@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Crypto.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Crypto.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Crypto.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // SHA-256 and HMAC-SHA256, hand-rolled.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Doppler.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Doppler.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Doppler.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `doppler` provider kind: Doppler.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Gcpsecrets.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Gcpsecrets.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Gcpsecrets.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `gcpsecrets` provider kind: GCP Secret Manager.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Hashicorp.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Hashicorp.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Hashicorp.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `hashicorp` provider kind: HashiCorp Vault over its HTTP API.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Httpjson.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Httpjson.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Httpjson.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The shared HTTP-JSON round-trip, and the small helpers every remote
 // store needs.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Infisical.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Infisical.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Infisical.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `infisical` provider kind: Infisical.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Onepassword.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Onepassword.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Onepassword.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `onepassword` provider kind: 1Password Connect.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Proc.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Proc.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Proc.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Running a child process, for the two provider kinds that read a vault
 // through its own CLI.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Secretspec.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Secretspec.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Secretspec.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The `secretspec` provider kind: SecretSpec, through its CLI.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/plugins/Sigv4.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/plugins/Sigv4.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/plugins/Sigv4.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // AWS Signature Version 4, hand-rolled.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Addr.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Addr.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Addr.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Refusing to send a secret-bearing credential in the clear.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Json.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Json.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Json.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Minimal JSON support for sekreto.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Provider.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Provider.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Provider.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // A source of secrets.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Providers.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Providers.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Providers.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, how a provider
 // kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/secrets/sekreto/Sekreto.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (swift/src/Sekreto.swift)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (swift/src/Sekreto.swift)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/Make.swift

@@ -131,9 +131,15 @@ func makePointUtil(_ ctx: Context) throws -> VMap? {
 }
 
 func makeSpecUtil(_ ctx: Context) throws -> Spec {
-  if let cached = ctx.out["spec"] as? Spec {
-    ctx.spec = cached
-    return cached
+  if let stored = ctx.out["spec"], let sp = stored {
+    // A PreSpec feature hook (e.g. validate) may short-circuit the operation
+    // by storing an error here; surface it before the request is built, the
+    // same way makePointUtil surfaces out["point"].
+    if let err = sp as? Error { throw err }
+    if let cached = sp as? Spec {
+      ctx.spec = cached
+      return cached
+    }
   }
 
