@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/go/feature/secrets/plugins/onepassword/onepassword.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/onepassword/onepassword.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/onepassword/onepassword.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The onepassword plugin: 1Password, through a Connect server. Needs
 // HTTPS. A port of typescript/plugins/onepassword.ts.

package/project/.sdk/tm/go/feature/secrets/plugins/secretspec/secretspec.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/plugins/secretspec/secretspec.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/secretspec/secretspec.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The secretspec plugin: SecretSpec, through its CLI. Needs a child
 // process. A port of typescript/plugins/secretspec.ts.

package/project/.sdk/tm/go/feature/secrets/sekreto/addr.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/addr.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/sekreto/addr.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The plaintext-address guard, in the core because it is pure - a
 // handful of string steps, no socket - and because it is on the spec:

package/project/.sdk/tm/go/feature/secrets/sekreto/providers.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/providers.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/sekreto/providers.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // What a provider is, what its declarative form looks like, how a provider
 // kind becomes a voxgig/plugin definition - and the four BUILT-IN kinds.
@@ -127,6 +127,17 @@ type ProviderSpec struct {
 	// infisical: the environment slug and secret path.
 	Environment string `json:"environment,omitempty"`
 	Path        string `json:"path,omitempty"`
+	// Passphrase is the minivault passphrase that unwraps VaultKey.
+	Passphrase string `json:"passphrase,omitempty"`
+	// VaultKey is which key in a minivault file to open with, defaulting
+	// to `master`. Named apart from Key and KeyID because those already
+	// mean a secret name and an AWS access key id.
+	VaultKey string `json:"vaultkey,omitempty"`
+	// Iterations is minivault's PBKDF2 round count, used only when a key
+	// is created.
+	Iterations int `json:"iterations,omitempty"`
+	// Create makes a minivault file if it is not there.
+	Create bool `json:"create,omitempty"`
 
 	// Provider is a provider already built, joining the chain as it is.
 	// Never serialized: a live provider is not data.
@@ -438,5 +449,6 @@ var Kinds = struct {
 	Plugin: []string{
 		"hashicorp", "boru", "awssecrets", "awsparams", "gcpsecrets",
 		"azuresecrets", "onepassword", "doppler", "infisical", "secretspec",
+		"minivault",
 	},
 }

package/project/.sdk/tm/go/feature/secrets/sekreto/sekreto.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (go/sekreto/sekreto.go)
-// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/sekreto/sekreto.go)
+// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // sekreto: one interface for secrets, wherever they live.
 //

package/project/.sdk/tm/go/feature/secrets_feature.go

@@ -15,58 +15,17 @@ import (
 	sekreto "GOMODULE/feature/secrets/sekreto"
 )
 
-// Secret access via a vendored @voxgig/sekreto provider chain, and the
-// access-token exchange some APIs require on top of it. The go port of
-// tm/ts/src/feature/secrets/SecretsFeature.ts - same contract, go idiom.
-//
-// The SDK's `apikey` option keeps exactly its old meaning: an explicit
-// credential given in code. This feature makes it ONE SOURCE among several
-// rather than the only one: when active, the apikey is resolved through a
-// sekreto chain in which the explicit option (when set) is the FIRST
-// provider - a `memory` store named `options` - so an explicit value always
-// wins, by sekreto's own first-hit rule rather than by special-case logic.
-//
-// Resolution is effectively ASYNC (providers do IO), and the auth header is
-// built by the synchronous prepareAuth inside makeSpec. The bridge is the
-// feature hook pipeline: every entity op runs featureHook("PreSpec") before
-// makeSpec, so the PreSpec hook below resolves the secret once and writes
-// it into the LIVE options map where prepareAuth already looks (ctx.Options
-// on the root context IS the options map the client clones for OptionsMap).
-// Concurrent operations share the single in-flight resolution.
-//
-// MISS vs ERROR (sekreto's invariant): a provider MISS falls through - the
-// op proceeds, unauthenticated if nothing else supplies a credential. A
-// provider ERROR (unreachable vault, bad creds) must FAIL the op: a broken
-// vault never degrades into an unauthenticated request. go's feature hooks
-// are synchronous and cannot fail an operation from PreSpec the way ts's
-// awaited hook rejection can - so, unlike ts, the transport is wrapped
-// WHENEVER the feature is active, and the wrapper refuses to send while
-// the last resolution stands failed. Fail-closed at the one seam every
-// request must pass.
-//
-// EXCHANGE: some APIs will not take a long-lived credential at all. What
-// the chain resolves is then a REFRESH token, which buys a short-lived
-// ACCESS token from a token endpoint (`exchange.path`, relative to
-// options.base); the access token is what every request carries, and when
-// a response status in `exchange.statuses` (401) says it is spent the
-// wrapper buys another and retries the same request once. Concurrent
-// purchases share the one in-flight exchange; test mode buys nothing and
-// answers with a deterministic fake token.
 type SecretsFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK
 	options map[string]any
 
