@voxgig/sdkgen 4.34.0 → 4.34.1

package/project/.sdk/tm/js/test/live-runner.js

@@ -2,13 +2,19 @@
 // Execute every independent live step before deciding the suite's result.
 // Values never appear in reports: they can contain credentials or API data.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LiveBlocked = void 0;
+exports.LiveEmpty = exports.LiveBlocked = void 0;
 exports.runLiveSteps = runLiveSteps;
 exports.assertLiveReport = assertLiveReport;
+exports.settleLiveReport = settleLiveReport;
+exports.liveSummary = liveSummary;
 exports.createLiveTransport = createLiveTransport;
 class LiveBlocked extends Error {
 }
 exports.LiveBlocked = LiveBlocked;
+// The account answered, but holds no record the step could act on.
+class LiveEmpty extends Error {
+}
+exports.LiveEmpty = LiveEmpty;
 async function runLiveSteps(steps, options = {}) {
     const values = new Map();
     const results = [];
@@ -67,11 +73,10 @@ async function runLiveSteps(steps, options = {}) {
                     record({ id: step.id, state: 'passed', attempted, requests });
                 }
                 catch (error) {
-                    // Ordinary SDK errors can contain request headers, bodies, or an
-                    // issued token. Report the step's failure without serializing it.
-                    record({ id: step.id, state: error instanceof LiveBlocked ? 'blocked' : 'failed',
-                        attempted, requests,
-                        reason: error instanceof LiveBlocked ? error.message : 'Request or assertion failed' });
+                    const state = error instanceof LiveEmpty ? 'empty'
+                        : error instanceof LiveBlocked ? 'blocked' : 'failed';
+                    record({ id: step.id, state, attempted, requests,
+                        reason: 'failed' === state ? failureReason(error) : error.message });
                 }
                 if (attempted && (options.delayMs || 0) > 0) {
                     await new Promise(resolve => setTimeout(resolve, options.delayMs));
@@ -91,15 +96,49 @@ async function runLiveSteps(steps, options = {}) {
         passed: results.filter(result => result.state === 'passed').length,
         failed: results.filter(result => result.state === 'failed').length,
         blocked: results.filter(result => result.state === 'blocked').length,
+        empty: results.filter(result => result.state === 'empty').length,
         excluded: results.filter(result => result.state === 'excluded').length,
         results,
     };
 }
+// An SDK error's code and an assertion's own fixed message say what went
+// wrong without repeating a value; a message built from values could
+// carry a header, a body or a token, so it is not reported.
+function failureReason(error) {
+    if (null != error?.sdk && 'string' === typeof error.code) {
+        return 'Request failed: ' + error.code;
+    }
+    // Node appends the compared values to a custom assertion message.
+    if ('ERR_ASSERTION' === error?.code && false === error.generatedMessage) {
+        return 'Assertion failed: ' + String(error.message).split('\n')[0];
+    }
+    return 'Request or assertion failed';
+}
+function liveIncomplete(report) {
+    return 0 < report.failed || 0 < report.blocked || 0 === report.attempted;
+}
 function assertLiveReport(report) {
-    if (report.failed || report.blocked || !report.attempted) {
+    if (liveIncomplete(report)) {
         throw new Error('Live coverage incomplete: ' + JSON.stringify(report));
     }
 }
+// An account with no record for a step to read skips in either mode.
+function settleLiveReport(report, settle = {}) {
+    if (liveIncomplete(report)) {
+        if (false !== settle.strict || null == settle.t)
+            return assertLiveReport(report);
+        return settle.t.skip('Live coverage incomplete (main.kit.test.live.strict is false): ' +
+            liveSummary(report));
+    }
+    if (0 < report.empty)
+        settle.t?.skip('Live coverage incomplete: ' + liveSummary(report));
+}
+function liveSummary(report) {
+    const open = report.results.filter(result => 'passed' !== result.state);
+    return 0 === open.length ? 'no request attempted' :
+        open.map(result => result.id + ' ' + result.state +
+            (result.reason ? ' (' + result.reason + ')' : '')).join('; ');
+}
 function createLiveTransport(timeoutMs = 30000) {
     let context;
     const requests = [];
@@ -109,8 +148,11 @@ function createLiveTransport(timeoutMs = 30000) {
         enter(next) { context = next; },
         fetch: async (input, init) => {
             const url = new URL(String(input));
+            // A credential can travel as the agent (auth.name), so only whether
+            // the request carried one is recorded, never its value.
             const request = {
                 method: init?.method || 'GET', path: url.origin + url.pathname,
+                agent: null == new Headers(init?.headers).get('user-agent') ? 'transport default' : 'configured',
             };
             requests.push(request);
             context?.requests.push(request);
@@ -121,6 +163,9 @@ function createLiveTransport(timeoutMs = 30000) {
             const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
             const response = await nativeFetch(input, { ...init, signal });
             request.status = response.status;
+            const type = response.headers.get('content-type');
+            if (type)
+                request.type = type.split(';')[0].trim();
             if (!context)
                 console.log('LIVE RESPONSE ' + JSON.stringify(request));
             return response;

