@voxgig/sdkgen 4.21.0 → 4.23.0

package/project/.sdk/tm/rust/feature/validate.rs

@@ -1,23 +1,3 @@
-// Payload validation against the model's own field types. The rust port of
-// tm/ts/src/feature/validate/ValidateFeature.ts.
-//
-// The specs are NOT written here and not written in the model either: every
-// entity field already carries a canonical type sentinel (`$STRING`,
-// `$INTEGER`, the `$ONE` union for an OpenAPI multi-type), which is the same
-// vocabulary `vs::validate` speaks. The generator maps them once
-// (helpers/canonSpec) and emits `core::schema::entityspec()`, so a field
-// whose type changes in the API spec changes what this feature enforces with
-// no edit anywhere.
-//
-// WHAT IS CHECKED
-//   outbound (pre_spec)  the payload the caller asked to send, against
-//                        spec.op[opname] - the operation's request shape.
-//   inbound  (pre_done)  each record the operation returned, against
-//                        spec.data - the entity's own field types.
-//
-// WHAT IS NOT. The model carries no array element types, no nested object
-// schemas, no enums, formats or bounds, so this checks the shape the model
-// knows and nothing more.
 
 use std::rc::Rc;
 
@@ -59,15 +39,6 @@ impl ValidateFeature {
         }
     }
 
-    // The payload an operation is about to send.
-    //
-    // TWO SLOTS, AND THE OP PICKS. A body op (create/update/patch) carries
-    // the caller's argument in `reqdata` over the entity's `data`; a match op
-    // (load/list/remove) carries it in `reqmatch` over `mtch`. That is what
-    // the entity operations pass to Context::new and what make_point reads -
-    // so reading `reqdata` for every op would check a `load({id})` against
-    // the entity's STALE stored match and reject it for the id the caller had
-    // just supplied.
     fn payload(&self, ctx: &Rc<Context>, opname: &str) -> Value {
         let body = "create" == opname || "update" == opname || "patch" == opname;
 
@@ -91,12 +62,6 @@ impl ValidateFeature {
             }
         }
 
-        // `$action` SELECTS A CUSTOM ENDPOINT; it is not a field of the
-        // record. make_point reads it off this same argument and the request
-        // transformer drops it before the body is built, so a spec built from
-        // the API's own fields will never name it - and under `strict` every
-        // custom-action call would be rejected for the one key that made it
-        // reachable.
         if let Some(m) = out.as_map() {
             m.borrow_mut().shift_remove("$action");
         }
@@ -108,10 +73,6 @@ impl ValidateFeature {
         getp(&self.spec, &entname(ctx))
     }
 
-    // One validate call. Errors are COLLECTED, never thrown: `vs::validate`
-    // returns the first failure as a StructError unless given an `errs` list,
-    // and a caller fixing a payload wants every problem with it, not the
-    // first one.
     fn check(
         &self,
         ctx: &Rc<Context>,
@@ -143,12 +104,6 @@ impl ValidateFeature {
         }
 
         if !errs.is_empty() {
-            // A callback receiving every failure, whatever `mode` does with
-            // it. `Value::Func` is the struct-level function type and takes
-            // an injection, not a report, so the report is handed to an
-            // `on_invalid` closure held in feature state instead - set with
-            // `ValidateFeature::on_invalid` after construction, the same way
-            // the retry port takes its injectable sleep.
             let report = Value::empty_map();
             setp(&report, "entity", Value::str(entname(ctx)));
             setp(&report, "op", Value::str(opname(ctx)));
@@ -212,9 +167,6 @@ impl Feature for ValidateFeature {
         };
     }
 
-    // Outbound. make_spec short-circuits on an `out["spec"]` that is already
-    // set, and surfaces an `OutVal::Err` there as the operation's error - the
-    // same seam rbac uses one stage earlier through `out["point"]`.
     fn pre_spec(&mut self, ctx: &Rc<Context>) {
         if !self.active || !self.request {
             return;
@@ -244,16 +196,6 @@ impl Feature for ValidateFeature {
         ctx.out_set("spec", OutVal::Err(err));
     }
 
