@voxgig/sdkgen 1.3.18 → 1.3.19

package/project/.sdk/src/cmp/ts/fragment/Config.fragment.ts

@@ -19,7 +19,7 @@ class Config {
 
 
   main = {
-    name: 'ProjectName',
+    name: '$$const.Name$$',
   }
 
 
@@ -31,7 +31,7 @@ class Config {
   options = {
     base: '$$main.kit.info.servers.0.url$$',
 
-    'AUTHBLOCK'headers: 'HEADERS',
+    'SERVERBLOCK''AUTHBLOCK'headers: 'HEADERS',
 
     entity: {
       // #EntityConfigs

package/project/.sdk/src/cmp/ts/fragment/Direct.test.fragment.ts

@@ -24,6 +24,10 @@ describe('EntityNameDirect', async () => {
 
   test('direct-exists', async () => {
     const sdk = new ProjectNameSDK({
+      // Concrete base: a live construction must satisfy any server
+      // variables a templated base URL declares; overriding base with a
+      // literal (as the direct flow tests do) sidesteps the requirement.
+      base: 'http://localhost:8080',
       system: { fetch: async () => ({}) }
     })
     assert('function' === typeof sdk.direct)

package/project/.sdk/tm/csharp/Makefile

@@ -15,21 +15,21 @@ clean:
 # publishing a version currently means pushing the tag csharp/vX.Y.Z. When the
 # registry goes live, `dotnet pack` + `dotnet nuget push` slot in before the
 # tag (mirroring the voxgig/struct csharp Makefile). Run headless under the
-# aql key vault, which injects the GitHub token so nothing lands on disk or
+# boru key vault, which injects the GitHub token so nothing lands on disk or
 # argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell cat VERSION)
 TAG := csharp/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "csharp v$(VERSION)"; \

package/project/.sdk/tm/dart/Makefile

@@ -22,14 +22,14 @@ clean:
 # the tag. set -e + tag-last: a failed upload never leaves a tag behind.
 VERSION := $(shell sed -nE 's/^version: *([0-9][^ ]*).*/\1/p' pubspec.yaml | head -1)
 TAG := dart/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump pubspec.yaml version first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would publish to pub.dev and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would publish to pub.dev and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	if [ -n "$$PUB_CREDENTIALS" ]; then \

package/project/.sdk/tm/go/Makefile

@@ -13,10 +13,10 @@ clean:
 # Go modules have no registry upload — publishing a version means pushing the
 # tag go/vX.Y.Z (this module is the go/ subdir, and Go's submodule-tag
 # convention is <subdir>/vX.Y.Z), which the module proxy + pkg.go.dev pick up on
-# first fetch. Run headless under the aql key vault, which injects the GitHub
+# first fetch. Run headless under the boru key vault, which injects the GitHub
 # token so nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 #
 # NOTE: publishing the git tag is deliberately NOT gated on `go test` (every
@@ -24,14 +24,14 @@ clean:
 # block the module tag). Run `make test` separately in CI to gate quality.
 VERSION := $(shell cat VERSION)
 TAG := go/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish:
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG) for pkg.go.dev; nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG) for pkg.go.dev; nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "go v$(VERSION)"; \

package/project/.sdk/tm/go/test/primary_utility_test.go

@@ -252,6 +252,10 @@ func TestPrimaryUtility(t *testing.T) {
 	t.Run("fetcher-live", func(t *testing.T) {
 		calls := []map[string]any{}
 		liveClient := sdk.NewProjectNameSDK(map[string]any{
+			// Concrete base: a live construction must satisfy any server
+			// variables a templated base URL declares; a literal base
+			// sidesteps the requirement.
+			"base": "http://localhost:8080",
 			"system": map[string]any{
 				"fetch": func(url string, fetchdef map[string]any) (map[string]any, error) {
 					calls = append(calls, map[string]any{"url": url, "init": fetchdef})
@@ -282,6 +286,7 @@ func TestPrimaryUtility(t *testing.T) {
 	t.Run("fetcher-blocked-test-mode", func(t *testing.T) {
 		// Create a live SDK then set mode to test (not using TestSDK, which installs test feature)
 		blockedClient := sdk.NewProjectNameSDK(map[string]any{
+			"base": "http://localhost:8080",
 			"system": map[string]any{
 				"fetch": func(url string, fetchdef map[string]any) (map[string]any, error) {
 					return map[string]any{}, nil

package/project/.sdk/tm/go/utility/make_options.go

@@ -1,6 +1,7 @@
 package utility
 
 import (
+	"regexp"
 	"sort"
 	"strings"
 