package/project/.sdk/tm/js/test/live-scenarios.js

@@ -40,7 +40,7 @@ function recipeNeeds(value) {
         return [];
     return [...new Set([...(typeof value.from === 'string' ? [value.from] : []), ...Object.values(value).flatMap(recipeNeeds)])];
 }
-async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}) {
+async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}, settle = {}) {
     const transport = (0, live_runner_1.createLiveTransport)();
     const steps = plan.map(point => {
         const hint = point.facts.live || {};
@@ -53,10 +53,10 @@ async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}) {
                 // Every operation point is planned, not only the hinted ones; a hint
                 // only decides whether this file is generated. Absent a recipe there
                 // is no consent to call the operation, so block rather than
-                // synthesize input for it. Blocked fails assertLiveReport, so an
+                // synthesize input for it. A strict run fails a blocked step, so an
                 // omission surfaces instead of passing quietly.
                 if (!point.facts.live)
-                    throw new LiveBlocked('No live recipe: add a live hint for this operation in the guide, or give it an explicit excluded reason');
+                    throw new live_runner_1.LiveBlocked('No live recipe: add a live hint for this operation in the guide, or give it an explicit excluded reason');
                 if (point.contractVersion && point.contractVersion !== 1)
                     throw new live_runner_1.LiveBlocked('Unsupported operation contract version');
                 if (point.op === 'remove' || hint.cleanup) {
@@ -144,6 +144,6 @@ async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}) {
     });
     const report = await (0, live_runner_1.runLiveSteps)(steps, { delayMs: (0, utility_1.liveDelayMs)(), report: result => console.log('LIVE STEP ' + JSON.stringify(result)) });
     console.log('LIVE SUMMARY ' + JSON.stringify(report));
-    (0, live_runner_1.assertLiveReport)(report);
+    (0, live_runner_1.settleLiveReport)(report, settle);
     return report;
 }

package/project/.sdk/tm/js/test/pipeline.test.js

@@ -9,7 +9,7 @@
 const { test, describe } = require('node:test')
 const { strictEqual, ok, deepStrictEqual } = require('node:assert')
 
-const { stdutil } = require('..')
+const { ProjectNameSDK, stdutil } = require('..')
 
 
 const struct = stdutil.struct
@@ -79,6 +79,23 @@ describe('pipeline:makePoint + makeSpec', () => {
     strictEqual(stdutil.makePoint(base({ out: { point: preset } })), preset)
   })
 
+  test('an allow list names whole operations, in any case', () => {
+    const point = { method: 'GET', parts: ['a'] }
+    const op = { name: 'load', points: [point] }
+    strictEqual(stdutil.makePoint(base({ op, options: { allow: { op: 'reload,unload' } } })).code,
+      'point_op_allow')
+    strictEqual(stdutil.makePoint(base({ op, options: { allow: { op: 'list, LOAD' } } })), point)
+  })
+
+  test('an allow list names whole methods', () => {
+    const ctx = base({
+      op: { name: 'update', points: [] },
+      point: { method: 'pu', parts: ['a'] },
+      options: { allow: { method: 'GET,PUT' }, base: 'http://x' },
+    })
+    strictEqual(stdutil.makeSpec(ctx).code, 'spec_method_allow')
+  })
+
   test('makeSpec short-circuits a feature-supplied spec', () => {
     const preset = { method: 'GET' }
     strictEqual(stdutil.makeSpec(base({ out: { spec: preset } })), preset)
@@ -86,6 +103,20 @@ describe('pipeline:makePoint + makeSpec', () => {
 })
 