-    // Inbound. pre_done rather than pre_result: the records are extracted
-    // from the response body by make_result, which runs between the two, so
-    // at pre_result there is nothing to check but the envelope.
-    //
-    // HOOK ORDER MATTERS HERE, and the default order is not the one you want.
-    // pre_done hooks fire in feature ADD order, which defaults to `test`
-    // first and then names sorted - and `validate` sorts last, after audit,
-    // cost, debug, metrics and telemetry. Those observers therefore record
-    // the operation as a success before this hook has looked at it.
-    // Activating features as an ORDERED LIST fixes it.
     fn pre_done(&mut self, ctx: &Rc<Context>) {
         if !self.active || !self.response {
             return;
@@ -274,14 +216,6 @@ impl Feature for ValidateFeature {
             return;
         }
 
-        // A list op returns many records and a load returns one; both are
-        // checked against the same record spec, because they are the same
-        // entity.
-        //
-        // NO UNWRAP STEP, unlike the ts and go ports: make_result already
-        // stores a list entry as the entity's own `data()` Value rather than
-        // as the entity object (utility/make_result.rs), so what arrives here
-        // is records either way.
         let records: Vec<Value> = match resdata.as_list() {
             Some(l) => l.borrow().clone(),
             None => vec![resdata.clone()],
@@ -313,16 +247,6 @@ impl Feature for ValidateFeature {
             ),
         );
 
-        // BOTH, and `ok` is the load-bearing half: `done` returns `resdata`
-        // whenever `result.ok` is true and never looks at `err`, so setting
-        // the error alone would hand the caller the very records that failed
-        // the spec.
-        //
-        // AND THE DATA GOES. The load/update paths copy `result.resdata` into
-        // the entity's own state on any non-null value, BEFORE `done` raises
-        // - so rejecting the operation while leaving the records in place
-        // would leave the caller holding an entity populated from a payload
-        // this feature had just declared invalid.
         let mut r = result.borrow_mut();
         r.ok = false;
         r.err = Some(err);
@@ -345,8 +269,6 @@ fn entname(ctx: &Rc<Context>) -> String {
     ctx.op.borrow().entity.clone()
 }
 
-// A collected failure as a message. `stringify` would quote a plain string,
-// which is what every struct failure already is.
 fn errmsg(v: &Value) -> String {
     match v {
         Value::Str(s) => s.clone(),
@@ -366,9 +288,6 @@ fn report_invalid(options: &Value, report: &Value) {
     }
 }
 
-// The spec tree with every `$OPEN` marker removed, so an undeclared key is an
-// error rather than a pass. Rebuilt rather than mutated: `Value` is Rc-backed
-// and `core::schema::entityspec()` hands out the process-wide constant.
 fn close(node: &Value) -> Value {
     match node {
         Value::List(l) => Value::list(l.borrow().iter().map(close).collect()),

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -1,13 +1,3 @@
-// Shared SDK test SUPPORT: the helpers the generated entity/direct tests and
-// the corpus call sites share — env loading, the sdk-test-control.json skip
-// and pacing machinery, corpus access, entity-data conversion, ctx
-// construction from a JSON test entry, and the fh* feature-test harness
-// (mirrors tm/go/test/testsupport_test.go plus the fh* harness from
-// tm/go/test/feature_test.go). Each test binary includes it with
-// `mod common;`.
-//
-// The corpus ENGINE half of this file was retired by the vendor-tag rollout:
-// see the note where it used to be, and tests/omni_resolver/mod.rs.
 
 #![allow(dead_code)]
 
@@ -40,7 +30,6 @@ pub fn read_json(path: &PathBuf) -> Value {
     json_parse(&txt).unwrap_or_else(|e| panic!("failed to parse {:?}: {}", path, e))
 }
 
-/// The shared test spec ../.sdk/test/test.json.
 pub fn load_test_spec() -> Value {
     let mut p = manifest_dir();
     p.push("..");
@@ -100,22 +89,6 @@ pub fn is_control_skipped(kind: &str, name: &str, mode: &str) -> (bool, String)
     (false, String::new())
 }
 
