@voxgig/sdkgen 4.21.0 → 4.22.0

package/project/.sdk/src/cmp/java/ReadmeExamplesTest_java.ts

@@ -4,26 +4,6 @@ import { cmp, File, Content } from '@voxgig/sdkgen'
 import { javaPackage } from './utility_java'
 
 
-// Emits test/ReadmeExamplesTest.java — a JUnit PRESENCE + STRUCTURE gate over
-// every ```java fenced block in the repository ROOT README.md, the
-// per-language java/README.md, AND the per-language java/REFERENCE.md.
-//
-// SCOPE NOTE (deliberate, documented): the Python/TS/Go equivalents EXECUTE and
-// type-check every documented block. That is infeasible here — the generated
-// Java SDK compiles with plain `javac`/Maven only (no in-process Java compiler
-// dependency wired into the test classpath), so a test cannot compile-and-run
-// arbitrary doc snippets at test time. This gate therefore guarantees the
-// weaker-but-real invariant that keeps the docs honest as the generator evolves:
-//   1. every doc exists and contains at least one ```java block (nothing was
-//      dropped);
-//   2. every ```java block is structurally well-formed — its braces,
-//      parentheses and brackets balance (catches a truncated or malformed
-//      generated snippet).
-// A per-doc summary line makes the coverage visible in the test output.
-//
-// The emitted Java is written WITHOUT literal backticks (the fence marker is
-// built at runtime as String.valueOf((char) 96).repeat(3)) so this TS template
-// literal stays clean.
 const ReadmeExamplesTest = cmp(function ReadmeExamplesTest(props: any) {
   const { target, ctx$: { model } } = props
 

package/project/.sdk/src/cmp/java/ReadmeQuick_java.ts

@@ -91,8 +91,6 @@ ${'' === javaServerLines
     const eVar = javaVarName(exampleEntity.name)
     const accessor = javaVarName(exampleEntity.name)
     const opnames = entityOps(exampleEntity)
-    // Model-driven id key: `idF` is the entity's id-like MATCH field name, or
-    // null when it has none.
     const idF = entityIdField(exampleEntity)
 
     if (opnames.includes('list')) {
@@ -152,7 +150,6 @@ catch (RuntimeException err) {
 `)
     }
     else if (opnames.includes('load')) {
-      // Every REQUIRED load-match key (id first, then parent path params).
       const loadRequired = opRequestShape(exampleEntity, 'load').items
         .filter((it: any) => !it.optional || it.name === idF)
         .sort((a: any, b: any) =>
@@ -219,7 +216,6 @@ client.${accessor}(null).update(Map.of(${updatePairs.join(', ')}), null);
 `)
       }
       if (opnames.includes('remove')) {
-        // Every REQUIRED remove-match key: the id plus parent keys like page_id.
         const removePairs = opRequestShape(exampleEntity, 'remove').items
           .filter((it: any) => !it.optional || it.name === idF)
           .sort((a: any, b: any) =>

package/project/.sdk/src/cmp/java/ReadmeRef_java.ts

@@ -1,5 +1,5 @@
 
-import { cmp, each, Content, canonToType, canonKey, canonScalarKey, File, isAuthActive, entityIdField, opRequestShape } from '@voxgig/sdkgen'
+import { cmp, each, Content, canonToType, canonKey, canonScalarKey, File, isAuthActive, entityIdField, opRequestShape , targetFeatures } from '@voxgig/sdkgen'
 import { ReadmeRefFeatures } from '@voxgig/sdkgen'
 
 import {
@@ -60,7 +60,7 @@ const ReadmeRef = cmp(function ReadmeRef(props: any) {
   const SDK = model.const.Name + 'SDK'
 
   const entity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  const feature = targetFeatures(model, target)
 
   const publishedEntities = each(entity).filter((e: any) => e.active !== false)
 
