@voxgig/sdkgen 1.3.18 → 1.4.0

package/project/.sdk/tm/lua/Makefile

@@ -10,26 +10,26 @@ clean:
 	@echo "No clean step for Lua"
 
 # --- Release: publish to LuaRocks -----------------------------------------
-# Upload the rockspec to LuaRocks, then tag lua/vX.Y.Z. LuaRocks has no aql
+# Upload the rockspec to LuaRocks, then tag lua/vX.Y.Z. LuaRocks has no boru
 # recipe, so inject its API key + the GitHub token as custom env vars
-# (all-positional — aql cannot mix --for recipes with positional env):
-#   aql vault exec '<alias>=LUAROCKS_API_KEY,<gh-alias>=GITHUB_TOKEN' -- make publish
+# (all-positional — boru cannot mix --for recipes with positional env):
+#   boru vault exec '<alias>=LUAROCKS_API_KEY,<gh-alias>=GITHUB_TOKEN' -- make publish
 # --skip-pack uploads only the rockspec (its git+https source is fetched at the
 # lua/vX.Y.Z tag on install; that tag is pushed in the LAST step, so we must not
 # pack here). LuaRocks requires the rockspec filename to be
-# <package>-<version>.rockspec, so we upload a canonically-named copy. aql
+# <package>-<version>.rockspec, so we upload a canonically-named copy. boru
 # `--dry-run` rehearses (no upload/tag). set -e + tag-last: a failed upload
 # never leaves a tag behind.
 VERSION := $(shell sed -nE 's/^version *= *"([0-9.]+).*/\1/p' *.rockspec | head -1)
 TAG := lua/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump the rockspec version first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$LUAROCKS_API_KEY" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would upload to LuaRocks and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ] || [ "$$LUAROCKS_API_KEY" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would upload to LuaRocks and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	rock=$$(ls *.rockspec | head -1); \

package/project/.sdk/tm/lua/feature/test_feature.lua

@@ -41,11 +41,39 @@ function TestFeature:init(ctx, options)
   local test_self = self
 
   local function test_fetcher(fctx, _fullurl, _fetchdef)
+    -- Shape the mock payload the way the real API would, so the op's
+    -- response transform recovers the entity from it. A point carrying
+    -- transform.res of `body.item` describes an API that answers
+    -- { item = {...} }; handing back the bare entity means the transform
+    -- unwraps a property that is not there and the caller gets nil.
+    -- The mock has to agree with the model, or it only ever simulates
+    -- APIs whose responses happen to be unwrapped. Mirrors the ts/py mocks.
+    local function envelope(data)
+      local point = fctx.point
+      if data == nil or type(point) ~= "table" then
+        return data
+      end
+      local transform = point.transform
+      if type(transform) ~= "table" then
+        return data
+      end
+      local restf = transform.res
+      if type(restf) ~= "string" then
+        return data
+      end
+      local key = string.match(restf, "^`body%.([^`%.]+)`$")
+      if key == nil then
+        return data
+      end
+      return { [key] = data }
+    end
+
     local function respond(status, data, extra)
+      local payload = envelope(data)
       local out = {
         status = status,
         statusText = "OK",
-        json = function() return data end,
+        json = function() return payload end,
         body = "not-used",
       }
       if type(extra) == "table" then

package/project/.sdk/tm/lua/test/primary_utility_test.lua

@@ -576,6 +576,9 @@ describe("PrimaryUtility", function()
   it("fetcher-live", function()
     local calls = {}
     local live_client = sdk.new({
+      -- Concrete base: a live construction must satisfy any server variables
+      -- a templated base URL declares; a literal base sidesteps the requirement.
+      base = "http://localhost:8080",
       system = {
         fetch = function(url, fetchdef)
           table.insert(calls, { url = url, init = fetchdef })
@@ -600,6 +603,7 @@ describe("PrimaryUtility", function()
 
   it("fetcher-blocked-test-mode", function()
     local blocked_client = sdk.new({
+      base = "http://localhost:8080",
       system = {
         fetch = function(url, fetchdef)
           return {}, nil

package/project/.sdk/tm/lua/utility/make_options.lua

@@ -92,6 +92,13 @@ local function make_options_util(ctx)
     clean = {
       keys = "key,token,id",
     },
+    -- Server-variable values for a templated base URL (OpenAPI server
+    -- variables): {name} placeholders in `base` are substituted from this
+    -- map at construction. Spec defaults arrive via the generated config;
+    -- user values override them.
+    server = {
+      ["`$CHILD`"] = "",
+    },
   }
 
