@voxgig/sdkgen 1.3.18 → 1.4.0

package/project/.sdk/src/cmp/ts/fragment/Config.fragment.ts

@@ -19,7 +19,7 @@ class Config {
 
 
   main = {
-    name: 'ProjectName',
+    name: '$$const.Name$$',
   }
 
 
@@ -31,7 +31,7 @@ class Config {
   options = {
     base: '$$main.kit.info.servers.0.url$$',
 
-    'AUTHBLOCK'headers: 'HEADERS',
+    'SERVERBLOCK''AUTHBLOCK'headers: 'HEADERS',
 
     entity: {
       // #EntityConfigs

package/project/.sdk/src/cmp/ts/fragment/Direct.test.fragment.ts

@@ -24,6 +24,10 @@ describe('EntityNameDirect', async () => {
 
   test('direct-exists', async () => {
     const sdk = new ProjectNameSDK({
+      // Concrete base: a live construction must satisfy any server
+      // variables a templated base URL declares; overriding base with a
+      // literal (as the direct flow tests do) sidesteps the requirement.
+      base: 'http://localhost:8080',
       system: { fetch: async () => ({}) }
     })
     assert('function' === typeof sdk.direct)

package/project/.sdk/tm/c/utility/prepare_method.c

@@ -2,10 +2,28 @@
 
 #include "sdk.h"
 
+#include <ctype.h>
 #include <string.h>
 
 const char* prepare_method_util(Context* ctx) {
   const char* op = ctx->op->name;
+
+  // The API definition is authoritative: a POST-only or PATCH-based API
+  // exposes `update` as POST or PATCH, not the PUT the op name implies.
+  // Only fall back to the op-name convention when the point has no method.
+  // Uppercased into a static buffer so the returned pointer stays valid for
+  // the caller's lifetime, matching the static-string contract above.
+  const char* m = get_str(ctx->point, "method");
+  if (m && '\0' != m[0]) {
+    static char upper[16];
+    size_t i = 0;
+    for (; i < sizeof(upper) - 1 && '\0' != m[i]; i++) {
+      upper[i] = (char)toupper((unsigned char)m[i]);
+    }
+    upper[i] = '\0';
+    return upper;
+  }
+
   if (strcmp(op, "create") == 0) return "POST";
   if (strcmp(op, "update") == 0) return "PUT";
   if (strcmp(op, "load") == 0) return "GET";

package/project/.sdk/tm/clojure/src/sdk/core.clj

@@ -389,7 +389,15 @@
 
 (defn u-clean [_ctx val] val)
 
-(defn u-prepare-method [ctx] (get METHOD-MAP (op-name (oget ctx :op)) "GET"))
+;; The API definition is authoritative: a POST-only or PATCH-based API
+;; exposes `update` as POST or PATCH, not the PUT the op name implies.
+;; Only fall back to the op-name convention when the point has no method.
+(defn u-prepare-method [ctx]
+  (let [point (oget ctx :point)
+        m (when point (vs/getprop point "method"))]
+    (if (and (string? m) (not= "" m))
+      (str/upper-case m)
+      (get METHOD-MAP (op-name (oget ctx :op)) "GET"))))
 
 (defn u-prepare-headers [ctx]
   (let [options (client-options-map (oget ctx :client))

package/project/.sdk/tm/cpp/utility/pipeline.hpp

@@ -654,6 +654,19 @@ inline ResultPtr makeResult(CtxPtr ctx) {
 
 inline std::string prepareMethod(CtxPtr ctx) {
   const std::string& opname = ctx->op->name;
+
+  // The API definition is authoritative: a POST-only or PATCH-based API
+  // exposes `update` as POST or PATCH, not the PUT the op name implies.
+  // Only fall back to the op-name convention when the point has no method.
+  Value pm = getp(ctx->point, "method");
+  if (pm.is_string()) {
+    std::string m = as_str(pm);
+    if (!m.empty()) {
+      for (auto& c : m) c = (char)std::toupper((unsigned char)c);
+      return m;
+    }
+  }
+
   if (opname == "create") return "POST";
   if (opname == "update") return "PUT";
   if (opname == "load") return "GET";