-	// The LIVE options map (root ctx options), where the resolved value
-	// lands so the sync prepareAuth sees it.
 	liveopts map[string]any
 
 	secretname string
 	cache      bool
 	sek        *sekreto.Sekreto
 
-	// Exchange state: nil config when off; the refresh credential the
-	// chain resolved; the single in-flight purchase.
 	exchange *secretsExchange
 	refresh  string
 
@@ -75,16 +34,6 @@ type SecretsFeature struct {
 	buying    *secretsBuy
 	initerr   error
 
-	// The RESOLVED credential, held in feature state and injected into
-	// each request at the transport seam - NEVER written into the shared
-	// live options map. This is go's structural deviation from the ts
-	// reference (which writes options.apikey): the go request path reads
-	// ctx.Options raw on every operation goroutine, so a feature that
-	// mutated that map would race every concurrent operation. With the
-	// feature as sole holder, the options map is frozen after
-	// construction and every raw read is safe; the header the wire sees
-	// is identical, because the transport wrapper rewrites it from this
-	// value the same way prepareAuth builds it.
 	cred string
 }
 
@@ -97,7 +46,6 @@ type secretsExchange struct {
 	retries  int
 }
 
-// One shared in-flight resolution: late arrivals wait on done and read err.
 type secretsCall struct {
 	done chan struct{}
 	err  error
@@ -127,8 +75,6 @@ func (f *SecretsFeature) Sekreto() *sekreto.Sekreto {
 	return f.sek
 }
 
-// Init is sync by feature contract: build the chain, never look anything
-// up here.
 func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 	f.client = ctx.Client
 	f.options = options
@@ -145,8 +91,6 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 	}
 	f.cache = foptBool(options, "cache", true)
 
-	// Exchange config, normalised once. Nil when off, so every later
-	// decision is a nil check.
 	xopts := foptMap(options, "exchange")
 	if foptBool(xopts, "active", false) {
 		statuses := []int{}
@@ -166,14 +110,6 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 		}
 	}
 
