@voxgig/sdkgen 4.21.0 → 4.23.0

package/project/.sdk/tm/ts/test/feature/secrets/Secrets.test.ts

@@ -1,16 +1,3 @@
-// Behavioural tests for the secrets feature (vendored @voxgig/sekreto).
-//
-// The contract under test: the `apikey` OPTION keeps its exact old meaning
-// and always wins, because SecretsFeature places it FIRST in the provider
-// chain (a `memory` store named `options`) — explicit-beats-lookup falls
-// out of sekreto's first-hit rule rather than from special-case logic.
-// With the feature inactive nothing changes at all. With it active and the
-// option unset, the chain (env, dotenv, a custom provider, a vault)
-// supplies the credential instead.
-//
-// This file lives in the `feature/` container on purpose: `target add`
-// trims it, along with the feature source and the vendored library, for a
-// project whose model does not select `secrets`.
 
 import { test, describe, beforeEach } from 'node:test'
 import assert from 'node:assert'
@@ -32,12 +19,6 @@ async function prepared(sdkopts: any): Promise<any> {
 }
 
 
-// The Authorization header carries the SPEC's credential prefix, which a
-// TEMPLATE cannot know: an OpenAPI `http`/`bearer` scheme gives
-// `Bearer <token>`, an apiKey scheme the raw token. So assert on the
-// CREDENTIAL and let the prefix be whatever this SDK's API declares —
-// pinning the whole header value passes only for a prefix-less API, and
-// this file ships to every project that selects the feature.
 function credentialIs(header: any, token: string) {
   const got = String(null == header ? '' : header)
   assert.ok(got === token || got.endsWith(' ' + token),
@@ -93,12 +74,6 @@ describe('secrets', () => {
   })
 
 
-  // The three ways an apikey can be "not given", pinned together because
-  // they are easy to conflate and only one of them is a suppression.
-  //
-  // makeOptions normalises an omitted apikey to '' before features
-  // initialise, so by init time omitted and explicit-empty are
-  // indistinguishable — both defer to the chain, deliberately.
 
   test('active: an OMITTED apikey defers to the chain', async () => {
     process.env[ENVPREFIX + 'APIKEY'] = 'ENVKEY01'
@@ -115,21 +90,6 @@ describe('secrets', () => {
   })
 
 
-  // `auth: null` — the documented way to disable auth outright, which
-  // prepareAuth honours before it ever reads the apikey.
-  //
-  // This needs an explicit guard because struct 0.3.2 nearly removed it in
-  // silence. Under 0.0.10, getprop returned a stored null as null, so
-  // validate saw `auth: null` as a non-map and REJECTED it for any SDK
-  // whose optspec supplies an `auth` default. Under 0.3.2 getprop treats a
-  // stored null as "no value", so the default fires instead and the
-  // suppression became "use default auth" — transmitting a credential the
-  // caller explicitly asked not to send. makeOptions now captures
-  // suppliedness BEFORE validate and restores the null after it.
-  //
-  // No corpus entry could catch this: corpus nulls travel as the
-  // '__NULL__' string, so real-JSON-null semantics are invisible to every
-  // port's shared fixtures.
   test('active: auth null suppresses the credential, chain or no chain',
     async () => {
       process.env[ENVPREFIX + 'APIKEY'] = 'ENVKEY01'
@@ -177,13 +137,6 @@ describe('secrets', () => {
   })
 
 
-  // sekreto's miss-vs-error invariant: a MISS falls through to the next
-  // provider, an ERROR does not. A broken vault must never degrade into an
-  // unauthenticated request.
-  //
-  // On the DIRECT path the error is RETURNED, not thrown: _rawRequest
-  // awaits prepare() outside its try, and direct()/graphql() are documented
-  // to return a value or an Error and never reject.
   test('active: a provider ERROR is returned by prepare, not thrown',
     async () => {
       const sdk = (SDK as any).test({}, {
@@ -260,15 +213,6 @@ describe('secrets', () => {
   })
 
