@voxgig/sdkgen 1.2.1 → 1.3.2

package/project/.sdk/tm/go/core/context.go

@@ -217,7 +217,17 @@ func NewContext(ctxmap map[string]any, basectx *Context) *Context {
 }
 
 func (ctx *Context) resolveOp(opname string) *Operation {
-	if op, ok := ctx.Opmap[opname]; ok && op != nil {
+	// Cache key is `<entity>:<opname>` so two entities with the same op
+	// (e.g. both have a "list") get distinct cached Operations. Keying on
+	// opname alone caused the first-resolved entity's points to be served
+	// to every subsequent entity's call.
+	entname := ""
+	if ctx.Entity != nil {
+		entname = ctx.Entity.GetName()
+	}
+	cacheKey := entname + ":" + opname
+
+	if op, ok := ctx.Opmap[cacheKey]; ok && op != nil {
 		return op
 	}
 
@@ -225,11 +235,6 @@ func (ctx *Context) resolveOp(opname string) *Operation {
 		return NewOperation(map[string]any{})
 	}
 
-	entname := ""
-	if ctx.Entity != nil {
-		entname = ctx.Entity.GetName()
-	}
-
 	opcfg := vs.GetPath([]any{"entity", entname, "op", opname}, ctx.Config)
 
 	input := "match"
@@ -258,7 +263,7 @@ func (ctx *Context) resolveOp(opname string) *Operation {
 		"points": targets,
 	})
 
-	ctx.Opmap[opname] = op
+	ctx.Opmap[cacheKey] = op
 	return op
 }
 

package/project/.sdk/tm/go-cli/src/feature/README.md

@@ -0,0 +1,6 @@
+# go-cli features
+
+The go-cli target does not generate per-feature source. Features are
+applied to the sibling Go SDK by the `go` target; the CLI consumes
+that SDK as a single dependency. This file exists only to satisfy
+the standard tm/<target>/src/feature/ folder convention.

package/project/.sdk/tm/go-mcp/src/feature/README.md

@@ -0,0 +1,6 @@
+# go-cli features
+
+The go-cli target does not generate per-feature source. Features are
+applied to the sibling Go SDK by the `go` target; the CLI consumes
+that SDK as a single dependency. This file exists only to satisfy
+the standard tm/<target>/src/feature/ folder convention.

package/project/.sdk/tm/js/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ $$const.Name$$
+Copyright (c) $$const.year$$ Voxgig
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/js/Makefile

@@ -0,0 +1,41 @@
+.PHONY: test build clean publish
+
+test:
+	npm test
+
+build:
+	@echo "No build step for JavaScript"
+
+clean:
+	rm -rf node_modules
+
+# --- Release: publish to npm ----------------------------------------------
+# Publish this package to npm, then tag js/vX.Y.Z. Run headless under the aql
+# key vault, which injects the npm auth token + the GitHub token (never on disk
+# or argv):
+#   aql vault exec --for=npm=<alias> --for=github=<alias> -- make publish
+# aql `--dry-run` injects a filler token we detect to rehearse (no publish/tag).
+# set -e + tag-last: a failed publish never leaves a tag behind.
+SHELL := /bin/bash
+VERSION := $(shell node -p "require('./package.json').version")
+TAG := js/v$(VERSION)
+AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+publish: test
+	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
+	  echo "tag $(TAG) already exists — bump package.json version first"; exit 1; fi
+	@set -e; \
+	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
+	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] aql filler token detected: would publish to npm and tag $(TAG); nothing pushed."; \
+	  exit 0; \
+	fi; \
+	npm publish --access public --registry https://registry.npmjs.org; \
+	git tag -a "$(TAG)" -m "js v$(VERSION)"; \
+	url=$$(git remote get-url origin | sed -E 's#^git@github.com:#https://github.com/#'); \
+	if [ -n "$$token" ] && printf '%s' "$$url" | grep -q '^https://github.com/'; then \
+	  hdr="AUTHORIZATION: basic $$(printf 'x-access-token:%s' "$$token" | base64 | tr -d '\n')"; \
+	  git -c http.extraheader="$$hdr" push "$$url" "$(TAG)"; \
+	else \
+	  git push origin "$(TAG)"; \
+	fi; \
+	echo "Published to npm + tag $(TAG)."

package/project/.sdk/tm/lua/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ $$const.Name$$
+Copyright (c) $$const.year$$ Voxgig
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/lua/Makefile

