@voxgig/sdkgen 1.3.18 → 1.3.19

package/project/.sdk/tm/php/test/PrimaryUtilityTest.php

@@ -587,6 +587,10 @@ class PrimaryUtilityTest extends TestCase
     {
         $calls = [];
         $live_client = new ProjectNameSDK([
+            // Concrete base: a live construction must satisfy any server
+            // variables a templated base URL declares; a literal base
+            // sidesteps the requirement.
+            'base' => 'http://localhost:8080',
             'system' => [
                 'fetch' => function (string $url, array $fetchdef) use (&$calls) {
                     $calls[] = ['url' => $url, 'init' => $fetchdef];
@@ -614,6 +618,7 @@ class PrimaryUtilityTest extends TestCase
     public function test_fetcher_blocked_test_mode(): void
     {
         $blocked_client = new ProjectNameSDK([
+            'base' => 'http://localhost:8080',
             'system' => [
                 'fetch' => function (string $url, array $fetchdef) {
                     return [[], null];

package/project/.sdk/tm/php/utility/MakeOptions.php

@@ -88,6 +88,11 @@ class ProjectNameMakeOptions
             'system' => (object)[],
             'test' => ['active' => false, 'entity' => ['`$OPEN`' => true]],
             'clean' => ['keys' => 'key,token,id'],
+            // Server-variable values for a templated base URL (OpenAPI server
+            // variables): {name} placeholders in 'base' are substituted from
+            // this map at construction. Spec defaults arrive via the generated
+            // config; user values override them.
+            'server' => ['`$CHILD`' => ''],
         ];
 
         // Empty [] would be treated as a list and clobber the map under merge;
@@ -101,6 +106,45 @@ class ProjectNameMakeOptions
             $opts = [];
         }
 
+        // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+        // Every placeholder must resolve to a non-empty value: from
+        // $options['server'] (user), else the config default. A placeholder
+        // that resolves to '' is a construction ERROR in live mode — the URL
+        // cannot work — but in test mode substitutes the deterministic value
+        // "test-<name>" so offline tests need no configuration.
+        $base = $opts['base'] ?? null;
+        if (is_string($base) && strpos($base, '{') !== false) {
+            $testmode =
+                \Voxgig\Struct\Struct::getpath($opts, 'test.active') === true
+                || \Voxgig\Struct\Struct::getpath($opts, 'feature.test.active') === true;
+            $server = is_array($opts['server'] ?? null) ? $opts['server'] : [];
+            $sdkname = \Voxgig\Struct\Struct::getpath($config, 'main.name');
+            if (!is_string($sdkname) || $sdkname === '') {
+                $sdkname = 'SDK';
+            }
+            $opts['base'] = preg_replace_callback(
+                '/\{([A-Za-z0-9_]+)\}/',
+                function ($m) use ($server, $testmode, $sdkname, $base) {
+                    $name = $m[1];
+                    $val = $server[$name] ?? '';
+                    if (!is_string($val)) {
+                        $val = '';
+                    }
+                    if ($val === '') {
+                        if ($testmode) {
+                            return 'test-' . $name;
+                        }
+                        throw new \InvalidArgumentException(
+                            $sdkname . ": the server variable '" . $name . "' is required: " .
+                            "the API base URL is '" . $base . "' — pass " .
+                            "['server' => ['" . $name . "' => '...']] in the SDK options");
+                    }
+                    return $val;
+                },
+                $base
+            );
+        }
+
         if ($sys_fetch) {
             if (!is_array($opts['system'] ?? null)) {
                 $opts['system'] = [];

package/project/.sdk/tm/py/Makefile

@@ -10,16 +10,16 @@ clean:
 	find . -name __pycache__ -exec rm -rf {} + 2>/dev/null; true
 