 
-  // A MISS IS NOT A CACHEABLE ANSWER — sekreto's own rule, which this
-  // feature used to override from the layer above.
-  //
-  // Default caching here, deliberately: `cache: true` is about holding a
-  // HIT, and holding the settled promise after a miss meant the chain was
-  // never asked again for the life of the client. A secret provisioned
-  // after startup (a mounted file, a vault policy granted a minute late)
-  // was invisible forever, and the only workaround was giving up hit
-  // caching entirely.
   test('active: a MISS is re-asked, so a late secret is picked up',
     async () => {
       let calls = 0
@@ -355,14 +299,6 @@ describe('secrets', () => {
   })
 
 
-  // The bridge that makes the whole design work: resolution is async, the
-  // auth header is built synchronously, and entity ops await
-  // featureHook('PreSpec') before makeSpec — so that is where the lookup
-  // happens and still lands in time.
-  //
-  // The entity is discovered from the SDK's own config rather than named,
-  // because this file is a TEMPLATE: it ships to every project, and no
-  // project's entity names are known here.
   test('active: entity ops resolve via the PreSpec hook', async () => {
     process.env[ENVPREFIX + 'APIKEY'] = 'ENVKEY02'
 
@@ -377,18 +313,6 @@ describe('secrets', () => {
     // Before any op, nothing has been resolved.
     assert.equal(sdk.options().apikey, '')
 
-    // AN OP THAT EXISTS, not `list` on whichever entity comes first.
-    //
-    // A generated TS entity carries only the ops its model DECLARES, so
-    // `list` is absent from an entity declaring `create` alone — and
-    // calling it throws before the PreSpec hook can run, failing the
-    // assertion below for a reason that has nothing to do with secrets.
-    // univec-sdk hit exactly that: its first entity declares `create`
-    // only, so this test failed on every run while PreSpec worked
-    // perfectly. Any real op exercises the hook; `list` is not special.
-    //
-    // This file is a TEMPLATE, so no project's op names are known here
-    // either. Discover the first callable one rather than assuming.
     let ran = false
     for (const one of names) {
       const acc = one.charAt(0).toUpperCase() + one.slice(1)
@@ -424,17 +348,6 @@ describe('secrets', () => {
 })
 
 
-// ACCESS-TOKEN EXCHANGE.
-//
-// The shape these tests pin: what the chain resolves is a REFRESH token,
-// which is POSTed to a token endpoint for a short-lived ACCESS token; the
-// access token is what the Authorization header carries; and when the API
-// answers 401 the client buys another and tries the same request again,
-// once.
-//
-// A LIVE client throughout, with `system.fetch` stubbed. Test mode is
-// deliberately excluded here — it buys nothing (see SecretsFeature._buy),
-// which is the subject of its own test at the end.
 describe('secrets exchange', () => {
 
   const BASE = 'http://exchange.test/api'
@@ -587,7 +500,6 @@ describe('secrets exchange', () => {
     assert.equal(stub.api().length, 2, 'expected the request to be retried')
 
     authIs(stub.api()[0], 'ACCESS01')
-    // The retry must carry the NEW token, not the spent one.
     authIs(stub.api()[1], 'ACCESS02')
 
     assert.equal(res.ok, true, 'the caller sees the successful retry')
@@ -749,10 +661,6 @@ describe('secrets exchange', () => {
   test('auth: null suppresses the credential, refusal or not', async () => {
     process.env[ENVPREFIX + 'REFRESH_TOKEN'] = REFRESH
 
-    // `auth: null` is the documented way to send no credential at all.
-    // A refusal of a deliberately unauthenticated request is not an
-    // expired token: buying one and retrying would transmit exactly the
-    // credential the caller suppressed.
     const stub = stubfetch({ apiStatus: [401] })
     const sdk = new (SDK as any)({
       base: BASE,
@@ -774,10 +682,6 @@ describe('secrets exchange', () => {
     assert.equal(stub.api()[0].auth, undefined,
       'no credential may be sent when auth is suppressed')
 