-/// Extra SDK options every LIVE client is constructed with, read from
-/// sdk-test-control.json `test.client.options`.
-///
-/// The generated live client knows two things: the base URL (from the spec)
-/// and the credential (from the environment). Everything else about how a
-/// particular API wants to be talked to - which features to switch on, and
-/// with what settings - is a property of THAT API, known to the project and
-/// to nothing in the toolchain.
-///
-/// Merged UNDER the generated fields, so the suite's own base/apikey/server
-/// values win: this ADDS to the live client, it does not redirect it.
-///
-/// Reserved fields are stripped HERE rather than at each merge site: the
-/// generated map only names a field when the model calls for one, so a
-/// "base" in this block would face no competing value and would silently
-/// redirect the whole suite - credential included - to another host.
 pub const LIVE_RESERVED: [&str; 6] =
     ["base", "prefix", "suffix", "server", "apikey", "secret"];
 
@@ -240,14 +213,6 @@ pub fn json_normalize(v: &Value) -> Value {
     }
 }
 
-// The corpus ENGINE that used to live here — `runset` / `runset_named`
-// (the entry loop) and `match_deep` / `match_string` (the match engine) —
-// is superseded by the vendored @voxgig/omni runner, driven through the
-// adapter in tests/omni_resolver/mod.rs (vendor-tag rollout, Decision 4).
-// This file keeps its SUPPORT half under its own name — env loading, the
-// sdk-test-control skip/pacing machinery, corpus and entity-data access,
-// ctx construction from a JSON entry, and the fh feature harness — so the
-// emitted call sites did not move.
 
 // ---- ctx construction from JSON test entries --------------------------------------
 

package/project/.sdk/tm/rust/tests/custom_utility_test.rs

@@ -1,5 +1,3 @@
-// Custom utility overrides (mirrors tm/go/test/custom_utility_test.go):
-// caller-supplied callables in options.utility land on utility.custom.
 
 use RUSTCRATE::core::helpers::{call_vfn, getp, jo, vfn};
 use RUSTCRATE::{test_sdk, Value};

package/project/.sdk/tm/rust/tests/feature/secrets/main.rs

@@ -1,28 +1,3 @@
-// Behavioural tests for the secrets feature (vendored @voxgig/sekreto).
-//
-// The contract under test: the `apikey` OPTION keeps its exact old meaning
-// and always wins, because the feature places it FIRST in the provider
-// chain (a `memory` store named `options`) - explicit-beats-lookup falls
-// out of sekreto's first-hit rule rather than from special-case logic. With
-// the feature inactive nothing changes at all. With it active and the
-// option unset, the chain supplies the credential instead.
-//
-// EVERY CLIENT HERE IS LIVE, and the thing counted is `system.fetch` - the
-// real transport the whole fetcher chain ends at. That is deliberate, and
-// it is the mistake this file exists to avoid: under `test_sdk` the test
-// feature REPLACES the transport with its own in-memory mock, so a counter
-// hung off `system.fetch` is never reached, and "no request was sent" would
-// hold for a healthy SDK carrying no secrets feature at all. An assertion
-// that cannot fail pins no rule. So each fail-closed case proves its own
-// counter FIRST, with the same construction and a WORKING provider: one
-// request must reach `system.fetch` carrying the resolved credential. Only
-// then does a zero from the broken provider mean REFUSED rather than
-// UNWIRED. And the refusal is matched on the PROVIDER'S OWN message, so an
-// unrelated failure cannot stand in for fail-closed.
-//
-// This file lives in the `feature/` container on purpose: `target add`
-// trims it, along with the feature source and the vendored library, for a
-// project whose model does not select `secrets`.
 
 use std::cell::RefCell;
 use std::rc::Rc;
@@ -38,14 +13,6 @@ const BASE: &str = "http://secrets.test/api";
 
 // ---- the counted transport ---------------------------------------------
 
-/// One recorded request, SNAPSHOT at the moment it was handed to the
-/// transport.
-///
-/// A snapshot, not the fetchdef itself, and that is load-bearing: the
-/// fetchdef's `headers` map is an Rc the retry path rewrites IN PLACE, so
-/// a recorder that kept the live map would report every earlier call as
-/// carrying the LAST token - and "the retry carried a new credential"
-/// would pass whether or not it did.
 #[derive(Clone)]
 struct Call {
     url: String,
@@ -205,12 +172,6 @@ fn authof(fetchdef: &Value) -> Option<String> {
     }
 }
 