   -- Preserve system.fetch before merge/validate.
@@ -104,6 +111,38 @@ local function make_options_util(ctx)
   end
   opts = validated
 
+  -- Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+  -- Every placeholder must resolve to a non-empty value: from
+  -- options.server (user), else the config default. A placeholder that
+  -- resolves to "" is a construction ERROR in live mode — the URL cannot
+  -- work — but in test mode substitutes the deterministic value
+  -- "test-<name>" so offline tests need no configuration.
+  local base = opts.base
+  if type(base) == "string" and string.find(base, "{", 1, true) then
+    local testmode = vs.getpath(opts, "test.active") == true
+      or vs.getpath(opts, "feature.test.active") == true
+    local server = type(opts.server) == "table" and opts.server or {}
+    local sdkname = vs.getpath(config, "main.name")
+    if type(sdkname) ~= "string" or sdkname == "" then
+      sdkname = "SDK"
+    end
+    opts.base = string.gsub(base, "{([%w_]+)}", function(name)
+      local val = server[name]
+      if type(val) ~= "string" then
+        val = ""
+      end
+      if val == "" then
+        if testmode then
+          return "test-" .. name
+        end
+        error(sdkname .. ": the server variable '" .. name .. "' is required: " ..
+          "the API base URL is '" .. base .. "' — pass " ..
+          "{ server = { " .. name .. " = \"...\" } } in the SDK options", 0)
+      end
+      return val
+    end)
+  end
+
   -- Restore system.fetch.
   if sys_fetch ~= nil then
     if type(opts["system"]) == "table" then

package/project/.sdk/tm/lua/utility/prepare_method.lua

@@ -1,5 +1,7 @@
 -- ProjectName SDK utility: prepare_method
 
+local vs = require("utility.struct.struct")
+
 local METHOD_MAP = {
   create = "POST",
   update = "PUT",
@@ -11,6 +13,15 @@ local METHOD_MAP = {
 
 local function prepare_method_util(ctx)
   local opname = ctx.op.name
+
+  -- The API definition is authoritative: a POST-only or PATCH-based API
+  -- exposes `update` as POST or PATCH, not the PUT the op name implies.
+  -- Only fall back to the op-name convention when the point has no method.
+  local method = vs.getprop(ctx.point, "method")
+  if "string" == type(method) and "" ~= method then
+    return string.upper(method)
+  end
+
   return METHOD_MAP[opname] or "GET"
 end
 

package/project/.sdk/tm/ocaml/sdk_runtime.ml

@@ -336,10 +336,16 @@ let feature_init_util (ctx : ctx) (f : feature) : unit =
 
 (* ----- prepare / param ----- *)
 
+(* The API definition is authoritative: a POST-only or PATCH-based API
+   exposes `update` as POST or PATCH, not the PUT the op name implies.
+   Only fall back to the op-name convention when the point has no method. *)
 let prepare_method_util (ctx : ctx) : string =
-  match ctx.c_op.op_name with
-  | "create" -> "POST" | "update" -> "PUT" | "load" -> "GET"
-  | "list" -> "GET" | "remove" -> "DELETE" | "patch" -> "PATCH" | _ -> "GET"
+  match getp ctx.c_point "method" with
+  | Str m when m <> "" -> String.uppercase_ascii m
+  | _ ->
+    match ctx.c_op.op_name with
+    | "create" -> "POST" | "update" -> "PUT" | "load" -> "GET"
+    | "list" -> "GET" | "remove" -> "DELETE" | "patch" -> "PATCH" | _ -> "GET"
 
 let prepare_headers_util (ctx : ctx) : value =
   let options = client_options_map (cc ctx) in