-    // AND NO PURCHASE. This is the half the API-call assertions cannot see:
-    // resolve() runs before _withRefresh's suppression check, so the
-    // refresh token used to go to the token endpoint in a request body
-    // even here. Stopping the retry does not unsend it.
     assert.equal(stub.token().length, 0,
       'auth: null suppressed the credential but the refresh token was ' +
       'still POSTed to the exchange endpoint')
@@ -787,16 +691,6 @@ describe('secrets exchange', () => {
   test('a token another request already bought is spent, not re-bought', async () => {
     process.env[ENVPREFIX + 'REFRESH_TOKEN'] = REFRESH
 
-    // STAGGERED 401s: the case the shared in-flight purchase does NOT
-    // cover. Two requests go out on the same token; the first is refused,
-    // buys a new one and clears the shared promise; only then is the
-    // second refused. Buying again there is a wasted exchange, and on a
-    // provider that invalidates the previous credential on issuance it
-    // breaks the first request's own retry.
-    //
-    // Driven through the transport wrapper directly, because the race is
-    // in WHEN the refusal arrives relative to another request's refresh,
-    // and that is not something two ordinary calls can be made to stage.
     const stub = stubfetch()
     const sdk = exchangeSdk(stub)
 

package/project/.sdk/tm/ts/test/live-contract.ts

@@ -1,7 +1,5 @@
 import { LiveBlocked } from './live-runner'
 
-// Deliberately conservative: unsupported constraints block preparation instead
-// of labelling an invented value as live-valid. Errors never include values.
 export function validateContract(schema: any, value: any, direction = 'request', depth = 0): void {
   const bad = () => { throw new Error('Operation contract mismatch') }
   if (depth > 40 || schema === false) return bad()

package/project/.sdk/tm/ts/test/live-entity.ts

@@ -5,26 +5,26 @@ import { isControlSkipped, liveDelayMs } from './utility'
 
 // The offline flow keeps its deterministic fixture assertions. Live flows
 // resolve real prerequisites per operation and collect failures until done.
-async function runLiveEntity(setup: any, entity: any, flow: any, accessor: string) {
+async function runLiveEntity(setup: any, entity: any, flow: any, accessor: string, facts: any = {}) {
   const { client, transport } = setup
-  const steps: any[] = flow.step || []
+  const steps: any[] = (flow.step || []).filter((step: any) => false !== step.a)
   const created = new Map<string, any>()
   const listed: any[] = []
   const marks = new Map<string, { name: string, value: any }>()
   const idField = entity.id?.field || 'id'
   const copy = (value: any) => JSON.parse(JSON.stringify(value ?? {}))
-  const hasCreate = steps.some(step => step.op === 'create')
+  const hasCreate = steps.some(step => step.o === 'create')
   const report = await runLiveSteps(steps.map((step, index) => {
-    const ref = step.input?.ref || entity.name + '_ref01'
-    const op = step.op
+    const ref = step.i?.ref || entity.name + '_ref01'
+    const op = step.o
     const excluded = isControlSkipped('entityOp', entity.name + '.' + op, 'live')
     return {
       id: entity.name + '.' + op + '.' + index,
-      cleanup: op === 'remove' || (step.valid || []).some((v: any) => v.apply === 'ItemNotExists'),
+      cleanup: op === 'remove' || (step.v || []).some((v: any) => v.apply === 'ItemNotExists'),
       excluded: excluded.skip ? excluded.reason || 'Excluded by test control' : undefined,
       run: async (context: any) => {
         transport.enter(context)
-        const points = entity.op?.[op]?.points || []
+        const points = (entity.op?.[op]?.points || []).filter((point: any) => false !== point.a)
         if (!points.length) throw new LiveBlocked('No modelled operation point')
         const record = created.get(ref)
         // A failed create must not turn a later update/remove into a write
@@ -41,7 +41,7 @@ async function runLiveEntity(setup: any, entity: any, flow: any, accessor: strin
 
