@voxgig/sdkgen 4.34.0 → 4.34.2

package/project/.sdk/tm/js/test/feature.test.js

@@ -6,7 +6,9 @@
 
 const { test, describe } = require('node:test')
 const { strictEqual, ok, deepStrictEqual } = require('node:assert')
+const { getEventListeners } = require('node:events')
 
+const { ProjectNameSDK } = require('..')
 const { hasFeature, makeClient, makeClock, makeResponse } = require('./feature/harness')
 
 
@@ -21,6 +23,23 @@ function recordingServer(reply) {
 }
 
 
+// Answers after `ms` unless the request's signal aborts first, when it rejects
+// with the signal's reason, as fetch does.
+function slowServer(ms) {
+  return (_ctx, _url, fetchdef) => new Promise((resolve, reject) => {
+    const timer = setTimeout(() => resolve(makeResponse(200, { ok: true })), ms)
+    const signal = fetchdef.signal
+    if (null == signal) return
+    const abort = () => {
+      clearTimeout(timer)
+      reject(signal.reason)
+    }
+    if (signal.aborted) return abort()
+    signal.addEventListener('abort', abort, { once: true })
+  })
+}
+
+
 // A subtest that drives a second feature (netsim as the simulated network)
 // can only run when this SDK was generated with it: the harness skips
 // absent features, which would leave the scenario unsimulated and the
@@ -786,4 +805,119 @@ describe('feature', () => {
       strictEqual(h.client._netsim.calls, 1)
     })
   }
+
+  // --- abort ----------------------------------------------------------------
+  // A caller's signal ends a request wherever it waits. Each wait is far longer
+  // than the abort, so a request that ignored the signal would take seconds.
+  describe('abort', () => {
+
+    test('a caller abort cancels a request the timeout feature wraps', { skip: skipWithout('timeout') }, async () => {
+      const h = makeClient({ features: [{ name: 'timeout', options: { ms: 5000 } }], server: slowServer(2000) })
+      const ac = new AbortController()
+      const reason = new Error('stop')
+      setTimeout(() => ac.abort(reason), 20)
+      const start = Date.now()
+      const res = await h.op({ op: 'load', ctrl: { signal: ac.signal } })
+      ok(Date.now() - start < 1000, 'the request ended at the abort')
+      strictEqual(res.error, reason)
+      strictEqual(h.client._timeout, undefined, 'an abort is not a timeout')
+    })
+
+    test('the deadline still fires while the caller signal stays live', { skip: skipWithout('timeout') }, async () => {
+      const h = makeClient({ features: [{ name: 'timeout', options: { ms: 20 } }], server: slowServer(2000) })
+      const ac = new AbortController()
+      const res = await h.op({ op: 'load', ctrl: { signal: ac.signal } })
+      strictEqual(res.error.code, 'timeout')
+      strictEqual(getEventListeners(ac.signal, 'abort').length, 0,
+        'the timeout leaves no listener on the caller signal')
+    })
+
+    test('an aborted request is not retried', { skip: skipWithout('retry') }, async () => {
+      const ac = new AbortController()
+      const rec = recordingServer(() => {
+        ac.abort()
+        return makeResponse(503)
+      })
+      const clock = makeClock()
+      const h = makeClient({
+        features: [{ name: 'retry', options: { retries: 3, minDelay: 10, jitter: false, sleep: clock.sleep } }],
+        server: rec.server,
+      })
+      const res = await h.op({ op: 'load', ctrl: { signal: ac.signal } })
+      strictEqual(rec.calls.length, 1)
+      strictEqual(res.error, ac.signal.reason)
+      strictEqual(h.client._retry, undefined, 'no retry was scheduled')