-	// The explicit credential, when set, is the first store in the chain.
-	//
-	// WHICH option that is depends on the exchange. Without one, the
-	// secret being resolved IS the credential the transport sends, so
-	// `apikey` is it. With one, the secret is a REFRESH token and `apikey`
-	// means the opposite thing - an access token the caller already holds
-	// - so the explicit seat belongs to `exchange.refresh`, and apikey is
-	// left alone to serve as the starting access token (see resolveonce).
 	explicit := ""
 	if nil == f.exchange {
 		explicit, _ = f.liveopts["apikey"].(string)
@@ -199,7 +135,6 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 		case *sekreto.ProviderSpec:
 			specs = append(specs, v)
 		case sekreto.Provider:
-			// A provider already built joins the chain as it is.
 			specs = append(specs, &sekreto.ProviderSpec{Provider: v})
 		case map[string]any:
 			spec, err := sekreto.SpecOf(v)
@@ -209,18 +144,6 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 			}
 			specs = append(specs, spec)
 		default:
-			// ANYTHING ELSE is refused, fail-closed - a bare kind name
-			// ("hashicorp"), a nil, a number. DELIBERATE DIVERGENCE from
-			// ts/kotlin: those push every entry through to Sekreto's
-			// constructor, whose dynamic providers list refuses it with this
-			// message. Go's Options.Providers is a typed slice, so there is
-			// nothing to push a string through; the feature raises the
-			// library's own error here instead, via sekreto.Fail with the
-			// constructor's own wording, and the transport gate below refuses
-			// to send. A switch without this arm silently DROPPED the entry,
-			// which SHORTENED the chain instead of failing it - a
-			// misconfigured providers list then sent ordinary unauthenticated
-			// requests, the exact fail-open the gate exists to prevent.
 			f.initerr = sekreto.Fail(
 				"sekreto: not a provider or a provider spec: " + fmt.Sprint(v))
 		}
@@ -253,10 +176,6 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 	}
 	f.sek = sek
 
-	// Wrap the transport: the fail-closed gate needs the seam whenever the
-	// feature is active, and the exchange (when on) additionally needs to
-	// SEE responses - expiry is only ever discovered from one, and this is
-	// the one place a response can be seen and the request tried again.
 	self := f
 	inner := ctx.Utility.Fetcher
 	ctx.Utility.Fetcher = func(ctx2 *core.Context, url string, fetchdef map[string]any) (any, error) {
@@ -264,19 +183,6 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 	}
 }
 
-// resolve runs one resolution, shared by every concurrent caller. A
-// settled HIT is kept only when caching is on (`cache: false` means every
-// resolve asks the chain again); a FAILURE is always cleared, so a
-// transient vault outage never poisons the client permanently - the next
-// operation asks the chain again.
-//
-// A MISS is cleared too, however caching is set. That rule is sekreto's,
-// not this feature's: `A miss is never cached: the next read asks again`,
-// in sekreto's own source. Retaining a settled miss here would override
-// that from the layer above, and a secret provisioned after startup - a
-// mounted file, a policy granted a minute late - would never be picked up
-// for the life of the client. `cache` is about caching a HIT; it was never
-// a promise to keep saying no.
 func (f *SecretsFeature) resolve() error {
 	if nil != f.initerr {
 		return f.initerr
@@ -315,8 +221,6 @@ func (f *SecretsFeature) resolveonce() (bool, error) {
 
 	found, has, err := f.sek.Try(f.secretname)
 	if nil != err {
-		// A provider ERROR fails the op (via the transport gate); only a
-		// MISS falls through.
 		return false, err
 	}
 
@@ -325,12 +229,6 @@ func (f *SecretsFeature) resolveonce() (bool, error) {
 		if has {
 			f.cred = found
 		} else {
-			// An UNCACHED miss after an earlier hit is a revocation: the
-			// chain now says no provider has the secret, so the resolved
-			// value must not keep going out on the wire. (An explicit
-			// apikey OPTION is never lost here - it seats FIRST in the
-			// chain as a memory provider, so the chain HITS while one is
-			// set and the miss branch is unreachable.)
 			f.cred = ""
 		}
 		f.mu.Unlock()
@@ -350,27 +248,15 @@ func (f *SecretsFeature) resolveonce() (bool, error) {
 	apikey := f.cred
 	f.mu.Unlock()
 	if "" == apikey {
-		// A starting access token supplied as the OPTION: read from the
-		// frozen options map (no feature ever writes it).
 		apikey, _ = f.liveopts["apikey"].(string)
 		f.mu.Lock()
 		f.cred = apikey
 		f.mu.Unlock()
 	}
 	if "" != apikey {
-		// A starting access token was supplied. Spend it: if it is stale
-		// the API answers with an expiry status and the transport wrapper
-		// buys another, which is the same path expiry takes anyway.
 		return true, nil
 	}
 
