Function validation_pipeline_from_config 

pub fn validation_pipeline_from_config(
    config: &ServerConfig,
) -> Result<ValidationPipeline>

Build a ValidationPipeline from a ServerConfig’s [code_mode] block.

Maps every reference-server CodeModeSection field onto CodeModeConfig per the verified construction surface in CODE_MODE_API_NOTES.md Section 2. The pipeline’s HMAC token machinery is keyed by the resolved TokenSecret (derived from a toolkit-owned SecretValue per review R6).

Per Phase 83 review R1 — the preflight selected the R1 split because pmcp-code-mode’s CodeExecutor requires backend injection (HttpExecutor / SdkExecutor / McpExecutor); no config-only executor constructor exists. This function delivers the validation surface; the caller supplies the executor (see code_mode_tools_from_executor).

Errors

• ToolkitError::CodeMode if config.code_mode is None.
• ToolkitError::Validation wrapping ConfigValidationError::InlineSecretRejected when token_secret is an inline literal without allow_inline_token_secret_for_dev (review R9).
• ToolkitError::CodeMode if the env var referenced by env:VAR_NAME is unset, or if the resolved secret is shorter than HmacTokenGenerator::MIN_SECRET_LEN (16 bytes).

Example

use pmcp_server_toolkit::code_mode::validation_pipeline_from_config;
use pmcp_server_toolkit::config::ServerConfig;

// ServerConfig with a [code_mode] block + env:-style token_secret
// resolves into a ValidationPipeline ready to validate SQL / GraphQL.
let toml = r#"
[server]
name = "demo"
version = "0.1.0"
[code_mode]
enabled = true
token_secret = "env:DEMO_HMAC_SECRET"
"#;
std::env::set_var("DEMO_HMAC_SECRET", "demo-secret-that-is-long-enough");
let cfg = ServerConfig::from_toml_strict_validated(toml).unwrap();
let _pipeline = validation_pipeline_from_config(&cfg).unwrap();