@voxgig/sdkgen 4.21.0 → 4.23.0

package/project/.sdk/src/cmp/ocaml/Config_ocaml.ts

@@ -28,46 +28,10 @@ import {
 } from './utility_ocaml'
 
 
-// THE SECRETS BUILD MODEL, derived from the model ONCE and read by both the
-// Makefile fragment (Main_ocaml emits feature/secrets/feature.mk from it)
-// and the generated config (the definitions list and the bundled transport
-// below), so the two cannot disagree about which kinds are compiled.
-//
-// Upstream sekreto retired its self-registration registry for voxgig/plugin
-// definitions: a provider kind the caller did not pass in `~plugins` is
-// unknown to that Sekreto. So the model's choice of plugin groups IS the
-// SDK's provider vocabulary, and the generated code names each active
-// group's constructor (`def: ocaml:` in model/feature/secrets.aon -
-// `Hashicorp.plugin`, the `unit -> Defs.definition` each vendored kind
-// module defines) and nothing else. A symbol named here whose module the
-// plugin trim removed is an "Unbound module" at compile time - a loud
-// failure, which is the right kind.
-//
-// MODULE ORDER IS THE DEPENDENCY ORDER, written down (upstream's own
-// Makefile is the source): the voxgig/plugin host, the sekreto core, the
-// shared helpers, the kinds. The helpers are ungrouped in the model (see the
-// ocaml note at the head of its `plugin` block) and are listed here only
-// when a selected kind needs them - the transport chain (crypto, sigv4, tls,
-// http, httpjson) when an active group declares `needs.fetch`, the
-// child-process helper (runcmd) when any kind is on - because OCaml
-// compiles exactly what it is handed: an [env, memory] chain compiles the
-// two cores alone, and `secretspec` alone compiles runcmd.ml and no TLS.
-//
-// Null when the model does not activate `secrets` for this target. Read
-// with `only_active: false` on the plugin map (pluginExcludesFor's
-// subtlety: the feature object a component is handed has already been
-// filtered, so a feature whose groups are all off would look like one
-// with no plugin machinery).
 type SecretsBuild = {
   groups: string[],
   tlsGroups: string[],
   tls: boolean,
-  // C stubs an active group brings with it, keyed by the group that
-  // brought them, in the order the groups sort. tls_stubs.c is NOT here:
-  // it belongs to the tls HELPER, which no group owns - these are stubs a
-  // KIND owns, declared in its own `path` list. The mini vault is the
-  // first, and the shape is general: a kind whose implementation needs C
-  // says so by listing a .c file, and the build compiles what it lists.
   stubs: string[],
   stubGroups: string[],
   plugin: string[],
@@ -167,28 +131,8 @@ const Config = cmp(async function Config(props: any) {
 
   const secrets = secretsBuild(model, target)
 
-  // The canonical config OBJECT and its JSON, from the shared helper. Both
-  // representations render from the same `def`, so they cannot describe
-  // different configs - and this target picks up `options.server` (the OpenAPI
-  // server-variable defaults), which the hand-rolled build here omitted.
-  // Passing target.name opts this target into the main slug/version/target
-  // identity fields (read by station's descriptor - see configDefinition).
   const { def: config } = configDefinition(model, target.name)
 
-  // `in` and `name` TRAVEL WITH THE PREFIX NOW. apidef resolved both from the
-  // spec's securityScheme all along and generation dropped them, so an
-  // apiKey-in-query API got an `authorization` header it does not read.
-  //
-  // Added to the shared `def` here rather than in configDefinition, so this
-  // change moves ocaml and nothing else - and both representations below
-  // render from the SAME object, which is why the JSON is stringified AFTER
-  // this rather than taken from configDefinition: the data rung and the
-  // literal rung must not be able to describe different configs.
-  //
-  // ONLY WHEN THEY DIFFER from the header/Authorization default, so every
-  // header-based SDK's sdk_config.ml is byte-identical to what it generated
-  // before. `options.auth` is absent entirely when auth is inactive
-  // (configDefinition's own gate), and there is nothing to qualify then.
   const authIn = resolveAuthIn(model)
   const authName = resolveAuthName(model)
   const authOpts = (config as any).options?.auth
@@ -206,16 +150,6 @@ const Config = cmp(async function Config(props: any) {
 