@@ -9,6 +10,9 @@ import (
 	"GOMODULE/core"
 )
 
+// {name} placeholders in a templated server URL (OpenAPI server variables).
+var serverVarRe = regexp.MustCompile(`\{[A-Za-z0-9_]+\}`)
+
 func makeOptionsUtil(ctx *core.Context) map[string]any {
 	options := ctx.Options
 	if options == nil {
@@ -108,6 +112,13 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 		"clean": map[string]any{
 			"keys": "key,token,id",
 		},
+		// Server-variable values for a templated base URL (OpenAPI server
+		// variables): {name} placeholders in "base" are substituted from this
+		// map at construction. Spec defaults arrive via the generated config;
+		// user values override them.
+		"server": map[string]any{
+			"`$CHILD`": "",
+		},
 	}
 
 	// Preserve system.fetch before merge/validate.
@@ -120,6 +131,43 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 	validated, _ := vs.Validate(merged, optspec)
 	opts = validated.(map[string]any)
 
+	// Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+	// Every placeholder must resolve to a non-empty value: from
+	// options["server"] (user), else the config default. A placeholder that
+	// resolves to "" is a construction error in live mode — the URL cannot
+	// work — but in test mode substitutes the deterministic value
+	// "test-<name>" so offline tests need no configuration. The SDK
+	// constructor has no error return, so a missing required variable
+	// PANICS (construction-time misconfiguration, as regexp.MustCompile).
+	if base, ok := opts["base"].(string); ok && strings.Contains(base, "{") {
+		testmode := false
+		if ta, ok := vs.GetPath([]any{"test", "active"}, opts).(bool); ok && ta {
+			testmode = true
+		}
+		if fa, ok := vs.GetPath([]any{"feature", "test", "active"}, opts).(bool); ok && fa {
+			testmode = true
+		}
+		server := core.ToMapAny(opts["server"])
+		sdkname := "SDK"
+		if mn, ok := vs.GetPath([]any{"main", "name"}, config).(string); ok && mn != "" {
+			sdkname = mn
+		}
+		resolved := serverVarRe.ReplaceAllStringFunc(base, func(ph string) string {
+			name := ph[1 : len(ph)-1]
+			val, _ := server[name].(string)
+			if val == "" {
+				if testmode {
+					return "test-" + name
+				}
+				panic(sdkname + ": the server variable '" + name + "' is required: " +
+					"the API base URL is '" + base + "' — pass " +
+					`options["server"].(map)["` + name + `"] in the SDK options`)
+			}
+			return val
+		})
+		opts["base"] = resolved
+	}
+
 	// Restore system.fetch.
 	if sysFetch != nil {
 		if sys, ok := opts["system"]; ok {

package/project/.sdk/tm/java/Makefile

@@ -12,10 +12,10 @@ clean:
 # --- Release: tag java/vX.Y.Z ----------------------------------------------
 # Maven Central publication (Sonatype Central Portal) is pending for this
 # target; publishing a version currently means pushing the java/vX.Y.Z git
-# tag. Run headless under the aql key vault, which injects the GitHub token
+# tag. Run headless under the boru key vault, which injects the GitHub token
 # so nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 #
 # NOTE: publishing the git tag is deliberately NOT gated on `mvn test` (every
@@ -23,14 +23,14 @@ clean:
 # block the tag). Run `make test` separately in CI to gate quality.
 VERSION := $(shell cat VERSION)
 TAG := java/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish:
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "java v$(VERSION)"; \

package/project/.sdk/tm/js/Makefile

@@ -10,23 +10,23 @@ clean:
 	rm -rf node_modules
 
 # --- Release: publish to npm ----------------------------------------------
-# Publish this package to npm, then tag js/vX.Y.Z. Run headless under the aql
+# Publish this package to npm, then tag js/vX.Y.Z. Run headless under the boru
 # key vault, which injects the npm auth token + the GitHub token (never on disk
 # or argv):
-#   aql vault exec --for=npm=<alias> --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no publish/tag).
+#   boru vault exec --for=npm=<alias> --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no publish/tag).
 # set -e + tag-last: a failed publish never leaves a tag behind.
 SHELL := /bin/bash
 VERSION := $(shell node -p "require('./package.json').version")
 TAG := js/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump package.json version first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would publish to npm and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would publish to npm and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	npm stage publish --access public --registry https://registry.npmjs.org; \

package/project/.sdk/tm/js/src/utility/MakeOptionsUtility.js

@@ -79,16 +79,54 @@ function makeOptions(ctx) {
     },
     clean: {
       keys: 'key,token,id'
+    },
+    // Server-variable values for a templated base URL (OpenAPI server
+    // variables): `{name}` placeholders in `base` are substituted from
+    // this map at construction. Spec defaults arrive via the generated
+    // Config; user values override them.
+    server: {
+      '`$CHILD`': ''
     }
   }
 