 # --- Release: publish to PyPI ---------------------------------------------
-# Publish this package to PyPI, then tag py/vX.Y.Z. Run headless under the aql
+# Publish this package to PyPI, then tag py/vX.Y.Z. Run headless under the boru
 # key vault, which injects the PyPI + GitHub tokens as environment variables
 # (never written to disk or argv):
-#   aql vault exec --for=pypi=<alias> --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse: builds the dist
+#   boru vault exec --for=pypi=<alias> --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse: builds the dist
 # but performs no upload, tag, or push. set -e + tag-last: a failed upload never
 # leaves a tag behind. Needs python `build` + `twine` (pip install build twine).
 VERSION := $(shell sed -nE 's/^version *= *"([^"]+)".*/\1/p' pyproject.toml | head -1)
 TAG := py/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump pyproject.toml version first"; exit 1; fi
@@ -27,8 +27,8 @@ publish: test
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
 	rm -rf dist; \
 	python3 -m build; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$TWINE_PASSWORD" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: built the dist; would upload to PyPI and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ] || [ "$$TWINE_PASSWORD" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: built the dist; would upload to PyPI and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	python3 -m twine upload dist/*; \

package/project/.sdk/tm/py/test/test_primary_utility.py

@@ -468,6 +468,10 @@ class TestPrimaryUtility:
             return {"status": 200, "statusText": "OK"}, None
 
         live_client = ProjectNameSDK({
+            # Concrete base: a live construction must satisfy any server
+            # variables a templated base URL declares; a literal base
+            # sidesteps the requirement.
+            "base": "http://localhost:8080",
             "system": {
                 "fetch": mock_fetch,
             },
@@ -490,6 +494,7 @@ class TestPrimaryUtility:
             return {}, None
 
         blocked_client = ProjectNameSDK({
+            "base": "http://localhost:8080",
             "system": {
                 "fetch": mock_fetch,
             },

package/project/.sdk/tm/py/utility/make_options.py

@@ -84,6 +84,13 @@ def make_options_util(ctx):
         "clean": {
             "keys": "key,token,id",
         },
+        # Server-variable values for a templated base URL (OpenAPI server
+        # variables): {name} placeholders in "base" are substituted from this
+        # map at construction. Spec defaults arrive via the generated config;
+        # user values override them.
+        "server": {
+            "`$CHILD`": "",
+        },
     }
 
     # Preserve system.fetch before merge/validate.
@@ -95,6 +102,41 @@ def make_options_util(ctx):
         validated = {}
     opts = validated
 
+    # Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+    # Every placeholder must resolve to a non-empty value: from
+    # options["server"] (user), else the config default. A placeholder that
+    # resolves to "" is a construction ERROR in live mode — the URL cannot
+    # work — but in test mode substitutes the deterministic value
+    # "test-<name>" so offline tests need no configuration.
+    base = opts.get("base")
+    if isinstance(base, str) and "{" in base:
+        import re as _re
+        testmode = (
+            vs.getpath(opts, "test.active") is True
+            or vs.getpath(opts, "feature.test.active") is True
+        )
+        server = opts.get("server") if isinstance(opts.get("server"), dict) else {}
+        sdkname = "SDK"
+        if isinstance(config, dict):
+            mn = vs.getpath(config, "main.name")
+            if isinstance(mn, str) and mn != "":
+                sdkname = mn
+
+        def _sub(m):
+            name = m.group(1)
+            val = server.get(name)
+            val = val if isinstance(val, str) else ""
+            if val == "":
+                if testmode:
+                    return "test-" + name
+                raise ValueError(
+                    sdkname + ": the server variable '" + name + "' is required: "
+                    "the API base URL is '" + base + "' — pass "
+                    '{"server": {"' + name + '": "..."}} in the SDK options')
+            return val
+
+        opts["base"] = _re.sub(r"\{([A-Za-z0-9_]+)\}", _sub, base)
+
     # Restore system.fetch.
     if sys_fetch is not None:
         if isinstance(opts.get("system"), dict):

package/project/.sdk/tm/rb/Makefile

@@ -13,14 +13,14 @@ clean:
 
 # --- Release: publish to RubyGems -----------------------------------------
 # Build the gem and push it to RubyGems, then tag rb/vX.Y.Z. Run headless under
-# the aql key vault, which injects GEM_HOST_API_KEY + the GitHub token (never on
+# the boru key vault, which injects GEM_HOST_API_KEY + the GitHub token (never on
 # disk or argv):
-#   aql vault exec --for=gem=<alias> --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (build only, no
+#   boru vault exec --for=gem=<alias> --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (build only, no
 # push/tag). set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell sed -nE 's/.*\.version *= *"([^"]+)".*/\1/p' *.gemspec | head -1)
 TAG := rb/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump the gemspec version first"; exit 1; fi
@@ -28,8 +28,8 @@ publish: test
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
 	rm -f *.gem; \
 	gem build *.gemspec; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$GEM_HOST_API_KEY" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: built the gem; would push to RubyGems and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ] || [ "$$GEM_HOST_API_KEY" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: built the gem; would push to RubyGems and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	gem push *.gem; \