         let input: any = op === 'create'
           ? copy(setup.data.new?.[entity.name]?.[ref]) : {}
-        for (const [name, binding] of Object.entries({ ...step.match, ...step.data })) {
+        for (const [name, binding] of Object.entries({ ...step.m, ...step.d })) {
           const value = setup.idmap[binding as string] ?? setup.idmap[name]
           if (undefined !== value) input[name] = value
         }
@@ -57,34 +57,34 @@ async function runLiveEntity(setup: any, entity: any, flow: any, accessor: strin
         let selected: any
         const missing = new Set<string>()
         for (const point of points) {
-          if (point.select?.$action !== input.$action) continue
+          if (point.q?.$action !== input.$action) continue
           const candidate = { ...input }
           let viable = true
-          const params = point.args?.params || []
-          const query = (point.args?.query || []).filter((arg: any) => arg.reqd)
+          const params = point.g?.params || []
+          const query = (point.g?.query || []).filter((arg: any) => arg.r)
           for (const arg of [...params, ...query]) {
-            if (undefined !== candidate[arg.name] && null !== candidate[arg.name]) continue
-            const key = arg.name === 'id' ? entity.name + '01' : arg.name.replace(/_id$/, '') + '01'
-            const value = setup.idmap[key] ?? setup.idmap[arg.name] ?? loaded?.[arg.name] ?? arg.example
-            if (undefined !== value && null !== value) candidate[arg.name] = value
-            else if (arg.reqd !== false) { viable = false; missing.add(arg.name) }
+            if (undefined !== candidate[arg.n] && null !== candidate[arg.n]) continue
+            const key = arg.n === 'id' ? entity.name + '01' : arg.n.replace(/_id$/, '') + '01'
+            const value = setup.idmap[key] ?? setup.idmap[arg.n] ?? loaded?.[arg.n] ?? arg.ex
+            if (undefined !== value && null !== value) candidate[arg.n] = value
+            else if (arg.r !== false) { viable = false; missing.add(arg.n) }
           }
           if (viable) { resolved = candidate; selected = point; break }
         }
         if (!resolved) throw new LiveBlocked('No usable route; missing arguments: ' + [...missing].join(', '))
         input = resolved
-        if (op === 'create' && selected.contract) {
-          const facts = JSON.parse(selected.contract.json)
-          const request = requestContract(facts)
-          if (request.schema) input = { ...synthesizeInput(request.schema, facts.live?.input ?? request.example) }
-          else if (facts.protocol === 'http') input = {}
-          for (const arg of selected.args?.params || []) if (resolved[arg.name] !== undefined) input[arg.name] = resolved[arg.name]
+        if (op === 'create' && facts[selected.m + ' ' + selected.o]) {
+          const selectedFacts = facts[selected.m + ' ' + selected.o]
+          const request = requestContract(selectedFacts)
+          if (request.schema) input = { ...synthesizeInput(request.schema, selected.li?.input ?? request.example) }
+          else if (selectedFacts.protocol === 'http') input = {}
+          for (const arg of selected.g?.params || []) if (resolved[arg.n] !== undefined) input[arg.n] = resolved[arg.n]
         }
         let intendedMark: { name: string, value: any } | undefined
         if (op === 'update') {
-          for (const spec of step.spec || []) {
-            if (spec.apply === 'TextFieldMark' && step.input?.textfield) {
-              const mark = { name: step.input.textfield, value: spec.def.mark + '_' + setup.now }
+          for (const spec of step.s || []) {
+            if (spec.apply === 'TextFieldMark' && step.i?.textfield) {
+              const mark = { name: step.i.textfield, value: spec.def.mark + '_' + setup.now }
               input[mark.name] = mark.value
               intendedMark = mark
             }
@@ -103,7 +103,7 @@ async function runLiveEntity(setup: any, entity: any, flow: any, accessor: strin
           })
           listed.splice(0, listed.length, ...data)
           context.publish(data)
-          for (const validation of step.valid || []) {
+          for (const validation of step.v || []) {
             const previous = created.get(validation.def?.ref)
             const id = previous?.[idField] ?? previous?.id
             if (undefined === id) continue