 
+describe('pipeline:direct', () => {
+
+  test('direct and graphql answer a method allow.method refuses with a result map', async () => {
+    const sdk = ProjectNameSDK.test({}, { allow: { method: 'GET' } })
+    const direct = await sdk.direct({ path: '/a', method: 'POST' })
+    strictEqual(direct.ok, false)
+    strictEqual(direct.err.code, 'spec_method_allow')
+    const graphql = await sdk.graphql('{ a }')
+    strictEqual(graphql.ok, false)
+    strictEqual(graphql.err.code, 'spec_method_allow')
+  })
+})
+
+
 describe('pipeline:makeResponse', () => {
 
   test('guards missing spec / response / result', async () => {
@@ -493,4 +524,24 @@ describe('pipeline:result helpers', () => {
     await stdutil.resultBody(ctx)
     strictEqual(ctx.result.body, undefined)
   })
+
+  // The agent and the body preview may carry a registered value; the body is
+  // cleaned before the bound so a split value cannot leave its prefix.
+  test('resultBody masks a registered value in the agent and across the preview bound', async () => {
+    const secret = 'PIPELINE-SECRET-a1b2c3d4e5f6'
+    const text = 'x'.repeat(150) + secret + 'y'.repeat(100)
+    const ctx = base({
+      options: { __derived__: { clean: { active: true, keys: [], values: [], mask: '[redacted]', hint: 0, min: 4 } } },
+      spec: { headers: { 'user-agent': 'Probe ' + secret } },
+      response: { body: 'body', json: async () => { throw Object.assign(new SyntaxError('bad json'), { text }) } },
+      result: { status: 200, headers: { 'content-type': 'text/html' } },
+    })
+    stdutil.cleanAdd(ctx, secret)
+    await stdutil.resultBody(ctx)
+    const message = String(ctx.result.err.message)
+    strictEqual(ctx.result.err.code, 'response_content_type')
+    ok(message.includes('user-agent Probe [redacted]'), message)
+    ok(message.includes('body: ' + 'x'.repeat(150) + '[redacted]'), message)
+    ok(!message.includes(secret.slice(0, 8)), message)
+  })
 })

package/project/.sdk/tm/js/test/utility.js

@@ -171,14 +171,37 @@ function maybeSkipControl(t, kind, name, live) {
     }
     return false;
 }
-function skipIfMissingIds(t, setup, requiredKeys) {
+// A live test without the ids its request needs is blocked rather than sent
+// with `undefined` in a path or query parameter. Returns true when skipped.
+function skipIfMissingIds(t, setup, requiredKeys, strict = true) {
     if (!setup.live)
         return false;
     const missing = requiredKeys.filter(k => null == setup.idmap?.[k]);
-    if (missing.length > 0) {
-        throw new Error(`Live test blocked: needs ${missing.join(', ')} via *_ENTID env var`);
+    return 0 < missing.length &&
+        liveMiss(t, strict, `Live test blocked: needs ${missing.join(', ')} via *_ENTID env var`);
+}
+// A live check that did not pass: strict fails the test, lenient skips it.
+function liveMiss(t, strict, reason) {
+    if (strict)
+        throw new Error(reason);
+    t.skip(reason);
+    return true;
+}
+// An empty list is a valid answer, so a test needing a record skips.
+function liveEmpty(t, reason) {
+    t.skip(reason);
+    return true;
+}
+// The SDK's error, already bounded and cleaned, or else status and content type.
+function describeLive(result) {
+    const err = result?.err;
+    if (null != err) {
+        return String(err.message || err.code || err);
     }
-    return false;
+    const headers = result?.headers;
+    const type = 'function' === typeof headers?.get ? headers.get('content-type') :
+        Object.entries(headers || {}).find(([k]) => 'content-type' === k.toLowerCase())?.[1];
+    return 'HTTP ' + result?.status + (type ? ' ' + String(type).split(';')[0] : '');
 }
 function loadEnvLocal(file) {
     let text;
@@ -232,6 +255,9 @@ module.exports = {
   isControlSkipped,
   maybeSkipControl,
   skipIfMissingIds,
+  liveMiss,
+  liveEmpty,
+  describeLive,
   loadEnvLocal,
   makeStepData,
   makeMatch,

package/project/.sdk/tm/kotlin/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ Voxgig
+Copyright (c) $$const.year$$ PROJECTPUBLISHER
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/kotlin/core/Context.kt