@@ -378,9 +378,6 @@ ${SDK} client = new ${SDK}(options);
 \`\`\`
 
 `)
-      // The shared feature reference: options, defaults, usage and the
-      // considerations. Model facts, identical in every target, so they are
-      // written once in cmp/ReadmeRefFeatures.ts rather than here.
       ReadmeRefFeatures({ target })
     }
 

package/project/.sdk/src/cmp/java/ReadmeTopQuick_java.ts

@@ -68,14 +68,10 @@ ${javaServerLines}${SDK} client = new ${SDK}(options);
   }
 
   if (exampleEntity) {
-    // Sanitise the local variable name — an entity whose camelCased name is a
-    // Java keyword gets a trailing underscore (javaVarName) so the snippet compiles.
     const eVar = javaVarName(exampleEntity.name)
     const accessor = javaVarName(exampleEntity.name)
     const eNameLower = nom(exampleEntity, 'Name').toLowerCase()
     const opnames = Object.keys(exampleEntity.op || {})
-    // Model-driven id key: null when the entity has no id-like field, in which
-    // case the load example takes an empty match.
     const idF = entityIdField(exampleEntity)
 
     if (opnames.includes('list')) {
@@ -86,9 +82,6 @@ System.out.println(${eVar}List);
     }
 
     if (opnames.includes('load')) {
-      // Every REQUIRED load-match key (id first, then parent path params like
-      // page_id) — the same shape the runtime resolves path params from, so
-      // the example always works.
       const loadItems = opRequestShape(exampleEntity, 'load').items
         .filter((it: any) => !it.optional || it.name === idF)
         .sort((a: any, b: any) =>

package/project/.sdk/src/cmp/java/Schema_java.ts

@@ -18,25 +18,6 @@ import {
 } from './utility_java'
 
 
-// THE GENERATED SCHEMA MODULE: the model's schemas, as data the SDK can run.
-//
-// The java peer of src/cmp/ts/Schema_ts.ts. Same two members, same source:
-// OPTSPEC from `main.kit.optspec` plus each feature's own `config.options`,
-// ENTITYSPEC from the entity field sentinels — both built by the shared
-// helpers, so what java validates against and what ts validates against
-// cannot drift.
-//
-// EMBEDDED AS JSON, PARSED AT LOAD, where ts emits an object literal: JSON is
-// a subset of TypeScript's own literal syntax and is not a subset of java's.
-// Chunked StringBuilder appends, exactly as Config.java carries its config,
-// keep every string constant far below the JVM's 64KB limit no matter how
-// many features or entities the model grows.
-//
-// The round-trip is exact because the spec holds only strings and booleans:
-// pinned by "strings and booleans only, so the JSON round-trip is lossless"
-// in ts/test/optspec.test.ts. That is not incidental — Json.parse decodes a
-// JSON number to one java type and struct reads a spec BY EXAMPLE, so one
-// number in here would mean something different in java than in ts.
 const Schema = cmp(async function Schema(props: any) {
   const ctx$ = props.ctx$
   const target = props.target

package/project/.sdk/src/cmp/java/TestDirect_java.ts

@@ -57,13 +57,6 @@ function normalizePathParams(
 }
 
 
-// Render a JSON value as a Java literal for query examples.
-// A Java source literal for an example value from the model.
-//
-// An integer beyond Java's int range needs the L suffix: javac rejects a bare
-// 120615523104 outright ("integer number too large"), so one large id in a
-// spec's example makes the whole generated test package fail to compile.
-// A non-integral double is fine unsuffixed.
 function javaLiteral(v: any): string {
   if (null == v) return 'null'
   if ('boolean' === typeof v) return String(v)

package/project/.sdk/src/cmp/java/TestEntity_java.ts

@@ -179,10 +179,6 @@ ${allSteps.length > 0 ? `    ${SDK} client = setup.client;\n\n` : ''}`)
 
 `)
 
-    // Stream test (PR #4): the entity `stream` method runs the op pipeline and
-    // returns a Stream. With the streaming feature active it yields from the
-    // feature's incremental iterator; otherwise it falls back to the
-    // materialised items. Only emitted for entities whose flow lists.
     const flowHasList = allSteps.some((s: any) => s.op === 'list')
     if (flowHasList) {
       Content(`  @Test

package/project/.sdk/src/cmp/java/Test_java.ts

@@ -24,12 +24,6 @@ const Test = cmp(function Test(props: any) {
     // Write-once: a project's edited control file survives regeneration.
     TestControl({ target, dir: 'test' })
 
