
+    // default would init station last and wrap OUTSIDE the recording
+    // features, turning its wire-truth events into fiction.
+    val si = featureorder.indexOf("station")
+    if (0 <= si) {
+      featureorder.removeAt(si)
+      featureorder.add(featureorder.indexOf("test") + 1, "station")
+    }
   }
 
   val derived = linkedMapOf<String, Any?>()

package/project/.sdk/tm/lean/test/TPrimaryUtility.lean

@@ -316,8 +316,19 @@ def main : IO UInt32 := do
     runset "makeResult" (← getSpec primary #["makeResult", "basic"]) fun entry => do
       pure ((← SdkUtility.makeResult (← entryCtx entry opts config)), none)
 
-    runset "makePoint" (← getSpec primary #["makePoint", "basic"]) fun entry => do
-      pure ((← SdkUtility.makePoint (← entryCtx entry opts config)), none)
+    -- makePoint is NOT driven here, and this is deliberate.
+    --
+    -- The section used to be empty, so running it asserted nothing. It now
+    -- carries seven cases, and every one supplies its own `options` (for
+    -- allow.op) and `config` (for the operation's points) — but `entryCtx`
+    -- OVERWRITES both with the SDK's, so the cases would not run as authored.
+    -- Wiring it up needs entryCtx to prefer a fixture-supplied options/config,
+    -- which changes every section here and could not be compiled or run when
+    -- this change was made.
+    --
+    -- Left out rather than left in: an entry that runs with the wrong context
+    -- is worse than one that does not run, and no coverage is lost — this
+    -- section asserted nothing before either.
 
     runset "makeFetchDef" (← getSpec primary #["makeFetchDef", "basic"]) fun entry => do
       pure ((← SdkUtility.makeFetchDef (← entryCtx entry opts config)), none)

package/project/.sdk/tm/lua/utility/make_options.lua

@@ -82,6 +82,12 @@ local function make_options_util(ctx)
       },
     },
     utility = {},
+    -- Feature INSTANCES supplied at construction (the station adopt
+    -- path): consumed by the constructor's feature_add loop, so they are
+    -- class instances, not data -- `$ANY` accepts them verbatim. Without
+    -- this entry the seam is dead: the constructor reads
+    -- options.extend, but validate rejected the key.
+    extend = "`$ANY`",
     system = {},
     test = {
       active = false,
@@ -104,6 +110,15 @@ local function make_options_util(ctx)
   -- Preserve system.fetch before merge/validate.
   local sys_fetch = vs.getpath(opts, "system.fetch")
 
+  -- Preserve extend feature INSTANCES before merge/validate, by ORIGINAL
+  -- reference (the ts makeOptions keeps the caller's instances too):
+  -- merge/validate are data-oriented and would mangle instance tables
+  -- carrying functions -- the same reason system.fetch is preserved.
+  local extend = nil
+  if type(options) == "table" and type(options["extend"]) == "table" then
+    extend = options["extend"]
+  end
+
   -- Clone the config side before merging: `config` is a per-Lua-state
   -- singleton (see config_shared), and merge would otherwise use its nested
   -- tables as merge TARGETS — one instance's options (server, headers, ...)
@@ -156,6 +171,11 @@ local function make_options_util(ctx)
     end
   end
 
+  -- Restore extend feature instances.
+  if extend ~= nil then
+    opts["extend"] = extend
+  end
+
   -- Derived clean config.
   local clean_keys = "key,token,id"
   local ck = vs.getpath(opts, "clean.keys")
@@ -202,6 +222,30 @@ local function make_options_util(ctx)
     else
       featureorder = names
     end
+    -- Station special case, mirroring test's: its transport wrap must
+    -- sit immediately outside the base transport (inside retry/cache/
+    -- netsim), so map-form activation hoists it to just after test -
+    -- or first, when no test entry exists. Without this the sorted
+    -- default would init station last and wrap OUTSIDE the recording
+    -- features, turning its wire-truth events into fiction.
+    local si = nil
+    for i, n in ipairs(featureorder) do
+      if n == "station" then
+        si = i
+        break
+      end
+    end
+    if si ~= nil then
+      table.remove(featureorder, si)
+      local ti = 0
+      for i, n in ipairs(featureorder) do
+        if n == "test" then
+          ti = i
+          break
+        end
+      end
+      table.insert(featureorder, ti + 1, "station")
+    end
   end
 
   local derived = { clean = {} }

package/project/.sdk/tm/perl/utility/fetcher.pm

@@ -39,7 +39,16 @@ our $DefaultHttpFetch = sub {
   my $opts = { headers => \%hdrs };
   $opts->{content} = "$body" if defined $body && !ref $body;
 