@@ -1,4 +1,4 @@
-.PHONY: test build clean
+.PHONY: test build clean publish
 
 test:
 	busted -p _test test/
@@ -8,3 +8,42 @@ build:
 
 clean:
 	@echo "No clean step for Lua"
+
+# --- Release: publish to LuaRocks -----------------------------------------
+# Upload the rockspec to LuaRocks, then tag lua/vX.Y.Z. LuaRocks has no aql
+# recipe, so inject its API key + the GitHub token as custom env vars
+# (all-positional — aql cannot mix --for recipes with positional env):
+#   aql vault exec '<alias>=LUAROCKS_API_KEY,<gh-alias>=GITHUB_TOKEN' -- make publish
+# --skip-pack uploads only the rockspec (its git+https source is fetched at the
+# lua/vX.Y.Z tag on install; that tag is pushed in the LAST step, so we must not
+# pack here). LuaRocks requires the rockspec filename to be
+# <package>-<version>.rockspec, so we upload a canonically-named copy. aql
+# `--dry-run` rehearses (no upload/tag). set -e + tag-last: a failed upload
+# never leaves a tag behind.
+VERSION := $(shell sed -nE 's/^version *= *"([0-9.]+).*/\1/p' *.rockspec | head -1)
+TAG := lua/v$(VERSION)
+AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+publish: test
+	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
+	  echo "tag $(TAG) already exists — bump the rockspec version first"; exit 1; fi
+	@set -e; \
+	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
+	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$LUAROCKS_API_KEY" = "$(AQL_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] aql filler token detected: would upload to LuaRocks and tag $(TAG); nothing pushed."; \
+	  exit 0; \
+	fi; \
+	rock=$$(ls *.rockspec | head -1); \
+	pkg=$$(sed -nE 's/^package *= *"([^"]+)".*/\1/p' "$$rock" | head -1); \
+	rev=$$(sed -nE 's/^version *= *"([^"]+)".*/\1/p' "$$rock" | head -1); \
+	cp "$$rock" "$$pkg-$$rev.rockspec"; \
+	luarocks upload --skip-pack "$$pkg-$$rev.rockspec" --temp-key="$$LUAROCKS_API_KEY"; \
+	rm -f "$$pkg-$$rev.rockspec"; \
+	git tag -a "$(TAG)" -m "lua v$(VERSION)"; \
+	url=$$(git remote get-url origin | sed -E 's#^git@github.com:#https://github.com/#'); \
+	if [ -n "$$token" ] && printf '%s' "$$url" | grep -q '^https://github.com/'; then \
+	  hdr="AUTHORIZATION: basic $$(printf 'x-access-token:%s' "$$token" | base64 | tr -d '\n')"; \
+	  git -c http.extraheader="$$hdr" push "$$url" "$(TAG)"; \
+	else \
+	  git push origin "$(TAG)"; \
+	fi; \
+	echo "Published to LuaRocks + tag $(TAG)."

package/project/.sdk/tm/lua/core/context.lua

@@ -160,17 +160,22 @@ end
 
 
 function Context:resolve_op(opname)
-  if self.opmap[opname] ~= nil then
-    return self.opmap[opname]
+  -- Cache key is `<entity>:<opname>` so two entities with the same op
+  -- (e.g. both have a "list") get distinct cached Operations. Keying
+  -- on opname alone caused the first-resolved entity's points to be
+  -- served to every subsequent entity's call.
+  local entname = "_"
+  if self.entity ~= nil and type(self.entity.get_name) == "function" then
+    entname = self.entity:get_name()
   end
+  local cache_key = entname .. ":" .. opname
 
-  if opname == "" then
-    return Operation.new({})
+  if self.opmap[cache_key] ~= nil then
+    return self.opmap[cache_key]
   end
 
-  local entname = "_"
-  if self.entity ~= nil and type(self.entity.get_name) == "function" then
-    entname = self.entity:get_name()
+  if opname == "" then
+    return Operation.new({})
   end
 
   local opcfg = vs.getpath(self.config, "entity." .. entname .. ".op." .. opname)
@@ -195,7 +200,7 @@ function Context:resolve_op(opname)
     points = points,
   })
 
-  self.opmap[opname] = op
+  self.opmap[cache_key] = op
   return op
 end
 

package/project/.sdk/tm/php/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ $$const.Name$$
+Copyright (c) $$const.year$$ Voxgig
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/php/Makefile