package/project/.sdk/tm/csharp/Makefile

@@ -15,21 +15,21 @@ clean:
 # publishing a version currently means pushing the tag csharp/vX.Y.Z. When the
 # registry goes live, `dotnet pack` + `dotnet nuget push` slot in before the
 # tag (mirroring the voxgig/struct csharp Makefile). Run headless under the
-# aql key vault, which injects the GitHub token so nothing lands on disk or
+# boru key vault, which injects the GitHub token so nothing lands on disk or
 # argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell cat VERSION)
 TAG := csharp/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "csharp v$(VERSION)"; \

package/project/.sdk/tm/csharp/utility/PrepareMethod.cs

@@ -1,5 +1,7 @@
 // ProjectName SDK utility: prepareMethod.
 
+using Voxgig.Struct;
+
 namespace ProjectNameSdk.Util;
 
 public static partial class SdkUtility
@@ -17,6 +19,15 @@ public static partial class SdkUtility
     internal static string PrepareMethodUtil(Context ctx)
     {
         var opname = ctx.Op!.Name;
+
+        // The API definition is authoritative: a POST-only or PATCH-based API
+        // exposes `update` as POST or PATCH, not the PUT the op name implies.
+        // Only fall back to the op-name convention when the point has no method.
+        if (StructUtils.GetProp(ctx.Point, "method") is string pm && "" != pm)
+        {
+            return pm.ToUpperInvariant();
+        }
+
         return MethodMap.TryGetValue(opname, out var m) ? m : "GET";
     }
 }

package/project/.sdk/tm/dart/Makefile

@@ -22,14 +22,14 @@ clean:
 # the tag. set -e + tag-last: a failed upload never leaves a tag behind.
 VERSION := $(shell sed -nE 's/^version: *([0-9][^ ]*).*/\1/p' pubspec.yaml | head -1)
 TAG := dart/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump pubspec.yaml version first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would publish to pub.dev and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would publish to pub.dev and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	if [ -n "$$PUB_CREDENTIALS" ]; then \

package/project/.sdk/tm/dart/lib/utility/PrepareMethodUtility.dart

@@ -1,3 +1,5 @@
+import 'voxgig_struct.dart' as vs;
+
 dynamic prepareMethod(dynamic ctx) {
   final op = ctx.op;
   final opname = op.name;
@@ -11,5 +13,13 @@ dynamic prepareMethod(dynamic ctx) {
     'patch': 'PATCH',
   };
 
+  // The API definition is authoritative: a POST-only or PATCH-based API
+  // exposes `update` as POST or PATCH, not the PUT the op name implies.
+  // Only fall back to the op-name convention when the point has no method.
+  final method = vs.getprop(ctx.point, 'method');
+  if (method is String && '' != method) {
+    return method.toUpperCase();
+  }
+
   return methodMap[opname];
 }

package/project/.sdk/tm/elixir/lib/projectname/utility.ex

@@ -888,7 +888,14 @@ defmodule ProjectName.Utility do
 
   def prepare_method_impl(ctx) do
     opname = S.getprop(S.getprop(ctx, "op"), "name")
-    Map.get(@method_map, opname, "GET")
+
+    # The API definition is authoritative: a POST-only or PATCH-based API
+    # exposes `update` as POST or PATCH, not the PUT the op name implies.
+    # Only fall back to the op-name convention when the point has no method.
+    case S.getprop(S.getprop(ctx, "point"), "method") do
+      m when is_binary(m) and m != "" -> String.upcase(m)
+      _ -> Map.get(@method_map, opname, "GET")
+    end
   end
 