+    })
+
+    test('an abort whose reason is not an Error is not retried either', { skip: skipWithout('retry') }, async () => {
+      // fetch rejects with the reason itself, so a string or a number reaches
+      // retry as a non-Error: it must still end the request, not become a response.
+      const server = slowServer(2000)
+      const h = makeClient({
+        features: [{ name: 'retry', options: { retries: 3, minDelay: 10, jitter: false } }],
+        server,
+      })
+      const ac = new AbortController()
+      setTimeout(() => ac.abort('user cancelled'), 20)
+      const start = Date.now()
+      const res = await h.op({ op: 'load', ctrl: { signal: ac.signal } })
+      ok(Date.now() - start < 1000, 'the request ended at the abort')
+      strictEqual(res.ok, false)
+      strictEqual(res.error, 'user cancelled')
+      strictEqual(h.client._retry, undefined, 'no retry was scheduled')
+    })
+
+    test('an abort during the retry backoff ends it', { skip: skipWithout('retry') }, async () => {
+      const ac = new AbortController()
+      const rec = recordingServer(() => makeResponse(503))
+      const h = makeClient({
+        features: [{ name: 'retry', options: { retries: 3, minDelay: 2000, jitter: false } }],
+        server: rec.server,
+      })
+      setTimeout(() => ac.abort(), 20)
+      const start = Date.now()
+      const res = await h.op({ op: 'load', ctrl: { signal: ac.signal } })
+      ok(Date.now() - start < 1000, 'the backoff ended at the abort')
+      strictEqual(rec.calls.length, 1)
+      strictEqual(res.error, ac.signal.reason)
+    })
+
+    test('an abort during simulated latency ends the request before the transport', { skip: skipWithout('netsim') }, async () => {
+      const ac = new AbortController()
+      const rec = recordingServer()
+      const h = makeClient({ features: [{ name: 'netsim', options: { latency: 2000 } }], server: rec.server })
+      setTimeout(() => ac.abort(), 20)
+      const start = Date.now()
+      const res = await h.op({ op: 'load', ctrl: { signal: ac.signal } })
+      ok(Date.now() - start < 1000, 'the latency ended at the abort')
+      strictEqual(rec.calls.length, 0)
+      strictEqual(res.error, ac.signal.reason)
+    })
+
+    test('an abort while waiting for a rate-limit token ends the wait', { skip: skipWithout('ratelimit') }, async () => {
+      const ac = new AbortController()
+      const rec = recordingServer()
+      const h = makeClient({ features: [{ name: 'ratelimit', options: { rate: 0.5, burst: 1 } }], server: rec.server })
+      await h.op({ op: 'load' })
+      setTimeout(() => ac.abort(), 20)
+      const start = Date.now()
+      const res = await h.op({ op: 'load', ctrl: { signal: ac.signal } })
+      ok(Date.now() - start < 1000, 'the wait ended at the abort')
+      strictEqual(rec.calls.length, 1)
+      strictEqual(res.error, ac.signal.reason)
+    })
+
+    test('the test transport aborts a request in flight', async () => {
+      const sdk = ProjectNameSDK.test({ net: { latency: 2000 } })
+      const ac = new AbortController()
+      const reason = new Error('stop')
+      setTimeout(() => ac.abort(reason), 20)
+      const start = Date.now()
+      const res = await sdk.direct({ path: '/ping', ctrl: { signal: ac.signal } })
+      ok(Date.now() - start < 1000, 'the request ended at the abort')
+      strictEqual(res.ok, false)
+      strictEqual(res.err.code, 'request_aborted')
+      strictEqual(res.err.cause, reason)
+    })
+  })
 })