package/project/.sdk/tm/rb/test/primary_utility_test.rb

@@ -176,6 +176,9 @@ class PrimaryUtilityTest < Minitest::Test
   def test_fetcher_live
     calls = []
     live_client = ProjectNameSDK.new({
+      # Concrete base: a live construction must satisfy any server variables
+      # a templated base URL declares; a literal base sidesteps the requirement.
+      "base" => "http://localhost:8080",
       "system" => {
         "fetch" => ->(url, fetchdef) {
           calls << { "url" => url, "init" => fetchdef }
@@ -199,6 +202,7 @@ class PrimaryUtilityTest < Minitest::Test
 
   def test_fetcher_blocked_test_mode
     blocked_client = ProjectNameSDK.new({
+      "base" => "http://localhost:8080",
       "system" => {
         "fetch" => ->(url, fetchdef) {
           return {}, nil

package/project/.sdk/tm/rb/utility/make_options.rb

@@ -52,6 +52,11 @@ module ProjectNameUtilities
       "system" => {},
       "test" => { "active" => false, "entity" => { "`$OPEN`" => true } },
       "clean" => { "keys" => "key,token,id" },
+      # Server-variable values for a templated base URL (OpenAPI server
+      # variables): {name} placeholders in "base" are substituted from this
+      # map at construction. Spec defaults arrive via the generated config;
+      # user values override them.
+      "server" => { "`$CHILD`" => "" },
     }
 
     sys_fetch = VoxgigStruct.getpath(opts, "system.fetch")
@@ -60,6 +65,38 @@ module ProjectNameUtilities
     validated = VoxgigStruct.validate(merged, optspec)
     opts = validated.is_a?(Hash) ? validated : {}
 
+    # Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+    # Every placeholder must resolve to a non-empty value: from
+    # options["server"] (user), else the config default. A placeholder that
+    # resolves to "" is a construction ERROR in live mode — the URL cannot
+    # work — but in test mode substitutes the deterministic value
+    # "test-<name>" so offline tests need no configuration.
+    base = opts["base"]
+    if base.is_a?(String) && base.include?("{")
+      testmode = VoxgigStruct.getpath(opts, "test.active") == true ||
+        VoxgigStruct.getpath(opts, "feature.test.active") == true
+      server = opts["server"].is_a?(Hash) ? opts["server"] : {}
+      sdkname = VoxgigStruct.getpath(config, "main.name")
+      sdkname = "SDK" unless sdkname.is_a?(String) && !sdkname.empty?
+      opts["base"] = base.gsub(/\{([A-Za-z0-9_]+)\}/) do
+        name = Regexp.last_match(1)
+        val = server[name]
+        val = "" unless val.is_a?(String)
+        if val.empty?
+          if testmode
+            "test-#{name}"
+          else
+            raise ArgumentError,
+              "#{sdkname}: the server variable '#{name}' is required: " \
+              "the API base URL is '#{base}' — pass " \
+              "{ \"server\" => { \"#{name}\" => \"...\" } } in the SDK options"
+          end
+        else
+          val
+        end
+      end
+    end
+
     if sys_fetch
       opts["system"] = {} unless opts["system"].is_a?(Hash)
       opts["system"]["fetch"] = sys_fetch

package/project/.sdk/tm/rust/Makefile

@@ -13,21 +13,21 @@ clean:
 # The crates.io registry entry is declared in the model with
 # state: 'pending' — a real deploy publishes the git tag rust/vX.Y.Z only;
 # `cargo publish` starts when the registry state flips to 'active'. Run
-# headless under the aql key vault, which injects the GitHub token so
+# headless under the boru key vault, which injects the GitHub token so
 # nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell cat VERSION)
 TAG := rust/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish:
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "rust v$(VERSION)"; \

package/project/.sdk/tm/swift/Makefile

@@ -13,21 +13,21 @@ clean:
 # --- Release: tag for the SwiftPM registry ---------------------------------
 # SwiftPM has no upload step - publishing IS the git tag. Publication is
 # pending (see model/target/swift.aontu publish block); publishing a version
-# currently means pushing the tag swift/vX.Y.Z. Run headless under the aql key
+# currently means pushing the tag swift/vX.Y.Z. Run headless under the boru key
 # vault, which injects the GitHub token so nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell cat VERSION)
 TAG := swift/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists - bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "swift v$(VERSION)"; \

package/project/.sdk/tm/ts/Makefile

@@ -17,22 +17,22 @@ clean:
 