   def prepare_headers_impl(ctx) do

package/project/.sdk/tm/go/Makefile

@@ -13,10 +13,10 @@ clean:
 # Go modules have no registry upload — publishing a version means pushing the
 # tag go/vX.Y.Z (this module is the go/ subdir, and Go's submodule-tag
 # convention is <subdir>/vX.Y.Z), which the module proxy + pkg.go.dev pick up on
-# first fetch. Run headless under the aql key vault, which injects the GitHub
+# first fetch. Run headless under the boru key vault, which injects the GitHub
 # token so nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 #
 # NOTE: publishing the git tag is deliberately NOT gated on `go test` (every
@@ -24,14 +24,14 @@ clean:
 # block the module tag). Run `make test` separately in CI to gate quality.
 VERSION := $(shell cat VERSION)
 TAG := go/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish:
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG) for pkg.go.dev; nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG) for pkg.go.dev; nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "go v$(VERSION)"; \

package/project/.sdk/tm/go/test/primary_utility_test.go

@@ -252,6 +252,10 @@ func TestPrimaryUtility(t *testing.T) {
 	t.Run("fetcher-live", func(t *testing.T) {
 		calls := []map[string]any{}
 		liveClient := sdk.NewProjectNameSDK(map[string]any{
+			// Concrete base: a live construction must satisfy any server
+			// variables a templated base URL declares; a literal base
+			// sidesteps the requirement.
+			"base": "http://localhost:8080",
 			"system": map[string]any{
 				"fetch": func(url string, fetchdef map[string]any) (map[string]any, error) {
 					calls = append(calls, map[string]any{"url": url, "init": fetchdef})
@@ -282,6 +286,7 @@ func TestPrimaryUtility(t *testing.T) {
 	t.Run("fetcher-blocked-test-mode", func(t *testing.T) {
 		// Create a live SDK then set mode to test (not using TestSDK, which installs test feature)
 		blockedClient := sdk.NewProjectNameSDK(map[string]any{
+			"base": "http://localhost:8080",
 			"system": map[string]any{
 				"fetch": func(url string, fetchdef map[string]any) (map[string]any, error) {
 					return map[string]any{}, nil

package/project/.sdk/tm/go/utility/make_options.go

@@ -1,6 +1,7 @@
 package utility
 
 import (
+	"regexp"
 	"sort"
 	"strings"
 
@@ -9,6 +10,9 @@ import (
 	"GOMODULE/core"
 )
 
+// {name} placeholders in a templated server URL (OpenAPI server variables).
+var serverVarRe = regexp.MustCompile(`\{[A-Za-z0-9_]+\}`)
+
 func makeOptionsUtil(ctx *core.Context) map[string]any {
 	options := ctx.Options
 	if options == nil {
@@ -108,6 +112,13 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 		"clean": map[string]any{
 			"keys": "key,token,id",
 		},
+		// Server-variable values for a templated base URL (OpenAPI server
+		// variables): {name} placeholders in "base" are substituted from this
+		// map at construction. Spec defaults arrive via the generated config;
+		// user values override them.
+		"server": map[string]any{
+			"`$CHILD`": "",
+		},
 	}
 
 	// Preserve system.fetch before merge/validate.
@@ -120,6 +131,43 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 	validated, _ := vs.Validate(merged, optspec)
 	opts = validated.(map[string]any)
 
+	// Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+	// Every placeholder must resolve to a non-empty value: from
+	// options["server"] (user), else the config default. A placeholder that
+	// resolves to "" is a construction error in live mode — the URL cannot
+	// work — but in test mode substitutes the deterministic value
+	// "test-<name>" so offline tests need no configuration. The SDK
+	// constructor has no error return, so a missing required variable
+	// PANICS (construction-time misconfiguration, as regexp.MustCompile).
+	if base, ok := opts["base"].(string); ok && strings.Contains(base, "{") {
+		testmode := false
+		if ta, ok := vs.GetPath([]any{"test", "active"}, opts).(bool); ok && ta {
+			testmode = true
+		}
+		if fa, ok := vs.GetPath([]any{"feature", "test", "active"}, opts).(bool); ok && fa {
+			testmode = true
+		}
+		server := core.ToMapAny(opts["server"])
+		sdkname := "SDK"
+		if mn, ok := vs.GetPath([]any{"main", "name"}, config).(string); ok && mn != "" {
+			sdkname = mn
+		}
+		resolved := serverVarRe.ReplaceAllStringFunc(base, func(ph string) string {
+			name := ph[1 : len(ph)-1]
+			val, _ := server[name].(string)
+			if val == "" {
+				if testmode {
+					return "test-" + name
+				}
+				panic(sdkname + ": the server variable '" + name + "' is required: " +
+					"the API base URL is '" + base + "' — pass " +
+					`options["server"].(map)["` + name + `"] in the SDK options`)
+			}
+			return val
+		})
+		opts["base"] = resolved
+	}
+
 	// Restore system.fetch.
 	if sysFetch != nil {
 		if sys, ok := opts["system"]; ok {