   File({ name: 'sdk_config.' + target.ext }, () => {
 
-    // ABOVE THE THRESHOLD: emit the model as DATA.
-    //
-    // The literal is one nested expression the compiler type-checks as a
-    // single item; a string is one token, and `Sdk_json.json_read` builds the
-    // same value tree at runtime. That reader used to live only in the corpus
-    // test harness - this rung is why it now lives in the runtime, and the
-    // harness uses it from there rather than keeping a second copy.
-    //
-    // No number-type question: `json_read` yields `Num (float)` and
-    // `formatOcamlValue` emits `(Num (5.))`, so both branches agree.
     if (asData) {
       Content(`(* Generated API configuration (mirrors go core/config.go).
  *
@@ -254,15 +188,6 @@ let make_config () : value =
 `)
     }
 
-    // THE PLUGIN DEFINITIONS the model selected, per feature (the ocaml
-    // peer of Config_go's featurePlugins map). EMITTED UNCONDITIONALLY, so
-    // every generated config answers the same question - but typed as
-    // `Defs.definition list` only when the secrets feature is active: the
-    // `Defs` module is part of the vendored voxgig/plugin tree, which is
-    // compiled only then, so an inactive model gets the polymorphic empty
-    // list instead (`'a list`, which unifies with anything a caller
-    // expects). DELIBERATE DIVERGENCE from the c/lua accessors, whose
-    // untyped return (void**, a table) needs no such split.
     if (null == secrets) {
       Content(`
 (* The plugin definitions the model selected, per feature: none - no
@@ -282,16 +207,6 @@ let feature_plugins (name : string) : Defs.definition list =
   | _ -> []
 `)
 
-      // THE EXCHANGE TRANSPORT OF LAST RESORT (go's rawExchangeFetch): the
-      // vendored sekreto HTTP client, which the active plugin groups
-      // compile and link anyway (feature/secrets/feature.mk adds the OpenSSL binding on
-      // exactly this condition). It exists so an exchange works with
-      // ordinary SDK options - requiring a custom transport for the COMMON
-      // case would refuse every live token purchase before a request was
-      // made. Same result shape the system.fetch seam promises ({status,
-      // statusText, headers, body, json()}). With no such group the feature
-      // is built without it and a purchase with no options.system.fetch
-      // fails with a named error (see secrets_feature.ml).
       if (secrets.tls) {
         Content(`
 (* The token-exchange transport of last resort: the vendored sekreto HTTP
@@ -322,12 +237,6 @@ let make_feature (name : string) : feature =
   match name with
 `)
 
-    // ONLY THE FEATURES THIS PORT ACTUALLY IMPLEMENTS. Emitting an arm for a
-    // name with no `<name>_feature` in tm/ocaml/sdk_features.ml is an
-    // "Unbound value" at COMPILE time — the whole SDK fails to build, not
-    // just the feature. That is how the missing `cost` was found, when an SDK
-    // first activated every feature; cost is implemented now, and this list
-    // is the guard against the next one.
     const OCAML_FEATURES = [
       'audit', 'cache', 'clienttrack', 'cost', 'debug', 'idempotency', 'log',
       'metrics', 'netsim', 'paging', 'proxy', 'ratelimit', 'rbac',
@@ -341,13 +250,6 @@ let make_feature (name : string) : feature =
       }
     })
 
-    // The secrets feature is the one ocaml feature that lives OUTSIDE
-    // sdk_features.ml (a container: feature/secrets_feature.ml plus the
-    // vendored trees), so its arm names its own module and hands it the
-    // definitions the model selected and, when a plugin group needing a
-    // transport is active, the bundled exchange transport. Emitted only
-    // when the feature is active: the module is not compiled otherwise
-    // (Main_ocaml's container gate, and the Makefile's feature/secrets/feature.mk).
     if (null != secrets) {
       Content(`  | "secrets" -> Secrets_feature.make ~plugins:(feature_plugins "secrets")${secrets.tls ? ' ~transport:secrets_transport' : ''} ()
 `)

package/project/.sdk/src/cmp/ocaml/EntityOperation_ocaml.ts

@@ -41,12 +41,6 @@ function entityOp(opname: string, present: boolean, entityname: string): string
     post = `            ()\n`
   }
 
-  // The op resolves to the ENTITY (see Sdk_types). `list` builds one entity
-  // per record here, since make_result works in `value` and cannot; `remove`
-  // marks the instance. With throwing disabled run_op returns the error
-  // payload, which an entity_obj return cannot carry, so that path resolves to
-  // the entity too and the caller reads ctrl.err - the mechanism no-throw mode
-  // documents anyway.
   const tail =
     'list' === opname
       ? `      let out = run_op ctx post_done in

package/project/.sdk/src/cmp/ocaml/Main_ocaml.ts

@@ -29,16 +29,6 @@ import { PrepareAuth } from './PrepareAuth_ocaml'
 import { entityModule, ocamlString } from './utility_ocaml'
 