package/project/.sdk/tm/perl/Makefile

@@ -20,10 +20,10 @@ clean:
 # Build a CPAN dist in a throwaway .release/ dir to validate the package,
 # then tag perl/vX.Y.Z (version from $VERSION in lib/*SDK.pm). The CPAN
 # registry entry for this port is declared but pending, so publish is
-# tag-only: no upload happens. Run headless under the aql key vault, which
+# tag-only: no upload happens. Run headless under the boru key vault, which
 # injects the GitHub token (never on disk or argv):
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (build only,
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (build only,
 # no tag). set -e + tag-last: a failed build never leaves a tag behind.
 #
 # NOTE: `perl Makefile.PL` (ExtUtils::MakeMaker) GENERATES a file named
@@ -31,7 +31,7 @@ clean:
 # dist build always happens inside .release/, never in place.
 VERSION := $(shell sed -nE "s/.*VERSION *= *'([^']+)'.*/\1/p" lib/*SDK.pm | head -1)
 TAG := perl/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION in lib/*SDK.pm first"; exit 1; fi
@@ -42,8 +42,8 @@ publish: test
 	{ [ -f README.md ] && cp README.md .release/ || true; }; \
 	(cd .release && $(PERL) Makefile.PL >/dev/null && echo "dist metadata OK"); \
 	rm -rf .release; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "perl v$(VERSION)"; \

package/project/.sdk/tm/perl/utility/prepare_method.pm

@@ -3,6 +3,13 @@
 use strict;
 use warnings;
 
+use File::Basename ();
+use Cwd ();
+
+my $__dir;
+BEGIN { $__dir = File::Basename::dirname(Cwd::abs_path(__FILE__)) }
+require(Cwd::abs_path("$__dir/../core/helpers.pm"));
+
 package ProjectNameUtilities;
 
 our %REGISTRY;
@@ -18,6 +25,16 @@ my %METHOD_MAP = (
 
 $REGISTRY{prepare_method} = sub {
   my ($ctx) = @_;
+
+  # The API definition is authoritative: a POST-only or PATCH-based API
+  # exposes `update` as POST or PATCH, not the PUT the op name implies.
+  # Only fall back to the op-name convention when the point has no method.
+  my $point = $ctx->{point};
+  if ($point) {
+    my $pm = ProjectNameHelpers::gp($point, 'method');
+    return uc($pm) if defined $pm && !ref($pm) && '' ne $pm;
+  }
+
   my $m = $METHOD_MAP{ $ctx->{op}{name} };
   return defined $m ? $m : 'GET';
 };

package/project/.sdk/tm/php/Makefile

@@ -13,20 +13,20 @@ clean:
 # Packagist has no upload — it tracks the repo and indexes each git tag
 # php/vX.Y.Z (a configured GitHub webhook, or the Packagist "Update" API,
 # refreshes the package). So publishing a version means pushing the tag. Run
-# headless under the aql key vault, which injects the GitHub token:
-#   aql vault exec --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (no tag/push).
+# headless under the boru key vault, which injects the GitHub token:
+#   boru vault exec --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (no tag/push).
 # set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell cat VERSION)
 TAG := php/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump VERSION first"; exit 1; fi
 	@set -e; \
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: would tag $(TAG) for Packagist; nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: would tag $(TAG) for Packagist; nothing pushed."; \
 	  exit 0; \
 	fi; \
 	git tag -a "$(TAG)" -m "php v$(VERSION)"; \

package/project/.sdk/tm/php/feature/TestFeature.php

@@ -48,11 +48,39 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
         $entity->data = $entity_data;
 
         $test_fetcher = function (ProjectNameContext $fctx, string $_fullurl, array $_fetchdef) use ($entity): array {
-            $respond = function (int $status, mixed $data, ?array $extra = null): array {
+            // Shape the mock payload the way the real API would, so the op's
+            // response transform recovers the entity from it. A point carrying
+            // transform.res of `body.item` describes an API that answers
+            // {"item": {...}}; handing back the bare entity means the
+            // transform unwraps a property that is not there and the caller
+            // gets null. The mock has to agree with the model, or it only
+            // ever simulates APIs whose responses happen to be unwrapped.
+            // Mirrors the ts/py mocks.
+            $envelope = function (mixed $data) use ($fctx): mixed {
+                $point = $fctx->point ?? null;
+                if ($data === null || !is_array($point)) {
+                    return $data;
+                }
+                $transform = $point['transform'] ?? null;
+                if (!is_array($transform)) {
+                    return $data;
+                }
+                $restf = $transform['res'] ?? null;
+                if (!is_string($restf)) {
+                    return $data;
+                }
+                if (!preg_match('/^`body\.([^`.]+)`$/', $restf, $m)) {
+                    return $data;
+                }
+                return [$m[1] => $data];
+            };
+
+            $respond = function (int $status, mixed $data, ?array $extra = null) use ($envelope): array {
+                $payload = $envelope($data);
                 $out = [
                     'status' => $status,
                     'statusText' => 'OK',
-                    'json' => function () use ($data) { return $data; },
+                    'json' => function () use ($payload) { return $payload; },
                     'body' => 'not-used',
                 ];
                 if ($extra) {