@@ -214,7 +214,7 @@ class Context(ctxmap: MutableMap<String, Any?>?, basectx: Context?) {
     val opcfg = Struct.getpath(this.config, listOf("entity", entname, "op", opname))
 
     var input = "match"
-    if ("update" == opname || "create" == opname) {
+    if ("update" == opname || "create" == opname || "patch" == opname) {
       input = "data"
     }
 

package/project/.sdk/tm/kotlin/core/Helpers.kt

@@ -15,6 +15,14 @@ object Helpers {
     )
   }
 
+  // Whether a comma-separated allow option names the item: whole names, any case.
+  fun allowed(names: Any?, item: String?): Boolean {
+    if (names !is String || item.isNullOrEmpty()) {
+      return false
+    }
+    return names.split(",").any { it.trim().equals(item, ignoreCase = true) }
+  }
+
   @Suppress("UNCHECKED_CAST")
   fun toMapAny(v: Any?): MutableMap<String, Any?>? {
     if (v == null) {

package/project/.sdk/tm/kotlin/core/Interfaces.kt

@@ -25,6 +25,8 @@ interface SdkEntity : Entity {
 
   fun update(reqdata: MutableMap<String, Any?>?, ctrl: MutableMap<String, Any?>?): Any?
 
+  fun patch(reqdata: MutableMap<String, Any?>?, ctrl: MutableMap<String, Any?>?): Any?
+
   fun remove(reqmatch: MutableMap<String, Any?>?, ctrl: MutableMap<String, Any?>?): Any?
 
   // Runs `action` through the pipeline and returns a Sequence over result

package/project/.sdk/tm/kotlin/core/Response.kt

@@ -15,6 +15,9 @@ class Response(resmap: Map<String, Any?>?) {
   var body: Any? = null
   var err: RuntimeException? = null
 
+  // Set by a transport that could not read a non-blank body as JSON.
+  var unreadable: Boolean = false
+
   init {
     val s = Struct.getprop(resmap, "status")
     if (s is Number) {
@@ -39,5 +42,67 @@ class Response(resmap: Map<String, Any?>?) {
     if (e is RuntimeException) {
       this.err = e
     }
+
+    this.unreadable = true == Struct.getprop(resmap, "unreadable")
+  }
+
+  companion object {
+    private const val PREVIEW_LENGTH = 160
+
+    /**
+     * A body that is not JSON. An HTTP failure keeps its own error, with the
+     * response described; otherwise the code tells a wrong content type from
+     * malformed JSON.
+     */
+    fun unreadableBody(
+      ctx: Context,
+      status: Int,
+      headers: Any?,
+      text: Any?,
+      sent: Any?,
+      failed: RuntimeException?,
+    ): RuntimeException {
+      val type = headerValue(headers, "content-type")
+      val agent = clean(ctx, headerValue(sent, "user-agent")).ifEmpty { "transport default" }
+      val detail = "HTTP " + status + ", content-type " + type.ifEmpty { "none" } +
+        ", user-agent " + agent + (if (text == null) "" else ", body: " + preview(ctx, text))
+
+      if (failed != null) {
+        if (failed is SdkError) {
+          failed.msg += " ($detail)"
+          return failed
+        }
+        return RuntimeException(failed.message + " ($detail)", failed)
+      }
+
+      if (type.isEmpty() || type.lowercase().contains("json")) {
+        return ctx.makeError("response_json_invalid", "response: body is not valid JSON ($detail)")
+      }
+      return ctx.makeError("response_content_type", "response: expected JSON, got $type ($detail)")
+    }
+
+    private fun headerValue(headers: Any?, name: String): String {
+      if (headers !is Map<*, *>) {
+        return ""
+      }
+      for ((k, v) in headers) {
+        if (name.equals(k.toString(), ignoreCase = true)) {
+          return v.toString()
+        }
+      }
+      return ""
+    }
+
+    private fun clean(ctx: Context, s: String): String =
+      ctx.utility?.clean?.invoke(ctx, s)?.toString() ?: s
+
+    // Cleaned whole: a secret the bound would split could leave its prefix.
+    private fun preview(ctx: Context, text: Any): String {
+      val flat = clean(ctx, text.toString().replace(Regex("\\s+"), " ").trim())
+      if (flat.codePointCount(0, flat.length) <= PREVIEW_LENGTH) {
+        return flat
+      }
+      return flat.substring(0, flat.offsetByCodePoints(0, PREVIEW_LENGTH)) + "..."
+    }
   }
 }