@@ -1,4 +1,4 @@
-.PHONY: test build clean
+.PHONY: test build clean publish
 
 test:
 	./vendor/bin/phpunit test
@@ -8,3 +8,33 @@ build:
 
 clean:
 	@echo "No clean step for PHP"
+
+# --- Release: tag for Packagist -------------------------------------------
+# Packagist has no upload — it tracks the repo and indexes each git tag
+# php/vX.Y.Z (a configured GitHub webhook, or the Packagist "Update" API,
+# refreshes the package). So publishing a version means pushing the tag. Run
+# headless under the aql key vault, which injects the GitHub token:
+#   aql vault exec --for=github=<alias> -- make publish
+# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+# set -e + tag-last: a failed push never leaves a tag behind.
+VERSION := $(shell cat VERSION)
+TAG := php/v$(VERSION)
+AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+publish: test
+	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
+	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
+	@set -e; \
+	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
+	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] aql filler token detected: would tag $(TAG) for Packagist; nothing pushed."; \
+	  exit 0; \
+	fi; \
+	git tag -a "$(TAG)" -m "php v$(VERSION)"; \
+	url=$$(git remote get-url origin | sed -E 's#^git@github.com:#https://github.com/#'); \
+	if [ -n "$$token" ] && printf '%s' "$$url" | grep -q '^https://github.com/'; then \
+	  hdr="AUTHORIZATION: basic $$(printf 'x-access-token:%s' "$$token" | base64 | tr -d '\n')"; \
+	  git -c http.extraheader="$$hdr" push "$$url" "$(TAG)"; \
+	else \
+	  git push origin "$(TAG)"; \
+	fi; \
+	echo "Tagged $(TAG) for Packagist."

package/project/.sdk/tm/php/VERSION

@@ -0,0 +1 @@
+0.0.1

package/project/.sdk/tm/php/core/Context.php

@@ -100,16 +100,22 @@ class ProjectNameContext
 
     public function resolve_op(string $opname): ProjectNameOperation
     {
-        if (isset($this->opmap[$opname])) {
-            return $this->opmap[$opname];
+        // Cache key is `<entity>:<opname>` so two entities with the same op
+        // (e.g. both have a "list") get distinct cached Operations. Keying
+        // on opname alone caused the first-resolved entity's points to be
+        // served to every subsequent entity's call.
+        $entname = (is_object($this->entity) && method_exists($this->entity, 'get_name'))
+            ? $this->entity->get_name()
+            : '_';
+        $cacheKey = $entname . ':' . $opname;
+
+        if (isset($this->opmap[$cacheKey])) {
+            return $this->opmap[$cacheKey];
         }
         if ($opname === '') {
             return new ProjectNameOperation([]);
         }
 
-        $entname = (is_object($this->entity) && method_exists($this->entity, 'get_name'))
-            ? $this->entity->get_name()
-            : '_';
         $opcfg = \Voxgig\Struct\Struct::getpath($this->config, "entity.{$entname}.op.{$opname}");
 
         $input = ($opname === 'update' || $opname === 'create') ? 'data' : 'match';
@@ -128,7 +134,7 @@ class ProjectNameContext
             'input' => $input,
             'points' => $points,
         ]);
-        $this->opmap[$opname] = $op;
+        $this->opmap[$cacheKey] = $op;
         return $op;
     }
 

package/project/.sdk/tm/php/test/PrimaryUtilityTest.php

@@ -405,7 +405,11 @@ class PrimaryUtilityTest extends TestCase
             $ctxmap = $entry['ctx'] ?? [];
             $ctx = self::make_ctx_from_map($ctxmap, $client, $utility);
             self::fixctx($ctx, $client);
-            return ($utility->done)($ctx);
+            // done now returns the bare result data (or raises on error, which
+            // runset catches). Re-wrap success into a (result, err) tuple so the
+            // data-driven spec matcher keeps working.
+            $out = ($utility->done)($ctx);
+            return [$out, null];
         });
     }
 
@@ -437,7 +441,11 @@ class PrimaryUtilityTest extends TestCase
                 $err = self::err_from_map($args[1]);
             }
 