   let options = ctx.options

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/MakeOptions.swift

@@ -3,92 +3,6 @@
 
 import Foundation
 
-private func buildOptSpec() -> Value {
-  // THE AUTH OPTION BLOCK, and every key the generated config can put in it.
-  //
-  // This spec is what `validate` checks the merged options against, and a key
-  // it does not name does not survive - so the generated Config's auth block
-  // was trimmed back to `prefix` on the way in and the SDK could not see its
-  // own scheme.
-  //
-  //   prefix  the credential prefix (Bearer/Basic/OAuth, or '' for a raw key)
-  //   basic   the scheme is real HTTP Basic: base64(apikey:secret), not a
-  //           single bearer token
-  //   in      WHERE the credential goes: header (the default) | query | cookie
-  //   name    the header, query parameter or cookie name it goes in under
-  //
-  // `in` and `name` mirror main.kit.optspec.auth in
-  // @voxgig/sdkgen/model/sdkgen.aon, which the model-driven targets read
-  // directly; '' means "take what the spec said", which is what the generated
-  // prepareAuth was built from, so an SDK that sets neither behaves exactly as
-  // it did before. Without them an apiKey-in-query SDK (joplin's `?token=`)
-  // cannot even construct its own options.
-  let authSpec = VMap()
-  authSpec.entries["prefix"] = .string("")
-  authSpec.entries["basic"] = .bool(false)
-  authSpec.entries["in"] = .string("")
-  authSpec.entries["name"] = .string("")
-
-  let headers = VMap()
-  headers.entries["`$CHILD`"] = .string("`$STRING`")
-
-  let allow = VMap()
-  allow.entries["method"] = .string("GET,PUT,POST,PATCH,DELETE,OPTIONS")
-  allow.entries["op"] = .string("create,update,load,list,remove,command,direct,graphql")
-
-  let entityChild = VMap()
-  entityChild.entries["`$OPEN`"] = .bool(true)
-  entityChild.entries["active"] = .bool(false)
-  entityChild.entries["alias"] = .map(VMap())
-  let entity = VMap()
-  entity.entries["`$CHILD`"] = .map(entityChild)
-
-  let featureChild = VMap()
-  featureChild.entries["`$OPEN`"] = .bool(true)
-  featureChild.entries["active"] = .bool(false)
-  let feature = VMap()
-  feature.entries["`$CHILD`"] = .map(featureChild)
-
-  let testEntity = VMap()
-  testEntity.entries["`$OPEN`"] = .bool(true)
-  let test = VMap()
-  test.entries["active"] = .bool(false)
-  test.entries["entity"] = .map(testEntity)
-
-  let clean = VMap()
-  clean.entries["keys"] = .string("key,token,id")
-
-  let spec = VMap()
-  spec.entries["apikey"] = .string("")
-  // The SECOND credential, for the HTTP Basic scheme
-  // (base64(apikey:secret)). Named by main.kit.optspec but missing here, and
-  // validate does not pass what it does not name - so a caller that supplied
-  // `secret` never had it reach prepareAuth.
-  spec.entries["secret"] = .string("")
-  spec.entries["base"] = .string("http://localhost:8000")
-  spec.entries["prefix"] = .string("")
-  spec.entries["suffix"] = .string("")
-  spec.entries["auth"] = .map(authSpec)
-  spec.entries["headers"] = .map(headers)
-  spec.entries["allow"] = .map(allow)
-  spec.entries["entity"] = .map(entity)
-  spec.entries["feature"] = .map(feature)
-  spec.entries["utility"] = .map(VMap())
-  // `extend` is the runtime feature-injection seam: a list of feature
-  // objects the constructor adds after the model-activated ones. Without
-  // this entry the seam is dead: the constructor reads options.extend, but
-  // validate rejected the key, so a caller could not hand in a feature the
-  // model did not activate, although the README documents the option - and
-  // every test that adopts a feature through it passed VACUOUSLY. Ported
-  // from MakeOptionsUtility.ts / make_options.go / MakeOptions.cs, which all
-  // carry it.
-  spec.entries["extend"] = .string("`$ANY`")
-  spec.entries["system"] = .map(VMap())
-  spec.entries["test"] = .map(test)
-  spec.entries["clean"] = .map(clean)
-
-  return .map(spec)
-}
 
 func makeOptionsUtil(_ ctx: Context) -> VMap {
   let options = ctx.options ?? VMap()
@@ -162,7 +76,18 @@ func makeOptionsUtil(_ ctx: Context) -> VMap {
   let config = ctx.config ?? VMap()
   let cfgopts = gp(config, "options").asMap ?? VMap()
 
-  let optspec = buildOptSpec()
+  // THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
+  //
+  // Built from the model: `main.kit.optspec` for the standard options, plus
+  // one entry per feature this target carries, from that feature's own
+  // `config.options` / `config.optspec`. Editing this file to add an option
+  // would put it back where it was - one of twenty hand-maintained copies of
+  // a schema nothing cross-checked - so add it to the model instead and every
+  // ported target validates it.
+  //
+  // Already parsed, and shared: makeOptions validates AGAINST the spec and
+  // writes into the options, never into the spec.
+  let optspec = SdkSchema.optspec
 
   // Preserve system.fetch across merge/validate (closures survive Clone, but
   // validation reshapes the system block).