package/project/.sdk/tm/kotlin/core/SdkClient.kt

@@ -126,6 +126,14 @@ abstract class SdkClient(sdkopts: MutableMap<String, Any?>?) {
     if ("" == method) {
       method = "GET"
     }
+    method = method.uppercase()
+
+    val allowMethod = Struct.getpath(options, listOf("allow", "method"))
+    if (!Helpers.allowed(allowMethod, method)) {
+      throw ctx.makeError("spec_method_allow",
+        "Method \"" + method + "\" not allowed by SDK option allow.method value: \"" +
+          ((allowMethod as? String) ?: "") + "\"")
+    }
 
     var params = Helpers.toMapAny(Struct.getprop(fetchargs, "params"))
     if (params == null) {
@@ -179,8 +187,7 @@ abstract class SdkClient(sdkopts: MutableMap<String, Any?>?) {
 
   // Is this raw-access op permitted by the SDK's allow.op option?
   private fun opAllowed(op: String): Boolean {
-    val allow = Struct.getpath(this.options, listOf("allow", "op"))
-    return allow is String && allow.contains(op)
+    return Helpers.allowed(Struct.getpath(this.options, listOf("allow", "op")), op)
   }
 
   private fun opDenied(op: String): MutableMap<String, Any?> {
@@ -311,18 +318,28 @@ abstract class SdkClient(sdkopts: MutableMap<String, Any?>?) {
       val noBody = status == 204 || status == 304 || "0" == contentLength
 
       var jsonData: Any? = null
+      var bodyErr: RuntimeException? = null
       if (!noBody) {
         val jf = Struct.getprop(fm, "json")
         if (jf is Supplier<*>) {
           // The supplier returns null on parse error in our fetcher.
           jsonData = (jf as Supplier<Any?>).get()
         }
+        if (true == Struct.getprop(fm, "unreadable")) {
+          val failed = if (status in 200..299) null else ctx.makeError(
+            "request_status", "request: " + status + ": " + Struct.getprop(fm, "statusText"))
+          bodyErr = Response.unreadableBody(ctx, status, headers, Struct.getprop(fm, "body"),
+            fetchdef["headers"], failed)
+        }
       }
 
-      out["ok"] = status in 200..299
+      out["ok"] = bodyErr == null && status in 200..299
       out["status"] = status
       out["headers"] = headers
       out["data"] = jsonData
+      if (bodyErr != null) {
+        out["err"] = utility.clean(ctx, bodyErr)
+      }
       return out
     }
 

package/project/.sdk/tm/kotlin/core/Spec.kt

@@ -17,6 +17,9 @@ class Spec(specmap: Map<String, Any?>? = null) {
   var body: Any? = null
   var url: String = ""
   var path: String = ""
+  // The query parameters prepareAuth placed: the credential, which the
+  // request sends and the entity's match leaves out.
+  var authquery: MutableList<String> = mutableListOf()
 