-  my $res = eval { HTTP::Tiny->new->request($method, $fullurl, $opts) };
+  # fetchdef.redirect 'manual' (the ts fetch vocabulary): return a 3xx
+  # as-is instead of following it. HTTP::Tiny follows redirects by
+  # default; the station feature's hosts policy sets this so a Location
+  # off the allowlist can never pull an automatic credentialed follow-up.
+  my %new_args;
+  $new_args{max_redirect} = 0
+    if defined $fetchdef->{redirect} && !ref $fetchdef->{redirect}
+      && 'manual' eq $fetchdef->{redirect};
+
+  my $res = eval { HTTP::Tiny->new(%new_args)->request($method, $fullurl, $opts) };
   if (!$res) {
     my $e = defined $@ ? "$@" : 'request failed';
     $e =~ s/\s+\z//;

package/project/.sdk/tm/perl/utility/make_options.pm

@@ -26,8 +26,20 @@ $REGISTRY{make_options} = sub {
     }
   }
 
+  # Feature INSTANCES supplied at construction (the station adopt path):
+  # consumed by the constructor's extend loop, so they are blessed class
+  # instances, not data. This is the perl form of the ts/rb targets'
+  # `extend => $ANY` optspec entry: this port deep-clones its options, and
+  # Voxgig::Struct::clone would flatten a blessed feature to a plain
+  # unblessed hash (and validate rejects the key outright), so the RAW
+  # list is captured here and re-attached after validation - the
+  # system.fetch idiom. Without this the seam is dead: the constructor
+  # reads options.extend, but clone/validate dropped the instances.
+  my $extend_raw = ProjectNameHelpers::gp($options, 'extend');
+
   my $opts = Voxgig::Struct::clone($options);
   $opts = {} unless Voxgig::Struct::ismap($opts);
+  delete $opts->{extend};
 
   # Feature add-order. options.feature may be given as an ordered ARRAY of
   # { name, active, ...opts } entries (the array position IS the order in
@@ -78,6 +90,12 @@ $REGISTRY{make_options} = sub {
     'system' => {},
     'test' => { 'active' => $JF, 'entity' => { '`$OPEN`' => $JT } },
     'clean' => { 'keys' => 'key,token,id' },
+    # Server-variable values for a templated base URL (OpenAPI server
+    # variables). The embedded config (configDefinition) carries the
+    # spec defaults; user values override them. This port does not yet
+    # substitute {name} placeholders into base - the entry keeps the
+    # config's server block valid under this optspec.
+    'server' => { '`$CHILD`' => '' },
   };
 
   my $sys_fetch = ProjectNameHelpers::gpath($opts, 'system.fetch');
@@ -95,6 +113,11 @@ $REGISTRY{make_options} = sub {
     $opts->{system}{fetch} = $sys_fetch;
   }
 
+  # Re-attach the raw extend instances captured above.
+  if (Voxgig::Struct::islist($extend_raw)) {
+    $opts->{extend} = $extend_raw;
+  }
+
   my $clean_keys = ProjectNameHelpers::gpath($opts, 'clean.keys');
   $clean_keys = 'key,token,id' unless defined $clean_keys && !ref $clean_keys;
   my @parts;
@@ -114,6 +137,19 @@ $REGISTRY{make_options} = sub {
     @featureorder = (grep { 'test' eq $_ } @names)
       ? ('test', grep { 'test' ne $_ } @names)
       : @names;
+
+    # Station special case, mirroring test's: its transport wrap must
+    # sit immediately outside the base transport (inside retry/cache/
+    # netsim), so map-form activation hoists it to just after test -
+    # or first, when no test entry exists. Without this the sorted
+    # default would init station last and wrap OUTSIDE the recording
+    # features, turning its wire-truth events into fiction.
+    my ($si) = grep { 'station' eq $featureorder[$_] } 0 .. $#featureorder;
+    if (defined $si) {
+      splice @featureorder, $si, 1;
+      my ($ti) = grep { 'test' eq $featureorder[$_] } 0 .. $#featureorder;
+      splice @featureorder, (defined $ti ? $ti + 1 : 0), 0, 'station';
+    }
   }
 