 # --- Release: publish to npm ----------------------------------------------
 # Compile, then publish this package to npm and tag ts/vX.Y.Z. Run headless
-# under the aql key vault, which injects the npm auth token + the GitHub token
+# under the boru key vault, which injects the npm auth token + the GitHub token
 # (never on disk or argv):
-#   aql vault exec --for=npm=<alias> --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (build only, no
+#   boru vault exec --for=npm=<alias> --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (build only, no
 # publish/tag). set -e + tag-last: a failed publish never leaves a tag behind.
 SHELL := /bin/bash
 VERSION := $(shell node -p "require('./package.json').version")
 TAG := ts/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump package.json version first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would publish to npm and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would publish to npm and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	npm stage publish --access public --registry https://registry.npmjs.org; \

package/project/.sdk/tm/ts/src/utility/MakeOptionsUtility.ts

@@ -82,16 +82,54 @@ function makeOptions(ctx: Context) {
     },
     clean: {
       keys: 'key,token,id'
+    },
+    // Server-variable values for a templated base URL (OpenAPI server
+    // variables): `{name}` placeholders in `base` are substituted from
+    // this map at construction. Spec defaults arrive via the generated
+    // Config; user values override them.
+    server: {
+      '`$CHILD`': ''
     }
   }
 
   // JavaScript specific option values.
   optspec.system.fetch = opts.system?.fetch || global.fetch
 
-  opts = merge([{}, cfgopts, opts])
+  // Clone the config side before merging: `config` is a module-level
+  // singleton in ts/js, and merge would otherwise use its nested maps as
+  // merge TARGETS — one instance's options (server, headers, ...) would
+  // contaminate every instance constructed after it.
+  opts = merge([{}, struct.clone(cfgopts), opts])
 
   opts = validate(opts, optspec)
 
+  // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+  // Every placeholder must resolve to a non-empty value: from
+  // options.server (user), else the Config default. A placeholder that
+  // resolves to '' is a construction ERROR in live mode — the URL cannot
+  // work — but in test mode substitutes the deterministic value
+  // `test-<name>` so offline tests need no configuration.
+  if ('string' === typeof opts.base && opts.base.includes('{')) {
+    const testmode = true === opts.test.active ||
+      true === (opts.feature && opts.feature.test && opts.feature.test.active)
+    const server = opts.server || {}
+    opts.base = opts.base.replace(/\{([A-Za-z0-9_]+)\}/g,
+      (_m: string, name: string) => {
+        let val = server[name]
+        val = 'string' === typeof val ? val : ''
+        if ('' === val) {
+          if (testmode) {
+            return 'test-' + name
+          }
+          throw new Error(
+            `${config?.main?.name || 'SDK'}: the server variable '${name}' is required: ` +
+            `the API base URL is '${opts.base}' — pass { server: { ${name}: '...' } } ` +
+            `in the SDK options`)
+        }
+        return val
+      })
+  }
+
   // Resolve the feature add-order: an explicit array order (above) wins;
   // otherwise order the map test-first, then the remaining names sorted, so
   // the outcome is deterministic and `test` is always the base transport.

