@voxgig/sdkgen 4.21.0 → 4.22.0

package/project/.sdk/tm/rust/feature/secrets.rs

@@ -1,58 +1,3 @@
-// Secret access via a vendored @voxgig/sekreto provider chain, and the
-// access-token exchange some APIs require on top of it. The rust port of
-// tm/ts/src/feature/secrets/SecretsFeature.ts, following the GO port's
-// structure - same contract, rust idiom.
-//
-// The SDK's `apikey` option keeps exactly its old meaning: an explicit
-// credential given in code. This feature makes it ONE SOURCE among several
-// rather than the only one: when active, the apikey is resolved through a
-// sekreto chain in which the explicit option (when set) is the FIRST
-// provider - a `memory` store named `options` - so an explicit value always
-// wins, by sekreto's own first-hit rule rather than by special-case logic.
-// When the option is unset the remaining providers (env, dotenv, a vault)
-// are asked in order, and moving a credential from code to a vault becomes
-// a configuration change.
-//
-// MISS vs ERROR (sekreto's invariant): a provider MISS falls through - the
-// op proceeds, unauthenticated if nothing else supplies a credential. A
-// provider ERROR (unreachable vault, bad creds) must FAIL the op: a broken
-// vault never degrades into an unauthenticated request.
-//
-// WHERE RESOLUTION HAPPENS, and why it is not the PreSpec hook. rust's
-// feature hooks return `()` (core/types.rs `fn pre_spec(&mut self, _ctx)
-// {}`), so a hook cannot fail an operation the way ts's awaited hook
-// rejection can - and `direct()` / `graphql()` run no feature hooks at all
-// (Main.fragment.rs raw_request calls utility.fetch directly). So, exactly
-// as in the go port, resolution happens at the TRANSPORT SEAM: the one
-// place every wire path crosses. The wrapper refuses to send while the
-// last resolution stands failed, which is fail-closed for the entity
-// pipeline and the raw paths alike, with one implementation.
-//
-// WHERE THE CREDENTIAL LIVES, and why it is not the options map. The ts
-// reference writes `options.apikey`; this port does NOT. `options_map()`
-// deep-clones on every prepare_auth call and the root options Value is
-// shared by every context, so a feature that mutated it would be visible
-// everywhere at once and would defeat the `auth: null` suppression pin.
-// The resolved credential is held in FEATURE STATE and written into each
-// request's header at the transport, the same construction prepare_auth
-// uses (options.auth.prefix), so the wire is identical and the options map
-// stays frozen after construction.
-//
-// EXCHANGE: some APIs will not take a long-lived credential at all. What
-// the chain resolves is then a REFRESH token, which buys a short-lived
-// ACCESS token from a token endpoint (`exchange.path`, relative to
-// options.base); the access token is what every request carries, and when
-// a response status in `exchange.statuses` (401) says it is spent the
-// wrapper buys another and retries the same request once. Test mode buys
-// nothing and answers with a deterministic fake token.
-//
-// THREADING: this SDK is single-threaded by construction (Value is
-// Rc/RefCell-backed, so !Send), which is why go's mutex/channel machinery
-// collapses to a RefCell here. The discipline that replaces it: the
-// transport closure must hold NO RefCell borrow across `inner(...)` or
-// across a provider lookup, or the failure is a runtime `already borrowed`
-// panic rather than a compile error. Every borrow below is scoped for that
-// reason.
 
 pub mod plugin;
 pub mod plugins;
@@ -121,10 +66,7 @@ pub struct SecretsState {
     options: Value,
     mode: String,
 
-    /// The RESOLVED credential, injected into each request at the
-    /// transport seam.
     cred: String,
-    /// The refresh token the chain resolved, when exchanging.
     refresh: String,
 
     /// A settled SUCCESSFUL resolution. Kept only while caching is on
@@ -156,22 +98,6 @@ impl SecretsState {
     }
 }
 
-/// A provider given as a plain callable.
-///
-/// A live `Rc<dyn Provider>` cannot travel inside a Value - the SDK union
-/// is Noval|Null|Bool|Num|Str|List|Map|Func|Sentinel, and adding a variant
-/// to the vendored struct library to carry SDK objects would be wrong - so
-/// go's `providers: [&customProvider{...}]` has no direct rust
-/// translation. This is the Value-shaped half of the answer (the typed
-/// half is `SecretsFeature::add_provider`): the callable is handed the
-/// secret NAME and answers
-///
-///   Value::Str(v)                  -> a HIT
-///   Value::Noval / Value::Null     -> a MISS, the chain continues
-///   { "__err__": "..." }           -> an ERROR, which fails the operation
-///
-/// The miss/error split is the whole point: conflating them turns a broken
-/// vault into a silent unauthenticated request.
 struct FuncProvider {
     f: Value,
 }
@@ -194,11 +120,6 @@ impl Provider for FuncProvider {
     }
 }
 