-    // The shared test infrastructure (RunnerSupport, the vendored omni
-    // runner under test/vendor/omni with its OmniResolver/OmniSmokeTest,
-    // FeatureHarness, PipelineTest, FeatureTest, NetsimTest,
-    // PrimaryUtilityTest, CustomUtilityTest, StructCorpusTest, ExistsTest
-    // and sdk-test-control.json) ships as templates in tm/java/test/ and
-    // is copied by Main_java. Here we generate only the API-specific tests.
     const entity = each(entityCollection(model))
       .filter((e: any) => false !== e.active)
     each(entity, (entity: ModelEntity) => {

package/project/.sdk/src/cmp/java/utility_java.ts

@@ -34,7 +34,6 @@ function javaPackage(model: any): string {
 }
 
 
-// Maven coordinates for the generated SDK (used by Package_java).
 function mavenGroupId(model: any): string {
   const org = String(model.origin || 'voxgig-sdk')
     .replace(/-sdk$/, '')
@@ -52,14 +51,10 @@ const JAVA_KEYWORDS = new Set([
   'package', 'private', 'protected', 'public', 'return', 'short', 'static',
   'strictfp', 'super', 'switch', 'synchronized', 'this', 'throw', 'throws',
   'transient', 'try', 'void', 'volatile', 'while',
-  // contextual/literal words unusable as identifiers
   'true', 'false', 'null', 'var', 'record', 'yield',
 ])
 
 
-// A camelCase Java identifier for a snake_case model name
-// (`status_embed_config` -> `statusEmbedConfig`), with a reserved-word
-// guard (a `new`/`class` entity must not bind a Java keyword).
 function javaVarName(name: string): string {
   const pascal = camelify(name)
   const out = pascal.charAt(0).toLowerCase() + pascal.slice(1)
@@ -67,42 +62,14 @@ function javaVarName(name: string): string {
 }
 
 
-// Strip model bookkeeping keys (ending in $) from a config subtree.
-// Emission-time normalisation of a model subtree (L0).
-//
-// Always drops jostraca's iteration metadata (`$`-suffixed keys: index$,
-// key$, val$). With `dropDefaults`, also drops keys whose value IS the
-// default the runtime already assumes when the key is absent, which is pure
-// payload — see CONFIG_DEFAULT.
-//
-// Rebuilds the tree rather than mutating during a walk. The previous
-// implementation walked a clone calling `delete p[k]`, but walk() assigns its
-// callback's result back over the child (`setprop(out, ckey, walk(...))`), so
-// the delete was undone on the way out and the helper silently did nothing.
-// Returning `undefined` from the callback does not fix it either: setprop
-// stores undefined rather than removing the key, which then emits as a null.
-//
-// `dropDefaults` is opt-in and must be passed ONLY for the entity subtree.
-// `active` means something different in feature config, where absent reads as
-// INACTIVE (see feature_init) — dropping `active: true` there would silently
-// disable the feature.
-// jostraca's iteration metadata, injected by each()/names() while it walks the
-// model. Listed explicitly rather than matched by trailing-dollar suffix: a
-// trailing dollar is not exclusive to jostraca -- Seneca uses entity$ as real
-// data -- so a blanket suffix match can silently drop a legitimate API field.
 const MODEL_META = ['index$', 'key$', 'val$']
 
-// Keys whose value IS the default the runtime already assumes when the key is
-// absent, so emitting them is pure payload.
 const CONFIG_DEFAULT: Record<string, any> = {
   active: true,
   req: false,
   reqd: false,
 }
 