package/project/.sdk/tm/go/utility/prepare_method.go

@@ -1,10 +1,23 @@
 package utility
 
-import "GOMODULE/core"
+import (
+	"strings"
+
+	vs "github.com/voxgig/struct"
+
+	"GOMODULE/core"
+)
 
 func prepareMethodUtil(ctx *core.Context) string {
 	opname := ctx.Op.Name
 
+	// The API definition is authoritative: a POST-only or PATCH-based API
+	// exposes `update` as POST or PATCH, not the PUT the op name implies.
+	// Only fall back to the op-name convention when the point has no method.
+	if m, ok := vs.GetProp(ctx.Point, "method").(string); ok && "" != m {
+		return strings.ToUpper(m)
+	}
+
 	methodMap := map[string]string{
 		"create": "POST",
 		"update": "PUT",

package/project/.sdk/tm/haskell/src/SdkRuntime.hs

@@ -13,6 +13,7 @@ module SdkRuntime where
 import Control.Exception (throwIO)
 import Control.Monad (forM_, when)
 import Data.Bits ((.&.))
+import Data.Char (toUpper)
 import Data.IORef
 import qualified Data.Map.Strict as Map
 import System.IO.Unsafe (unsafePerformIO)
@@ -318,12 +319,20 @@ featureInitUtil ctx f = do
 
 -- ----- prepare / param -----
 
+-- The API definition is authoritative: a POST-only or PATCH-based API
+-- exposes `update` as POST or PATCH, not the PUT the op name implies. Only
+-- fall back to the op-name convention when the point has no method.
 prepareMethodUtil :: Context -> IO String
 prepareMethodUtil ctx = do
-  op <- readIORef (cOp ctx)
-  pure $ case opName op of
-    "create" -> "POST"; "update" -> "PUT"; "load" -> "GET"
-    "list" -> "GET"; "remove" -> "DELETE"; "patch" -> "PATCH"; _ -> "GET"
+  point <- readIORef (cPoint ctx)
+  pm <- getp point "method"
+  case pm of
+    VStr m | not (null m) -> pure (map toUpper m)
+    _ -> do
+      op <- readIORef (cOp ctx)
+      pure $ case opName op of
+        "create" -> "POST"; "update" -> "PUT"; "load" -> "GET"
+        "list" -> "GET"; "remove" -> "DELETE"; "patch" -> "PATCH"; _ -> "GET"
 
 prepareHeadersUtil :: Context -> IO Value
 prepareHeadersUtil ctx = do

package/project/.sdk/tm/java/Makefile

@@ -12,10 +12,10 @@ clean:
 # --- Release: tag java/vX.Y.Z ----------------------------------------------
 # Maven Central publication (Sonatype Central Portal) is pending for this
 # target; publishing a version currently means pushing the java/vX.Y.Z git
-# tag. Run headless under the aql key vault, which injects the GitHub token
+# tag. Run headless under the boru key vault, which injects the GitHub token
 # so nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 #
 # NOTE: publishing the git tag is deliberately NOT gated on `mvn test` (every
@@ -23,14 +23,14 @@ clean:
 # block the tag). Run `make test` separately in CI to gate quality.
 VERSION := $(shell cat VERSION)
 TAG := java/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish:
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "java v$(VERSION)"; \

package/project/.sdk/tm/java/utility/PrepareMethod.java

@@ -3,6 +3,7 @@ package JAVAPACKAGE.utility;
 import java.util.Map;
 
 import JAVAPACKAGE.core.Context;
+import JAVAPACKAGE.utility.struct.Struct;
 
 final class PrepareMethod {
 
@@ -19,6 +20,14 @@ final class PrepareMethod {
   static String prepareMethod(Context ctx) {
     String opname = ctx.op.name;
 