-	// `auth: nil` is the documented way to send NO credential, and a
-	// purchase is a credential-bearing call: the refresh token goes to the
-	// token endpoint in the request body. withrefresh honours suppression
-	// for the RETRY, but it runs after this - by then the refresh token has
-	// already left the process, and no later check can call it back. The
-	// suppression has to be honoured here, before the first purchase, or it
-	// only ever half-held.
 	if nil == f.liveopts["auth"] {
 		return false, nil
 	}
@@ -379,21 +265,9 @@ func (f *SecretsFeature) resolveonce() (bool, error) {
 	return nil == err, err
 }
 
-// transport wraps whatever transport was current at Init.
 func (f *SecretsFeature) transport(ctx *core.Context, url string,
 	fetchdef map[string]any, inner core.FetcherFunc) (any, error) {
 
-	// Fail-closed, at the ONE seam every wire path crosses. Entity ops,
-	// Direct, Graphql and the exchange retries all come through this
-	// wrapper, so resolving HERE is what gives the raw paths - which run
-	// no feature hooks at all - the same credential the entity pipeline
-	// gets (ts resolves in its awaited PreSpec instead; go's header is
-	// rewritten below AFTER Prepare built it, so the transport is exactly
-	// early enough). resolve() is shared and cached: concurrent callers
-	// join the in-flight attempt, a cached success is free, and with
-	// `cache: false` the chain is asked once per REQUEST, which is that
-	// option's meaning. A provider ERROR refuses the request with the
-	// provider's error - never an unauthenticated send.
 	if nil != f.initerr {
 		return nil, f.initerr
 	}
@@ -417,22 +291,9 @@ func (f *SecretsFeature) transport(ctx *core.Context, url string,
 	return f.withrefresh(ctx, url, fetchdef, inner)
 }
 
-// withrefresh buys a token and tries the request again when the API says
-// the current one is spent.
-//
-// The retry rewrites the authorization header IN PLACE on the fetchdef,
-// because the header was built by the synchronous prepareAuth before this
-// request left, and it carries the token that just failed. Rebuilt the way
-// prepareAuth builds it, from the same options auth.prefix, so the two
-// cannot drift.
 func (f *SecretsFeature) withrefresh(ctx *core.Context, url string,
 	fetchdef map[string]any, inner core.FetcherFunc) (any, error) {
 
-	// `auth: nil` is the documented way to send NO credential, and
-	// prepareAuth honours it by removing the header. A refusal of a
-	// deliberately unauthenticated request is not an expired token and
-	// cannot be fixed by buying one - retrying would transmit exactly the
-	// credential the caller suppressed.
 	if nil == f.liveopts["auth"] {
 		return inner(ctx, url, fetchdef)
 	}
@@ -441,8 +302,6 @@ func (f *SecretsFeature) withrefresh(ctx *core.Context, url string,
 	attempt := 0
 
 	for {
-		// The credential THIS attempt goes out with, captured before it
-		// leaves: it is what tells a stale refusal apart from a fresh one.
 		used := f.getcred()
 
 		res, err := inner(ctx, url, fetchdef)
@@ -451,12 +310,6 @@ func (f *SecretsFeature) withrefresh(ctx *core.Context, url string,
 			return res, err
 		}
 
-		// Another request may have bought a token while this one was in
-		// flight. Concurrent expiries share the in-flight purchase, but
-		// STAGGERED ones do not - so spend what is current before buying:
-		// a second exchange for a token that is already fresh is wasted,
-		// and on a provider that invalidates the previous credential on
-		// issuance it breaks the first request's own retry.
 		current := f.getcred()
 		token := ""
 
@@ -497,7 +350,6 @@ func (f *SecretsFeature) spent(res any) bool {
 	return false
 }
 