package/project/.sdk/tm/js/test/live-contract.js

@@ -140,10 +140,10 @@ function synthesizeInput(schema, explicit, depth = 0) {
         }
         catch { }
     }
-    let value;
     if (schema.allOf)
-        value = Object.assign({}, ...schema.allOf.map((s) => synthesizeInput(s, undefined, depth + 1)));
-    else if (schema.type === 'object' || schema.properties) {
+        return allOfInput(schema, depth);
+    let value;
+    if (schema.type === 'object' || schema.properties) {
         value = {};
         for (const key of schema.required || [])
             if (!schema.properties?.[key]?.readOnly) {
@@ -170,6 +170,76 @@ function synthesizeInput(schema, explicit, depth = 0) {
     validateContract(schema, value);
     return value;
 }
+// An allOf's objects merged, else the first value its parts give that the whole schema
+// accepts: a declared value, then a synthesized one. A part that gives no value is left
+// to that validation, unless it carries a constraint the validator does not check.
+function allOfInput(schema, depth) {
+    let blocked;
+    const given = schema.allOf.map((part) => {
+        try {
+            return synthesizeInput(part, undefined, depth + 1);
+        }
+        catch (error) {
+            const unchecked = uncheckedConstraint(part);
+            if (unchecked)
+                throw new live_runner_1.LiveBlocked('Unsupported contract constraint: ' + unchecked);
+            blocked ??= error;
+        }
+    });
+    const objects = given.filter((v) => v !== null && typeof v === 'object' && !Array.isArray(v));
+    const candidates = [...(objects.length ? [Object.assign({}, ...objects)] : []),
+        ...declaredValues(schema.allOf), ...given.filter((v) => v !== undefined)];
+    let mismatch;
+    for (const value of candidates) {
+        try {
+            validateContract(schema, value);
+            return value;
+        }
+        catch (error) {
+            mismatch ??= error;
+        }
+    }
+    throw blocked ?? mismatch ?? new live_runner_1.LiveBlocked('Required input needs a guide recipe or validated example');
+}
+// What the parts declare, each kind in part order: every example, then every enum
+// value, then every default.
+function declaredValues(parts) {
+    const schemas = parts.filter(part => part !== null && typeof part === 'object');
+    const values = [];
+    const add = (value) => {
+        if (!values.some(v => JSON.stringify(v) === JSON.stringify(value)))
+            values.push(value);
+    };
+    for (const part of schemas) {
+        if (part.example !== undefined)
+            add(part.example);
+        for (const value of Array.isArray(part.examples) ? part.examples : [])
+            add(value);
+    }
+    for (const part of schemas)
+        for (const value of Array.isArray(part.enum) ? part.enum : [])
+            add(value);
+    for (const part of schemas)
+        if (part.default !== undefined)
+            add(part.default);
+    return values;
+}
+// The keywords validateContract reads, and those that only annotate; any other
+// keyword on a part is a constraint no validation of the whole schema can enforce.
+const CHECKED_KEYWORDS = new Set(['$ref', 'type', 'enum', 'const', 'format', 'pattern',
+    'minLength', 'maxLength', 'minimum', 'maximum', 'exclusiveMinimum', 'exclusiveMaximum',
+    'multipleOf', 'items', 'prefixItems', 'minItems', 'maxItems', 'uniqueItems', 'properties',
+    'required', 'additionalProperties', 'allOf', 'oneOf', 'anyOf', 'not', 'if', 'then', 'else',
+    'dependentRequired', 'dependentSchemas', 'patternProperties', 'contains',
+    'unevaluatedProperties', 'unevaluatedItems']);
+const ANNOTATION_KEYWORDS = new Set(['description', 'title', 'example', 'examples', 'default',
+    'deprecated', 'readOnly', 'writeOnly', 'externalDocs', 'xml', 'nullable', 'discriminator',
+    '$comment', '$schema', '$id']);
+function uncheckedConstraint(part) {
+    if (part === null || typeof part !== 'object')
+        return undefined;
+    return Object.keys(part).find(key => !CHECKED_KEYWORDS.has(key) && !ANNOTATION_KEYWORDS.has(key) && !key.startsWith('x-'));
+}
 function requestContract(facts) {
     const body = facts?.requestBody;
     if (body) {