+    // The API definition is authoritative: a POST-only or PATCH-based API
+    // exposes `update` as POST or PATCH, not the PUT the op name implies.
+    // Only fall back to the op-name convention when the point has no method.
+    Object pm = Struct.getprop(ctx.point, "method");
+    if (pm instanceof String && !((String) pm).isEmpty()) {
+      return ((String) pm).toUpperCase();
+    }
+
     String m = METHOD_MAP.get(opname);
     if (m != null) {
       return m;

package/project/.sdk/tm/js/Makefile

@@ -10,23 +10,23 @@ clean:
 	rm -rf node_modules
 
 # --- Release: publish to npm ----------------------------------------------
-# Publish this package to npm, then tag js/vX.Y.Z. Run headless under the aql
+# Publish this package to npm, then tag js/vX.Y.Z. Run headless under the boru
 # key vault, which injects the npm auth token + the GitHub token (never on disk
 # or argv):
-#   aql vault exec --for=npm=<alias> --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no publish/tag).
+#   boru vault exec --for=npm=<alias> --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no publish/tag).
 # set -e + tag-last: a failed publish never leaves a tag behind.
 SHELL := /bin/bash
 VERSION := $(shell node -p "require('./package.json').version")
 TAG := js/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump package.json version first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would publish to npm and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would publish to npm and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	npm stage publish --access public --registry https://registry.npmjs.org; \

package/project/.sdk/tm/js/src/utility/MakeOptionsUtility.js

@@ -79,16 +79,54 @@ function makeOptions(ctx) {
     },
     clean: {
       keys: 'key,token,id'
+    },
+    // Server-variable values for a templated base URL (OpenAPI server
+    // variables): `{name}` placeholders in `base` are substituted from
+    // this map at construction. Spec defaults arrive via the generated
+    // Config; user values override them.
+    server: {
+      '`$CHILD`': ''
     }
   }
 
   // JavaScript specific option values.
   optspec.system.fetch = opts.system?.fetch || global.fetch
 
-  opts = merge([{}, cfgopts, opts])
+  // Clone the config side before merging: `config` is a module-level
+  // singleton in ts/js, and merge would otherwise use its nested maps as
+  // merge TARGETS — one instance's options (server, headers, ...) would
+  // contaminate every instance constructed after it.
+  opts = merge([{}, struct.clone(cfgopts), opts])
 
   opts = validate(opts, optspec)
 
+  // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+  // Every placeholder must resolve to a non-empty value: from
+  // options.server (user), else the Config default. A placeholder that
+  // resolves to '' is a construction ERROR in live mode — the URL cannot
+  // work — but in test mode substitutes the deterministic value
+  // `test-<name>` so offline tests need no configuration.
+  if ('string' === typeof opts.base && opts.base.includes('{')) {
+    const testmode = true === opts.test.active ||
+      true === (opts.feature && opts.feature.test && opts.feature.test.active)
+    const server = opts.server || {}
+    opts.base = opts.base.replace(/\{([A-Za-z0-9_]+)\}/g,
+      (_m, name) => {
+        let val = server[name]
+        val = 'string' === typeof val ? val : ''
+        if ('' === val) {
+          if (testmode) {
+            return 'test-' + name
+          }
+          throw new Error(
+            (config?.main?.name || 'SDK') + ": the server variable '" + name +
+            "' is required: the API base URL is '" + opts.base +
+            "' — pass { server: { " + name + ": '...' } } in the SDK options")
+        }
+        return val
+      })
+  }
+
   // Resolve the feature add-order: an explicit array order (above) wins;
   // otherwise order the map test-first, then the remaining names sorted, so
   // the outcome is deterministic and `test` is always the base transport.