 
-// Features whose source is a CONTAINER under the top-level feature/ dir,
-// beside the single template module (sdk_features.ml) every other ocaml
-// feature lives in. Today that is `secrets`: feature/secrets_feature.ml,
-// feature/secrets/ (the vendored @voxgig/sekreto port, the voxgig/plugin
-// host and the provider kinds - some forty modules of key-store,
-// request-signing and child-process code that an SDK which never asked for
-// secrets must not ship) and its shipped suite under test/feature/secrets/.
-// Anything named here is EXCLUDED from the verbatim copy unless the model
-// SELECTS the feature (see the Copy below). The lua and clojure targets gate
-// their containers the same way (Main_lua.ts, Main_clojure.ts).
 const CONTAINED = ['secrets']
 
 
@@ -52,16 +42,6 @@ const Main = cmp(async function Main(props: any) {
   // it has no source for. One rule, one place: helpers/applicability.
   const feature = targetFeatures(model, target)
 
-  // THE feature/<name>/ CONTAINER IS GATED HERE, at generate time - the
-  // top-level-container peer of the `srcFeatureExcludes` gate ts and js
-  // apply to src/feature/<name>/. `target add` keeps an unselected
-  // feature out of a project's tm/ in the first place (ocaml.aon has
-  // `feature: { trim: true }`); this covers a feature switched off after
-  // it was added, and the generator suite, which copies the whole scaffold
-  // tree. An inactive feature's vendored kind files go with it - every
-  // declared group's, not only the groups marked inactive, because
-  // pluginExcludes below walks only ACTIVE features (Main_c's
-  // inactivePluginExcludes, for the same reason one target over).
   const containerExcludes = CONTAINED
     .filter((name: string) => null == (feature as any)[name])
     .flatMap((name: string) => [
@@ -74,22 +54,6 @@ const Main = cmp(async function Main(props: any) {
 
   Gitignore({})
 
-  // Copy tm/ocaml verbatim with ProjectName replacement. The src/ subtree
-  // only stages per-feature custom-source dirs (srcfeature: false, so unused),
-  // excluded like the go/rust targets. Stray compiled artifacts and built
-  // test binaries are excluded defensively. test/vendor/omni (the vendored
-  // @voxgig/omni corpus engine) rides along verbatim - the replacements are
-  // ProjectName-shaped and the port names nothing project-specific, so it
-  // lands byte-identical to its recorded vendored.json digest.
-  //
-  // pluginExcludes: the generate-time plugin trim (an ACTIVE feature's
-  // INACTIVE plugin group's declared files stay out of the tree). The
-  // model's ocaml `path` entries are target-root-relative, which is this
-  // Copy's root - helpers/featureSource documents that getting the root
-  // wrong makes the trim a silent no-op. ocaml has `srcfeature: false`, so
-  // the per-feature Copy in cmp/Feature.ts - where pluginExcludesFor
-  // normally applies this trim - never runs for it, and this whole-tree
-  // Copy is the ONLY copy the target has (Main_go.ts precedent).
   Copy({
     from: 'tm/' + target.name,
     exclude: [/src\//, /\.(cmi|cmo|cmx|cma|cmxa|o|a)$/, /a\.out$/,
@@ -100,26 +64,6 @@ const Main = cmp(async function Main(props: any) {
     }
   })
 