package/project/.sdk/tm/ts/test/live-scenarios.ts

@@ -52,9 +52,9 @@ export async function runLiveScenarios(SDK: any, plan: any[], envPrefix: string,
         const explicit = hint.input === undefined ? request.example : resolveRecipe(hint.input, ctx.values)
         let input = request.schema ? synthesizeInput(request.schema, explicit) : explicit ?? {}
         for (const kind of ['params', 'query', 'header', 'cookie']) for (const arg of point.args?.[kind] || []) {
-          if (arg.reqd && input[arg.name] === undefined) {
-            if (arg.example === undefined) throw new LiveBlocked('Missing required argument: ' + arg.name)
-            input[arg.name] = arg.example
+          if (arg.r && input[arg.n] === undefined) {
+            if (arg.ex === undefined) throw new LiveBlocked('Missing required argument: ' + arg.n)
+            input[arg.n] = arg.ex
           }
         }
         const role = hint.auth || (point.facts.security?.length === 0 || point.facts.securitySource === 'unspecified' ? 'public' : 'account')

package/project/.sdk/tm/ts/test/omni.ts

@@ -1,27 +1,3 @@
-// The corpus test runner: vendored @voxgig/omni driven through its NATIVE
-// API (`makeRunner(specref, provider)`), presented to the corpus tests in
-// the struct-runner shape they already use (`R.spec`, `R.runset`,
-// `R.runsetflags`, `R.client`). No compat shim is vendored: the adapter
-// below IS the whole bridge, per language, per the vendor-tag rollout
-// (docs/design/vendor-tag-rollout.md, Decision 4).
-//
-// Two local decisions, both required:
-//
-// 1. SPEC PATH. omni's own spec resolution expects the caller to hand it a
-//    usable path — its docs say a port must resolve the path itself. This
-//    module compiles to dist-test/omni.js, the same depth as the old
-//    dist-test/runner.js, so the existing TEST_JSON_FILE constant keeps
-//    working verbatim: a relative path is absolutized against __dirname.
-//
-// 2. PROVIDER DELEGATION. Corpus-driven contexts get `ctx.client` set to
-//    the runner's provider (omni overwrites it on any ctx/args map entry).
-//    A five-hook provider object HIDES the live SDK from the generated
-//    utilities that reach through it — prepareHeaders via client.options(),
-//    fetcher via client._mode, the feature helpers via client._rootctx and
-//    even ASSIGNING client._features. So the provider here is built by
-//    PROTOTYPE DELEGATION over the live SDK instance: every SDK member
-//    resolves, while the omni hooks sit on top. (Upstream omni#56 tracks
-//    giving the stock provider the same shape.)
 
 import { isAbsolute, join } from 'node:path'
 
@@ -37,8 +13,6 @@ import {
 import type { Json, Provider, Subject } from './vendor/omni/index'
 
 
-// The runner API the corpus tests consume — struct's runner shape, name
-// for name, served over native omni.
 export type StructSubject = (...args: any[]) => any
 export type StructRunSet = (testspec: any, testsubject?: StructSubject) => Promise<void>
 export type StructRunSetFlags = (
@@ -67,11 +41,8 @@ export type StructProvider = Provider & {
 }
 
 
-// The omni hooks for an SDK subject — what the retired compat shim called
-// `structprovider`, inlined here because this resolver is the one consumer.
 function sdkhooks(sdk: any) {
   return {
-    // A subject is resolved from the utility, or from utility.struct.
     subject: (name: string): Subject | undefined => {
       const utility = sdk.utility()
       return utility[name] || (utility.struct && utility.struct[name])
@@ -81,7 +52,6 @@ function sdkhooks(sdk: any) {
     // same delegating shape, not a plain hook object.
     client: async (options: Json) => sdkprovider(await sdk.tester(options)),
 
-    // The SDK supplies its own context wrapper.
     contextify: (val: Json): Json => {
       const utility = sdk.utility()
       const hook =
@@ -95,7 +65,6 @@ function sdkhooks(sdk: any) {
       return ctx
     },
 