package/project/.sdk/tm/js/src/utility/PrepareMethodUtility.js

@@ -14,6 +14,15 @@ function prepareMethod(ctx) {
     patch: 'PATCH',
   }
 
+  // The API definition is authoritative: a POST-only or PATCH-based API
+  // exposes `update` as POST or PATCH, not the PUT the op name implies.
+  // Only fall back to the op-name convention when the point has no method.
+  const method = ctx.point && ctx.point.method
+
+  if (null != method && '' !== method) {
+    return method.toUpperCase()
+  }
+
   return methodMap[key]
 }
 

package/project/.sdk/tm/js/test/utility/PrimaryUtility.test.js

@@ -205,6 +205,9 @@ describe('PrimaryUtility', async () => {
       body: 'present',
     })
     const reqClient = new SDK({
+      // Concrete base: a live construction must satisfy any server variables
+      // a templated base URL declares; a literal base sidesteps the requirement.
+      base: 'http://localhost:8080',
       system: { fetch: mockFetch }
     })
     const reqUtility = reqClient.utility()
@@ -386,6 +389,7 @@ describe('PrimaryUtility', async () => {
   test('fetcher-live', async () => {
     const calls = []
     const liveClient = new SDK({
+      base: 'http://localhost:8080',
       system: {
         fetch: async (url, init) => {
           calls.push({ url, init })
@@ -407,6 +411,7 @@ describe('PrimaryUtility', async () => {
 
   test('fetcher-blocked-test-mode', async () => {
     const blockedClient = new SDK({
+      base: 'http://localhost:8080',
       system: { fetch: async () => ({}) }
     })
     blockedClient._mode = 'test'

package/project/.sdk/tm/kotlin/Makefile

@@ -16,20 +16,20 @@ clean:
 # --- Release: tag kotlin/vX.Y.Z ---------------------------------------------
 # Maven Central publication (Sonatype Central Portal) is pending for this
 # target; publishing a version currently means pushing the kotlin/vX.Y.Z git
-# tag. Run headless under the aql key vault, which injects the GitHub token
+# tag. Run headless under the boru key vault, which injects the GitHub token
 # so nothing lands on disk or argv:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 VERSION := $(shell cat VERSION)
 TAG := kotlin/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish:
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "kotlin v$(VERSION)"; \

package/project/.sdk/tm/kotlin/utility/Prepare.kt

@@ -143,6 +143,15 @@ fun prepareHeaders(ctx: Context): MutableMap<String, Any?> {
 
 fun prepareMethod(ctx: Context): String {
   val opname = ctx.op.name
+
+  // The API definition is authoritative: a POST-only or PATCH-based API
+  // exposes `update` as POST or PATCH, not the PUT the op name implies.
+  // Only fall back to the op-name convention when the point has no method.
+  val pm = Struct.getprop(ctx.point, "method")
+  if (pm is String && "" != pm) {
+    return pm.uppercase()
+  }
+
   val m = METHOD_MAP[opname]
   if (m != null) {
     return m

package/project/.sdk/tm/lean/src/SdkUtility.lean

@@ -239,8 +239,13 @@ def preparePath (ctx : Value) : SIO String := do
     pure ("/" ++ String.intercalate "/" segs.toList)
   | _ => pure ""
 
+/-- The API definition is authoritative: a POST-only or PATCH-based API
+exposes `update` as POST or PATCH, not the PUT the op name implies. Only
+fall back to the op-name convention when the point has no method. -/
 def prepareMethod (ctx : Value) : SIO String := do
-  pure (opMethodOf (← opnameOf ctx))
+  let m ← gpS (← gp ctx "point") "method"
+  if m != "" then pure m.toUpper
+  else pure (opMethodOf (← opnameOf ctx))
 
 def prepareHeaders (ctx : Value) : SIO Value := do
   let options ← gp ctx "options"