package/project/.sdk/tm/swift/Tests/ProjectNameSDKTests/PrimaryUtilityTest.swift

@@ -289,12 +289,12 @@ final class PrimaryUtilityTest: XCTestCase {
   // THE `extend` SEAM IS REAL. options.extend is the runtime
   // feature-injection seam the README documents, and the constructor reads
   // it - but only after makeOptions' validate, which used to REJECT the key
-  // because buildOptSpec never named it. The seam was dead: a caller could
+  // because the option spec never named it. The seam was dead: a caller could
   // not hand in a feature the model did not activate, and every suite that
   // adopts a feature through `extend` passed VACUOUSLY on a client that
   // never held it. Pinned here, in the ungated suite, so the seam is proven
-  // whatever features a project selects. Delete the `extend` optspec entry
-  // and this goes red.
+  // whatever features a project selects. Delete `extend` from
+  // `main.kit.optspec` and this goes red.
   func testExtendOptionInstallsAndInitialisesTheFeature() {
     var initCalled = false
     let feature = TestInitFeature()

package/project/.sdk/tm/swift/Tests/vendor/omni/Json.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (swift/Sources/Omni/Json.swift)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Json.swift)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The omni JSON value model, with a small in-tree parser.
 //

package/project/.sdk/tm/swift/Tests/vendor/omni/Runner.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (swift/Sources/Omni/Runner.swift)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Runner.swift)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner (Swift port).
 //

package/project/.sdk/tm/swift/Tests/vendor/omni/Util.swift

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260908-1556-0 (swift/Sources/Omni/Util.swift)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/omni sdk-20260917-1242-0 (swift/Sources/Omni/Util.swift)
+// Source: https://github.com/voxgig/omni @ b9e6085d185e174be84f9e6123be807ccd9fcb4e  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/ts/src/Context.ts

@@ -13,7 +13,6 @@ import { Result } from './Result'
 import { Spec } from './Spec'
 
 
-// TODO: move to own file
 class Context {
 
   id = 'C' + ('' + Math.random()).substring(2, 10)
@@ -86,10 +85,6 @@ class Context {
 
 
   resolveOp(opname: string): Operation {
-    // Cache key is `<entity>:<opname>` so two entities with the same op
-    // (e.g. both have a "list") get distinct cached Operations. Keying on
-    // opname alone caused the first-resolved entity's points to be served
-    // to every subsequent entity's call.
     const entname = getprop(this.entity, 'name', '')
     const cacheKey = entname + ':' + opname
     let op: Operation = getprop(this.opmap, cacheKey)

package/project/.sdk/tm/ts/src/feature/audit/AuditFeature.ts

@@ -5,13 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Audit trail. Emits a structured record for every operation — who (actor),
-// what (entity + op), the outcome, and a correlation id — suitable for
-// compliance logging. Records accumulate on `client._audit.records`
-// (bounded by `max`) and, when a `sink` callback is supplied, are also
-// pushed to it (e.g. to forward to a SIEM). The actor is taken from options
-// (`actor`) or a per-call `ctrl.actor`. Timestamps use the injectable
-// `now` clock so tests stay deterministic.
 class AuditFeature extends BaseFeature {
   version = '0.0.1'
   name = 'audit'

package/project/.sdk/tm/ts/src/feature/cache/CacheFeature.ts

@@ -5,14 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Response caching for safe (read) requests. Wraps the active transport and
-// serves a fresh cached snapshot instead of hitting the network when the
-// same method+URL was fetched within `ttl` ms. Only successful responses to
-// cacheable methods (default: GET) are stored, keyed by method+URL. The
-// cache is bounded (`max` entries, oldest evicted) and every hit/miss is
-// recorded on `client._cache` for inspection. One-shot response bodies are
-// normalised on capture so both the current caller and later hits can read
-// the JSON body repeatedly.
 class CacheFeature extends BaseFeature {
   version = '0.0.1'
   name = 'cache'