-    // Client options may reference the runner store.
     inject: (options: Json, store: Json): Json => {
       const structutils = sdk.utility().struct
       if (structutils && 'function' === typeof structutils.inject) {
@@ -144,7 +113,6 @@ async function makeRunner(testfile: string | Json, client: any): Promise<StructR
 }
 
 
-// struct's flag-modifier name, served from native omni.
 const nullModifier = nullmodifier
 
 

package/project/.sdk/tm/ts/test/pipeline.test.ts

@@ -1,10 +1,4 @@
 
-// Direct unit tests for the operation-pipeline utilities. The generated
-// entity tests exercise the happy path; these drive the error and edge
-// branches (missing spec/response/result, 4xx handling, transport
-// failures, feature ordering, auth header shaping) that a normal
-// success-path op never reaches. All utilities are reached through
-// `stdutil`, so this suite is API-agnostic.
 
 import { test, describe } from 'node:test'
 import { strictEqual, ok, deepStrictEqual } from 'node:assert'
@@ -325,43 +319,66 @@ describe('pipeline:feature order', () => {
 
 describe('pipeline:prepareAuth', () => {
 
-  // Fake client so the exact options.auth / apikey shape is controlled.
-  function authCtx(options: any, headers: any) {
-    return base({ client: { options: () => options }, spec: headers == null ? null : { headers } })
+  function authCtx(options: any, spec: any) {
+    return base({ client: { options: () => options }, spec })
+  }
+
+  function bags(): any {
+    return { headers: {} as any, query: {} as any }
+  }
+
+  // Run prepareAuth with both containers present and see which one the
+  // generated utility writes to, and under what name. Null means this SDK
+  // places no credential at all — a public API — which is a legitimate
+  // shape, and the tests below assert exactly that instead.
+  const CRED = (() => {
+    const ctx = authCtx({ apikey: 'K', auth: { prefix: 'Bearer' } }, bags())
+    ;(stdutil as any).prepareAuth(ctx)
+    for (const where of ['headers', 'query'] as const) {
+      const name = Object.keys(ctx.spec[where] as any)[0]
+      if (null != name) return { where, name, value: ctx.spec[where][name] }
+    }
+    return null
+  })()
+
+  function placed(options: any, seed?: any) {
+    const spec: any = bags()
+    if (null != CRED && null != seed) spec[CRED.where][CRED.name] = seed
+    const ctx = authCtx(options, spec)
+    ;(stdutil as any).prepareAuth(ctx)
+    return null == CRED ? undefined : ctx.spec[CRED.where][CRED.name]
   }
 
   test('guards a missing spec', () => {
     strictEqual((stdutil as any).prepareAuth(authCtx({ auth: { prefix: '' }, apikey: 'K' }, null)).code, 'auth_no_spec')
   })
 
-  test('an apikey with a prefix is space-joined', () => {
-    const ctx = authCtx({ apikey: 'K', auth: { prefix: 'Bearer' } }, {})
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, 'Bearer K')
+  test('the apikey is placed where this API puts it', () => {
+    if (null == CRED) {
+      // A public API places nothing, and that is the whole assertion.
+      strictEqual(placed({ apikey: 'K', auth: { prefix: 'Bearer' } }), undefined)
+      return
+    }
+    ok('headers' === CRED.where || 'query' === CRED.where)
+    // A header credential is prefix-joined; a query credential is the raw
+    // key, because a query parameter has nowhere to put a scheme name.
+    strictEqual(CRED.value, 'headers' === CRED.where ? 'Bearer K' : 'K')
   })
 
   test('a raw apikey (empty prefix) goes in as-is', () => {
-    const ctx = authCtx({ apikey: 'K', auth: { prefix: '' } }, {})
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, 'K')
+    strictEqual(placed({ apikey: 'K', auth: { prefix: '' } }), null == CRED ? undefined : 'K')
   })
 