-  // THE BUILD SEAM: feature/secrets/feature.mk, GENERATED only when the
-  // model activates `secrets` for this target. It is what only the model
-  // knows and only a Makefile can say in OCaml - the module list in
-  // DEPENDENCY ORDER (ocamlc compiles a module before anything that uses
-  // it and has no link-time reordering, so a wildcard over the vendored
-  // directories would not build), the -I paths, unix.cma for the dotenv
-  // and file built-ins, the gated suite, and, ONLY when an active plugin
-  // group declares `needs.fetch`, the OpenSSL binding: plugins/tls_stubs.c
-  // compiled and linked with `-custom -cclib -lssl -cclib -lcrypto`. The
-  // template Makefile includes `$(wildcard feature/*/feature.mk)` - it names
-  // no feature itself - and every variable a fragment sets is empty without
-  // one, so an SDK without secrets - or with the built-in
-  // chain alone, or with `secretspec` alone - runs no C compiler and links
-  // no OpenSSL. The shape lua's native.mk and c's kinds.c take.
-  //
-  // The vendored stub opens with the vendoring tool's three-line `(* *)`
-  // provenance header (every file under tm/ocaml is stamped in ocaml's
-  // comment syntax; the guard holds that), which a C compiler cannot
-  // read - so the rule feeds the compiler from line four, as lua's does.
-  // Compiler line numbers are therefore three lower than in the file.
   const build = secretsBuild(model, target)
   if (null != build) {
     Folder({ name: 'feature' }, () => {
@@ -154,13 +98,6 @@ FEATURE_SRC = $(SECRETS_PLUGIN) $(SECRETS_CORE) $(SECRETS_HELPERS) $(SECRETS_KIN
 FEATURE_TESTS = test/feature/secrets/t_secrets.ml
 `)
 
-          // EVERY C OBJECT THIS CHAIN NEEDS, from two different owners.
-          // tls_stubs.c belongs to the transport HELPER, which no group
-          // owns and which any kind reaching the network pulls in;
-          // minivault_stubs.c belongs to the KIND, and is listed in that
-          // group's own `path`. Both link against libcrypto and only the
-          // transport needs libssl, so the link line is assembled rather
-          // than written twice - an SDK with both gets each library once.
           const objs = [
             ...(build.tls ? ['feature/secrets/plugins/tls_stubs.o'] : []),
             ...build.stubs.map((one) => one.replace(/\.c$/, '.o')),
@@ -202,30 +139,16 @@ FEATURE_LINK =
     })
   }
 
-  // Generated API config + branded-error re-export.
   Schema({ target })
   Config({ target })
   SdkError({ target })
 
   // sdk_prepare_auth.ml is GENERATED, not templated: WHERE the credential
   // goes (header / query / cookie, and under what name) is a fact about the
-  // API, and tm/ can only hold one answer. ocaml had no prepare_auth
-  // template to replace - the body was a `let` inside the monolithic
-  // tm/ocaml/sdk_runtime.ml - so this is a real extraction: the module
-  // keeps the `prepare_auth_util` name by aliasing this one, and every
   // existing caller (the utility record, make_spec, the secrets feature's
   // re-run, the shipped suites) resolves unchanged. See PrepareAuth_ocaml.
-  //
-  // AT ROOT LEVEL, with no Folder open. The ocaml tree is flat at the
-  // target root and the Makefile's `RUNTIME` names `sdk_prepare_auth.ml`
-  // by that exact path, between sdk_helpers.ml (which it uses) and
-  // sdk_runtime.ml (which uses it) - ocamlc compiles in the order it is
-  // handed and has no link-time reordering. Emitting it inside a Folder
-  // would put it where neither `RUNTIME` nor `-I .` looks, and
-  // sdk_runtime.ml would fail with `Unbound module Sdk_prepare_auth`.
   PrepareAuth({ target })
 
-  // sdk_client.ml — the client constructors, direct/prepare, and the
   // per-entity accessors (twin of the go root package + rust core/sdk.rs).
   File({ name: 'sdk_client.' + target.ext }, () => {
 
@@ -285,7 +208,6 @@ let prepare (client : sdk_client) (fetchargs : value) : value =
     // rather than naming a generated accessor - the shipped feature suites
     // are templates and know no project's entity names - has no way to reach
     // one without this. The go peer is the untyped interface go-cli/go-mcp
-    // dispatch through. None for a name this SDK did not generate.
     const names = each(entity).map((e: ModelEntity) => e.name).sort()
     if (0 === names.length) {
       Content(`

package/project/.sdk/src/cmp/ocaml/Package_ocaml.ts

@@ -12,19 +12,6 @@ import { packageName } from './utility_ocaml'
 import { secretsBuild } from './Config_ocaml'
 
 
-// <name>.opam — opam package metadata (publish is declared pending in the
-// model; the build itself is stock ocamlc via the Makefile and needs no opam
-// packages). Twin of rust Cargo.toml, but the runtime is dependency-free so
-// there is no depends list beyond the OCaml compiler.
-//
-// The secrets feature's build model is NOT emitted from here, unlike
-// Package_rust's rustls dependency table: the Makefile reads the generated
-// feature/secrets/feature.mk (Main_ocaml), which lists the vendored modules
-// in dependency order and turns the OpenSSL binding on only when a plugin
-// group needing a transport is active. What this manifest CAN state is the
-// system dependency that binding introduces - `depexts`, opam's word for a
-// distribution package - and it states it on exactly the same condition,
-// read from the same helper, so the two cannot drift.
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const target = props.target

package/project/.sdk/src/cmp/ocaml/PrepareAuth_ocaml.ts

@@ -21,68 +21,20 @@ import {
 } from './utility_ocaml'
 