-// getcred reads the resolved credential under the feature mutex.
 func (f *SecretsFeature) getcred() string {
 	f.mu.Lock()
 	v := f.cred
@@ -518,12 +370,6 @@ func (f *SecretsFeature) reauth(fetchdef map[string]any, token string) {
 		return
 	}
 
-	// Suppressed auth means NO header, the same answer prepareAuth gives.
-	// Reached defensively - withrefresh does not retry at all when auth is
-	// nil - but this is the function that writes the credential, so it is
-	// where the rule has to hold.
-	// The options map is FROZEN after construction (this feature never
-	// writes it), so the raw read is safe on any goroutine.
 	rawauth := f.liveopts["auth"]
 	auth, _ := rawauth.(map[string]any)
 	if nil == rawauth || nil == auth {
@@ -543,12 +389,6 @@ func (f *SecretsFeature) reauth(fetchdef map[string]any, token string) {
 // ONE in-flight purchase; the slot is cleared once settled, so the next
 // expiry buys a fresh token rather than replaying this result.
 func (f *SecretsFeature) buy() (string, error) {
-	// TEST MODE BUYS NOTHING. The test feature replaces the transport so
-	// no request leaves the process; an exchange here would be the one
-	// HTTP call it could not stop, and it would need a live token endpoint
-	// for a suite whose whole point is not needing one. A deterministic,
-	// obviously-fake token instead - the same answer makeOptions gives a
-	// required server variable, for the same reason.
 	if "live" != f.client.Mode {
 		token := "test-" + f.exchange.response
 		f.mu.Lock()
@@ -574,8 +414,6 @@ func (f *SecretsFeature) buy() (string, error) {
 	buying.err = err
 	f.buying = nil
 	if nil == err {
-		// Publish HERE, before the waiters wake: one writer, under the
-		// mutex - waiters consume the returned value.
 		f.cred = token
 	}
 	f.mu.Unlock()
@@ -595,8 +433,6 @@ func (f *SecretsFeature) buyonce() (string, error) {
 
 	options := f.client.OptionsMap()
 
-	// The token endpoint is RELATIVE to the base, which already carries
-	// whatever account or tenant segment the server URL declares.
 	base, _ := options["base"].(string)
 	base = strings.TrimRight(base, "/")
 	url := base + "/" + strings.TrimLeft(x.path, "/")
@@ -605,11 +441,6 @@ func (f *SecretsFeature) buyonce() (string, error) {
 	fetch, _ := system["fetch"].(func(string, map[string]any) (map[string]any, error))
 
 	if nil == fetch {
-		// No custom transport supplied - the ordinary case. makeOptions
-		// leaves system.fetch unset, so the exchange gets its own raw
-		// HTTP path (mirroring the ts reference, whose system.fetch is
-		// initialized from the platform fetcher). Local and minimal on
-		// purpose: see the NOT-the-SDK-transport note below.
 		fetch = rawExchangeFetch
 	}
 
@@ -621,10 +452,6 @@ func (f *SecretsFeature) buyonce() (string, error) {
 		return "", err
 	}
 
-	// Deliberately NOT the SDK transport. The transport is what this
-	// feature wraps, and sending the token request back through it would
-	// recurse on the first expiry - and would route the exchange through
-	// the test mock, which knows nothing about it.
 	res, err := fetch(url, map[string]any{
 		"method":  x.method,
 		"headers": map[string]any{"content-type": "application/json"},

package/project/.sdk/tm/go/feature/streaming_feature.go

@@ -4,13 +4,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Streaming result support. For list-style operations it attaches a
-// `Result.Stream` function yielding a channel so callers can consume items
-// incrementally with `for item := range result.Stream()` instead of
-// materialising the whole slice at once. A `chunkSize` groups items into
-// []any batches when set; a `chunkDelay` (ms) paces delivery via the
-// injectable `sleep` for offline tests. The channel is fully buffered, so
-// abandoning a stream never leaks the producing goroutine.
 type StreamingFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/telemetry_feature.go