package/project/.sdk/tm/js/test/live-entity.js

@@ -10,11 +10,17 @@ const live_runner_1 = require("./live-runner");
 const utility_1 = require("./utility");
 // The offline flow keeps its deterministic fixture assertions. Live flows
 // resolve real prerequisites per operation and collect failures until done.
-async function runLiveEntity(setup, entity, flow, accessor, facts = {}) {
+async function runLiveEntity(setup, entity, flow, accessor, facts = {}, settle = {}) {
     const { client, transport } = setup;
-    const steps = (flow.step || []).filter((step) => false !== step.a);
+    // A step switched off only because the offline call reaches no route of
+    // its operation still runs here, where each route's inputs are resolved.
+    const steps = (flow.step || [])
+        .filter((step) => false !== step.a || true === step.unreachable);
     const created = new Map();
     const listed = [];
+    let listedEmpty = false;
+    const recordFields = new Set(['id', entity.id?.field || 'id',
+        ...Object.values(entity.fields || {}).map((field) => field?.n).filter(Boolean)]);
     const marks = new Map();
     const idField = entity.id?.field || 'id';
     const copy = (value) => JSON.parse(JSON.stringify(value ?? {}));
@@ -61,15 +67,18 @@ async function runLiveEntity(setup, entity, flow, accessor, facts = {}) {
                 }
                 // A nested route needing a parent id must not hide an available
                 // parameter-free route for the same operation. Use the first viable
-                // candidate; the SDK still performs its normal route selection.
+                // candidate. An action route is taken only when the step names its
+                // action or the operation has no other route, and then by name.
                 let resolved;
                 let selected;
-                const missing = new Set();
+                const unusable = [];
+                const actionOnly = points.every((point) => null != point.q?.$action);
                 for (const point of points) {
-                    if (point.q?.$action !== input.$action)
+                    const action = point.q?.$action;
+                    if (null == input.$action ? null != action && !actionOnly : action !== input.$action)
                         continue;
-                    const candidate = { ...input };
-                    let viable = true;
+                    const candidate = null == action ? { ...input } : { ...input, $action: action };
+                    const missing = [];
                     const params = point.g?.params || [];
                     const query = (point.g?.query || []).filter((arg) => arg.r);
                     for (const arg of [...params, ...query]) {
@@ -79,19 +88,26 @@ async function runLiveEntity(setup, entity, flow, accessor, facts = {}) {
                         const value = setup.idmap[key] ?? setup.idmap[arg.n] ?? loaded?.[arg.n] ?? arg.ex;
                         if (undefined !== value && null !== value)
                             candidate[arg.n] = value;
-                        else if (arg.r !== false) {
-                            viable = false;
-                            missing.add(arg.n);
-                        }
+                        else if (arg.r !== false)
+                            missing.push(arg.n);
                     }
-                    if (viable) {
+                    if (0 === missing.length) {
                         resolved = candidate;
                         selected = point;
                         break;
                     }
+                    unusable.push({ route: null == action ? point.m + ' ' + point.o : '$action ' + action, missing });
+                }
+                if (!resolved) {
+                    // An empty list is a valid answer: the account has no record to load.
+                    if (op === 'load' && !record && listedEmpty &&
+                        unusable.every(route => route.missing.every(name => recordFields.has(name)))) {
+                        throw new live_runner_1.LiveEmpty('The account has no ' + entity.name + ' record to load');
+                    }
+                    throw new live_runner_1.LiveBlocked(0 === unusable.length ? 'No route for $action ' + input.$action :
+                        'No usable route: ' + unusable.map(route => route.route + ' needs ' +
+                            route.missing.join(', ')).join('; '));
                 }
-                if (!resolved)
-                    throw new live_runner_1.LiveBlocked('No usable route; missing arguments: ' + [...missing].join(', '));
                 input = resolved;
                 if (op === 'create' && facts[selected.m + ' ' + selected.o]) {
                     const selectedFacts = facts[selected.m + ' ' + selected.o];
@@ -103,6 +119,8 @@ async function runLiveEntity(setup, entity, flow, accessor, facts = {}) {
                     for (const arg of selected.g?.params || [])
                         if (resolved[arg.n] !== undefined)
                             input[arg.n] = resolved[arg.n];
+                    if (undefined !== resolved.$action)
+                        input.$action = resolved.$action;
                 }
                 let intendedMark;
                 if (op === 'update') {
@@ -126,6 +144,7 @@ async function runLiveEntity(setup, entity, flow, accessor, facts = {}) {
                         return item.data();
                     });
                     listed.splice(0, listed.length, ...data);
+                    listedEmpty = 0 === data.length;
                     context.publish(data);
                     for (const validation of step.v || []) {
                         const previous = created.get(validation.def?.ref);
@@ -165,5 +184,5 @@ async function runLiveEntity(setup, entity, flow, accessor, facts = {}) {
         report: result => console.log('LIVE STEP ' + JSON.stringify(result)),
     });
     console.log('LIVE SUMMARY ' + JSON.stringify({ entity: entity.name, ...report }));
-    (0, live_runner_1.assertLiveReport)(report);
+    (0, live_runner_1.settleLiveReport)(report, settle);
 }