   // JavaScript specific option values.
   optspec.system.fetch = opts.system?.fetch || global.fetch
 
-  opts = merge([{}, cfgopts, opts])
+  // Clone the config side before merging: `config` is a module-level
+  // singleton in ts/js, and merge would otherwise use its nested maps as
+  // merge TARGETS — one instance's options (server, headers, ...) would
+  // contaminate every instance constructed after it.
+  opts = merge([{}, struct.clone(cfgopts), opts])
 
   opts = validate(opts, optspec)
 
+  // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+  // Every placeholder must resolve to a non-empty value: from
+  // options.server (user), else the Config default. A placeholder that
+  // resolves to '' is a construction ERROR in live mode — the URL cannot
+  // work — but in test mode substitutes the deterministic value
+  // `test-<name>` so offline tests need no configuration.
+  if ('string' === typeof opts.base && opts.base.includes('{')) {
+    const testmode = true === opts.test.active ||
+      true === (opts.feature && opts.feature.test && opts.feature.test.active)
+    const server = opts.server || {}
+    opts.base = opts.base.replace(/\{([A-Za-z0-9_]+)\}/g,
+      (_m, name) => {
+        let val = server[name]
+        val = 'string' === typeof val ? val : ''
+        if ('' === val) {
+          if (testmode) {
+            return 'test-' + name
+          }
+          throw new Error(
+            (config?.main?.name || 'SDK') + ": the server variable '" + name +
+            "' is required: the API base URL is '" + opts.base +
+            "' — pass { server: { " + name + ": '...' } } in the SDK options")
+        }
+        return val
+      })
+  }
+
   // Resolve the feature add-order: an explicit array order (above) wins;
   // otherwise order the map test-first, then the remaining names sorted, so
   // the outcome is deterministic and `test` is always the base transport.

package/project/.sdk/tm/js/test/utility/PrimaryUtility.test.js

@@ -205,6 +205,9 @@ describe('PrimaryUtility', async () => {
       body: 'present',
     })
     const reqClient = new SDK({
+      // Concrete base: a live construction must satisfy any server variables
+      // a templated base URL declares; a literal base sidesteps the requirement.
+      base: 'http://localhost:8080',
       system: { fetch: mockFetch }
     })
     const reqUtility = reqClient.utility()
@@ -386,6 +389,7 @@ describe('PrimaryUtility', async () => {
   test('fetcher-live', async () => {
     const calls = []
     const liveClient = new SDK({
+      base: 'http://localhost:8080',
       system: {
         fetch: async (url, init) => {
           calls.push({ url, init })
@@ -407,6 +411,7 @@ describe('PrimaryUtility', async () => {
 
   test('fetcher-blocked-test-mode', async () => {
     const blockedClient = new SDK({
+      base: 'http://localhost:8080',
       system: { fetch: async () => ({}) }
     })
     blockedClient._mode = 'test'

package/project/.sdk/tm/kotlin/Makefile

@@ -16,20 +16,20 @@ clean:
 # --- Release: tag kotlin/vX.Y.Z ---------------------------------------------
 # Maven Central publication (Sonatype Central Portal) is pending for this
 # target; publishing a version currently means pushing the kotlin/vX.Y.Z git
-# tag. Run headless under the aql key vault, which injects the GitHub token
+# tag. Run headless under the boru key vault, which injects the GitHub token
 # so nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 VERSION := $(shell cat VERSION)
 TAG := kotlin/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish:
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "kotlin v$(VERSION)"; \

package/project/.sdk/tm/lua/Makefile

@@ -10,26 +10,26 @@ clean:
 	@echo "No clean step for Lua"
 