package/project/.sdk/tm/ts/src/feature/clienttrack/ClienttrackFeature.ts

@@ -5,13 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Client tracking. Establishes a stable per-client session id at
-// construction and stamps identifying headers on every request: a
-// `User-Agent`, an `X-Client-Id` (session), and a fresh per-request
-// `X-Request-Id`. This lets a server correlate all traffic from one SDK
-// instance and each individual call. Header names, client name/version and
-// the id generator are configurable; the session id and request counter are
-// exposed on `client._clienttrack`.
 class ClienttrackFeature extends BaseFeature {
   version = '0.0.1'
   name = 'clienttrack'

package/project/.sdk/tm/ts/src/feature/cost/CostFeature.ts

@@ -5,30 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Cost tracking and spend budget. Uses BOTH seams, which is the point of
-// the feature: money is spent per HTTP ATTEMPT (a retried call is charged
-// again, because the upstream API charges it again), but it is owed by an
-// OPERATION. So the transport wrap prices each attempt, and PreDone
-// attributes the running total to `<entity>.<op>` and to the caller
-// (`ctrl.actor`, the same actor the audit feature records).
-//
-// The price of an attempt comes from the first source that answers:
-// a response header (`header` x `perUnit`), the rate table (`rates`, keyed
-// '<entity>.<op>' / '<op>' / '*'), then the flat `unit`. A body figure
-// (`path` x `perUnit`, e.g. 'usage.total_tokens') is read at PreDone
-// instead, from the already-parsed result: the response body is a one-shot
-// stream, and consuming it at the transport seam would leave the pipeline
-// with nothing. A body figure describes the whole call, so it REPLACES the
-// per-attempt estimate rather than adding to it.
-//
-// `budget` caps total spend. With `onBudget: 'deny'` a further operation is
-// refused at PrePoint, before an endpoint is resolved and before anything
-// reaches the network.
-//
-// ORDER MATTERS. Cost must sit INSIDE the cache, or a response served from
-// cache is charged for money that was never spent. The default (map) order
-// puts cache innermost and cost outside it, so activate them in array form
-// with cost first: [{ name: 'cost' }, { name: 'cache' }].
 class CostFeature extends BaseFeature {
   version = '0.0.1'
   name = 'cost'
@@ -81,8 +57,6 @@ class CostFeature extends BaseFeature {
       return
     }
 
-    // Mark the context as running through the pipeline, so _charge knows a
-    // PreDone is coming and does not commit the spend itself.
     let pending = this._pending.get(ctx)
     if (null == pending) {
       pending = this._newPending()
@@ -144,15 +118,6 @@ class CostFeature extends BaseFeature {
 
     pending.attempts++
 
-    // Accumulated here, committed once at PreDone. Adding each attempt to
-    // the running total and then subtracting it again when a body figure
-    // supersedes it loses precision to catastrophic cancellation
-    // (5 + (0.01 - 5) is not 0.01 in binary floating point).
-    //
-    // Reported and estimated are kept apart per ATTEMPT, not per operation:
-    // a 503 priced from the rate table followed by a 200 carrying the cost
-    // header is part estimate, part reported, and collapsing both into the
-    // final attempt's category would corrupt the split.
     pending.amount += priced.amount
     pending[('header' === priced.source || 'body' === priced.source) ?
       'reported' : 'estimated'] += priced.amount
@@ -160,11 +125,6 @@ class CostFeature extends BaseFeature {
 
     cost.total.attempts++
 
-    // direct() and graphql() call the transport through _rawRequest, which
-    // dispatches no pipeline hooks at all — no PrePoint to gate on, and no
-    // PreDone to commit. Their spend is committed here instead, or it would
-    // never be counted and could run past an onBudget: 'deny' ceiling
-    // indefinitely. `piped` is set by PrePoint, so its absence is the signal.
     if (!pending.piped) {
       this._commit(ctx, pending, '_', 'direct')
       this._pending.delete(ctx)
@@ -209,15 +169,6 @@ class CostFeature extends BaseFeature {
     }
     this._pending.delete(ctx)
 