-/// SDK Value -> voxgig/plugin Value, so an option map can be handed to
-/// sekreto's `specof`. The two are different types on purpose: sekreto's
-/// is an owned BTreeMap tree with an Opaque variant for host objects, the
-/// SDK's is Rc/RefCell-backed and closed. Callables and sentinels have no
-/// counterpart and become null.
 fn to_plugin_value(v: &Value) -> PluginValue {
     match v {
         Value::Bool(b) => PluginValue::Bool(*b),
@@ -255,7 +176,6 @@ impl SecretsFeature {
         self.state.borrow().cred.clone()
     }
 
-    /// Resolve now, rather than at the next request.
     pub fn resolve(&self) -> Result<(), ProjectNameError> {
         resolve(&self.state)
     }
@@ -281,8 +201,6 @@ impl Feature for SecretsFeature {
         self.add_opts.clone()
     }
 
-    // Sync by feature contract: build the chain, never look anything up
-    // here.
     fn init(&mut self, ctx: &Rc<Context>, options: &Value) {
         self.active = fopt_bool(options, "active", false);
 
@@ -323,16 +241,6 @@ impl Feature for SecretsFeature {
             });
         }
 
-        // The explicit credential, when set, is the first store in the
-        // chain.
-        //
-        // WHICH option that is depends on the exchange. Without one, the
-        // secret being resolved IS the credential the transport sends, so
-        // `apikey` is it. With one, the secret is a REFRESH token and
-        // `apikey` means the opposite thing - an access token the caller
-        // already holds - so the explicit seat belongs to
-        // `exchange.refresh`, and apikey is left alone to serve as the
-        // starting access token (see resolve_once).
         let explicit = if state.exchange.is_none() {
             match getp(&state.options, "apikey") {
                 Value::Str(s) => s,
@@ -368,13 +276,6 @@ impl Feature for SecretsFeature {
                         ..Default::default()
                     }),
                     Value::Map(_) => specs.push(specof(&to_plugin_value(p))),
-                    // FAIL CLOSED, never drop. An entry that is neither a
-                    // callable nor a spec (a bare "hashicorp" where a spec
-                    // map was meant) must not leave the chain quietly
-                    // shorter than the options say: sekreto's own wording
-                    // lands in the init-failure gate, which refuses to send.
-                    // The rust ProviderSpec is typed, so the refusal is
-                    // raised at this arm, as the go port does.
                     _ => {
                         if state.initerr.is_none() {
                             state.initerr = Some(format!(
@@ -415,25 +316,12 @@ impl Feature for SecretsFeature {
 
         self.state = Rc::new(RefCell::new(state));
 
-        // The public accessor, published on the client's shared map: rust
-        // options are pure data, and the generated client must not name a
-        // feature type, so `sdk.secrets()` has no rust spelling. A Value
-        // callable does have one, and it reaches every caller - and every
-        // test - with no downcast.
-        //
-        //   let s = getp(&client.get_root_ctx().shared.borrow(), "secrets");
-        //   call_vfn(&s, &ja(vec![Value::str("getfrom"),
-        //                         Value::str("options"), Value::str("apikey")]))
         let shared = ctx.shared.borrow().clone();
         if let Value::Map(_) = shared {
             let h = self.state.clone();
             setp(&shared, "secrets", vfn(move |arg| secrets_call(&h, arg)));
         }
 
-        // Wrap the transport. The fail-closed gate needs the seam whenever
-        // the feature is active - hooks cannot fail an operation and the
-        // raw paths run none - and the exchange additionally needs to SEE
-        // responses, since expiry is only ever discovered from one.
         let util = ctx.util();
         let inner: FetcherFn = util.fetcher.borrow().clone();
         let state = self.state.clone();
@@ -443,7 +331,6 @@ impl Feature for SecretsFeature {
     }
 }
 