package/project/.sdk/tm/ts/test/utility/PrimaryUtility.test.ts

@@ -229,6 +229,8 @@ describe('PrimaryUtility', async () => {
       body: 'present',
     })
     const reqClient = new (SDK as any)({
+      // Concrete base: a live construction must satisfy any server variables a templated base URL declares; a literal base sidesteps the requirement.
+      base: 'http://localhost:8080',
       system: { fetch: mockFetch }
     })
     const reqUtility = reqClient.utility()
@@ -410,6 +412,7 @@ describe('PrimaryUtility', async () => {
   test('fetcher-live', async () => {
     const calls: any[] = []
     const liveClient = new (SDK as any)({
+      base: 'http://localhost:8080',
       system: {
         fetch: async (url: string, init: any) => {
           calls.push({ url, init })
@@ -431,6 +434,7 @@ describe('PrimaryUtility', async () => {
 
   test('fetcher-blocked-test-mode', async () => {
     const blockedClient = new (SDK as any)({
+      base: 'http://localhost:8080',
       system: { fetch: async () => ({}) }
     })
     blockedClient._mode = 'test'

package/src/cmp/Deploy.ts

@@ -10,7 +10,7 @@ import {
 // `publish` sections (see model/sdkgen.aontu):
 //
 //   publish.tag       — git release tag `<prefix>/vX.Y.Z`; every port has
-//                       one, pushed with a token from the aql key vault
+//                       one, pushed with a token from the boru key vault
 //                       (--for recipe + alias, default github/github).
 //   publish.registry  — package registry details (name, url, vault
 //                       credential recipe or raw env mapping) plus a
@@ -25,7 +25,7 @@ import {
 // Follows the voxgig/struct root Makefile conventions: per-target deploy
 // targets, deliberately no all-targets real deploy (each upload is
 // irreversible), and an everything-at-once DRY run leaning on
-// `aql vault exec --dry-run` filler-token cooperation in each target's
+// `boru vault exec --dry-run` filler-token cooperation in each target's
 // publish recipe.
 const Deploy = cmp(function Deploy(props: any) {
   const { ctx$ } = props
@@ -76,7 +76,7 @@ function aliasVarName(name: string): string {
 }
 
 
-// The aql vault exec argument string for a target: `--for=<recipe>=<alias>`
+// The boru vault exec argument string for a target: `--for=<recipe>=<alias>`
 // flags where a preset recipe exists, or a raw `'alias=ENV_VAR,...'`
 // mapping when any credential lacks a preset (e.g. luarocks). The github
 // token for the tag push is always included.
@@ -142,10 +142,10 @@ function makeDeployMakefile(model: any, targets: any[]): string {
       return `
 deploy-${t.name}:
 \t@echo "deploy-${t.name}: tag-only port — publishing the git tag."
-\taql vault exec ${ghArgs} -- $(MAKE) tag-push-${t.name}
+\tboru vault exec ${ghArgs} -- $(MAKE) tag-push-${t.name}
 
 deploy-dry-${t.name}:
-\taql vault exec --dry-run ${ghArgs} -- $(MAKE) tag-push-${t.name}
+\tboru vault exec --dry-run ${ghArgs} -- $(MAKE) tag-push-${t.name}
 ${tagPushRecipe(t.name, 'tag-only port')}
 `
     }
@@ -157,20 +157,20 @@ ${tagPushRecipe(t.name, 'tag-only port')}
       return `
 deploy-${t.name}:
 \t@echo "deploy-${t.name}: ${reg.name} publication is pending — publishing the git tag only."
-\taql vault exec ${ghArgs} -- $(MAKE) tag-push-${t.name}
+\tboru vault exec ${ghArgs} -- $(MAKE) tag-push-${t.name}
 
 deploy-dry-${t.name}:
-\taql vault exec --dry-run ${ghArgs} -- $(MAKE) tag-push-${t.name}
+\tboru vault exec --dry-run ${ghArgs} -- $(MAKE) tag-push-${t.name}
 ${tagPushRecipe(t.name, reg.name + ' publication pending — tag-only deploy')}
 `
     }
 
     return `
 deploy-${t.name}:
-\taql vault exec ${args} -- $(MAKE) -C ${t.name} publish
+\tboru vault exec ${args} -- $(MAKE) -C ${t.name} publish
 
 deploy-dry-${t.name}:
-\taql vault exec --dry-run ${args} -- $(MAKE) -C ${t.name} publish
+\tboru vault exec --dry-run ${args} -- $(MAKE) -C ${t.name} publish
 `
   }).join('')
 