@@ -6,14 +6,6 @@ import (
 	"GOMODULE/core"
 )
 
-// Distributed-tracing telemetry. Opens a span per operation (PrePoint),
-// propagates trace context to the server as W3C `traceparent` plus
-// `X-Trace-Id` / `X-Span-Id` headers (PreRequest), and closes the span on
-// completion (PreDone) or failure (PreUnexpected). Each span closes exactly
-// once (the per-context marker in ctx.Out is consumed on close). Finished
-// spans accumulate on the feature; an `exporter` callback, when provided,
-// is invoked with each finished span. Trace/span id generation (`idgen`)
-// and the clock (`now`) are injectable for deterministic tests.
 type TelemetryFeature struct {
 	BaseFeature
 	client  *core.ProjectNameSDK

package/project/.sdk/tm/go/feature/test_feature.go

@@ -55,13 +55,6 @@ func (f *TestFeature) Init(ctx *core.Context, options map[string]any) {
 	self := f
 
 	testFetcher := func(ctx *core.Context, _fullurl string, _fetchdef map[string]any) (any, error) {
-		// Shape the mock payload the way the real API would, so the op's
-		// response transform recovers the entity from it. A point carrying
-		// `transform.res: ` + "`body.item`" + ` describes an API that answers
-		// {"item": {...}}; handing back the bare entity means the transform
-		// unwraps a property that is not there and the caller gets nil. The
-		// mock has to agree with the model, or it only ever simulates APIs
-		// whose responses happen to be unwrapped. Mirrors the ts mock.
 		envelope := func(data any) any {
 			if data == nil || ctx.Point == nil {
 				return data
@@ -78,8 +71,6 @@ func (f *TestFeature) Init(ctx *core.Context, options map[string]any) {
 			if m == nil {
 				return data
 			}
-			// Multi-segment on purpose: GraphQL ops unwrap body.data.<field>
-			// (and body.data.<field>.<entity> for mutations), not just one level.
 			segs := strings.Split(m[1], ".")
 			out := data
 			for i := len(segs) - 1; 0 <= i; i-- {
@@ -152,13 +143,6 @@ func (f *TestFeature) Init(ctx *core.Context, options map[string]any) {
 			out := vs.Clone(found)
 			return respond(200, out, nil), nil
 		} else if op.Name == "update" {
-			// Match the existing entity by id only (or its alias). Reqdata
-			// also contains the new field values, which would otherwise
-			// cause Select to filter out the entity we want to update.
-			// When reqdata has no id, fall back to the id the entity
-			// client carries from a prior create/load (in ctx.Match /
-			// ctx.Data), mirroring the TS mock where param(ctx,'id')
-			// resolves from accumulated state.
 			updateMatch := map[string]any{}
 			if ctx.Reqdata != nil {
 				if v, has := ctx.Reqdata["id"]; has {
@@ -357,13 +341,6 @@ func (f *TestFeature) buildArgs(ctx *core.Context, op *core.Operation, args map[
 	// (e.g. GET /result?trace_id=), which has no path param at all.
 	paramsPath := vs.GetPath(point, []any{"args", "params"})
 	reqdParams := vs.Select(paramsPath, map[string]any{"reqd": true})
-	// The error return Transform gained in struct go 0.1.3 is discarded
-	// DELIBERATELY here, unlike in transform_request/response: these two
-	// transform a spec the SDK itself built from the point definition, not
-	// user data, so an error means a generator bug rather than something a
-	// caller can act on — and buildArgs has no error seam to route it
-	// through. An empty result is the conservative outcome: no required
-	// fields, which is what an absent spec already produces.
 	reqdFromParams, _ := vs.Transform(reqdParams, []any{"`$EACH`", "", "`$KEY.name`"})
 	queryPath := vs.GetPath(point, []any{"args", "query"})
 	reqdQuery := vs.Select(queryPath, map[string]any{"reqd": true})