@voxgig/sdkgen 4.23.0 → 4.24.1

package/project/.sdk/tm/lua/feature/paging_feature.lua

@@ -5,8 +5,9 @@
 -- (PreResult) it reads the server's pagination signals — a
 -- `Link: <...>; rel="next"` header, `X-Page`/`X-Next-Page`/
 -- `X-Total-Count` headers, or `next`/`cursor`/`nextCursor`/`hasMore`
--- fields in the body — and records them on `ctx.result.paging`. A
--- per-call `ctrl.paging` (cursor or page) wins over the option defaults,
+-- fields in the body (snake_case forms too) — and records them on
+-- `ctx.result.paging` and the caller's `ctrl.paging`. A per-call
+-- `ctrl.paging` (cursor or page) wins over the option defaults,
 -- so auto-iteration can advance the cursor/page and re-issue the list
 -- call until `hasMore` is false. Parameter names (`pageParam`,
 -- `limitParam`, `cursorParam`), `startPage` (default 1) and `limit` are
@@ -95,8 +96,14 @@ function PagingFeature:PreRequest(ctx)
   if paging["cursor"] ~= nil then
     spec.query[cursor_param] = paging["cursor"]
   elseif spec.query[page_param] == nil then
-    if paging["page"] ~= nil then
-      spec.query[page_param] = paging["page"]
+    -- A record written back by PreResult holds the page just fetched as
+    -- "page" and the one to fetch as "nextPage", so nextPage wins.
+    local page = paging["nextPage"]
+    if page == nil then
+      page = paging["page"]
+    end
+    if page ~= nil then
+      spec.query[page_param] = page
     else
       spec.query[page_param] = self.options["startPage"] or 1
     end
@@ -218,17 +225,33 @@ function PagingFeature:PreResult(ctx)
     end
   end
 
-  -- Body-level cursors.
+  -- Body-level signals; snake_case forms are read first so camelCase wins.
   if type(body) == "table" then
     if body["next"] ~= nil and paging.next == nil then
       paging.next = body["next"]
     end
+    if body["next_cursor"] ~= nil then
+      paging.cursor = body["next_cursor"]
+    end
     if body["cursor"] ~= nil then
       paging.cursor = body["cursor"]
     end
     if body["nextCursor"] ~= nil then
       paging.cursor = body["nextCursor"]
     end
+    if paging.nextPage == nil then
+      local np = body["nextPage"]
+      if np == nil then
+        np = body["next_page"]
+      end
+      if type(np) == "number" or type(np) == "string" then
+        paging.nextPage = np
+      end
+    end
+    if type(body["has_more"]) == "boolean" then
+      paging.hasMore = body["has_more"]
+      explicit_more = true
+    end
     if type(body["hasMore"]) == "boolean" then
       paging.hasMore = body["hasMore"]
       explicit_more = true
@@ -247,6 +270,22 @@ function PagingFeature:PreResult(ctx)
 
   result.paging = paging
 
+  if ctx.ctrl ~= nil then
+    -- The Context shares the caller's paging table by reference, so refill
+    -- it in place; a fresh table on ctrl never reaches the caller.
+    if type(ctx.ctrl.paging) == "table" then
+      local shared = ctx.ctrl.paging
+      for k in pairs(shared) do
+        shared[k] = nil
+      end
+      for k, v in pairs(paging) do
+        shared[k] = v
+      end
+    else
+      ctx.ctrl.paging = paging
+    end
+  end
+
   local client = self.client
   client._paging = { last = paging }
 end

package/project/.sdk/tm/lua/feature/test_feature.lua

@@ -167,21 +167,12 @@ function TestFeature:init(ctx, options)
       local args = test_self:build_args(fctx, op, update_match)
       local found = vs.select(entmap, args)
       local ent = vs.getelem(found, 0)
-      if ent == nil and type(entmap) == "table" then
-        for _, e in pairs(entmap) do
-          if type(e) == "table" then ent = e; break end
-        end
-      end
       if ent == nil then
+        -- update miss: 404, never another record
         return respond(404, nil, { statusText = "Not found" })
       end
-      if type(ent) == "table" then
-        local reqdata = fctx.reqdata
-        if reqdata ~= nil then
-          for k, v in pairs(reqdata) do
-            ent[k] = v
-          end
-        end
+      if type(ent) == "table" and type(fctx.reqdata) == "table" then
+        vs.merge({ ent, fctx.reqdata })
       end
       vs.delprop(ent, "$KEY")
       local out = vs.clone(ent)
@@ -312,12 +303,39 @@ function TestFeature:make_netsim(net, inner)
 end
 
 
+local function point_terminal(p)
+  local parts = vs.getprop(p, "parts")
+  if type(parts) ~= "table" or #parts == 0 then return false end
+  local last = parts[#parts]
+  return type(last) == "string" and last:sub(1, 1) == "{"
+end
+
+local function point_depth(p)
+  local parts = vs.getprop(p, "parts")
+  return type(parts) == "table" and #parts or 0
+end
+
+-- The entity's own endpoint: a terminal `{param}` marks a record route, and
+-- among equals the shallower path wins (the same rule as make_point).
+local function pick_point(points)
+  if type(points) ~= "table" or #points == 0 then return nil end
+  local point = points[1]
+  for i = 2, #points do
+    local cand = points[i]
+    if point_terminal(cand) ~= point_terminal(point) then
+      if point_terminal(cand) then point = cand end
+    elseif point_depth(cand) < point_depth(point) then
+      point = cand
+    end
+  end
+  return point
+end
+
 function TestFeature:build_args(ctx, op, args)
   local opname = op.name
 