   init {
     if (specmap != null) {

package/project/.sdk/tm/kotlin/feature/TestFeature.kt

@@ -59,9 +59,29 @@ class TestFeature : BaseFeature("test", "0.0.1", true) {
   // and the response transform unwraps that key on the way back. Returning the
   // bare payload means the transform unwraps a property that is not there and
   // the caller gets nothing. Mirrors the go/ts/lua/php mocks.
+  // The record the mock keeps: the request data without `$body`, which only the
+  // wire carries.
+  private fun record(reqdata: Map<String, Any?>?): MutableMap<String, Any?>? {
+    if (reqdata == null) return null
+    val out = LinkedHashMap(reqdata)
+    out.remove("\$body")
+    return out
+  }
+
+  // The key a list's response transform
+  // ["`$EACH`", "body", {"`$MERGE`": "`.<key>`"}] reads each item's record under.
+  private fun itemEnvelopeKey(restf: Any?): String? {
+    val spec = restf as? List<*> ?: return null
+    if (3 != spec.size || "`\$EACH`" != spec[0] || "body" != spec[1]) return null
+    val merge = (spec[2] as? Map<*, *>)?.get("`\$MERGE`") as? String ?: return null
+    return Regex("^`\\.([^.`\$]+)`\$").matchEntire(merge)?.groupValues?.get(1)
+  }
+
   private fun envelope(ctx: Context?, data: Any?): Any? {
     if (null == data || null == ctx) return data
     val tm = Struct.getprop(ctx.point, "transform")
+    val key = itemEnvelopeKey(Struct.getprop(tm, "res"))
+    if (null != key && data is List<*>) return data.map { linkedMapOf<String, Any?>(key to it) }
     val restf = Struct.getprop(tm, "res") as? String ?: return data
     // Rebuild whatever nesting the transform unwraps. Multi-segment on purpose:
     // GraphQL ops unwrap `body.data.<field>`, not just one envelope property.
@@ -139,7 +159,7 @@ class TestFeature : BaseFeature("test", "0.0.1", true) {
         val out = Struct.clone(found)
         return respond(ctx, 200, out, null)
       }
-      "update" -> {
+      "update", "patch" -> {
         // Match the existing entity by id only (or its alias).
         var updateMatch: MutableMap<String, Any?> = linkedMapOf()
         val reqdata = ctx.reqdata
@@ -166,7 +186,7 @@ class TestFeature : BaseFeature("test", "0.0.1", true) {
           return respond(ctx, 404, null, extra("statusText", "Not found"))
         }
         if (ent is MutableMap<*, *>) {
-          Struct.merge(Struct.jt(ent, reqdata))
+          Struct.merge(Struct.jt(ent, record(reqdata)))
         }
         Struct.delprop(ent, "\$KEY")
         val out = Struct.clone(ent)
@@ -195,7 +215,7 @@ class TestFeature : BaseFeature("test", "0.0.1", true) {
           )
         }
 
-        val ent = Struct.clone(ctx.reqdata)
+        val ent = Struct.clone(record(ctx.reqdata))
         if (ent is MutableMap<*, *>) {
           val entm = ent as MutableMap<String, Any?>
           entm["id"] = id

package/project/.sdk/tm/kotlin/feature/TimeoutFeature.kt

@@ -5,6 +5,7 @@ import java.util.concurrent.CompletionException
 import java.util.concurrent.ExecutionException
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.TimeoutException
+import java.util.concurrent.atomic.AtomicLong
 
 import KOTLINPACKAGE.core.Context
 import KOTLINPACKAGE.core.FetcherFn
@@ -42,31 +43,57 @@ class TimeoutFeature : BaseFeature("timeout", "0.0.1", true) {
       return inner(ctx, url, fetchdef)
     }
 
-    val fut: CompletableFuture<Any?> = CompletableFuture.supplyAsync { inner(ctx, url, fetchdef) }
+    // The deadline runs from here, not from the wait below: a caller paused
+    // between the two would otherwise find a late response complete and take
+    // it. The worker notes when it finished, so a response or a failure after
+    // the deadline is a timeout however late the caller looks.
+    val now = FeatureOptions.foptNow(this.options)
+    val start = now.asLong
+    val arrived = AtomicLong(Long.MAX_VALUE)
+    val fut: CompletableFuture<Any?> = CompletableFuture.supplyAsync {
+      try {
+        inner(ctx, url, fetchdef)
+      } finally {
+        arrived.set(now.asLong)
+      }
+    }
 