-            return ($utility->make_error)($ctx, $err);
+            // make_error now RAISES the constructed exception (default throw
+            // path); runset catches it. On the no-throw path it returns the
+            // bare result data, which we re-wrap into a (result, err) tuple.
+            $out = ($utility->make_error)($ctx, $err);
+            return [$out, null];
         });
     }
 
@@ -455,8 +463,9 @@ class PrimaryUtilityTest extends TestCase
             'resdata' => ['id' => 'safe01'],
         ]);
 
-        [$out, $err] = ($utility->make_error)($ctx, $ctx->make_error('test_code', 'test message'));
-        $this->assertNull($err, 'expected no error');
+        // throw_err === false: make_error returns the bare result data instead
+        // of raising (the result-object / no-throw escape hatch).
+        $out = ($utility->make_error)($ctx, $ctx->make_error('test_code', 'test message'));
         $this->assertIsArray($out);
         $this->assertEquals('safe01', $out['id']);
     }

package/project/.sdk/tm/php/utility/Done.php

@@ -5,7 +5,7 @@ declare(strict_types=1);
 
 class ProjectNameDone
 {
-    public static function call(ProjectNameContext $ctx): array
+    public static function call(ProjectNameContext $ctx): mixed
     {
         if ($ctx->ctrl->explain) {
             $ctx->ctrl->explain = ($ctx->utility->clean)($ctx, $ctx->ctrl->explain);
@@ -19,7 +19,7 @@ class ProjectNameDone
             if (is_object($resdata)) {
                 $resdata = (array)$resdata;
             }
-            return [$resdata, null];
+            return $resdata;
         }
         return ($ctx->utility->make_error)($ctx, null);
     }

package/project/.sdk/tm/php/utility/MakeError.php

@@ -9,7 +9,7 @@ require_once __DIR__ . '/../core/Error.php';
 
 class ProjectNameMakeError
 {
-    public static function call(?ProjectNameContext $ctx, mixed $err): array
+    public static function call(?ProjectNameContext $ctx, mixed $err): mixed
     {
         if ($ctx === null) {
             require_once __DIR__ . '/../core/Context.php';
@@ -52,8 +52,8 @@ class ProjectNameMakeError
         $ctx->ctrl->err = $sdk_err;
 
         if ($ctx->ctrl->throw_err === false) {
-            return [$result->resdata, null];
+            return $result->resdata;
         }
-        return [null, $sdk_err];
+        throw $sdk_err;
     }
 }

package/project/.sdk/tm/py/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ $$const.Name$$
+Copyright (c) $$const.year$$ Voxgig
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/py/Makefile

@@ -1,4 +1,4 @@
-.PHONY: test build clean
+.PHONY: test build clean publish
 
 test:
 	python -m pytest test/
@@ -8,3 +8,36 @@ build:
 
 clean:
 	find . -name __pycache__ -exec rm -rf {} + 2>/dev/null; true
+
+# --- Release: publish to PyPI ---------------------------------------------
+# Publish this package to PyPI, then tag py/vX.Y.Z. Run headless under the aql
+# key vault, which injects the PyPI + GitHub tokens as environment variables
+# (never written to disk or argv):
+#   aql vault exec --for=pypi=<alias> --for=github=<alias> -- make publish
+# aql `--dry-run` injects a filler token we detect to rehearse: builds the dist
+# but performs no upload, tag, or push. set -e + tag-last: a failed upload never
+# leaves a tag behind. Needs python `build` + `twine` (pip install build twine).
+VERSION := $(shell sed -nE 's/^version *= *"([^"]+)".*/\1/p' pyproject.toml | head -1)
+TAG := py/v$(VERSION)
+AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+publish: test
+	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
+	  echo "tag $(TAG) already exists — bump pyproject.toml version first"; exit 1; fi
+	@set -e; \
+	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
+	rm -rf dist; \
+	python3 -m build; \
+	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$TWINE_PASSWORD" = "$(AQL_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] aql filler token detected: built the dist; would upload to PyPI and tag $(TAG); nothing pushed."; \
+	  exit 0; \
+	fi; \
+	python3 -m twine upload dist/*; \
+	git tag -a "$(TAG)" -m "py v$(VERSION)"; \
+	url=$$(git remote get-url origin | sed -E 's#^git@github.com:#https://github.com/#'); \
+	if [ -n "$$token" ] && printf '%s' "$$url" | grep -q '^https://github.com/'; then \
+	  hdr="AUTHORIZATION: basic $$(printf 'x-access-token:%s' "$$token" | base64 | tr -d '\n')"; \
+	  git -c http.extraheader="$$hdr" push "$$url" "$(TAG)"; \
+	else \
+	  git push origin "$(TAG)"; \
+	fi; \
+	echo "Published to PyPI + tag $(TAG)."