 # --- Release: publish to LuaRocks -----------------------------------------
-# Upload the rockspec to LuaRocks, then tag lua/vX.Y.Z. LuaRocks has no aql
+# Upload the rockspec to LuaRocks, then tag lua/vX.Y.Z. LuaRocks has no boru
 # recipe, so inject its API key + the GitHub token as custom env vars
-# (all-positional — aql cannot mix --for recipes with positional env):
-#   aql vault exec '<alias>=LUAROCKS_API_KEY,<gh-alias>=GITHUB_TOKEN' -- make publish
+# (all-positional — boru cannot mix --for recipes with positional env):
+#   boru vault exec '<alias>=LUAROCKS_API_KEY,<gh-alias>=GITHUB_TOKEN' -- make publish
 # --skip-pack uploads only the rockspec (its git+https source is fetched at the
 # lua/vX.Y.Z tag on install; that tag is pushed in the LAST step, so we must not
 # pack here). LuaRocks requires the rockspec filename to be
-# <package>-<version>.rockspec, so we upload a canonically-named copy. aql
+# <package>-<version>.rockspec, so we upload a canonically-named copy. boru
 # `--dry-run` rehearses (no upload/tag). set -e + tag-last: a failed upload
 # never leaves a tag behind.
 VERSION := $(shell sed -nE 's/^version *= *"([0-9.]+).*/\1/p' *.rockspec | head -1)
 TAG := lua/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump the rockspec version first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$LUAROCKS_API_KEY" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would upload to LuaRocks and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ] || [ "$$LUAROCKS_API_KEY" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would upload to LuaRocks and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	rock=$$(ls *.rockspec | head -1); \

package/project/.sdk/tm/lua/feature/test_feature.lua

@@ -41,11 +41,39 @@ function TestFeature:init(ctx, options)
   local test_self = self
 
   local function test_fetcher(fctx, _fullurl, _fetchdef)
+    -- Shape the mock payload the way the real API would, so the op's
+    -- response transform recovers the entity from it. A point carrying
+    -- transform.res of `body.item` describes an API that answers
+    -- { item = {...} }; handing back the bare entity means the transform
+    -- unwraps a property that is not there and the caller gets nil.
+    -- The mock has to agree with the model, or it only ever simulates
+    -- APIs whose responses happen to be unwrapped. Mirrors the ts/py mocks.
+    local function envelope(data)
+      local point = fctx.point
+      if data == nil or type(point) ~= "table" then
+        return data
+      end
+      local transform = point.transform
+      if type(transform) ~= "table" then
+        return data
+      end
+      local restf = transform.res
+      if type(restf) ~= "string" then
+        return data
+      end
+      local key = string.match(restf, "^`body%.([^`%.]+)`$")
+      if key == nil then
+        return data
+      end
+      return { [key] = data }
+    end
+
     local function respond(status, data, extra)
+      local payload = envelope(data)
       local out = {
         status = status,
         statusText = "OK",
-        json = function() return data end,
+        json = function() return payload end,
         body = "not-used",
       }
       if type(extra) == "table" then

package/project/.sdk/tm/lua/test/primary_utility_test.lua

@@ -576,6 +576,9 @@ describe("PrimaryUtility", function()
   it("fetcher-live", function()
     local calls = {}
     local live_client = sdk.new({
+      -- Concrete base: a live construction must satisfy any server variables
+      -- a templated base URL declares; a literal base sidesteps the requirement.
+      base = "http://localhost:8080",
       system = {
         fetch = function(url, fetchdef)
           table.insert(calls, { url = url, init = fetchdef })
@@ -600,6 +603,7 @@ describe("PrimaryUtility", function()
 
   it("fetcher-blocked-test-mode", function()
     local blocked_client = sdk.new({
+      base = "http://localhost:8080",
       system = {
         fetch = function(url, fetchdef)
           return {}, nil

package/project/.sdk/tm/lua/utility/make_options.lua

@@ -92,6 +92,13 @@ local function make_options_util(ctx)
     clean = {
       keys = "key,token,id",
     },
+    -- Server-variable values for a templated base URL (OpenAPI server
+    -- variables): {name} placeholders in `base` are substituted from this
+    -- map at construction. Spec defaults arrive via the generated config;
+    -- user values override them.
+    server = {
+      ["`$CHILD`"] = "",
+    },
   }
 
   -- Preserve system.fetch before merge/validate.
@@ -104,6 +111,38 @@ local function make_options_util(ctx)
   end
   opts = validated
 