-// ---- the accessor -------------------------------------------------------
 
 fn secrets_call(state: &Rc<RefCell<SecretsState>>, arg: &Value) -> Value {
     let args: Vec<Value> = match arg {
@@ -505,19 +392,7 @@ fn secrets_call(state: &Rc<RefCell<SecretsState>>, arg: &Value) -> Value {
     }
 }
 
-// ---- resolution ---------------------------------------------------------
-
-// One resolution, shared by every request. A settled HIT is kept only when
-// caching is on; a FAILURE is never kept, so a transient vault outage never
-// poisons the client permanently - the next operation asks again.
-//
-// A MISS is not kept either, however caching is set. That rule is
-// sekreto's, not this feature's: `A miss is never cached: the next read
-// asks again`, in sekreto's own source. Keeping a settled miss here would
-// override that from the layer above, and a secret provisioned after
-// startup - a mounted file, a policy granted a minute late - would never be
-// picked up for the life of the client. `cache` is about caching a HIT; it
-// was never a promise to keep saying no.
+
 fn resolve(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
     {
         let s = state.borrow();
@@ -573,12 +448,6 @@ fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<bool, ProjectNameEr
         let mut s = state.borrow_mut();
 
         if s.exchange.is_none() {
-            // An UNCACHED miss after an earlier hit is a revocation: the
-            // chain now says no provider has the secret, so the resolved
-            // value must not keep going out on the wire. (An explicit
-            // apikey OPTION is never lost here - it seats FIRST in the
-            // chain as a memory provider, so the chain HITS while one is
-            // set and the miss branch is unreachable.)
             let hit = found.is_some();
             s.cred = found.unwrap_or_default();
             return Ok(hit);
@@ -604,13 +473,6 @@ fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<bool, ProjectNameEr
             return Ok(true);
         }
 
-        // `auth: null` is the documented way to send NO credential, and a
-        // purchase is a credential-bearing call: the refresh token goes to
-        // the token endpoint in the request body. with_refresh honours
-        // suppression for the RETRY, but it runs after this - by then the
-        // refresh token has already left the process, and no later check
-        // can call it back. The suppression has to be honoured here, before
-        // the first purchase, or it only ever half-held.
         if !authactive(&s.options) {
             return Ok(false);
         }
@@ -619,7 +481,6 @@ fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<bool, ProjectNameEr
     buy(state).map(|_| true)
 }
 
-// ---- the transport seam -------------------------------------------------
 
 fn transport(
     state: &Rc<RefCell<SecretsState>>,
@@ -628,12 +489,6 @@ fn transport(
     fetchdef: &Value,
     inner: &FetcherFn,
 ) -> Result<Value, ProjectNameError> {
-    // Fail-closed, at the ONE seam every wire path crosses. Entity ops,
-    // direct(), graphql() and the exchange retries all come through here,
-    // so resolving HERE is what gives the raw paths - which run no feature
-    // hooks at all - the same credential the entity pipeline gets. A
-    // provider ERROR refuses the request with the provider's own error;
-    // never an unauthenticated send.
     resolve(state)?;
 
     let (token, exchanging) = {
@@ -641,12 +496,6 @@ fn transport(
         (s.cred.clone(), s.exchange.is_some())
     };
 
-    // Inject the resolved credential into THIS request's header. The
-    // header was built by prepare_auth from the options apikey; the
-    // chain-resolved value lives in feature state instead, so the wrapper
-    // writes it here - same construction, same suppression rules - and the
-    // shared options map stays untouched. A MISS leaves whatever
-    // prepare_auth built, which is nothing.
     if !token.is_empty() {
         reauth(state, fetchdef, &token);
     }
@@ -658,14 +507,6 @@ fn transport(
     with_refresh(state, ctx, url, fetchdef, inner)
 }
 
-// Buy a token and try the request again when the API says the current one
-// is spent.
-//
-// The retry rewrites the authorization header IN PLACE on the fetchdef,
-// because the header was built by the synchronous prepare_auth before this
-// request left and carries the token that just failed. Rebuilt the way
-// prepare_auth builds it, from the same options.auth.prefix, so the two
-// cannot drift.
 fn with_refresh(
     state: &Rc<RefCell<SecretsState>>,
     ctx: &Rc<Context>,
@@ -673,11 +514,6 @@ fn with_refresh(
     fetchdef: &Value,
     inner: &FetcherFn,
 ) -> Result<Value, ProjectNameError> {
-    // `auth: null` is the documented way to send NO credential, and
-    // prepare_auth honours it by removing the header. A refusal of a
-    // deliberately unauthenticated request is not an expired token and
-    // cannot be fixed by buying one - retrying would transmit exactly the
-    // credential the caller suppressed.
     let (suppressed, max) = {
         let s = state.borrow();
         (
@@ -792,15 +628,8 @@ fn reauth(state: &Rc<RefCell<SecretsState>>, fetchdef: &Value, token: &str) {
     }
 }
 