-// Subtrees carrying user payload rather than schema. An active:true inside an
-// OpenAPI example is DATA, not a default, so default-pruning stops at these
-// keys and everything below them is passed through untouched.
 const PAYLOAD_KEYS = ['default', 'example', 'examples']
 
 function cleanModel(o: any, dropDefaults?: boolean): any {

package/project/.sdk/src/cmp/js/Config_js.ts

@@ -42,9 +42,6 @@ const Config = cmp(async function Config(props: any) {
   const model: Model = ctx$.model
 
   const entity = getModelPath(model, `main.${KIT}.entity`)
-  // Gated by the applicability tags, so this target never imports or
-  // registers a feature it has no source for. One rule, one place:
-  // helpers/applicability.
   const feature = targetFeatures(model, target)
 
   const ff = Path.normalize(__dirname + '/../../../src/cmp/js/fragment/')
@@ -52,7 +49,6 @@ const Config = cmp(async function Config(props: any) {
   const headers = getModelPath(model, `main.${KIT}.config.headers`) || {}
 
   const authActive = isAuthActive(model)
-  // config.auth.prefix override -> spec-derived info.security.prefix -> 'Bearer'
   const authPrefix = resolveAuthPrefix(model)
   // `in` and `name` travel with the prefix now. They were resolved by
   // apidef all along and dropped here, so an apiKey-in-query API got an
@@ -71,30 +67,17 @@ const Config = cmp(async function Config(props: any) {
     `
     : ''
 
-  // Templated server URL: emit the spec's server-variable defaults so the
-  // runtime can substitute {name} placeholders in base (see makeOptions).
   const svars = serverVariables(model)
   const serverBlock = 0 === svars.length ? '' :
     'server: {\n' +
     svars.map((v: any) => `      ${JSON.stringify(v.name)}: ${JSON.stringify(v.dflt)},\n`).join('') +
     '    },\n\n    '
 
-  // Read the base URL here rather than leaving it to a `$$...$$` stdrep
-  // placeholder in the fragment. stdrep can only substitute a path the model
-  // actually has: a model with no `info.servers` left the placeholder itself in
-  // the generated source, so `options.base` came out as the literal string
-  // '$main.kit.info.servers.0.url$'. Reading it explicitly yields '' in that
-  // case, which is what every other target already emits, and is identical to
-  // the old output whenever the model does define a server.
   let baseUrl = ''
   try {
     baseUrl = getModelPath(model, `main.${KIT}.info.servers.0.url`)
   } catch (_e) { }
 
-  // The same config as an OBJECT, built by the shared helper so this target's
-  // literal and the data that replaces it above the threshold are the same
-  // config by construction. The JSON is what the threshold is measured on -
-  // emitted source size varies by language, the model does not.
   const { def: configDef, json: configJson } = configDefinition(model, target.name)
   const asData = isConfigData(configJson, configReprSetting(model))
 
@@ -122,9 +105,6 @@ const Config = cmp(async function Config(props: any) {
 
           '// #FeaturePlugins': () => pluginDefs(feature),
 
-          // A JS string literal, so the JSON survives verbatim. JSON.stringify
-          // escapes the quotes and backslashes the model contains (values like
-          // `$STRING` carry backticks, which a template literal could not).
           "'CONFIGJSON'": JSON.stringify(configJson),
         }
       })
@@ -162,8 +142,6 @@ const Config = cmp(async function Config(props: any) {
 
         '// #FeatureClasses': () => {
           each(feature, (f: any) => {
-            // Trailing comma: the map has one entry per feature, so entries
-            // must be comma-separated (a single feature hid this until now).
             Line(` ${f.name}: ${nom(f, 'Name')}Feature,`)
           })
         },
@@ -189,12 +167,6 @@ const Config = cmp(async function Config(props: any) {
           })
         },
 
-        // configDefinition's `def.entity` verbatim, NOT rebuilt here. This
-        // reduce was a second copy of that function's entityDefs loop, and
-        // when configDefinition started reconstructing a point's `parts`
-        // from apidef's segment vector (its ADR-003), only the data
-        // representation got it — the literal one emitted empty paths. The
-        // config-repr equivalence test caught it, which is what it is for.
         "'ENTITYMAP'": formatJson(configDef.entity, { margin: 2 }).trim(),
       }
     })
@@ -202,24 +174,8 @@ const Config = cmp(async function Config(props: any) {
 })
 