package/project/.sdk/tm/js/test/live-runner.js

@@ -2,13 +2,19 @@
 // Execute every independent live step before deciding the suite's result.
 // Values never appear in reports: they can contain credentials or API data.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LiveBlocked = void 0;
+exports.LiveEmpty = exports.LiveBlocked = void 0;
 exports.runLiveSteps = runLiveSteps;
 exports.assertLiveReport = assertLiveReport;
+exports.settleLiveReport = settleLiveReport;
+exports.liveSummary = liveSummary;
 exports.createLiveTransport = createLiveTransport;
 class LiveBlocked extends Error {
 }
 exports.LiveBlocked = LiveBlocked;
+// The account answered, but holds no record the step could act on.
+class LiveEmpty extends Error {
+}
+exports.LiveEmpty = LiveEmpty;
 async function runLiveSteps(steps, options = {}) {
     const values = new Map();
     const results = [];
@@ -67,11 +73,10 @@ async function runLiveSteps(steps, options = {}) {
                     record({ id: step.id, state: 'passed', attempted, requests });
                 }
                 catch (error) {
-                    // Ordinary SDK errors can contain request headers, bodies, or an
-                    // issued token. Report the step's failure without serializing it.
-                    record({ id: step.id, state: error instanceof LiveBlocked ? 'blocked' : 'failed',
-                        attempted, requests,
-                        reason: error instanceof LiveBlocked ? error.message : 'Request or assertion failed' });
+                    const state = error instanceof LiveEmpty ? 'empty'
+                        : error instanceof LiveBlocked ? 'blocked' : 'failed';
+                    record({ id: step.id, state, attempted, requests,
+                        reason: 'failed' === state ? failureReason(error) : error.message });
                 }
                 if (attempted && (options.delayMs || 0) > 0) {
                     await new Promise(resolve => setTimeout(resolve, options.delayMs));
@@ -91,15 +96,49 @@ async function runLiveSteps(steps, options = {}) {
         passed: results.filter(result => result.state === 'passed').length,
         failed: results.filter(result => result.state === 'failed').length,
         blocked: results.filter(result => result.state === 'blocked').length,
+        empty: results.filter(result => result.state === 'empty').length,
         excluded: results.filter(result => result.state === 'excluded').length,
         results,
     };
 }
+// An SDK error's code and an assertion's own fixed message say what went
+// wrong without repeating a value; a message built from values could
+// carry a header, a body or a token, so it is not reported.
+function failureReason(error) {
+    if (null != error?.sdk && 'string' === typeof error.code) {
+        return 'Request failed: ' + error.code;
+    }
+    // Node appends the compared values to a custom assertion message.
+    if ('ERR_ASSERTION' === error?.code && false === error.generatedMessage) {
+        return 'Assertion failed: ' + String(error.message).split('\n')[0];
+    }
+    return 'Request or assertion failed';
+}
+function liveIncomplete(report) {
+    return 0 < report.failed || 0 < report.blocked || 0 === report.attempted;
+}
 function assertLiveReport(report) {
-    if (report.failed || report.blocked || !report.attempted) {
+    if (liveIncomplete(report)) {
         throw new Error('Live coverage incomplete: ' + JSON.stringify(report));
     }
 }
+// An account with no record for a step to read skips in either mode.
+function settleLiveReport(report, settle = {}) {
+    if (liveIncomplete(report)) {
+        if (false !== settle.strict || null == settle.t)
+            return assertLiveReport(report);
+        return settle.t.skip('Live coverage incomplete (main.kit.test.live.strict is false): ' +
+            liveSummary(report));
+    }
+    if (0 < report.empty)
+        settle.t?.skip('Live coverage incomplete: ' + liveSummary(report));
+}
+function liveSummary(report) {
+    const open = report.results.filter(result => 'passed' !== result.state);
+    return 0 === open.length ? 'no request attempted' :
+        open.map(result => result.id + ' ' + result.state +
+            (result.reason ? ' (' + result.reason + ')' : '')).join('; ');
+}
 function createLiveTransport(timeoutMs = 30000) {
     let context;
     const requests = [];
@@ -109,8 +148,11 @@ function createLiveTransport(timeoutMs = 30000) {
         enter(next) { context = next; },
         fetch: async (input, init) => {
             const url = new URL(String(input));
+            // A credential can travel as the agent (auth.name), so only whether
+            // the request carried one is recorded, never its value.
             const request = {
                 method: init?.method || 'GET', path: url.origin + url.pathname,
+                agent: null == new Headers(init?.headers).get('user-agent') ? 'transport default' : 'configured',
             };
             requests.push(request);
             context?.requests.push(request);
@@ -121,6 +163,9 @@ function createLiveTransport(timeoutMs = 30000) {
             const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
             const response = await nativeFetch(input, { ...init, signal });
             request.status = response.status;
+            const type = response.headers.get('content-type');
+            if (type)
+                request.type = type.split(';')[0].trim();
             if (!context)
                 console.log('LIVE RESPONSE ' + JSON.stringify(request));
             return response;