-// ---- the access-token exchange -----------------------------------------
 
 fn buy(state: &Rc<RefCell<SecretsState>>) -> Result<String, ProjectNameError> {
-    // TEST MODE BUYS NOTHING. The test feature replaces the transport so
-    // no request leaves the process; an exchange here would be the one
-    // call it could not stop, and it would need a live token endpoint for
-    // a suite whose whole point is not needing one. A deterministic,
-    // obviously-fake token instead - the same answer make_options gives a
-    // required server variable, for the same reason.
     let (testmode, response) = {
         let s = state.borrow();
         (
@@ -848,8 +677,6 @@ fn buy_once(state: &Rc<RefCell<SecretsState>>) -> Result<String, ProjectNameErro
         )));
     }
 
-    // The token endpoint is RELATIVE to the base, which already carries
-    // whatever account or tenant segment the server URL declares.
     let base = match getp(&options, "base") {
         Value::Str(s) => s,
         _ => String::new(),
@@ -860,9 +687,6 @@ fn buy_once(state: &Rc<RefCell<SecretsState>>) -> Result<String, ProjectNameErro
         x.path.trim_start_matches('/')
     );
 
-    // The body is SERIALISED, never concatenated: a refresh token (or a
-    // configured request-field name) carrying a quote, backslash or
-    // newline must arrive as that literal value, not as malformed JSON.
     let body = vs::jsonify(
         &jo(vec![(x.request.as_str(), Value::str(refresh))]),
         Some(&JsonFlags {
@@ -880,10 +704,6 @@ fn buy_once(state: &Rc<RefCell<SecretsState>>) -> Result<String, ProjectNameErro
         ("body", Value::str(body)),
     ]);
 
-    // Deliberately NOT the SDK transport. The transport is what this
-    // feature wraps, and sending the token request back through it would
-    // recurse on the first expiry - and would route the exchange through
-    // the test mock, which knows nothing about it.
     let sys_fetch = getpath(&["system", "fetch"], &options);
 
     let res = if let Value::Func(_) = sys_fetch {
@@ -896,10 +716,6 @@ fn buy_once(state: &Rc<RefCell<SecretsState>>) -> Result<String, ProjectNameErro
         }
         out
     } else {
-        // No custom transport supplied - the ordinary case. make_options
-        // leaves system.fetch unset, so the exchange gets its own raw HTTP
-        // path; requiring a custom transport for the COMMON case would
-        // reject every live token purchase before a request was made.
         raw_exchange_fetch(&url, &fetchdef)?
     };
 
@@ -933,8 +749,6 @@ fn buy_once(state: &Rc<RefCell<SecretsState>>) -> Result<String, ProjectNameErro
     Ok(token)
 }
 
-// The token-exchange transport of last resort: plain ureq, answering with
-// the same shape the system.fetch seam promises ("status" + "json").
 fn raw_exchange_fetch(fullurl: &str, fetchdef: &Value) -> Result<Value, ProjectNameError> {
     let method = get_str(fetchdef, "method")
         .filter(|m| !m.is_empty())

package/project/.sdk/tm/rust/feature/streaming.rs

@@ -1,10 +1,3 @@
-// Streaming result support (mirrors go feature/streaming_feature.go,
-// adapted to a synchronous runtime). For list-style operations it attaches
-// a `result.stream` producer so callers can consume items incrementally
-// with `for item in (result.stream)()` instead of materialising the whole
-// list themselves. A `chunkSize` groups items into list batches when set;
-// a `chunkDelay` (ms) paces delivery via the injectable `sleep` for
-// offline tests.
 
 use std::rc::Rc;
 

package/project/.sdk/tm/rust/feature/support.rs

@@ -1,9 +1,3 @@
-// Shared option readers for the feature implementations (mirrors go
-// feature/feature_options.go). Feature options arrive as Value maps (from
-// SDK options or test harnesses); callables (clocks, sleepers, generators,
-// sinks) arrive as Value::Func entries. These helpers normalise access and
-// supply defaults, mirroring the `null == opts.x ? def : opts.x` pattern of
-// the ts features.
 