-    // A FAILED operation that made no attempt never reached the network:
-    // PrePoint creates the pending entry to mark the context as piped, and
-    // then the budget gate refuses the call (rbac, or an unresolvable
-    // endpoint, short-circuits just as early). Committing it would count a
-    // call that never happened and file a zero-amount record as `last`.
-    //
-    // A SUCCEEDED operation that made no attempt is the opposite case: it was
-    // served from the cache. That is a real call, and the fact that it cost
-    // nothing is the whole point of ordering cost inside the cache.
     if (!done && 0 === pending.attempts) {
       return
     }
@@ -229,9 +180,6 @@ class CostFeature extends BaseFeature {
   }
 
 
-  // Commit one operation's spend: totals, budget, per-op and per-actor
-  // attribution, and the record. Shared by PreDone and the raw-request path
-  // in _charge, which has no PreDone to reach.
   _commit(this: any, ctx: any, pending: any, entity: string, opname: string) {
     const client: any = this._client
     const cost = client._cost

package/project/.sdk/tm/ts/src/feature/debug/DebugFeature.ts

@@ -5,12 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Request/response capture for debugging. Records a bounded ring buffer of
-// per-operation traces — method, URL, redacted headers, response status and
-// timing — on `client._debug.entries`. Sensitive header values (matching
-// `redact`, default authorization/cookie/api-key style names) are masked.
-// An optional `onEntry` callback receives each finished entry (e.g. to
-// stream to a console). `max` caps the buffer (default 100).
 class DebugFeature extends BaseFeature {
   version = '0.0.1'
   name = 'debug'

package/project/.sdk/tm/ts/src/feature/metrics/MetricsFeature.ts

@@ -5,12 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Statistics capture. Records per-operation counters and latency for every
-// call: totals plus a breakdown keyed by `<entity>.<op>`. Timing starts at
-// endpoint resolution (PrePoint) and stops when the call returns (PreDone)
-// or throws (PreUnexpected). Aggregates live on `client._metrics` and can be
-// read via `client.metrics()` in the generated SDK. The clock is injectable
-// (`now`) for deterministic tests.
 class MetricsFeature extends BaseFeature {
   version = '0.0.1'
   name = 'metrics'

package/project/.sdk/tm/ts/src/feature/netsim/NetsimFeature.ts

@@ -5,14 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Network behaviour simulation. Wraps the active transport (the live
-// `fetch` or the `test` feature's in-memory mock) and injects realistic
-// network conditions so offline unit tests can exercise slowness,
-// transient failures, rate limiting and outages deterministically.
-//
-// Every injection mode is counter-driven (per client instance) so tests
-// are reproducible without mocking timers. `failRate` adds optional
-// pseudo-random failures via a seeded LCG for coverage-style testing.
 class NetsimFeature extends BaseFeature {
   version = '0.0.1'
   name = 'netsim'

package/project/.sdk/tm/ts/src/feature/paging/PagingFeature.ts

@@ -5,14 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Pagination support for list operations. On the way out (PreRequest) it
-// stamps page/limit (or a cursor) into the request query; on the way back
-// (PreResult) it reads the server's pagination signals — a `Link:
-// rel="next"` header, `X-Next-Page`/`X-Total-Count` headers, or `next`/
-// `cursor`/`hasMore` fields in the body — and records them on
-// `ctx.result.paging`. Generated SDKs build auto-iteration on top of this
-// (advance the cursor/page and re-issue the list call until `hasMore` is
-// false). Parameter names and page size are configurable.
 class PagingFeature extends BaseFeature {
   version = '0.0.1'
   name = 'paging'
@@ -45,7 +37,6 @@ class PagingFeature extends BaseFeature {
     const limitParam = this._options.limitParam || 'limit'
     const cursorParam = this._options.cursorParam || 'cursor'
 