package/project/.sdk/tm/js/test/live-scenarios.js

@@ -40,7 +40,7 @@ function recipeNeeds(value) {
         return [];
     return [...new Set([...(typeof value.from === 'string' ? [value.from] : []), ...Object.values(value).flatMap(recipeNeeds)])];
 }
-async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}) {
+async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}, settle = {}) {
     const transport = (0, live_runner_1.createLiveTransport)();
     const steps = plan.map(point => {
         const hint = point.facts.live || {};
@@ -53,10 +53,10 @@ async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}) {
                 // Every operation point is planned, not only the hinted ones; a hint
                 // only decides whether this file is generated. Absent a recipe there
                 // is no consent to call the operation, so block rather than
-                // synthesize input for it. Blocked fails assertLiveReport, so an
+                // synthesize input for it. A strict run fails a blocked step, so an
                 // omission surfaces instead of passing quietly.
                 if (!point.facts.live)
-                    throw new LiveBlocked('No live recipe: add a live hint for this operation in the guide, or give it an explicit excluded reason');
+                    throw new live_runner_1.LiveBlocked('No live recipe: add a live hint for this operation in the guide, or give it an explicit excluded reason');
                 if (point.contractVersion && point.contractVersion !== 1)
                     throw new live_runner_1.LiveBlocked('Unsupported operation contract version');
                 if (point.op === 'remove' || hint.cleanup) {
@@ -144,6 +144,6 @@ async function runLiveScenarios(SDK, plan, envPrefix, liveDefaults = {}) {
     });
     const report = await (0, live_runner_1.runLiveSteps)(steps, { delayMs: (0, utility_1.liveDelayMs)(), report: result => console.log('LIVE STEP ' + JSON.stringify(result)) });
     console.log('LIVE SUMMARY ' + JSON.stringify(report));
-    (0, live_runner_1.assertLiveReport)(report);
+    (0, live_runner_1.settleLiveReport)(report, settle);
     return report;
 }

package/project/.sdk/tm/js/test/pipeline.test.js

@@ -9,7 +9,7 @@
 const { test, describe } = require('node:test')
 const { strictEqual, ok, deepStrictEqual } = require('node:assert')
 