 use crate::core::helpers::{call_vfn, getp, now_ms, sleep_ms, to_int};
 use crate::utility::voxgigstruct::Value;

package/project/.sdk/tm/rust/feature/telemetry.rs

@@ -1,12 +1,3 @@
-// Distributed-tracing telemetry (mirrors go feature/telemetry_feature.go).
-// Opens a span per operation (PrePoint), propagates trace context to the
-// server as W3C `traceparent` plus `X-Trace-Id` / `X-Span-Id` headers
-// (PreRequest), and closes the span on completion (PreDone) or failure
-// (PreUnexpected). Each span closes exactly once (the per-context marker
-// in ctx.out is consumed on close). Finished spans accumulate on the
-// feature; an `exporter` callback, when provided, is invoked with each
-// finished span. Trace/span id generation (`idgen`) and the clock (`now`)
-// are injectable for deterministic tests.
 
 use std::rc::Rc;
 

package/project/.sdk/tm/rust/feature/test.rs

@@ -1,8 +1,3 @@
-// The offline `test` feature (mirrors go feature/test_feature.go): an
-// in-memory mock transport that serves entity CRUD from a fixture, so
-// generated tests run with no live server. An optional `net` block wraps
-// the mock with simulated network conditions (latency, first-N failures,
-// connection errors, offline) — see make_netsim below.
 
 use std::cell::RefCell;
 use std::rc::Rc;
@@ -33,17 +28,6 @@ impl TestFeature {
     }
 }
 
-// THE MOCK HAS TO AGREE WITH THE MODEL.
-//
-// A point carrying `transform.res: `body.item`` describes an API that answers
-// {"item": {...}}, and the response transform unwraps that key on the way
-// back. Handing back the bare payload means the transform unwraps a property
-// that is not there, and the caller gets nothing — a mock that only ever
-// simulates APIs whose responses happen to be unwrapped.
-//
-// univec's list op declares `body.data`, so every list returned zero items
-// while the fixture plainly held two. Mirrors the go/ts/lua/php mocks, which
-// already wrap; rust, c and zig were the three that did not.
 fn envelope(ctx: &Rc<Context>, data: Value) -> Value {
     if data.is_noval() || data.is_null() {
         return data;
@@ -206,9 +190,6 @@ fn test_fetch(
         }
 
         "update" => {
-            // Match the existing entity by id only (or its alias). Reqdata
-            // also contains the new field values, which would otherwise
-            // cause select to filter out the entity we want to update.
             let reqdata = ctx.reqdata.borrow().clone();
             let update_match = Value::empty_map();
             if let Value::Map(_) = reqdata {

package/project/.sdk/tm/rust/feature/timeout.rs

@@ -1,10 +1,3 @@
-// Per-request timeout (mirrors go feature/timeout_feature.go, adapted to a
-// synchronous single-threaded transport like the ruby port). The active
-// transport is wrapped with a deadline of `ms` milliseconds (default
-// 30000; <= 0 disables). The transport is synchronous, so the elapsed
-// (injectable `now`) clock is checked around the inner call: when the call
-// took longer than the deadline its result is discarded and a `timeout`
-// error is returned instead.
 
 use std::cell::RefCell;
 use std::rc::Rc;

package/project/.sdk/tm/rust/feature/validate.rs

@@ -1,23 +1,3 @@
-// Payload validation against the model's own field types. The rust port of
-// tm/ts/src/feature/validate/ValidateFeature.ts.
-//
-// The specs are NOT written here and not written in the model either: every
-// entity field already carries a canonical type sentinel (`$STRING`,
-// `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
-// vocabulary `vs::validate` speaks. The generator maps them once
-// (helpers/canonSpec) and emits `core::schema::entityspec()`, so a field
-// whose type changes in the API spec changes what this feature enforces with
-// no edit anywhere.
-//
-// WHAT IS CHECKED
-//   outbound (pre_spec)  the payload the caller asked to send, against
-//                        spec.op[opname] - the operation's request shape.
-//   inbound  (pre_done)  each record the operation returned, against
-//                        spec.data - the entity's own field types.
-//
-// WHAT IS NOT. The model carries no array element types, no nested object
-// schemas, no enums, formats or bounds, so this checks the shape the model
-// knows and nothing more.
 
 use std::rc::Rc;
 