package/project/.sdk/tm/php/test/PrimaryUtilityTest.php

@@ -587,6 +587,10 @@ class PrimaryUtilityTest extends TestCase
     {
         $calls = [];
         $live_client = new ProjectNameSDK([
+            // Concrete base: a live construction must satisfy any server
+            // variables a templated base URL declares; a literal base
+            // sidesteps the requirement.
+            'base' => 'http://localhost:8080',
             'system' => [
                 'fetch' => function (string $url, array $fetchdef) use (&$calls) {
                     $calls[] = ['url' => $url, 'init' => $fetchdef];
@@ -614,6 +618,7 @@ class PrimaryUtilityTest extends TestCase
     public function test_fetcher_blocked_test_mode(): void
     {
         $blocked_client = new ProjectNameSDK([
+            'base' => 'http://localhost:8080',
             'system' => [
                 'fetch' => function (string $url, array $fetchdef) {
                     return [[], null];

package/project/.sdk/tm/php/utility/MakeOptions.php

@@ -88,6 +88,11 @@ class ProjectNameMakeOptions
             'system' => (object)[],
             'test' => ['active' => false, 'entity' => ['`$OPEN`' => true]],
             'clean' => ['keys' => 'key,token,id'],
+            // Server-variable values for a templated base URL (OpenAPI server
+            // variables): {name} placeholders in 'base' are substituted from
+            // this map at construction. Spec defaults arrive via the generated
+            // config; user values override them.
+            'server' => ['`$CHILD`' => ''],
         ];
 
         // Empty [] would be treated as a list and clobber the map under merge;
@@ -101,6 +106,45 @@ class ProjectNameMakeOptions
             $opts = [];
         }
 
+        // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+        // Every placeholder must resolve to a non-empty value: from
+        // $options['server'] (user), else the config default. A placeholder
+        // that resolves to '' is a construction ERROR in live mode — the URL
+        // cannot work — but in test mode substitutes the deterministic value
+        // "test-<name>" so offline tests need no configuration.
+        $base = $opts['base'] ?? null;
+        if (is_string($base) && strpos($base, '{') !== false) {
+            $testmode =
+                \Voxgig\Struct\Struct::getpath($opts, 'test.active') === true
+                || \Voxgig\Struct\Struct::getpath($opts, 'feature.test.active') === true;
+            $server = is_array($opts['server'] ?? null) ? $opts['server'] : [];
+            $sdkname = \Voxgig\Struct\Struct::getpath($config, 'main.name');
+            if (!is_string($sdkname) || $sdkname === '') {
+                $sdkname = 'SDK';
+            }
+            $opts['base'] = preg_replace_callback(
+                '/\{([A-Za-z0-9_]+)\}/',
+                function ($m) use ($server, $testmode, $sdkname, $base) {
+                    $name = $m[1];
+                    $val = $server[$name] ?? '';
+                    if (!is_string($val)) {
+                        $val = '';
+                    }
+                    if ($val === '') {
+                        if ($testmode) {
+                            return 'test-' . $name;
+                        }
+                        throw new \InvalidArgumentException(
+                            $sdkname . ": the server variable '" . $name . "' is required: " .
+                            "the API base URL is '" . $base . "' — pass " .
+                            "['server' => ['" . $name . "' => '...']] in the SDK options");
+                    }
+                    return $val;
+                },
+                $base
+            );
+        }
+
         if ($sys_fetch) {
             if (!is_array($opts['system'] ?? null)) {
                 $opts['system'] = [];

package/project/.sdk/tm/php/utility/PrepareMethod.php

@@ -16,6 +16,17 @@ class ProjectNamePrepareMethod
 
     public static function call(ProjectNameContext $ctx): string
     {
+        // The API definition is authoritative: a POST-only or PATCH-based API
+        // exposes `update` as POST or PATCH, not the PUT the op name implies.
+        // Only fall back to the op-name convention when the point has no method.
+        $point = $ctx->point;
+        if ($point) {
+            $method = \Voxgig\Struct\Struct::getprop($point, 'method');
+            if (is_string($method) && '' !== $method) {
+                return strtoupper($method);
+            }
+        }
+
         return self::METHOD_MAP[$ctx->op->name] ?? 'GET';
     }
 }

package/project/.sdk/tm/py/Makefile

@@ -10,16 +10,16 @@ clean:
 	find . -name __pycache__ -exec rm -rf {} + 2>/dev/null; true
 