 
-// WHERE THE CREDENTIAL GOES IS A FACT ABOUT THE API, so it is generated
-// rather than templated. The ocaml peer of PrepareAuth_ts / PrepareAuth_py;
-// read PrepareAuth_ts first, it carries the full account of the defect.
-//
-// apidef has always resolved the scheme's `in` and `name` into
-// `main.kit.info.security` - joplin's says `in: "query", name: "token"` -
-// and generation dropped both, so the SDK sent a header the API does not
-// read and never sent the query parameter it does. Four repos in the cedar
-// fleet ship SDKs that cannot authenticate for this reason: joplin
-// (`token`), pipedrive (`api_token`), trello (`key`), lm-umbrella
-// (`apiKey`).
-//
-// OCAML IS THE ODD ONE OUT: it had no prepare_auth TEMPLATE to replace.
-// The body was one `let` inside tm/ocaml/sdk_runtime.ml, the 1200-line
-// module that holds every `*_util` and the registrar that binds them. So
-// the extraction is a real one, and the shape was chosen rather than
-// inherited - see EXTRACTION SHAPE below.
 const PrepareAuth = cmp(async function PrepareAuth(props: any) {
   const { target } = props
   const { model } = props.ctx$
 
   const where = resolveAuthIn(model)
 
-  // A HEADER NAME IS LOWER-CASED HERE; A QUERY OR COOKIE NAME IS NOT.
-  // apidef writes `name: "Authorization"`, the extracted body hardcoded
-  // `"authorization"`, and the whole ocaml runtime keys headers in lower
-  // case: make_spec writes "content-type", header_ci lower-cases before it
-  // looks up, the secrets feature rewrites `headers.authorization`, and the
-  // SHARED corpus asserts `ctx:spec:headers:authorization` - which
-  // test/primary_utility_test.ml drives through this very function. A
-  // struct map key is case-SENSITIVE, so emitting "Authorization" verbatim
-  // would put the credential under a key nothing in the SDK reads.
-  //
-  // A query parameter and a cookie name are case-sensitive ON THE WIRE:
-  // lm-umbrella's `apiKey` is not `apikey`, and lower-casing it would break
-  // exactly the APIs this change exists to fix. So they keep the spec's
-  // spelling, byte for byte.
   const resolved = resolveAuthName(model)
   const name = 'header' === where ? resolved.toLowerCase() : resolved
 
-  // Read so the resolution is visible at generation time, even though the
-  // emitted code takes the prefix from options at runtime (the secrets
-  // feature rewrites it there, and `auth.prefix` is a documented option).
   const prefix = resolveAuthPrefix(model)
 
   const basic = isHttpBasicAuth(model)
   const active = authSwitchedOn(model)
 
-  // FOLDER NESTING. Main_ocaml calls this with NO Folder open: its own
-  // Config, SdkError and `sdk_client.ml` all write straight to the target
-  // root, and the only Folder it opens (`feature/secrets` for feature.mk)
-  // is scoped to that one block and closed before this call. The ocaml tree
-  // is FLAT at the root - sdk_types.ml, sdk_helpers.ml, sdk_runtime.ml,
-  // sdk_features.ml, sdk_config.ml all sit there, and the Makefile names
-  // each by that exact path in `RUNTIME`.
-  //
-  // So this component opens NO folder. Opening one (`utility`, say, copying
-  // the c and lua ports) would write `<root>/utility/sdk_prepare_auth.ml`,
-  // which is NOT what `RUNTIME` lists and NOT where `-I .` looks: ocamlc
-  // would report `Unbound module Sdk_prepare_auth` while compiling
-  // sdk_runtime.ml, and `utility/` already holds the vendored struct port,
-  // which the Copy owns.
   File({ name: 'sdk_prepare_auth.' + target.ext }, () => {
     Content(render({
       project: model.const.Name, active, where, name, prefix, basic,
@@ -91,30 +43,6 @@ const PrepareAuth = cmp(async function PrepareAuth(props: any) {
 })
 