-  test('an empty apikey drops the header', () => {
-    const ctx = authCtx({ apikey: '', auth: { prefix: 'Bearer' } }, { authorization: 'stale' })
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('an empty apikey drops the credential', () => {
+    strictEqual(placed({ apikey: '', auth: { prefix: 'Bearer' } }, 'stale'), undefined)
   })
 
-  test('a public API (no auth block) drops the header', () => {
-    const ctx = authCtx({ apikey: 'K' }, { authorization: 'stale' })
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('a public API (no auth block) drops the credential', () => {
+    strictEqual(placed({ apikey: 'K' }, 'stale'), undefined)
   })
 
-  test('a missing apikey option drops the header', () => {
-    const ctx = authCtx({ auth: { prefix: 'Bearer' } }, { authorization: 'stale' })
-    ;(stdutil as any).prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('a missing apikey option drops the credential', () => {
+    strictEqual(placed({ auth: { prefix: 'Bearer' } }, 'stale'), undefined)
   })
 })
 

package/project/.sdk/tm/ts/test/utility/Corpus.test.ts

@@ -6,19 +6,6 @@ import { join } from 'node:path'
 import { TEST_JSON_FILE } from './index'
 
 
-// Guards the shared corpus AS A WHOLE, which the per-section guard in the
-// language runners cannot do.
-//
-// That guard only fires for a section some test actually runs. Seven sections
-// — fetcher, makeFetchDef, makePoint, makeResult, featureAdd, featureHook and
-// featureInit — had no test calling them at all, so they sat at `set: []`
-// through two reviews reporting nothing. A fixture nobody runs is
-// indistinguishable from a fixture that passes.
-//
-// Deferral is therefore DATA (`basic.pending`), not a comment: comments do not
-// survive compilation to test.json, so a marker written only in the .aon
-// source cannot be checked by the thing that consumes it. Being data, these
-// invariants hold for every port, not just this one.
 describe('Corpus', () => {
 
   // Resolved the same way runner.ts resolves it — from dist-test/, one level

package/project/.sdk/tm/ts/test/utility/PrimaryUtility.test.ts

@@ -31,23 +31,11 @@ describe('PrimaryUtility', async () => {
   }
 
 
-  // Sections deliberately left empty in the shared corpus
-  // (.sdk/test/primary/<name>.aon carries a PENDING header). Everything
-  // else MUST contribute cases.
   const PENDING = new Set([
     'fetcher', 'makeFetchDef', 'makeResult',
     'featureAdd', 'featureHook', 'featureInit',
   ])
 
-  // Run one corpus section, failing loudly when it would run ZERO cases.
-  // A renamed section or a fixture that compiled to an empty `set` used to
-  // pass silently, which defeats the point of a shared oracle. (The guard
-  // lives here rather than in runner.ts, which is vendored verbatim from
-  // @voxgig/struct and must stay byte-identical to upstream.)
-  //
-  // EVERY corpus-backed test goes through here — a guard that only some
-  // sections opt into leaves the rest able to run zero assertions, which is
-  // the exact hole it was added to close.
   async function runsection(name: string, subject: Function) {
     const section = spec[name]
     ok(null != section,
@@ -70,10 +58,6 @@ describe('PrimaryUtility', async () => {
     spec = run.spec
     runset = run.runset
     runsetflags = run.runsetflags
-    // Under the old hand-vendored runner, run.client WAS the SDK; under
-    // omni it is the provider wrapping it. This suite treats the client as
-    // the SDK — including ASSIGNING to client._features, which prototype
-    // delegation cannot forward — so unwrap the real instance.
     client = (run.client as any).sdk
     utility = client.utility()
     struct = utility.struct
@@ -111,14 +95,65 @@ describe('PrimaryUtility', async () => {
   })
 