 # --- Release: publish to PyPI ---------------------------------------------
-# Publish this package to PyPI, then tag py/vX.Y.Z. Run headless under the aql
+# Publish this package to PyPI, then tag py/vX.Y.Z. Run headless under the boru
 # key vault, which injects the PyPI + GitHub tokens as environment variables
 # (never written to disk or argv):
-#   aql vault exec --for=pypi=<alias> --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse: builds the dist
+#   boru vault exec --for=pypi=<alias> --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse: builds the dist
 # but performs no upload, tag, or push. set -e + tag-last: a failed upload never
 # leaves a tag behind. Needs python `build` + `twine` (pip install build twine).
 VERSION := $(shell sed -nE 's/^version *= *"([^"]+)".*/\1/p' pyproject.toml | head -1)
 TAG := py/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump pyproject.toml version first"; exit 1; fi
@@ -27,8 +27,8 @@ publish: test
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
 	rm -rf dist; \
 	python3 -m build; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$TWINE_PASSWORD" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: built the dist; would upload to PyPI and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ] || [ "$$TWINE_PASSWORD" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: built the dist; would upload to PyPI and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	python3 -m twine upload dist/*; \

package/project/.sdk/tm/py/test/test_primary_utility.py

@@ -468,6 +468,10 @@ class TestPrimaryUtility:
             return {"status": 200, "statusText": "OK"}, None
 
         live_client = ProjectNameSDK({
+            # Concrete base: a live construction must satisfy any server
+            # variables a templated base URL declares; a literal base
+            # sidesteps the requirement.
+            "base": "http://localhost:8080",
             "system": {
                 "fetch": mock_fetch,
             },
@@ -490,6 +494,7 @@ class TestPrimaryUtility:
             return {}, None
 
         blocked_client = ProjectNameSDK({
+            "base": "http://localhost:8080",
             "system": {
                 "fetch": mock_fetch,
             },

package/project/.sdk/tm/py/utility/make_options.py

@@ -84,6 +84,13 @@ def make_options_util(ctx):
         "clean": {
             "keys": "key,token,id",
         },
+        # Server-variable values for a templated base URL (OpenAPI server
+        # variables): {name} placeholders in "base" are substituted from this
+        # map at construction. Spec defaults arrive via the generated config;
+        # user values override them.
+        "server": {
+            "`$CHILD`": "",
+        },
     }
 
     # Preserve system.fetch before merge/validate.
@@ -95,6 +102,41 @@ def make_options_util(ctx):
         validated = {}
     opts = validated
 
+    # Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
+    # Every placeholder must resolve to a non-empty value: from
+    # options["server"] (user), else the config default. A placeholder that
+    # resolves to "" is a construction ERROR in live mode — the URL cannot
+    # work — but in test mode substitutes the deterministic value
+    # "test-<name>" so offline tests need no configuration.
+    base = opts.get("base")
+    if isinstance(base, str) and "{" in base:
+        import re as _re
+        testmode = (
+            vs.getpath(opts, "test.active") is True
+            or vs.getpath(opts, "feature.test.active") is True
+        )
+        server = opts.get("server") if isinstance(opts.get("server"), dict) else {}
+        sdkname = "SDK"
+        if isinstance(config, dict):
+            mn = vs.getpath(config, "main.name")
+            if isinstance(mn, str) and mn != "":
+                sdkname = mn
+
+        def _sub(m):
+            name = m.group(1)
+            val = server.get(name)
+            val = val if isinstance(val, str) else ""
+            if val == "":
+                if testmode:
+                    return "test-" + name
+                raise ValueError(
+                    sdkname + ": the server variable '" + name + "' is required: "
+                    "the API base URL is '" + base + "' — pass "
+                    '{"server": {"' + name + '": "..."}} in the SDK options')
+            return val
+
+        opts["base"] = _re.sub(r"\{([A-Za-z0-9_]+)\}", _sub, base)
+
     # Restore system.fetch.
     if sys_fetch is not None:
         if isinstance(opts.get("system"), dict):