   $opts->{__derived__} = {

package/project/.sdk/tm/php/test/PipelineTest.php

@@ -154,6 +154,26 @@ class PipelineTest extends TestCase
         ]));
     }
 
+    // Station special case, mirroring test's: its transport wrap must sit
+    // immediately outside the base transport, so map-form activation hoists
+    // it to just after test - or first, when no test entry exists.
+    public function test_feature_order_map_hoists_station_after_test(): void
+    {
+        $this->assertSame('test,station,metrics', self::resolve_order([
+            'metrics' => ['active' => true],
+            'station' => ['active' => true],
+            'test' => ['active' => true],
+        ]));
+    }
+
+    public function test_feature_order_map_hoists_station_first_without_test(): void
+    {
+        $this->assertSame('station,metrics', self::resolve_order([
+            'metrics' => ['active' => true],
+            'station' => ['active' => true],
+        ]));
+    }
+
     public function test_feature_order_no_test_deterministic(): void
     {
         $this->assertSame('cache,retry', self::resolve_order([

package/project/.sdk/tm/php/utility/Fetcher.php

@@ -35,7 +35,8 @@ class ProjectNameFetcher
         // Prefer cURL when available — its header capture is reliable across
         // PHP versions, while file_get_contents + custom stream wrappers
         // don't propagate $http_response_header for user-defined wrappers
-        // in PHP 8.3+.
+        // in PHP 8.3+. (cURL is configured with FOLLOWLOCATION off, so the
+        // manual-redirect annotation below holds there by construction.)
         if (function_exists('curl_init')) {
             return self::curlFetch($fullurl, $method_str, $body_str, $header_lines);
         }
@@ -47,6 +48,16 @@ class ProjectNameFetcher
             ],
         ];
 
+        // Honour a redirect annotation on the fetch definition (set by the
+        // station feature's middleware under a hosts policy): "manual"
+        // surfaces a 3xx as an ordinary response instead of auto-following
+        // it — the http stream wrapper otherwise replays the request,
+        // headers included, against whatever host Location names, carrying
+        // injected credentials to a host no policy approved.
+        if (($fetchdef['redirect'] ?? null) === 'manual') {
+            $opts['http']['follow_location'] = 0;
+        }
+
         if (is_string($body_str)) {
             $opts['http']['content'] = $body_str;
         }

package/project/.sdk/tm/php/utility/MakeOptions.php

@@ -37,6 +37,34 @@ class ProjectNameMakeOptions
         // Preserve system.fetch before merge/validate.
         $sys_fetch = \Voxgig\Struct\Struct::getpath($options, 'system.fetch');
 
+        // Feature INSTANCES supplied at construction (the station adopt path)
+        // are consumed by the constructor's feature-add loop straight from the
+        // RAW construction options - extend is consumed exactly once, at
+        // construction. Strip it here so it never enters the cloned option
+        // map: Struct::clone flattens arbitrary objects, and options_map()
+        // re-clones $this->options on every request.
+        if (isset($options['extend'])) {
+            unset($options['extend']);
+        }
+
+        // The station feature's binding handle and caller opts are live
+        // values (connect/adopt/st->options() plant them): hold them aside so
+        // the clone below cannot flatten them, and reattach after validate.
+        $station_handle = null;
+        $station_caller = null;
+        $station_has_caller = false;
+        if (is_array($options['feature']['station'] ?? null)) {
+            if (is_object($options['feature']['station']['station'] ?? null)) {
+                $station_handle = $options['feature']['station']['station'];
+                unset($options['feature']['station']['station']);
+            }
+            if (array_key_exists('calleropts', $options['feature']['station'])) {
+                $station_caller = $options['feature']['station']['calleropts'];
+                $station_has_caller = true;
+                unset($options['feature']['station']['calleropts']);
+            }
+        }
+
         $opts = \Voxgig\Struct\Struct::clone($options);
         $opts = self::to_array_deep($opts);
         if (!is_array($opts)) {
@@ -106,6 +134,24 @@ class ProjectNameMakeOptions
             $opts = [];
         }
 