-    // A per-call cursor/page from ctrl takes priority (used by auto-iteration).
     const paging = (ctx.ctrl && ctx.ctrl.paging) || {}
 
     // GraphQL paginates through operation VARIABLES, not the query string.
@@ -94,7 +85,6 @@ class PagingFeature extends BaseFeature {
       hasMore: false,
     }
 
-    // Link: <...>; rel="next"
     const link = this._header(headers, 'link')
     if (null != link) {
       const m = /<([^>]+)>\s*;\s*rel="?next"?/i.exec(link)
@@ -126,7 +116,6 @@ class PagingFeature extends BaseFeature {
       }
     }
 
-    // Body-level cursors.
     if (body && 'object' === typeof body) {
       if (null != body.next) { paging.next = paging.next || body.next }
       if (null != body.cursor) { paging.cursor = body.cursor }
@@ -171,8 +160,6 @@ class PagingFeature extends BaseFeature {
     const afterVar = this._options.afterVar || 'after'
     const firstVar = this._options.firstVar || 'first'
 
-    // Only bind variables the operation actually declares, or the server
-    // rejects the document.
     const declared: Record<string, boolean> = {}
     for (const v of ((point.graphql && point.graphql.vars) || [])) {
       declared[v.name] = true

package/project/.sdk/tm/ts/src/feature/proxy/ProxyFeature.ts

@@ -5,14 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Outbound HTTP(S) proxy support. Wraps the active transport and attaches
-// proxy routing to each request's fetch definition. The proxy target comes
-// from options (`url`) or, when `fromEnv` is set, the standard
-// HTTPS_PROXY / HTTP_PROXY / NO_PROXY environment variables. Constructing a
-// concrete agent/dispatcher is dependency-specific, so a factory may be
-// supplied via `options.agent` (e.g. wrapping undici's ProxyAgent); when
-// absent the request is annotated with `fetchdef.proxy` for the transport
-// to honour. Hosts matching `noProxy` bypass the proxy.
 class ProxyFeature extends BaseFeature {
   version = '0.0.1'
   name = 'proxy'

package/project/.sdk/tm/ts/src/feature/ratelimit/RatelimitFeature.ts

@@ -5,12 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Client-side rate limiting via a token bucket. Each request consumes a
-// token; when the bucket is empty the request waits until the bucket
-// refills at `rate` tokens per second (with capacity `burst`). This keeps
-// the client under a server's published quota rather than discovering it
-// via 429s. The clock (`now`) and the wait (`sleep`) are injectable so the
-// accounting can be tested deterministically without wall-clock timing.
 class RatelimitFeature extends BaseFeature {
   version = '0.0.1'
   name = 'ratelimit'

package/project/.sdk/tm/ts/src/feature/rbac/RbacFeature.ts

@@ -5,14 +5,6 @@ import type { ProjectNameSDK } from '../../ProjectNameSDK'
 import { BaseFeature } from '../base/BaseFeature'
 
 
-// Client-side role/permission enforcement. Before an operation resolves its
-// endpoint, the required permission for that entity+operation is checked
-// against the permissions the client holds; a disallowed call is
-// short-circuited with an `rbac_denied` error and never touches the
-// network. Required permissions come from `rules` (keyed by
-// `<entity>.<op>`, `<op>`, or `*`); the default when no rule matches is
-// controlled by `deny` (default: allow when unspecified). Held permissions
-// are the `permissions` list (a `*` grants everything).
 class RbacFeature extends BaseFeature {
   version = '0.0.1'
   name = 'rbac'
@@ -43,7 +35,6 @@ class RbacFeature extends BaseFeature {
 
     const required = this._required(ctx)
     if (null == required) {
-      // No rule: honour the default policy.
       if (true === this._options.deny) {
         return this._reject(ctx, '<default-deny>')
       }