@@ -59,15 +39,6 @@ impl ValidateFeature {
         }
     }
 
-    // The payload an operation is about to send.
-    //
-    // TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries
-    // the caller's argument in `reqdata` over the entity's `data`; a match op
-    // (load/list/remove) carries it in `reqmatch` over `mtch`. That is what
-    // the entity operations pass to Context::new and what make_point reads -
-    // so reading `reqdata` for every op would check a `load({id})` against
-    // the entity's STALE stored match and reject it for the id the caller had
-    // just supplied.
     fn payload(&self, ctx: &Rc<Context>, opname: &str) -> Value {
         let body = "create" == opname || "update" == opname || "patch" == opname;
 
@@ -91,12 +62,6 @@ impl ValidateFeature {
             }
         }
 
-        // `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the
-        // record. make_point reads it off this same argument and the request
-        // transformer drops it before the body is built, so a spec built from
-        // the API's own fields will never name it - and under `strict` every
-        // custom-action call would be rejected for the one key that made it
-        // reachable.
         if let Some(m) = out.as_map() {
             m.borrow_mut().shift_remove("$action");
         }
@@ -108,10 +73,6 @@ impl ValidateFeature {
         getp(&self.spec, &entname(ctx))
     }
 
-    // One validate call. Errors are COLLECTED, never thrown: `vs::validate`
-    // returns the first failure as a StructError unless given an `errs` list,
-    // and a caller fixing a payload wants every problem with it, not the
-    // first one.
     fn check(
         &self,
         ctx: &Rc<Context>,
@@ -143,12 +104,6 @@ impl ValidateFeature {
         }
 
         if !errs.is_empty() {
-            // A callback receiving every failure, whatever `mode` does with
-            // it. `Value::Func` is the struct-level function type and takes
-            // an injection, not a report, so the report is handed to an
-            // `on_invalid` closure held in feature state instead - set with
-            // `ValidateFeature::on_invalid` after construction, the same way
-            // the retry port takes its injectable sleep.
             let report = Value::empty_map();
             setp(&report, "entity", Value::str(entname(ctx)));
             setp(&report, "op", Value::str(opname(ctx)));
@@ -212,9 +167,6 @@ impl Feature for ValidateFeature {
         };
     }
 
-    // Outbound. make_spec short-circuits on an `out["spec"]` that is already
-    // set, and surfaces an `OutVal::Err` there as the operation's error - the
-    // same seam rbac uses one stage earlier through `out["point"]`.
     fn pre_spec(&mut self, ctx: &Rc<Context>) {
         if !self.active || !self.request {
             return;
@@ -244,16 +196,6 @@ impl Feature for ValidateFeature {
         ctx.out_set("spec", OutVal::Err(err));
     }
 
-    // Inbound. pre_done rather than pre_result: the records are extracted
-    // from the response body by make_result, which runs between the two, so
-    // at pre_result there is nothing to check but the envelope.
-    //
-    // HOOK ORDER MATTERS HERE, and the default order is not the one you want.
-    // pre_done hooks fire in feature ADD order, which defaults to `test`
-    // first and then names sorted - and `validate` sorts last, after audit,
-    // cost, debug, metrics and telemetry. Those observers therefore record
-    // the operation as a success before this hook has looked at it.
-    // Activating features as an ORDERED LIST fixes it.
     fn pre_done(&mut self, ctx: &Rc<Context>) {
         if !self.active || !self.response {
             return;
@@ -274,14 +216,6 @@ impl Feature for ValidateFeature {
             return;
         }
 
-        // A list op returns many records and a load returns one; both are
-        // checked against the same record spec, because they are the same
-        // entity.
-        //
-        // NO UNWRAP STEP, unlike the ts and go ports: make_result already
-        // stores a list entry as the entity's own `data()` Value rather than
-        // as the entity object (utility/make_result.rs), so what arrives here
-        // is records either way.
         let records: Vec<Value> = match resdata.as_list() {
             Some(l) => l.borrow().clone(),
             None => vec![resdata.clone()],
@@ -313,16 +247,6 @@ impl Feature for ValidateFeature {
             ),
         );
 