 
-// PLUGIN DEFINITION REQUIRES AND THE FEATURE_PLUGINS MAP.
-//
-// Upstream sekreto replaced its self-registration registry with
-// voxgig/plugin definitions: a provider kind the caller did not pass in
-// via `plugins: [...]` is unknown to that Sekreto. So Config no longer
-// requires provider modules for their side effects — it requires each
-// active plugin's exported Definition BY NAME (the model's `def` map)
-// and hands the list to the feature through FEATURE_PLUGINS.
-//
-// Emitted here because Config already requires every active feature from
-// the model, and this is the same list one level down. The `def` map is
-// declared in the model rather than derived from filenames because one
-// file may export several definitions (sekreto's aws.js exports
-// awssecrets AND awsparams).
 function pluginImports(feature: any) {
   each(feature, (f: any) => {
-    // path -> [symbol, ...], so one require line serves a two-definition
-    // module.
     const bypath: Record<string, string[]> = {}
 
     each(f.plugin, (plugin: any) => {
@@ -243,8 +199,6 @@ function pluginImports(feature: any) {
   })
 }
 
-// The FEATURE_PLUGINS entries: one line per feature that has any active
-// plugin definitions, listing the required symbols.
 function pluginDefs(feature: any) {
   each(feature, (f: any) => {
     const syms: string[] = []

package/project/.sdk/src/cmp/js/EntityTypes_js.ts

@@ -1,25 +1,5 @@
 
 
-// Typed-model generator (JavaScript target).
-//
-// JavaScript is dynamically typed, so the "types" are JSDoc typedefs
-// (@typedef / @property) for editor/tooling DX only — no runtime effect.
-//
-// Reads main.<KIT>.entity.<e>.fields[] and per-op params
-// (op.<name>.points[].args.params[]) and emits one file, src/<Sdk>Types.js,
-// with a `@typedef {Object} <Name>` per active entity plus a request/match
-// typedef per active op. Field/param sentinels ($STRING, $INTEGER, ...) are
-// turned into JSDoc types by the shared sdkgen helper `canonToType`
-// ('js' column: Object / Array / * for open shapes).
-//
-// The typedefs are emitted at file (script) scope so they are GLOBAL across
-// the SDK's JS program — the op fragments reference them by bare name
-// (@param {AdviceLoadMatch} / @returns {Promise<Advice>}). The program itself
-// is established by the tm/js/jsconfig.json template shipped at the SDK root
-// (one project spanning src/ + test/), so resolution does not depend on
-// editor workspace inference. Keeps the SAME type-name scheme as the TS
-// reference (<Name>, <Name>LoadMatch, <Name>ListMatch, <Name>CreateData,
-// <Name>UpdateData, <Name>RemoveMatch).
 
 import {
   cmp, each, names,
@@ -37,8 +17,6 @@ import {
 const LANG = 'js'
 
 
-// A bare JSDoc property key, or a quoted string literal for anything that is
-// not a plain identifier.
 function propKey(name: string): string {
   return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name)
 }
@@ -47,10 +25,6 @@ function propKey(name: string): string {
 const EntityTypes = cmp(function EntityTypes(props: any) {
   const { model, log } = props.ctx$
 
-  // only_active:false — getModelPath DROPS active:false entries by default,
-  // but the consumer scaffold (create-sdkgen Root.ts) iterates the RAW entity
-  // collection, so inactive entities still get generated entity code that
-  // references these typed names. The typed model must cover them too.
   const entity = getModelPath(model, `main.${KIT}.entity`, { only_active: false, required: false })
   // Emit for EVERY entity that gets generated entity code: the consumer
   // scaffold (create-sdkgen Root.ts) iterates entities WITHOUT an active
@@ -62,9 +36,6 @@ const EntityTypes = cmp(function EntityTypes(props: any) {
   // entity not yet named (e.g. a fieldless placeholder) would otherwise read
   // `Name = undefined` below. Parity with the go emitter's fix.
 