package/project/.sdk/tm/py/utility/prepare_method.py

@@ -1,5 +1,7 @@
 # ProjectName SDK utility: prepare_method
 
+from utility.voxgig_struct import voxgig_struct as vs
+
 METHOD_MAP = {
     "create": "POST",
     "update": "PUT",
@@ -12,4 +14,12 @@ METHOD_MAP = {
 
 def prepare_method_util(ctx):
     opname = ctx.op.name
+
+    # The API definition is authoritative: a POST-only or PATCH-based API
+    # exposes `update` as POST or PATCH, not the PUT the op name implies.
+    # Only fall back to the op-name convention when the point has no method.
+    method = vs.getprop(ctx.point, "method")
+    if isinstance(method, str) and "" != method:
+        return method.upper()
+
     return METHOD_MAP.get(opname, "GET")

package/project/.sdk/tm/rb/Makefile

@@ -13,14 +13,14 @@ clean:
 
 # --- Release: publish to RubyGems -----------------------------------------
 # Build the gem and push it to RubyGems, then tag rb/vX.Y.Z. Run headless under
-# the aql key vault, which injects GEM_HOST_API_KEY + the GitHub token (never on
+# the boru key vault, which injects GEM_HOST_API_KEY + the GitHub token (never on
 # disk or argv):
-#   aql vault exec --for=gem=<alias> --for=github=<alias> -- make publish
-# aql `--dry-run` injects a filler token we detect to rehearse (build only, no
+#   boru vault exec --for=gem=<alias> --for=github=<alias> -- make publish
+# boru `--dry-run` injects a filler token we detect to rehearse (build only, no
 # push/tag). set -e + tag-last: a failed push never leaves a tag behind.
 VERSION := $(shell sed -nE 's/.*\.version *= *"([^"]+)".*/\1/p' *.gemspec | head -1)
 TAG := rb/v$(VERSION)
-AQL_DRY_RUN_FILLER := AQL-DRY-RUN-FILLER-NOT-A-REAL-SECRET
+BORU_DRY_RUN_FILLER := BORU-DRY-RUN-FILLER-NOT-A-REAL-SECRET
 publish: test
 	@if git rev-parse -q --verify "refs/tags/$(TAG)" >/dev/null; then \
 	  echo "tag $(TAG) already exists — bump the gemspec version first"; exit 1; fi
@@ -28,8 +28,8 @@ publish: test
 	token="$${GITHUB_TOKEN:-$$GH_TOKEN}"; \
 	rm -f *.gem; \
 	gem build *.gemspec; \
-	if [ "$$token" = "$(AQL_DRY_RUN_FILLER)" ] || [ "$$GEM_HOST_API_KEY" = "$(AQL_DRY_RUN_FILLER)" ]; then \
-	  echo "[dry-run] aql filler token detected: built the gem; would push to RubyGems and tag $(TAG); nothing pushed."; \
+	if [ "$$token" = "$(BORU_DRY_RUN_FILLER)" ] || [ "$$GEM_HOST_API_KEY" = "$(BORU_DRY_RUN_FILLER)" ]; then \
+	  echo "[dry-run] boru filler token detected: built the gem; would push to RubyGems and tag $(TAG); nothing pushed."; \
 	  exit 0; \
 	fi; \
 	gem push *.gem; \

package/project/.sdk/tm/rb/test/primary_utility_test.rb

@@ -176,6 +176,9 @@ class PrimaryUtilityTest < Minitest::Test
   def test_fetcher_live
     calls = []
     live_client = ProjectNameSDK.new({
+      # Concrete base: a live construction must satisfy any server variables
+      # a templated base URL declares; a literal base sidesteps the requirement.
+      "base" => "http://localhost:8080",
       "system" => {
         "fetch" => ->(url, fetchdef) {
           calls << { "url" => url, "init" => fetchdef }
@@ -199,6 +202,7 @@ class PrimaryUtilityTest < Minitest::Test
 
   def test_fetcher_blocked_test_mode
     blocked_client = ProjectNameSDK.new({
+      "base" => "http://localhost:8080",
       "system" => {
         "fetch" => ->(url, fetchdef) {
           return {}, nil