     try {
-      return fut.get(deadline.toLong(), TimeUnit.MILLISECONDS)
-    } catch (e: TimeoutException) {
-      track(deadline)
-      throw ctx.makeError("timeout", "Request exceeded timeout of ${deadline}ms")
-    } catch (e: ExecutionException) {
-      var cause: Throwable? = e.cause
-      if (cause is CompletionException && cause.cause != null) {
-        cause = cause.cause
+      val remaining = maxOf(0L, deadline - (now.asLong - start))
+      val out = try {
+        fut.get(remaining, TimeUnit.MILLISECONDS)
+      } catch (e: ExecutionException) {
+        if (deadline < arrived.get() - start) {
+          throw timeout(ctx, deadline)
+        }
+        throw unwrap(e)
       }
-      if (cause is RuntimeException) {
-        throw cause
+      if (deadline < arrived.get() - start) {
+        throw timeout(ctx, deadline)
       }
-      if (cause is Error) {
-        throw cause
-      }
-      throw RuntimeException(cause)
+      return out
+    } catch (e: TimeoutException) {
+      throw timeout(ctx, deadline)
     } catch (e: InterruptedException) {
       Thread.currentThread().interrupt()
       throw RuntimeException(e)
     }
   }
 
+  private fun unwrap(e: ExecutionException): Throwable {
+    var cause: Throwable? = e.cause
+    if (cause is CompletionException && cause.cause != null) {
+      cause = cause.cause
+    }
+    val found = cause
+    return if (found is RuntimeException || found is Error) found else RuntimeException(found)
+  }
+
+  private fun timeout(ctx: Context, deadline: Int): Throwable {
+    track(deadline)
+    return ctx.makeError("timeout", "Request exceeded timeout of ${deadline}ms")
+  }
+
   private fun track(deadline: Int) {
     this.count++
     this.ms = deadline

package/project/.sdk/tm/kotlin/feature/ValidateFeature.kt

@@ -184,6 +184,8 @@ class ValidateFeature : BaseFeature("validate", "0.0.1", true) {
     // fields will never name it - and under `strict` every custom-action call
     // would be rejected for the one key that made it reachable.
     out.remove("\$action")
+    // Nor is `$body`, the raw request body.
+    out.remove("\$body")
 
     return out
   }

package/project/.sdk/tm/kotlin/test/FeatureHarness.kt

@@ -142,7 +142,7 @@ object FeatureHarness {
   fun fhDefaultMethod(op: String): String {
     return when (op) {
       "create" -> "POST"
-      "update" -> "PATCH"
+      "update", "patch" -> "PATCH"
       "remove" -> "DELETE"
       else -> "GET"
     }

package/project/.sdk/tm/kotlin/test/FeatureTest.kt

@@ -274,6 +274,38 @@ class FeatureTest {
     assertEquals(1, f.count, "expected 1 timeout")
   }
 
+  // The deadline runs from the request's start, not from the wait: a response
+  // that arrives after it is a timeout even when the caller only looks once it
+  // is complete. The clock stands at the start for the caller and 300 ms
+  // later for the worker.
+  @Test
+  fun timeout_lateResponseTimesOutHoweverLateTheCallerLooks() {
+    assumeFeatures("timeout")
+    val f = TimeoutFeature()
+    val h = fhMake(null, fhF(f, fhMap("ms", 20, "now", workerClock(300L))))
+    val res = h.op(fhOp("load"))
+    assertEquals("timeout", fhErrCode(res.err), "expected timeout error, got ${res.err}")
+    assertEquals(1, f.count, "expected 1 timeout")
+  }
+
+  // A transport failure after the deadline is a timeout too, not the failure.
+  @Test
+  fun timeout_lateFailureTimesOut() {
+    assumeFeatures("timeout")
+    val f = TimeoutFeature()
+    val h = fhMake({ _, _, _ -> throw IllegalStateException("socket closed") },
+      fhF(f, fhMap("ms", 20, "now", workerClock(300L))))
+    val res = h.op(fhOp("load"))
+    assertEquals("timeout", fhErrCode(res.err), "expected timeout error, got ${res.err}")
+    assertEquals(1, f.count, "expected 1 timeout")
+  }
+
+  // A clock standing at 0 for the calling thread and at `later` for any other.
+  private fun workerClock(later: Long): LongSupplier {
+    val caller = Thread.currentThread()
+    return LongSupplier { if (Thread.currentThread() === caller) 0L else later }
+  }
+
   @Test
   fun timeout_fastRequestPasses() {
     assumeFeatures("timeout")