 
-// NOT `isAuthActive`, AND THE DIFFERENCE IS LOAD-BEARING (the py port found
-// this first; six of the eleven ports found it independently).
-//
-// `isAuthActive` is false whenever the SPEC declares no security scheme
-// (`main.kit.info.auth: false`). That is a statement about the DEFINITION,
-// not a ban on ever sending a credential: apidef writes it for every spec
-// with no securitySchemes block - GitHub's official OpenAPI included - and
-// those SDKs are still expected to honour an `apikey` the caller passes.
-// `optspec` always declares `apikey`, and make_options fills `options.auth`
-// from the optspec defaults, so the runtime `auth = Noval | Null` guard
-// never fired and every such SDK has ALWAYS sent the credential.
-//
-// Gating the body on `isAuthActive` therefore does not trim dead code, it
-// deletes working authentication - and takes the secrets feature with it,
-// since that resolves a secret into `options.apikey` and prepare_auth then
-// places nothing. generatedcompile's own fixture is one of these
-// (`main: kit: info: { ... auth: false }` in generateharness), and the
-// shipped tm/ocaml/test/feature/secrets/t_secrets.ml drives a LIVE client
-// on it.
-//
-// `main.kit.config.auth.active: false` is the project saying "this SDK
-// sends no credential, ever" - an explicit per-SDK switch nobody sets by
-// accident, and the only signal that can honestly be honoured before
-// runtime. So it is the only one used here.
 function authSwitchedOn(model: any): boolean {
   const auth = getModelPath(model, `main.${KIT}.config.auth`,
     { only_active: false, required: false })
@@ -132,42 +60,6 @@ type AuthSpec = {
 }
 
 
-// EXTRACTION SHAPE: ITS OWN COMPILATION UNIT, and the module keeps calling
-// it.
-//
-// The preferred shape, and it fits: `sdk_prepare_auth.ml` is module
-// `Sdk_prepare_auth`, compiled between sdk_helpers.ml and sdk_runtime.ml -
-// the Makefile's `RUNTIME` is an explicit ORDERED list (ocamlc compiles a
-// module before anything that uses it and has no link-time reordering), so
-// the position is stated there rather than discovered.
-//
-// THE BINDING IS PRESERVED EXACTLY. sdk_runtime.ml keeps
-//
-//   let prepare_auth_util = Sdk_prepare_auth.prepare_auth_util
-//
-// so every existing call site resolves at the same name it always did:
-//   - `u_prepare_auth = prepare_auth_util` in new_utility, and
-//     `u.u_prepare_auth <- prepare_auth_util` in register - the closure
-//     record that IS the ocaml registrar (sdk_types.ml declares the field);
-//   - `u.u_prepare_auth ctx` in make_spec_util (sdk_runtime.ml) and in the
-//     secrets feature's re-run of the pipeline (sdk_features.ml);
-//   - `prepare_auth_util c` in test/primary_utility_test.ml, which reaches
-//     it through `open Sdk_runtime` and drives the SHARED corpus section
-//     through it - the parity suite requires ocaml to execute `prepareAuth`
-//     (parity.test.ts FULL tier), so that name had to keep resolving;
-//   - `cl.cl_utility.u_prepare_auth ctx` in the four t_pipeline.ml cases.
-// Nothing in the tree was re-pointed at the new module, and nothing needed
-// to be.
-//
-// THE ONE THING THAT HAD TO MOVE. The body reads the client's options
-// through `client_options_map`, which was defined in sdk_runtime.ml - i.e.
-// AFTER this module in compile order, so it could not be called from here.
-// It is a one-line accessor over `sdk_client.cl_options` with no dependency
-// on anything else in that module, so it moved DOWN into sdk_helpers.ml,
-// where `cc`, `cu`, `getp` and every other shared accessor already live.
-// sdk_runtime.ml opens Sdk_helpers, so its own three call sites are
-// unchanged. The alternative - re-deriving the options map here - would
-// fork a definition that must not drift.
 function render(spec: AuthSpec): string {
   const head = `(* ${spec.project} SDK utility: prepare_auth.
  *
@@ -234,20 +126,6 @@ function placement(spec: AuthSpec): string {
 }
 