-  // Surface duplicate generated type names (two entities with the same
-  // PascalCase Name) — they would redeclare a type in statically-typed
-  // targets. Detection only; renaming is a model-level decision.
   warnEntityTypeCollisions(entity, log, LANG)
 
   File({ name: model.const.Name + 'Types.' + LANG }, () => {
@@ -84,7 +55,6 @@ const EntityTypes = cmp(function EntityTypes(props: any) {
       const fields = (ent.fields ? each(ent.fields) : [])
         .filter((f: any) => f.active !== false)
 
-      // Entity data model: one @property per field, `req:false` -> optional [].
       Content(`/**
  * @typedef {Object} ${Name}
 `)
@@ -97,9 +67,6 @@ const EntityTypes = cmp(function EntityTypes(props: any) {
 
 `)
 
-      // Per active op: a request/match typedef. Members and their optionality
-      // come from the shared partiality policy (opRequestShape); this file only
-      // renders them as JSDoc @property lines (optional -> [bracketed] key).
       const ops = ent.op || {}
       ;['load', 'list', 'create', 'update', 'remove'].forEach((opname: string) => {
         if (null == ops[opname]) {

package/project/.sdk/src/cmp/js/Main_js.ts

@@ -55,15 +55,6 @@ const Main = cmp(async function Main(props: any) {
 
   Copy({
     from: 'tm/' + target.name,
-    // Root copies src/feature/<name>/ per ACTIVE feature; keep this blanket
-    // copy from restoring one that was switched off after `target add`.
-    // A feature's inactive plugins go too - same rule, one level
-    // deeper. See helpers/featureSource.pluginExcludes.
-    //
-    // pluginExcludes is REQUIRED, not cosmetic: Feature() renders before
-    // Main(), so its per-feature Copy applies pluginExcludesFor and then
-    // this blanket copy runs — and without the same patterns here it puts
-    // every trimmed plugin straight back.
     exclude: [
       ...srcFeatureExcludes(model),
       ...pluginExcludes(model),
@@ -93,14 +84,6 @@ const Main = cmp(async function Main(props: any) {
           replace: {
             ...props.ctx$.stdrep,
 
-            // SECRETS. All five slots are emitted only when the secrets
-            // feature applies to this target AND the model activates it.
-            // An unconditional edit here would land in every generated SDK
-            // and break the inactive-output gate: a model without the
-            // feature must generate byte-identically to pre-migration.
-            //
-            // `feature` is already gated by targetFeatures, so a target
-            // that does not provide 'sekreto' never reaches these.
             '// #SecretsImport': () => secrets ?
               Line(`const sekreto = require('./feature/secrets/sekreto')`) : undefined,
 
@@ -117,15 +100,6 @@ secrets() {
 }
 `) : undefined,
 
-            // prepare() bypasses the feature hook pipeline, so the PreSpec
-            // hook that resolves the secret for entity ops never runs on
-            // this path and the resolve has to be explicit. This is also
-            // what defends direct() and graphql(), which run no feature
-            // hooks at all and reach the wire through prepare().
-            //
-            // It RETURNS the Error rather than rejecting: _rawRequest
-            // awaits prepare() outside its try, and direct()/graphql() are
-            // documented to return a value or an Error, never reject.
             '// #SecretsResolve': ({ indent }: any) => secrets ?
               Content({ indent }, `
 if (null != this._secrets) {
@@ -174,13 +148,6 @@ if (fres instanceof Promise) { await fres }
           })
         })
 
-      // Station self-registration (station design §6.2 path 1;
-      // station-declarative-config §11 item 2): emitted ONLY when the model
-      // carries an ACTIVE station feature (installed via
-      // `package add @voxgig/sdkgen-station`). The library package name
-      // comes from the feature model's own `deps.js` block — the same entry
-      // collectDeps flows into package.json — so the manifest dependency
-      // and the emitted require cannot disagree.
       const stationPkg = stationLibrary(model, target.name)
       if (null != stationPkg) {
         Fragment({

package/project/.sdk/src/cmp/js/Package_js.ts

@@ -14,6 +14,7 @@ import {
   packageVersion,
   authorInfo,
   targetFeatures, envName,
+  hasLiveScenarios,
 } from '@voxgig/sdkgen'
 