-// The Authorization header carries the SPEC's credential prefix, which a
-// TEMPLATE cannot know: an OpenAPI `http`/`bearer` scheme gives
-// `Bearer <token>`, an apiKey scheme the raw token. So assert on the
-// CREDENTIAL and let the prefix be whatever this SDK's API declares -
-// pinning the whole header value passes only for a prefix-less API, and
-// this file ships to every project that selects the feature.
 fn credential_is(header: Option<String>, token: &str) {
     let got = header.unwrap_or_default();
     assert!(
@@ -227,14 +188,6 @@ fn call_auth(calls: &[Call], i: usize) -> Option<String> {
 
 // ---- clients ------------------------------------------------------------
 
-// `allow.op` is named explicitly: a project that narrows the default set
-// would otherwise turn the raw-path cases into a false RED (the control leg
-// refused before it reached the transport), and the rule under test lives
-// at the transport, downstream of the allow gate either way.
-//
-// `base` is named explicitly too: a LIVE client whose model has a templated
-// base URL panics on a missing server variable at construction, and this
-// file ships to every project.
 fn sdk(wire: &Wire, secrets: Vec<(&str, Value)>) -> Rc<ProjectNameSDK> {
     let fopts = jo(vec![("active", Value::Bool(true))]);
     for (k, v) in secrets {
@@ -303,15 +256,6 @@ fn secrets_call(client: &Rc<ProjectNameSDK>, args: Vec<Value>) -> Value {
 
 // ---- the ENTITY path ----------------------------------------------------
 
-/// One request through the REAL entity-request utility, on the client's own
-/// utility - the one the feature wrapped.
-///
-/// `direct()` and `graphql()` are the raw paths and are exercised as
-/// themselves below; this is the OTHER half, and it cannot be reached by
-/// naming an entity because this file is a TEMPLATE and no project's entity
-/// names are known here. `make_request` is the utility every generated
-/// entity op ends at, so driving it directly exercises the same seam with
-/// the same wiring.
 fn entity_request(client: &Rc<ProjectNameSDK>, path: &str) -> Option<String> {
     let rootctx = client.get_root_ctx();
     let utility = rootctx.util();
@@ -514,12 +458,6 @@ fn auth_null_suppresses_the_credential_chain_or_no_chain() {
         wire.trace()
     );
 
-    // The suppression survives option validation rather than being replaced
-    // by the optspec's default auth map.
-    //
-    // Read from the RAW map: `getp` applies the Group A rule and answers
-    // the alt for a stored null, so it cannot tell an absent auth from a
-    // suppressed one - and only the latter is a suppression.
     let opts = client.options_map();
     let suppressed = match &opts {
         Value::Map(m) => matches!(m.borrow().get("auth"), Some(Value::Null)),
@@ -787,13 +725,6 @@ fn an_unknown_provider_kind_refuses_rather_than_sending() {
     assert_eq!(control.sent(), 1, "the control request never reached the wire");
 }
 
-// A MALFORMED entry is the same rule again, and the one a typed port can
-// get wrong silently: `providers` is a Value list, so an entry that is
-// neither a callable nor a spec map (a bare "hashicorp" where a spec was
-// meant) matches no arm. Dropping it leaves the chain quietly SHORTER than
-// the options say - a fail-OPEN that sends the request without the
-// credential the project configured. It must refuse instead, carrying
-// sekreto's own wording, on every wire path.
 const MALFORMED_MSG: &str = "sekreto: not a provider or a provider spec";
 
 #[test]
@@ -879,15 +810,6 @@ fn the_selected_plugin_kinds_have_distinct_names() {
     );
 }
 
-// A SELECTED plugin kind is really in the vocabulary.
-//
-// Construction is where an unknown kind is refused, so a chain that names
-// the kind and still reaches the wire IS the check. The memory store comes
-// FIRST so sekreto's first-hit rule answers from it and the vault is never
-// contacted - the kind has to be declarable, not reachable.
-//
-// Conditional on the kind being selected, because this file ships to
-// projects that take the feature without the `vault` plugin group.
 #[test]
 fn a_selected_plugin_kind_is_in_the_sdk_vocabulary() {
     let defs = RUSTCRATE::feature::secrets::plugins::definitions();
@@ -990,13 +912,10 @@ fn cache_false_asks_the_chain_on_every_request() {
 }
 
 // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this feature
-// used to override from the layer above.
 //
 // DEFAULT caching here, which is the whole point: `cache: true` is about
 // holding a HIT (the test below pins that half), and keeping the settled
 // resolution after a miss meant the chain was never asked again for the life
-// of the client. A secret provisioned after startup (a mounted file, a vault
-// policy granted a minute late) was invisible forever.
 #[test]
 fn cache_true_re_asks_after_a_miss() {
     let wire = Wire::new();
@@ -1153,12 +1072,6 @@ fn sekreto_is_live_for_arbitrary_secrets_and_redaction() {
     );
 }
 
-// ---- ACCESS-TOKEN EXCHANGE ----------------------------------------------
-//
-// What the chain resolves is a REFRESH token, which is POSTed to a token
-// endpoint for a short-lived ACCESS token; the access token is what the
-// Authorization header carries; and when the API answers 401 the client
-// buys another and tries the same request again, once.
 
 const REFRESH: &str = "REFRESH01";
 
@@ -1252,7 +1165,6 @@ fn an_expiry_buys_another_token_and_retries_the_same_request() {
     assert_eq!(wire.token().len(), 2, "expected a second token purchase");
     assert_eq!(wire.api().len(), 2, "expected the request to be retried");
     credential_is(call_auth(&wire.api(), 0), "ACCESS01");
-    // The retry must carry the NEW token, not the spent one.
     credential_is(call_auth(&wire.api(), 1), "ACCESS02");
     assert_eq!(
         getp(&res, "ok"),
@@ -1489,7 +1401,6 @@ fn exchange_auth_null_suppresses_and_is_never_retried() {
     );
 
     // AND NO PURCHASE. resolve() runs before with_refresh's suppression
-    // check, so the refresh token used to go to the token endpoint in a
     // request body even here. Stopping the retry does not unsend it, and
     // only the token endpoint can see this.
     assert_eq!(
@@ -1501,12 +1412,6 @@ fn exchange_auth_null_suppresses_and_is_never_retried() {
     );
 }
 
-// The exchange with NO system.fetch: the ordinary case, where make_options
-// leaves the seam unset and the purchase takes its own raw HTTP path. There
-// is no token endpoint to talk to here, so what this pins is that the
-// fallback EXISTS and reports - before this, `buy` with no custom transport
-// simply had nothing to call - and that a failed purchase refuses the
-// operation rather than sending it unauthenticated.
 #[test]
 fn the_exchange_has_a_raw_transport_when_no_system_fetch_is_given() {
     // Port 1 is reserved and never listening, so the connection is refused

package/project/.sdk/tm/rust/tests/feature_test.rs

@@ -1,10 +1,3 @@
-// Behavioural tests for the enterprise features shipped with this SDK
-// (mirrors tm/go/test/feature_test.go). Feature behaviour is unit-tested
-// by driving each feature through a faithful miniature of the real
-// operation pipeline against a configurable mock transport — the same hook
-// order and short-circuit rules as the generated entity op code, but with
-// no live server and no API-specific fixtures. Each block runs only when
-// its feature is present in this SDK (see common::fh_present).
 
 mod common;
 
@@ -1828,15 +1821,6 @@ fn feature_proxy_inactive_does_not_wrap() {
 
 // --- station --------------------------------------------------------------------
 
-// The station adapter (installed by @voxgig/sdkgen-station) with NO open
-// station must be an inert no-op that emits nothing and fails nothing
-// (station design 3.1). Constructed through the generated make_feature
-// factory - never a compile-time module reference - so this file stays
-// compilable both with and without the station feature installed: absent,
-// the factory answers with the inert BaseFeature and fh_present skips the
-// assertions. Bound behaviour (registration, injection, wire events) is
-// exercised by the station library's own suite and the consumer-side
-// station validation, not here.
 #[test]
 fn feature_station_inert_without_open_station() {
     if !fh_present(&["station"]) {

package/project/.sdk/tm/rust/tests/netsim_test.rs

@@ -1,9 +1,3 @@
-// Network-behaviour simulation over the offline mock transport (mirrors
-// tm/go/test/netsim_test.go). The `test` feature accepts an optional `net`
-// config so unit tests can exercise slow, failing and offline conditions
-// without a live server. These checks drive the transport through
-// direct(), which needs no entity, so they run for every generated SDK
-// regardless of its API shape.
 
 use RUSTCRATE::core::helpers::{getp, jo, now_ms};
 use RUSTCRATE::{test_sdk, Value};