+        // Reattach the station binding handle held aside above (the feature
+        // optspec is `$OPEN`, so the extra keys are legal; they were only
+        // kept out of the clone/validate round-trip).
+        if (null !== $station_handle || $station_has_caller) {
+            if (!is_array($opts['feature'] ?? null)) {
+                $opts['feature'] = [];
+            }
+            if (!is_array($opts['feature']['station'] ?? null)) {
+                $opts['feature']['station'] = [];
+            }
+            if (null !== $station_handle) {
+                $opts['feature']['station']['station'] = $station_handle;
+            }
+            if ($station_has_caller) {
+                $opts['feature']['station']['calleropts'] = $station_caller;
+            }
+        }
+
         // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
         // Every placeholder must resolve to a non-empty value: from
         // $options['server'] (user), else the config default. A placeholder
@@ -181,6 +227,18 @@ class ProjectNameMakeOptions
             } else {
                 $featureorder = $names;
             }
+            // Station special case, mirroring test's: its transport wrap must
+            // sit immediately outside the base transport (inside retry/cache/
+            // netsim), so map-form activation hoists it to just after test -
+            // or first, when no test entry exists. Without this the sorted
+            // default would init station last and wrap OUTSIDE the recording
+            // features, turning its wire-truth events into fiction.
+            $si = array_search('station', $featureorder, true);
+            if (false !== $si) {
+                array_splice($featureorder, $si, 1);
+                $ti = array_search('test', $featureorder, true);
+                array_splice($featureorder, false === $ti ? 0 : $ti + 1, 0, ['station']);
+            }
         }
 
         $derived = ['clean' => $keyre === '' ? [] : ['keyre' => $keyre]];

package/project/.sdk/tm/py/pkg/utility/fetcher.py

@@ -35,8 +35,20 @@ def _default_http_fetch(fullurl, fetchdef):
     if not has_ua:
         req.add_header("User-Agent", _DEFAULT_USER_AGENT)
 
+    # Manual redirects: fetchdef["redirect"] == "manual" surfaces a 3xx as
+    # an ordinary response instead of auto-following it — urllib would
+    # otherwise replay the request, headers included, against whatever host
+    # Location names. Set by the station feature's transport middleware
+    # under an egress hosts policy (mirrors the ts fetch option).
+    opener = None
+    if fetchdef.get("redirect") == "manual":
+        class _NoRedirect(urllib.request.HTTPRedirectHandler):
+            def redirect_request(self, req, fp, code, msg, headers, newurl):
+                return None
+        opener = urllib.request.build_opener(_NoRedirect)
+
     try:
-        resp = urllib.request.urlopen(req)
+        resp = opener.open(req) if opener is not None else urllib.request.urlopen(req)
         body = resp.read().decode("utf-8")
         resp_headers = {}
         for k, v in resp.getheaders():

package/project/.sdk/tm/py/pkg/utility/make_options.py

@@ -15,6 +15,15 @@ def make_options_util(ctx):
             for key, val in custom_utils.items():
                 utility.custom[key] = val
 
+    # Feature INSTANCES supplied at construction (the station adopt path)
+    # are consumed by the constructor's feature-add loop straight from the
+    # RAW construction options - extend is consumed exactly once, at
+    # construction. They are stripped here so they never enter the cloned
+    # option map: vs.clone flattens arbitrary objects, and options_map()
+    # re-clones self.options on every request.
+    if isinstance(options, dict) and options.get("extend") is not None:
+        options = {k: v for k, v in options.items() if k != "extend"}
+
     opts = vs.clone(options)
     if not isinstance(opts, dict):
         opts = {}
@@ -74,6 +83,10 @@ def make_options_util(ctx):
             },
         },
         "utility": {},
+        # Extension feature instances (see above) - stripped before the
+        # clone, but the key stays legal so a passed-through map cannot
+        # fail validation.
+        "extend": "`$ANY`",
         "system": {},
         "test": {
             "active": False,
@@ -171,6 +184,16 @@ def make_options_util(ctx):
             featureorder = ["test"] + [n for n in names if n != "test"]
         else:
             featureorder = names
+        # Station special case, mirroring test's: its transport wrap must
+        # sit immediately outside the base transport (inside retry/cache/
+        # netsim), so map-form activation hoists it to just after test -
+        # or first, when no test entry exists. Without this the sorted
+        # default would init station last and wrap OUTSIDE the recording
+        # features, turning its wire-truth events into fiction.
+        if "station" in featureorder:
+            featureorder = [n for n in featureorder if n != "station"]
+            at = featureorder.index("test") + 1 if "test" in featureorder else 0
+            featureorder.insert(at, "station")
 