 
@@ -44,14 +45,11 @@ const Package = cmp(async function Package(props: any) {
   const only = (kind: string, deps: any) =>
     omap(deps, ([k, v]: any) => [v.active && kind === v.kind ? k : undefined, v.version])
 
-  // merge target and feature deps, by kind
   const deps =
     each(feature, (feature: any) =>
       omap(feature.deps?.[target.name], ([k, v]: any) =>
         [v.active ? k : undefined, v]))
 
-      // TODO: sort by version; rules for version choice?
-      // TODO: non-node dep kinds
       .reduce((a: any, deps: any) => (each(deps, (dep: any) =>
         a[dep.kind][dep.key$] = dep.version), a),
         {
@@ -64,8 +62,6 @@ const Package = cmp(async function Package(props: any) {
   const { repoUrl, issuesUrl } = repoInfo(model)
 
   const pkg = {
-    // The ts target publishes the canonical scoped npm name; the js target
-    // appends `-js` so the two never collide on npm.
     name: packageName(model, target.name),
     version: packageVersion(model, target.name),
     description: pkgDescription(model, target.name),
@@ -81,7 +77,7 @@ const Package = cmp(async function Package(props: any) {
     // directly (no build step), so that is the whole package.
     files: ['src'],
     scripts: {
-      ...(Object.values(model.main.kit.entity || {}).some((e: any) => Object.values(e.op || {}).some((o: any) => (o.points || []).some((p: any) => p.contract && JSON.parse(p.contract.json).live))) ? {
+      ...(hasLiveScenarios(model) ? {
         'test:live': `${envName(model)}_TEST_LIVE=TRUE node --test test/live.test.js`,
       } : {}),
 
@@ -95,7 +91,6 @@ const Package = cmp(async function Package(props: any) {
     },
     author,
 
-    // TODO: needs to be config
     license: 'MIT',
 
     dependencies: deps.prod,

package/project/.sdk/src/cmp/js/PrepareAuth_js.ts

@@ -17,53 +17,17 @@ import {
 } from '@voxgig/apidef'
 
 
-// WHERE THE CREDENTIAL GOES IS A FACT ABOUT THE API, so it is generated
-// rather than templated.
-//
-// This was a static file at `tm/js/src/utility/PrepareAuthUtility.js` that
-// hardcoded `authorization` and a header. apidef has always resolved the
-// scheme's `in` and `name` into `main.kit.info.security` — joplin's says
-// `in: "query", name: "token"` — and generation dropped both. The result
-// was an SDK that sent a header the API does not read and never sent the
-// query parameter it does, so it could not authenticate at all. Four
-// repos in the cedar fleet shipped that way: joplin (`token`), pipedrive
-// (`api_token`), trello (`key`), lm-umbrella (`apiKey`).
-//
-// A template cannot fix this, because the three placements need three
-// different bodies and a template has to pick one. A component emits the
-// branch this API actually uses and nothing else — no dead query code in
-// a bearer-token SDK, and no runtime `if` on a value that is fixed at
-// generation time.
-//
-// Ported from PrepareAuth_ts, which is the proven shape. The differences
-// are the language's, not the design's: no type import, `module.exports`
-// instead of `export {}`, and the prefix read inline off `options.auth`
-// exactly as the js template read it, rather than hoisted into a local
-// that the query and cookie bodies would leave unused.
 const PrepareAuth = cmp(async function PrepareAuth(props: any) {
   const { target } = props
   const { model } = props.ctx$
 
   const active = isAuthActive_js(model)
   const where = resolveAuthIn(model)
-  // LOWERCASED FOR A HEADER, VERBATIM OTHERWISE. The js runtime keys its
-  // header map in lower case — the old template hardcoded 'authorization',
-  // the shared corpus asserts ctx:spec:headers:authorization, and every
-  // generatedcompile probe reads the lower-case key. apidef writes
-  // name: "Authorization", so emitting it verbatim hides the credential
-  // under a key nothing reads. Query parameters and cookies ARE
-  // case-sensitive and keep the spec's spelling.
   const resolvedName = resolveAuthName(model)
   const name = 'header' === where ? resolvedName.toLowerCase() : resolvedName
   const prefix = resolveAuthPrefix(model)
   const basic = isHttpBasicAuth(model)
 