-        // BOTH, and `ok` is the load-bearing half: `done` returns `resdata`
-        // whenever `result.ok` is true and never looks at `err`, so setting
-        // the error alone would hand the caller the very records that failed
-        // the spec.
-        //
-        // AND THE DATA GOES. The load/update paths copy `result.resdata` into
-        // the entity's own state on any non-null value, BEFORE `done` raises
-        // - so rejecting the operation while leaving the records in place
-        // would leave the caller holding an entity populated from a payload
-        // this feature had just declared invalid.
         let mut r = result.borrow_mut();
         r.ok = false;
         r.err = Some(err);
@@ -345,8 +269,6 @@ fn entname(ctx: &Rc<Context>) -> String {
     ctx.op.borrow().entity.clone()
 }
 
-// A collected failure as a message. `stringify` would quote a plain string,
-// which is what every struct failure already is.
 fn errmsg(v: &Value) -> String {
     match v {
         Value::Str(s) => s.clone(),
@@ -366,9 +288,6 @@ fn report_invalid(options: &Value, report: &Value) {
     }
 }
 
-// The spec tree with every `$OPEN` marker removed, so an undeclared key is an
-// error rather than a pass. Rebuilt rather than mutated: `Value` is Rc-backed
-// and `core::schema::entityspec()` hands out the process-wide constant.
 fn close(node: &Value) -> Value {
     match node {
         Value::List(l) => Value::list(l.borrow().iter().map(close).collect()),

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -1,13 +1,3 @@
-// Shared SDK test SUPPORT: the helpers the generated entity/direct tests and
-// the corpus call sites share — env loading, the sdk-test-control.json skip
-// and pacing machinery, corpus access, entity-data conversion, ctx
-// construction from a JSON test entry, and the fh* feature-test harness
-// (mirrors tm/go/test/testsupport_test.go plus the fh* harness from
-// tm/go/test/feature_test.go). Each test binary includes it with
-// `mod common;`.
-//
-// The corpus ENGINE half of this file was retired by the vendor-tag rollout:
-// see the note where it used to be, and tests/omni_resolver/mod.rs.
 
 #![allow(dead_code)]
 
@@ -40,7 +30,6 @@ pub fn read_json(path: &PathBuf) -> Value {
     json_parse(&txt).unwrap_or_else(|e| panic!("failed to parse {:?}: {}", path, e))
 }
 
-/// The shared test spec ../.sdk/test/test.json.
 pub fn load_test_spec() -> Value {
     let mut p = manifest_dir();
     p.push("..");
@@ -100,22 +89,6 @@ pub fn is_control_skipped(kind: &str, name: &str, mode: &str) -> (bool, String)
     (false, String::new())
 }
 
-/// Extra SDK options every LIVE client is constructed with, read from
-/// sdk-test-control.json `test.client.options`.
-///
-/// The generated live client knows two things: the base URL (from the spec)
-/// and the credential (from the environment). Everything else about how a
-/// particular API wants to be talked to - which features to switch on, and
-/// with what settings - is a property of THAT API, known to the project and
-/// to nothing in the toolchain.
-///
-/// Merged UNDER the generated fields, so the suite's own base/apikey/server
-/// values win: this ADDS to the live client, it does not redirect it.
-///
-/// Reserved fields are stripped HERE rather than at each merge site: the
-/// generated map only names a field when the model calls for one, so a
-/// "base" in this block would face no competing value and would silently
-/// redirect the whole suite - credential included - to another host.
 pub const LIVE_RESERVED: [&str; 6] =
     ["base", "prefix", "suffix", "server", "apikey", "secret"];
 
@@ -240,14 +213,6 @@ pub fn json_normalize(v: &Value) -> Value {
     }
 }
 
-// The corpus ENGINE that used to live here — `runset` / `runset_named`
-// (the entry loop) and `match_deep` / `match_string` (the match engine) —
-// is superseded by the vendored @voxgig/omni runner, driven through the
-// adapter in tests/omni_resolver/mod.rs (vendor-tag rollout, Decision 4).
-// This file keeps its SUPPORT half under its own name — env loading, the
-// sdk-test-control skip/pacing machinery, corpus and entity-data access,
-// ctx construction from a JSON entry, and the fh feature harness — so the
-// emitted call sites did not move.
 
 // ---- ctx construction from JSON test entries --------------------------------------
 

package/project/.sdk/tm/rust/tests/custom_utility_test.rs

@@ -1,5 +1,3 @@
-// Custom utility overrides (mirrors tm/go/test/custom_utility_test.go):
-// caller-supplied callables in options.utility land on utility.custom.
 
 use RUSTCRATE::core::helpers::{call_vfn, getp, jo, vfn};
 use RUSTCRATE::{test_sdk, Value};