     derived = {"clean": {}}
     if keyre != "":

package/project/.sdk/tm/rb/utility/make_options.rb

@@ -49,6 +49,12 @@ module ProjectNameUtilities
       "entity" => { "`$CHILD`" => { "`$OPEN`" => true, "active" => false, "alias" => {} } },
       "feature" => { "`$CHILD`" => { "`$OPEN`" => true, "active" => false } },
       "utility" => {},
+      # Feature INSTANCES supplied at construction (the station adopt
+      # path): consumed by the constructor's feature_add loop, so they are
+      # class instances, not data — `$ANY` accepts them verbatim. Without
+      # this entry the seam is dead: the constructor reads
+      # options["extend"], but validate rejected the key.
+      "extend" => "`$ANY`",
       "system" => {},
       "test" => { "active" => false, "entity" => { "`$OPEN`" => true } },
       "clean" => { "keys" => "key,token,id" },
@@ -122,6 +128,18 @@ module ProjectNameUtilities
       else
         featureorder = names
       end
+      # Station special case, mirroring test's: its transport wrap must
+      # sit immediately outside the base transport (inside retry/cache/
+      # netsim), so map-form activation hoists it to just after test -
+      # or first, when no test entry exists. Without this the sorted
+      # default would init station last and wrap OUTSIDE the recording
+      # features, turning its wire-truth events into fiction.
+      si = featureorder.index("station")
+      unless si.nil?
+        featureorder.delete_at(si)
+        ti = featureorder.index("test")
+        featureorder.insert(ti.nil? ? 0 : ti + 1, "station")
+      end
     end
 
     derived = { "clean" => keyre.empty? ? {} : { "keyre" => keyre } }

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -295,7 +295,7 @@ pub fn match_deep(check: &Value, base: &Value) -> Option<String> {
 // (.sdk/test/primary/<name>.aontu carries a PENDING header). Everything else
 // MUST contribute cases.
 pub const PENDING_SECTIONS: &[&str] = &[
-    "fetcher", "makeFetchDef", "makePoint", "makeResult", "featureAdd",
+    "fetcher", "makeFetchDef", "makeResult", "featureAdd",
     "featureHook", "featureInit",
 ];
 

package/project/.sdk/tm/rust/tests/feature_test.rs

@@ -1826,6 +1826,33 @@ fn feature_proxy_inactive_does_not_wrap() {
     );
 }
 
+// --- station --------------------------------------------------------------------
+
+// The station adapter (installed by @voxgig/sdkgen-station) with NO open
+// station must be an inert no-op that emits nothing and fails nothing
+// (station design 3.1). Constructed through the generated make_feature
+// factory - never a compile-time module reference - so this file stays
+// compilable both with and without the station feature installed: absent,
+// the factory answers with the inert BaseFeature and fh_present skips the
+// assertions. Bound behaviour (registration, injection, wire events) is
+// exercised by the station library's own suite and the consumer-side
+// station validation, not here.
+#[test]
+fn feature_station_inert_without_open_station() {
+    if !fh_present(&["station"]) {
+        return;
+    }
+    let f = RUSTCRATE::make_feature("station");
+    assert_eq!(
+        "station",
+        f.borrow().name(),
+        "generated factory has a station arm"
+    );
+    let h = fh_make(None, vec![(f, Value::Noval)]);
+    let res = h.op(opspec("load"));
+    assert!(res.ok, "expected inert station to pass the op through");
+}
+
 // --- composition ----------------------------------------------------------------
 
 #[test]

package/project/.sdk/tm/rust/utility/fetcher.rs

@@ -19,6 +19,14 @@ fn default_http_fetch(fullurl: &str, fetchdef: &Value) -> Result<Value, ProjectN
             builder = builder.proxy(p);
         }
     }
+    // A `redirect: "manual"` annotation (set by the station feature when a
+    // hosts policy is active - the same in-band channel as `proxy` above)
+    // disables automatic redirect following, so a 3xx rides back as a normal
+    // response: a Location pointing off an egress allowlist must never pull
+    // an automatic credentialed follow-up request.
+    if get_str(fetchdef, "redirect").as_deref() == Some("manual") {
+        builder = builder.redirects(0);
+    }
     let agent = builder.build();
 
     let mut req = agent.request(&method, fullurl);