-const { stdutil } = require('..')
+const { ProjectNameSDK, stdutil } = require('..')
 
 
 const struct = stdutil.struct
@@ -79,6 +79,23 @@ describe('pipeline:makePoint + makeSpec', () => {
     strictEqual(stdutil.makePoint(base({ out: { point: preset } })), preset)
   })
 
+  test('an allow list names whole operations, in any case', () => {
+    const point = { method: 'GET', parts: ['a'] }
+    const op = { name: 'load', points: [point] }
+    strictEqual(stdutil.makePoint(base({ op, options: { allow: { op: 'reload,unload' } } })).code,
+      'point_op_allow')
+    strictEqual(stdutil.makePoint(base({ op, options: { allow: { op: 'list, LOAD' } } })), point)
+  })
+
+  test('an allow list names whole methods', () => {
+    const ctx = base({
+      op: { name: 'update', points: [] },
+      point: { method: 'pu', parts: ['a'] },
+      options: { allow: { method: 'GET,PUT' }, base: 'http://x' },
+    })
+    strictEqual(stdutil.makeSpec(ctx).code, 'spec_method_allow')
+  })
+
   test('makeSpec short-circuits a feature-supplied spec', () => {
     const preset = { method: 'GET' }
     strictEqual(stdutil.makeSpec(base({ out: { spec: preset } })), preset)
@@ -86,6 +103,20 @@ describe('pipeline:makePoint + makeSpec', () => {
 })
 
 
+describe('pipeline:direct', () => {
+
+  test('direct and graphql answer a method allow.method refuses with a result map', async () => {
+    const sdk = ProjectNameSDK.test({}, { allow: { method: 'GET' } })
+    const direct = await sdk.direct({ path: '/a', method: 'POST' })
+    strictEqual(direct.ok, false)
+    strictEqual(direct.err.code, 'spec_method_allow')
+    const graphql = await sdk.graphql('{ a }')
+    strictEqual(graphql.ok, false)
+    strictEqual(graphql.err.code, 'spec_method_allow')
+  })
+})
+
+
 describe('pipeline:makeResponse', () => {
 
   test('guards missing spec / response / result', async () => {
@@ -493,4 +524,24 @@ describe('pipeline:result helpers', () => {
     await stdutil.resultBody(ctx)
     strictEqual(ctx.result.body, undefined)
   })
+
+  // The agent and the body preview may carry a registered value; the body is
+  // cleaned before the bound so a split value cannot leave its prefix.
+  test('resultBody masks a registered value in the agent and across the preview bound', async () => {
+    const secret = 'PIPELINE-SECRET-a1b2c3d4e5f6'
+    const text = 'x'.repeat(150) + secret + 'y'.repeat(100)
+    const ctx = base({
+      options: { __derived__: { clean: { active: true, keys: [], values: [], mask: '[redacted]', hint: 0, min: 4 } } },
+      spec: { headers: { 'user-agent': 'Probe ' + secret } },
+      response: { body: 'body', json: async () => { throw Object.assign(new SyntaxError('bad json'), { text }) } },
+      result: { status: 200, headers: { 'content-type': 'text/html' } },
+    })
+    stdutil.cleanAdd(ctx, secret)
+    await stdutil.resultBody(ctx)
+    const message = String(ctx.result.err.message)
+    strictEqual(ctx.result.err.code, 'response_content_type')
+    ok(message.includes('user-agent Probe [redacted]'), message)
+    ok(message.includes('body: ' + 'x'.repeat(150) + '[redacted]'), message)
+    ok(!message.includes(secret.slice(0, 8)), message)
+  })
 })