@@ -183,7 +183,7 @@ deploy-dry-${t.name}:
 #
 # Every port gets a git release tag <target>/vX.Y.Z. Ports with an ACTIVE
 # registry also publish a package there. Credentials are injected at exec
-# time by the aql key vault (https://github.com/aql-lang/aql) — never
+# time by the boru key vault (https://github.com/boru-lang/boru) — never
 # stored on disk or passed on the command line.
 #
 # Publication state (from the model):
@@ -194,7 +194,7 @@ ${summary}
 #                             registry upload is irreversible); while a
 #                             registry is pending this publishes the
 #                             port's git tag only
-#   make deploy-dry           rehearse EVERY target: aql --dry-run
+#   make deploy-dry           rehearse EVERY target: boru --dry-run
 #                             injects a filler token that each publish
 #                             recipe detects, so build + test run in full
 #                             but nothing is uploaded and no tag is cut
@@ -207,7 +207,7 @@ ${varLines}
 
 # Lockstep SDK version, read from the canonical ts manifest.
 VERSION := $(shell node -p "require('./ts/package.json').version" 2>/dev/null || echo 0.0.0)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 
 TARGETS := ${targets.map((t: any) => t.name).join(' ')}
 
@@ -233,7 +233,7 @@ ${deployRules}`
 
 
 
-// The root-level tag creation + push recipe for a target: aql --dry-run
+// The root-level tag creation + push recipe for a target: boru --dry-run
 // filler cooperation, idempotent tag creation, token-authenticated https
 // push (works from an ssh-remote clone without ssh keys).
 function tagPushRecipe(name: string, note: string): string {
@@ -241,9 +241,9 @@ function tagPushRecipe(name: string, note: string): string {
 tag-push-${name}:
 \t@set -e; tag="${name}/v$(VERSION)"; \\
 \ttoken="\$\${GITHUB_TOKEN:-$$GH_TOKEN}"; \\
-\tif [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \\
-\t  echo "[dry-run] aql filler token detected: would create (if missing) and push tag $$tag; nothing pushed."; exit 0; fi; \\
-\tif [ -z "$$token" ]; then echo "tag-push-${name}: no GITHUB_TOKEN in env — run via make deploy-${name} (aql vault exec)"; exit 1; fi; \\
+\tif [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \\
+\t  echo "[dry-run] boru filler token detected: would create (if missing) and push tag $$tag; nothing pushed."; exit 0; fi; \\
+\tif [ -z "$$token" ]; then echo "tag-push-${name}: no GITHUB_TOKEN in env — run via make deploy-${name} (boru vault exec)"; exit 1; fi; \\
 \tif git rev-parse -q --verify "refs/tags/$$tag" >/dev/null; then \\
 \t  echo "tag $$tag already exists — pushing existing tag"; \\
 \telse git tag -a "$$tag" -m "Release $$tag"; fi; \\

package/src/cmp/ReadmeTop.ts

@@ -549,28 +549,30 @@ Pass custom features via the \`extend\` option at construction time.
 `)
     }
 
-    // 13. Upstream API — contact/servers from the OpenAPI info block
+    // 13. Upstream API — always disclose the OpenAPI origin and where the
+    // spec(s) live; contact/servers links come from the OpenAPI info block.
     const upstreamUrl = (info.contact && info.contact.url)
       || (info.servers && info.servers[0] && info.servers[0].url)
       || homepage
-    if (upstreamUrl || docsUrl) {
-      Content(`## Upstream API
+    Content(`## Upstream API
 
 This SDK is generated from the upstream OpenAPI specification. It is an
 unofficial client and is not affiliated with the API provider.
 
+The OpenAPI spec(s) this SDK was generated from are kept in the
+[\`.sdk/def/\`](.sdk/def/) folder.
+
 `)
-      if (upstreamUrl) {
-        Content(`- Upstream API: [${upstreamUrl}](${upstreamUrl})
-`)
-      }
-      if (docsUrl && docsUrl !== upstreamUrl) {
-        Content(`- Documentation: [${docsUrl}](${docsUrl})
+    if (upstreamUrl) {
+      Content(`- Upstream API: [${upstreamUrl}](${upstreamUrl})
 `)
-      }
-      Content(`
+    }
+    if (docsUrl && docsUrl !== upstreamUrl) {
+      Content(`- Documentation: [${docsUrl}](${docsUrl})
 `)
     }
+    Content(`
+`)
 
     // 13b. Security
     Content(`## Security