 
-// HEADER. Behaviourally what sdk_runtime.ml's `prepare_auth_util` did, line
-// for line and idiom for idiom: the same `auth_no_spec` error, the same
-// `__NOTFOUND__` sentinel read through `getprop ~alt`, the same
-// missing-credential handling (delete the header), the same empty-prefix
-// rule. Only the credential NAME moves with the model - and it resolves to
-// "authorization" for every header SDK, so those regenerate unchanged.
-//
-// The HTTP Basic block is the one addition, and it is emitted ONLY when the
-// model says the scheme IS basic (`isHttpBasicAuth`). An ordinary
-// bearer/apiKey SDK carries no dead code and no behaviour change. ocaml's
-// extracted body never had this branch: a basic scheme resolved
-// `auth.prefix` to "Basic" and sent `Basic <apikey>` - a single token where
-// the scheme demands `base64(user:pass)`, which cannot authenticate. The
-// other eleven ports added the same branch for the same reason.
 function renderHeader(spec: AuthSpec, head: string): string {
   return head + `
 let option_apikey = "apikey"
@@ -318,12 +196,6 @@ let prepare_auth_util (ctx : ctx) : (spec option * sdk_error option) =
 }
 
 
-// COOKIE. A cookie IS a header, so the credential rides the header bag -
-// but the \`cookie\` header is SHARED with whatever cookies the caller set
-// through options.headers, so our pair is SPLICED in and out rather than
-// the header assigned over. Splicing also makes this idempotent: the
-// secrets feature re-runs the pipeline on a retried request, and an
-// assignment would leave the credential in the header twice.
 function renderCookie(spec: AuthSpec, head: string): string {
   return head + `
 let cookie_header = "cookie"
@@ -382,17 +254,6 @@ let prepare_auth_util (ctx : ctx) : (spec option * sdk_error option) =
 }
 
 
-// True HTTP Basic Auth: TWO credentials, base64-joined. Emitted only for a
-// HEADER placement, because the scheme IS a header -
-// \`Authorization: Basic base64(user:pass)\` cannot be expressed as a query
-// parameter or a cookie pair, so renderQuery and renderCookie never carry
-// it.
-//
-// It is the FIRST of three `unit` branches - basic, no-credential,
-// single-token - and the shared \`(Some spec, None)\` after them is the one
-// result. Written that way rather than as an early return because OCaml
-// sequences with \`;\`: a branch returning the tuple could not sit beside
-// two returning unit.
 const BASIC = `       if (match getpath_s options "auth.basic" with Bool b -> b | _ -> false) then begin
          (* True HTTP Basic Auth needs TWO credentials, base64-joined - a
           * single token in the header (the branch below) can never
@@ -417,12 +278,6 @@ const BASIC = `       if (match getpath_s options "auth.basic" with Bool b -> b
 `
 
 
-// OCaml's stdlib has no base64 (4.14 ships none, and the SDK is
-// dependency-free: stock ocamlc, no opam, no dune). The vendored sekreto
-// port has one, but it lives inside the OPTIONAL secrets feature - an SDK
-// that never asked for secrets does not compile it - so an HTTP Basic SDK
-// carries its own. Emitted only in that branch, so nothing else pays for
-// it. The lua port carries the same encoder for the same reason.
 const BASE64 = `
 let b64_alphabet =
   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

package/project/.sdk/src/cmp/ocaml/ReadmeEntity_ocaml.ts

@@ -68,7 +68,7 @@ const ReadmeEntity = cmp(function ReadmeEntity(props: any) {
 
   publishedEntities.map((entity: any) => {
     const opnames = Object.keys(entity.op || {})
-    const fields = entity.fields || []
+    const fields = Object.values(entity.fields || {})
     // Model-driven id key: null when this entity has no id-like field.
     const idF = entityIdField(entity)
     const fn = ocamlVarName(entity.name)
@@ -114,8 +114,8 @@ const ReadmeEntity = cmp(function ReadmeEntity(props: any) {
 `)
 
       each(fields, (field: any) => {
-        const desc = field.short || ''
-        Content(`| \`${field.name}\` | \`${ocamlType(field.type)}\` | ${desc} |
+        const desc = field.sh || ''
+        Content(`| \`${field.n}\` | \`${ocamlType(field.t)}\` | ${desc} |
 `)
       })
 

package/project/.sdk/src/cmp/ocaml/ReadmeExamplesTest_ocaml.ts

@@ -2,23 +2,6 @@
 import { cmp, Content, File } from '@voxgig/sdkgen'
 