-  // No `src` folder here: Main_js already opened it, and Config, Schema,
-  // SdkError, EntityBase and EntityTypes all write straight into it. The
-  // template this replaces lived at `tm/js/src/utility/`, so relative to
-  // that open folder the file needs `utility` and nothing more. Opening a
-  // second `src` would put it at src/src/utility/ — where nothing imports
-  // it, and the stale copy at src/utility/ keeps being used.
   Folder({ name: 'utility' }, () => {
     File({ name: 'PrepareAuthUtility.' + target.ext }, () => {
       Content(render({ active, where, name, prefix, basic }))
@@ -76,8 +40,6 @@ function render(spec: {
   active: boolean, where: string, name: string, prefix: string, basic: boolean
 }): string {
 
-  // NO AUTH AT ALL. A public API's SDK gets a prepareAuth that is honest
-  // about it rather than one that deletes a header nobody set.
   if (!spec.active) {
     return `
 // This API declares no authentication, so there is no credential to
@@ -193,16 +155,10 @@ function clear(where: string): string {
 
 function place(where: string): string {
   if ('query' === where) {
-    // NO PREFIX IN A QUERY STRING. `?token=Bearer%20abc` is not a thing any
-    // API reads; the prefix is a header convention and is dropped here
-    // deliberately rather than silently concatenated.
     return `    setprop(query, CRED_name, apikey)`
   }
 
   if ('cookie' === where) {
-    // APPEND, never clobber: the request may already carry a session
-    // cookie set from options.headers, and a cookie header holds a
-    // '; '-joined list of pairs.
     return `    const existing = getprop(headers, 'cookie', '')
     const pair = CRED_name + '=' + apikey
     setprop(headers, 'cookie', existing ? existing + '; ' + pair : pair)`
@@ -224,19 +180,6 @@ export {
 }
 
 
-// NOT `isAuthActive`, AND THE DIFFERENCE IS LOAD-BEARING. That helper is
-// also false whenever the SPEC declares no security scheme
-// (`main.kit.info.auth: false`) — a statement about the DEFINITION, not a
-// ban on ever sending a credential. `optspec` still declares `apikey` and
-// makeOptions fills `options.auth` from its defaults, so the runtime
-// `options.auth == null` guard never fired and those SDKs have always sent
-// the credential. Gating the body on `isAuthActive` does not trim dead
-// code, it removes working authentication — which
-// `js: auth null suppresses the credential` catches, and which takes the
-// secrets feature down with it.
-//
-// `main.kit.config.auth.active: false` is the project saying "no credential,
-// ever", and it is the only signal that can be honoured before runtime.
 function isAuthActive_js(model: any): boolean {
   const auth = getModelPath(model, `main.${KIT}.config.auth`,
     { only_active: false, required: false })

package/project/.sdk/src/cmp/js/ReadmeEntity_js.ts

@@ -9,14 +9,6 @@ import {
 import { exampleValue } from './utility_js'
 
 
-// Operation method spelling differs between Go and other languages — Go
-// uses PascalCase methods with explicit ctrl arg, others use lowercase
-// methods with optional ctrl. The op descriptions are language-agnostic.
-// A `list()` on a NESTED entity needs its parent path params. The
-// quickstart used to emit `client.Moon().list()` for an entity at
-// `/planet/{planet_id}/moon`, which 404s against a live server from a
-// half-built URL — indistinguishable from "no such record". The model
-// already marks those params `reqd: true`; matchArg renders exactly them.
 function listMatchArg(ent: any): string {
   const idF = entityIdField(ent)
   return matchArg('ts', ent, 'list', idF, idLiteral(ent, 'list', idF))
@@ -56,7 +48,6 @@ const ReadmeEntity = cmp(function ReadmeEntity(props: any) {
     const fields = entity.fields || []
     // Model-driven id key: null when this entity has no id-like field.
     const idF = entityIdField(entity)
-    // Variable-safe lowercase name (a `Delete` entity must not bind `delete`).
     const eVar = exampleVarName(entity.name, 'js')
 
     Content(`