package/project/.sdk/tm/py/core/context.py

@@ -163,15 +163,20 @@ class ProjectNameContext:
         self.op = self.resolve_op(opname)
 
     def resolve_op(self, opname):
-        if opname in self.opmap:
-            return self.opmap[opname]
-
-        if opname == "":
-            return ProjectNameOperation({})
-
+        # Cache key is `<entity>:<opname>` so two entities with the same op
+        # (e.g. both have a "list") get distinct cached Operations. Keying
+        # on opname alone caused the first-resolved entity's points to be
+        # served to every subsequent entity's call.
         entname = "_"
         if self.entity is not None and hasattr(self.entity, "get_name") and callable(self.entity.get_name):
             entname = self.entity.get_name()
+        cache_key = entname + ":" + opname
+
+        if cache_key in self.opmap:
+            return self.opmap[cache_key]
+
+        if opname == "":
+            return ProjectNameOperation({})
 
         opcfg = vs.getpath(self.config, "entity." + entname + ".op." + opname)
 
@@ -192,7 +197,7 @@ class ProjectNameContext:
             "points": points,
         })
 
-        self.opmap[opname] = op
+        self.opmap[cache_key] = op
         return op
 
     def make_error(self, code, msg):

package/project/.sdk/tm/py/test/test_primary_utility.py

@@ -329,7 +329,12 @@ class TestPrimaryUtility:
                 ctxmap = {}
             ctx = _make_ctx_from_map(ctxmap, client, utility)
             _fixctx(ctx, client)
-            return utility.done(ctx)
+            # done() returns the bare result data on success and raises on
+            # error. Adapt to the (result, err) shape the runner expects.
+            try:
+                return utility.done(ctx), None
+            except ProjectNameError as e:
+                return None, e
 
         _runset(_get_spec(primary, "done", "basic"), subject)
 
@@ -356,7 +361,12 @@ class TestPrimaryUtility:
                 if isinstance(err_map, dict):
                     err = _err_from_map(err_map)
 
-            return utility.make_error(ctx, err)
+            # make_error() raises the constructed exception on the default
+            # (throw) path. Adapt to the (result, err) shape the runner expects.
+            try:
+                return utility.make_error(ctx, err), None
+            except ProjectNameError as e:
+                return None, e
 
         _runset(_get_spec(primary, "makeError", "basic"), subject)
 
@@ -370,8 +380,9 @@ class TestPrimaryUtility:
             "resdata": {"id": "safe01"},
         })
 
-        out, err = utility.make_error(ctx, ctx.make_error("test_code", "test message"))
-        assert err is None
+        # throw_err is False: make_error returns the bare result data instead
+        # of raising (the result-object / no-throw escape hatch).
+        out = utility.make_error(ctx, ctx.make_error("test_code", "test message"))
         assert isinstance(out, dict)
         assert out["id"] == "safe01"
 

package/project/.sdk/tm/py/test/test_struct_utility.py

@@ -516,7 +516,7 @@ class TestStructUtility(unittest.TestCase):
 
     # -------------------------------------------------
     # transform tests
-    # Inputs and expected outputs: build/test/transform.jsonic
+    # Inputs and expected outputs: build/test/transform.aontu
     # -------------------------------------------------
 
     def test_transform_basic(self):

package/project/.sdk/tm/py/utility/done.py

@@ -9,6 +9,8 @@ def done_util(ctx):
             explain_result.pop("err", None)
 
     if ctx.result is not None and ctx.result.ok:
-        return ctx.result.resdata, None
+        return ctx.result.resdata
 
+    # make_error raises on the default (throw) path; only returns bare
+    # resdata when throw_err is explicitly disabled.
     return ctx.utility.make_error(ctx, None)

package/project/.sdk/tm/py/utility/make_error.py

@@ -59,6 +59,6 @@ def make_error_util(ctx, err):
     ctx.ctrl.err = sdk_err
 
     if ctx.ctrl.throw_err is False:
-        return result.resdata, None
+        return result.resdata
 