 
+  function credential() {
+    const ctx: any = {
+      utility,
+      client: { options: () => ({ apikey: 'PROBE', auth: { prefix: '' } }) },
+      spec: { headers: {}, query: {} },
+      error: (code: string, msg: string) => Object.assign(new Error(msg), { code }),
+    }
+    try { utility.prepareAuth(ctx) } catch (e) { return null }
+    for (const where of ['headers', 'query']) {
+      const name = Object.keys(ctx.spec[where] || {})[0]
+      if (null != name) return { where, name }
+    }
+    return null
+  }
+
+  // Rename the corpus's `headers` bag to the real container, and the
+  // `authorization` key inside it to the real credential name. Applied only
+  // to the prepareAuth section, so real header assertions elsewhere are
+  // untouched.
+  function retarget(node: any, cred: { where: string, name: string }): any {
+    if (null == node || 'object' !== typeof node) return node
+    if (Array.isArray(node)) return node.map((n) => retarget(n, cred))
+    const out: any = {}
+    for (const key of Object.keys(node)) {
+      if ('headers' === key) {
+        const bag: any = {}
+        for (const bk of Object.keys(node[key] || {})) {
+          bag['authorization' === bk ? cred.name : bk] = retarget(node[key][bk], cred)
+        }
+        out[cred.where] = bag
+      }
+      else out[key] = retarget(node[key], cred)
+    }
+    return out
+  }
+
   test('auth-basic', async () => {
     const sdkopts = spec.prepareAuth?.DEF?.setup?.a || {}
     const authClient = SDK.test({}, sdkopts)
-    await runsection('prepareAuth', (ctx: any) => {
-      ctx.client = authClient
-      fixctx(ctx)
-      return utility.prepareAuth(ctx)
-    })
+
+    const cred = credential()
+    ok(null != cred, 'prepareAuth placed no credential in headers or query')
+
+    const section = spec.prepareAuth
+    const original = section.basic
+    if ('headers' !== cred!.where || 'authorization' !== cred!.name) {
+      section.basic = retarget(original, cred!)
+    }
+
+    try {
+      await runsection('prepareAuth', (ctx: any) => {
+        ctx.client = authClient
+        fixctx(ctx)
+        return utility.prepareAuth(ctx)
+      })
+    }
+    finally {
+      section.basic = original
+    }
   })
 
 
@@ -233,7 +268,6 @@ describe('PrimaryUtility', async () => {
       body: 'present',
     })
     const reqClient = new (SDK as any)({
-      // Concrete base: a live construction must satisfy any server variables a templated base URL declares; a literal base sidesteps the requirement.
       base: 'http://localhost:8080',
       system: { fetch: mockFetch }
     })
@@ -283,13 +317,6 @@ describe('PrimaryUtility', async () => {
   })
 
 
-  // Was one hand-written case (the single-point path) covering one of this
-  // utility's seven branches, which is how the corpus fixture came to be
-  // marked deferred as "needs a real client". It does not: Context rebuilds
-  // `op` from opname + entity + config, and `options` can be supplied
-  // literally, so allow.op, the empty-points error, exist-selection,
-  // $action selection and the invalid-$action error are all expressible.
-  // Driven from the corpus now, so every port asserts the same branches.
   test('makePoint-basic', async () => {
     await runsection('makePoint', utility.makePoint)
   })

package/project/.sdk/tm/ts/test/utility/StructUtility.test.ts

@@ -315,12 +315,6 @@ describe('struct', async () => {
   })
 
 
-  // The struct.nullsem section: does a PRESENT key holding a JSON null
-  // read as "no value"? Opt-in per target (create-sdkgen ships it; an
-  // older project corpus may predate it - the skip below says so OUT
-  // LOUD rather than passing vacuously). All lanes run {null: false}:
-  // without the flag the runner rewrites every null to '__NULL__' and
-  // the section asserts nothing about null at all.
   test('nullsem', async (t) => {
     const nullsem = spec.nullsem
     if (null == nullsem) {
@@ -822,7 +816,6 @@ describe('struct', async () => {
     const extra = {
       $INTEGER: (inj: any) => {
         const { key } = inj
-        // let out = getprop(current, key)
         let out = struct.getprop(inj.dparent, key)
 
         let t = typeof out