package/project/.sdk/tm/js/test/utility.js

@@ -171,14 +171,37 @@ function maybeSkipControl(t, kind, name, live) {
     }
     return false;
 }
-function skipIfMissingIds(t, setup, requiredKeys) {
+// A live test without the ids its request needs is blocked rather than sent
+// with `undefined` in a path or query parameter. Returns true when skipped.
+function skipIfMissingIds(t, setup, requiredKeys, strict = true) {
     if (!setup.live)
         return false;
     const missing = requiredKeys.filter(k => null == setup.idmap?.[k]);
-    if (missing.length > 0) {
-        throw new Error(`Live test blocked: needs ${missing.join(', ')} via *_ENTID env var`);
+    return 0 < missing.length &&
+        liveMiss(t, strict, `Live test blocked: needs ${missing.join(', ')} via *_ENTID env var`);
+}
+// A live check that did not pass: strict fails the test, lenient skips it.
+function liveMiss(t, strict, reason) {
+    if (strict)
+        throw new Error(reason);
+    t.skip(reason);
+    return true;
+}
+// An empty list is a valid answer, so a test needing a record skips.
+function liveEmpty(t, reason) {
+    t.skip(reason);
+    return true;
+}
+// The SDK's error, already bounded and cleaned, or else status and content type.
+function describeLive(result) {
+    const err = result?.err;
+    if (null != err) {
+        return String(err.message || err.code || err);
     }
-    return false;
+    const headers = result?.headers;
+    const type = 'function' === typeof headers?.get ? headers.get('content-type') :
+        Object.entries(headers || {}).find(([k]) => 'content-type' === k.toLowerCase())?.[1];
+    return 'HTTP ' + result?.status + (type ? ' ' + String(type).split(';')[0] : '');
 }
 function loadEnvLocal(file) {
     let text;
@@ -232,6 +255,9 @@ module.exports = {
   isControlSkipped,
   maybeSkipControl,
   skipIfMissingIds,
+  liveMiss,
+  liveEmpty,
+  describeLive,
   loadEnvLocal,
   makeStepData,
   makeMatch,

package/project/.sdk/tm/kotlin/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ Voxgig
+Copyright (c) $$const.year$$ PROJECTPUBLISHER
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/kotlin/core/Context.kt

@@ -1,5 +1,6 @@
 package KOTLINPACKAGE.core
 
+import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.ThreadLocalRandom
 
 import KOTLINPACKAGE.utility.struct.Struct
@@ -143,7 +144,7 @@ class Context(ctxmap: MutableMap<String, Any?>?, basectx: Context?) {
       this.opmap = basectx.opmap
     }
     if (this.opmap == null) {
-      this.opmap = linkedMapOf()
+      this.opmap = ConcurrentHashMap()
     }
 
     // Data
@@ -214,7 +215,7 @@ class Context(ctxmap: MutableMap<String, Any?>?, basectx: Context?) {
     val opcfg = Struct.getpath(this.config, listOf("entity", entname, "op", opname))
 
     var input = "match"
-    if ("update" == opname || "create" == opname) {
+    if ("update" == opname || "create" == opname || "patch" == opname) {
       input = "data"
     }
 
@@ -237,8 +238,9 @@ class Context(ctxmap: MutableMap<String, Any?>?, basectx: Context?) {
 
     val op = Operation(opdef)
 
-    this.opmap!![cacheKey] = op
-    return op
+    // Requests on other threads share this cache; every one of them gets
+    // the Operation stored first.
+    return this.opmap!!.putIfAbsent(cacheKey, op) ?: op
   }
 
   fun makeError(code: String, msg: String): SdkError {