+  -- Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+  -- Every placeholder must resolve to a non-empty value: from
+  -- options.server (user), else the config default. A placeholder that
+  -- resolves to "" is a construction ERROR in live mode — the URL cannot
+  -- work — but in test mode substitutes the deterministic value
+  -- "test-<name>" so offline tests need no configuration.
+  local base = opts.base
+  if type(base) == "string" and string.find(base, "{", 1, true) then
+    local testmode = vs.getpath(opts, "test.active") == true
+      or vs.getpath(opts, "feature.test.active") == true
+    local server = type(opts.server) == "table" and opts.server or {}
+    local sdkname = vs.getpath(config, "main.name")
+    if type(sdkname) ~= "string" or sdkname == "" then
+      sdkname = "SDK"
+    end
+    opts.base = string.gsub(base, "{([%w_]+)}", function(name)
+      local val = server[name]
+      if type(val) ~= "string" then
+        val = ""
+      end
+      if val == "" then
+        if testmode then
+          return "test-" .. name
+        end
+        error(sdkname .. ": the server variable '" .. name .. "' is required: " ..
+          "the API base URL is '" .. base .. "' — pass " ..
+          "{ server = { " .. name .. " = \"...\" } } in the SDK options", 0)
+      end
+      return val
+    end)
+  end
+
   -- Restore system.fetch.
   if sys_fetch ~= nil then
     if type(opts["system"]) == "table" then

package/project/.sdk/tm/perl/Makefile

@@ -20,10 +20,10 @@ clean:
 # Build a CPAN dist in a throwaway .release/ dir to validate the package,
 # then tag perl/vX.Y.Z (version from $VERSION in lib/*SDK.pm). The CPAN
 # registry entry for this port is declared but pending, so publish is
-# tag-only: no upload happens. Run headless under the aql key vault, which
+# tag-only: no upload happens. Run headless under the boru key vault, which
 # injects the GitHub token (never on disk or argv):
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (build only,
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (build only,
 # no tag). set -e + tag-last: a failed build never leaves a tag behind.
 #
 # NOTE: `perl Makefile.PL` (ExtUtils::MakeMaker) GENERATES a file named
@@ -31,7 +31,7 @@ clean:
 # dist build always happens inside .release/, never in place.
 VERSION := $(shell sed -nE "s/.*VERSION *= *'([^']+)'.*/\1/p" lib/*SDK.pm | head -1)
 TAG := perl/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION in lib/*SDK.pm first"; exit 1; fi
@@ -42,8 +42,8 @@ publish: test
 	{ [ -f README.md ] && cp README.md .release/ || true; }; \
 	(cd .release && $(PERL) Makefile.PL >/dev/null && echo "dist metadata OK"); \
 	rm -rf .release; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "perl v$(VERSION)"; \

package/project/.sdk/tm/php/Makefile

@@ -13,20 +13,20 @@ clean:
 # Packagist has no upload — it tracks the repo and indexes each git tag
 # php/vX.Y.Z (a configured GitHub webhook, or the Packagist "Update" API,
 # refreshes the package). So publishing a version means pushing the tag. Run
-# headless under the aql key vault, which injects the GitHub token:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+# headless under the boru key vault, which injects the GitHub token:
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell cat VERSION)
 TAG := php/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG) for Packagist; nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG) for Packagist; nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "php v$(VERSION)"; \

package/project/.sdk/tm/php/feature/TestFeature.php

@@ -48,11 +48,39 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
         $entity->data = $entity_data;
 
         $test_fetcher = function (ProjectNameContext $fctx, string $_fullurl, array $_fetchdef) use ($entity): array {
-            $respond = function (int $status, mixed $data, ?array $extra = null): array {
+            // Shape the mock payload the way the real API would, so the op's
+            // response transform recovers the entity from it. A point carrying
+            // transform.res of `body.item` describes an API that answers
+            // {"item": {...}}; handing back the bare entity means the
+            // transform unwraps a property that is not there and the caller
+            // gets null. The mock has to agree with the model, or it only
+            // ever simulates APIs whose responses happen to be unwrapped.
+            // Mirrors the ts/py mocks.
+            $envelope = function (mixed $data) use ($fctx): mixed {
+                $point = $fctx->point ?? null;
+                if ($data === null || !is_array($point)) {
+                    return $data;
+                }
+                $transform = $point['transform'] ?? null;
+                if (!is_array($transform)) {
+                    return $data;
+                }
+                $restf = $transform['res'] ?? null;
+                if (!is_string($restf)) {
+                    return $data;
+                }
+                if (!preg_match('/^`body\.([^`.]+)`$/', $restf, $m)) {
+                    return $data;
+                }
+                return [$m[1] => $data];
+            };
+
+            $respond = function (int $status, mixed $data, ?array $extra = null) use ($envelope): array {
+                $payload = $envelope($data);
                 $out = [
                     'status' => $status,
                     'statusText' => 'OK',
-                    'json' => function () use ($data) { return $data; },
+                    'json' => function () use ($payload) { return $payload; },
                     'body' => 'not-used',
                 ];
                 if ($extra) {