-    return None, sdk_err
+    raise sdk_err

package/project/.sdk/tm/rb/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ $$const.Name$$
+Copyright (c) $$const.year$$ Voxgig
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/rb/Makefile

@@ -1,10 +1,44 @@
-.PHONY: test build clean
+.PHONY: test build clean publish
 
+# Run the WHOLE suite (entity, direct, utility, and readme-example tests) —
+# a single-file invocation here leaves the rest of test/ silently unrun.
 test:
-	ruby -Ilib test/exists_test.rb
+	ruby -Ilib -Itest -e 'Dir.glob("./test/*_test.rb").each { |f| require f }'
 
 build:
 	@echo "No build step for Ruby"
 
 clean:
 	@echo "No clean step for Ruby"
+
+# --- Release: publish to RubyGems -----------------------------------------
+# Build the gem and push it to RubyGems, then tag rb/vX.Y.Z. Run headless under
+# the aql key vault, which injects GEM_HOST_API_KEY + the GitHub token (never on
+# disk or argv):
+#   aql vault exec --for=gem=<alias> --for=github=<alias> -- make publish
+# aql `--dry-run` injects a filler token we detect to rehearse (build only, no
+# push/tag). set -e + tag-last: a failed push never leaves a tag behind.
+VERSION := $(shell sed -nE 's/.*\.version *= *"([^"]+)".*/\1/p' *.gemspec | head -1)
+TAG := rb/v$(VERSION)
+AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+publish: test
+	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
+	  echo "tag $(TAG) already exists — bump the gemspec version first"; exit 1; fi
+	@set -e; \
+	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
+	rm -f *.gem; \
+	gem build *.gemspec; \
+	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$GEM_HOST_API_KEY" = "$(AQL_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] aql filler token detected: built the gem; would push to RubyGems and tag $(TAG); nothing pushed."; \
+	  exit 0; \
+	fi; \
+	gem push *.gem; \
+	git tag -a "$(TAG)" -m "rb v$(VERSION)"; \
+	url=$$(git remote get-url origin | sed -E 's#^git@github.com:#https://github.com/#'); \
+	if [ -n "$$token" ] && printf '%s' "$$url" | grep -q '^https://github.com/'; then \
+	  hdr="AUTHORIZATION: basic $$(printf 'x-access-token:%s' "$$token" | base64 | tr -d '\n')"; \
+	  git -c http.extraheader="$$hdr" push "$$url" "$(TAG)"; \
+	else \
+	  git push origin "$(TAG)"; \
+	fi; \
+	echo "Published to RubyGems + tag $(TAG)."

package/project/.sdk/tm/rb/core/context.rb

@@ -75,10 +75,15 @@ class ProjectNameContext
   end
 
   def resolve_op(opname)
-    return @opmap[opname] if @opmap[opname]
+    # Cache key is `<entity>:<opname>` so two entities with the same op
+    # (e.g. both have a "list") get distinct cached Operations. Keying
+    # on opname alone caused the first-resolved entity's points to be
+    # served to every subsequent entity's call.
+    entname = @entity&.respond_to?(:get_name) ? @entity.get_name : "_"
+    cache_key = "#{entname}:#{opname}"
+    return @opmap[cache_key] if @opmap[cache_key]
     return ProjectNameOperation.new({}) if opname.empty?
 
-    entname = @entity&.respond_to?(:get_name) ? @entity.get_name : "_"
     opcfg = VoxgigStruct.getpath(@config, "entity.#{entname}.op.#{opname}")
 
     input = (opname == "update" || opname == "create") ? "data" : "match"
@@ -95,7 +100,7 @@ class ProjectNameContext
       "input" => input,
       "points" => points,
     })
-    @opmap[opname] = op
+    @opmap[cache_key] = op
     op
   end
 

package/project/.sdk/tm/rb/test/primary_utility_test.rb

@@ -101,8 +101,8 @@ class PrimaryUtilityTest < Minitest::Test
       "resdata" => { "id" => "safe01" },
     })
 
-    out, err = @utility.make_error.call(ctx, ctx.make_error("test_code", "test message"))
-    assert_nil err, "expected no error"
+    # Opt-out path: throw_err disabled -> returns the bare result data, no raise.
+    out = @utility.make_error.call(ctx, ctx.make_error("test_code", "test message"))
     assert out.is_a?(Hash), "expected hash result, got: #{out.class}"
     assert_equal "safe01", out["id"], "expected id=safe01"
   end