 
-// Emits test/readme_examples_test.ml — a structural gate over every ```ocaml
-// fenced block in the three docs that ship ocaml examples:
-//   - the root README.md (top-level, multi-language quick start)
-//   - the per-language ocaml/README.md
-//   - the per-language ocaml/REFERENCE.md
-//
-// DESIGN NOTE (mirrors ReadmeExamplesTest_rust): the py gate shells out to a
-// python subprocess to COMPILE + EXECUTE every block. A faithful ocaml port
-// would shell out to `ocamlc` against each extracted snippet — a large,
-// environment-sensitive harness that cannot be authored safely without a build
-// to validate it (and the generated SDK ships a dependency-free stock-ocamlc
-// build, no doc-test tooling). This gate instead validates that every
-// documented ocaml block is PRESENT and STRUCTURALLY well-formed (balanced
-// delimiters, non-empty). It is a real, always-passing test that keeps the docs
-// honest about block structure; upgrading it to a true compile gate (a temp
-// project that `ocamlc`s each block against the generated SDK) is a follow-up.
-// Missing docs are tolerated (a run may generate a subset of phases).
 const ReadmeExamplesTest = cmp(function ReadmeExamplesTest(props: any) {
   const { target, ctx$: { model } } = props
 

package/project/.sdk/src/cmp/ocaml/ReadmeModel_ocaml.ts

@@ -123,13 +123,13 @@ On error, \`ok\` is \`Bool false\` and \`err\` carries the error value.
 
 `)
   each(entityList, (ent: any) => {
-    const fields = ent.fields || []
+    const fields = Object.values(ent.fields || {})
     const opnames = Object.keys(ent.op || {})
     const ops = ent.op || {}
     const points = each(ops).map((op: any) =>
       op.points ? each(op.points) : []
     ).flat()
-    const path = points.length > 0 ? (points[0] as any).orig || '' : ''
+    const path = points.length > 0 ? (points[0] as any).o || '' : ''
 
     Content(`#### ${ent.Name}
 
@@ -137,7 +137,7 @@ On error, \`ok\` is \`Bool false\` and \`err\` carries the error value.
 | --- | --- |
 `)
     each(fields, (field: any) => {
-      Content(`| \`${field.name}\` | ${field.short || ''} |
+      Content(`| \`${field.n}\` | ${field.sh || ''} |
 `)
     })
 

package/project/.sdk/src/cmp/ocaml/ReadmeRef_ocaml.ts

@@ -1,5 +1,5 @@
 
-import { cmp, each, Content, canonKey, canonScalarKey, File, isAuthActive, entityIdField, opRequestShape } from '@voxgig/sdkgen'
+import { cmp, each, Content, canonKey, canonScalarKey, File, isAuthActive, entityIdField, opRequestShape , targetFeatures } from '@voxgig/sdkgen'
 import { ReadmeRefFeatures } from '@voxgig/sdkgen'
 
 import {
@@ -69,7 +69,7 @@ const ReadmeRef = cmp(function ReadmeRef(props: any) {
   const { model } = props.ctx$
 
   const entity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  const feature = targetFeatures(model, target)
 
   const publishedEntities = each(entity).filter((e: any) => e.active !== false)
 
@@ -177,7 +177,7 @@ on error.
     // Entity reference sections
     publishedEntities.map((ent: any) => {
       const opnames = Object.keys(ent.op || {})
-      const fields = ent.fields || []
+      const fields = Object.values(ent.fields || {})
       const idF = entityIdField(ent)
       const fn = ocamlVarName(ent.name)
 
@@ -209,9 +209,9 @@ let ${fn} = Sdk_client.${fn} client Noval
 | --- | --- | --- | --- |
 `)
         each(fields, (field: any) => {
-          const req = field.req ? 'Yes' : 'No'
-          const desc = field.short || ''
-          Content(`| \`${field.name}\` | \`${ocamlType(field.type)}\` | ${req} | ${desc} |
+          const req = field.r ? 'Yes' : 'No'
+          const desc = field.sh || ''
+          Content(`| \`${field.n}\` | \`${ocamlType(field.t)}\` | ${req} | ${desc} |
 `)
         })
 
@@ -236,7 +236,7 @@ let ${fn} = Sdk_client.${fn} client Noval
               if (fop.active === false) return '-'
               return 'Yes'
             })
-            Content(`| \`${field.name}\` | ${cols.join(' | ')} |
+            Content(`| \`${field.n}\` | ${cols.join(' | ')} |
 `)
           })
 
@@ -392,9 +392,6 @@ let client = Sdk_client.make (jo [
 \`\`\`
 
 `)
-      // The shared feature reference: options, defaults, usage and the
-      // considerations. Model facts, identical in every target, so they are
-      // written once in cmp/ReadmeRefFeatures.ts rather than here.
       ReadmeRefFeatures({ target })
     }