-  -- Get last point from config.
   local points = vs.getpath(ctx.config, "entity." .. ctx.entity:get_name() .. ".op." .. opname .. ".points")
-  local point = vs.getelem(points, -1)
+  local point = pick_point(points)
 
   -- Path AND query: a path-only read misses a query-addressed record
   -- (e.g. GET /result?trace_id=), which has no path param at all.

package/project/.sdk/tm/lua/test/omni.lua

@@ -403,7 +403,14 @@ end
 --- omni's value model), which keeps smoke tests free of fixture files.
 function M.makeRunner(testfile, client)
   local specref = testfile
-  if "string" == type(testfile) and "/" ~= testfile:sub(1, 1) then
+  -- A drive letter and a UNC prefix are absolute too, and neither starts
+  -- with "/": treating one as relative joins it onto _test_dir and reads
+  -- nothing. Lua has no path library, so the shapes are spelled out.
+  local function isabs(p)
+    return nil ~= p:match("^/") or nil ~= p:match("^%a:[/\\]")
+      or nil ~= p:match("^\\\\")
+  end
+  if "string" == type(testfile) and not isabs(testfile) then
     specref = _test_dir .. testfile
   end
 

package/project/.sdk/tm/lua/test/pipeline_test.lua

@@ -536,58 +536,137 @@ describe("pipeline", function()
 
   describe("prepareAuth", function()
 
+    -- A cookie credential as prepare_auth writes it: `<scheme>=K` for the
+    -- probe key, with no scheme prefix and nothing else in the bag.
+    local function is_cookie_pair(value)
+      return "string" == type(value) and nil ~= value:match("^[^=;]+=K$")
+    end
+
     -- Fake client so the exact options.auth / apikey shape is controlled.
-    local function auth_ctx(options, headers)
+    local function auth_ctx(options, spec)
       local ctx = base_ctx({})
       ctx.client = {
         options_map = function(_self)
           return options
         end,
       }
-      if headers == nil then
-        ctx.spec = nil
-      else
-        ctx.spec = Spec.new({ headers = headers })
-      end
+      ctx.spec = spec
       return ctx
     end
 
+    local function auth_bags()
+      return Spec.new({ headers = {}, query = {} })
+    end
+
+    -- A cookie credential rides the header bag, because a cookie IS a header.
+    local function auth_bag(spec, where)
+      if "query" == where then return spec.query end
+      return spec.headers
+    end
+
+    -- `basic = false` is explicit: an HTTP Basic API's generated config
+    -- carries `auth.basic: true`, and a client that merges it in takes a
+    -- branch needing a secret as well. With none supplied that branch writes
+    -- nothing, which the probe would read as a public API.
+    local function auth_block(prefix)
+      return { prefix = prefix, basic = false }
+    end
+
+    -- Run prepare_auth with both containers present and see which one the
+    -- generated utility writes to, and under what name. nil means this SDK
+    -- places no credential at all - a public API - which is a legitimate
+    -- shape, and the tests below assert exactly that instead. `pair` is the
+    -- `<scheme>=` lead-in of a COOKIE credential, which rides the header bag
+    -- under the key "cookie" instead of taking a header of its own.
+    local function auth_probe(options)
+      local ctx = auth_ctx(options, auth_bags())
+      ctx.utility.prepare_auth(ctx)
+      for _, where in ipairs({ "headers", "query" }) do
+        for name, value in pairs(auth_bag(ctx.spec, where)) do
+          local pair = ""
+          if "headers" == where and "cookie" == name and is_cookie_pair(value) then
+            pair = value:sub(1, -2)
+          end
+          return { where = where, name = name, value = value, pair = pair }
+        end
+      end
+      return nil
+    end
+
+    local function auth_credential()
+      return auth_probe({ apikey = "K", auth = auth_block("Bearer") })
+    end
+
+    -- Every credential this SDK could possibly place: both credentials and
+    -- Basic switched on, so whichever branch the API has, something lands
+    -- unless the API is public.
+    local function auth_any_credential()
+      return auth_probe({ apikey = "K", secret = "S",
+        auth = { prefix = "Bearer", basic = true } })
+    end
+
+    local function auth_placed(options, seed)
+      local cred = auth_credential()
+      local spec = auth_bags()
+      if nil ~= cred and nil ~= seed then
+        auth_bag(spec, cred.where)[cred.name] = seed
+      end
+      local ctx = auth_ctx(options, spec)
+      ctx.utility.prepare_auth(ctx)
+      if nil == cred then return nil end
+      return auth_bag(ctx.spec, cred.where)[cred.name]
+    end
+
     it("guards a missing spec", function()
-      local ctx = auth_ctx({ auth = { prefix = "" }, apikey = "K" }, nil)
+      local ctx = auth_ctx({ auth = auth_block(""), apikey = "K" }, nil)
       local _, err = ctx.utility.prepare_auth(ctx)
       assert.are.equal("auth_no_spec", err.code)
     end)
 
-    it("an apikey with a prefix is space-joined", function()
-      local ctx = auth_ctx({ apikey = "K", auth = { prefix = "Bearer" } }, {})
-      ctx.utility.prepare_auth(ctx)
-      assert.are.equal("Bearer K", ctx.spec.headers["authorization"])
+    -- Without this the cases below cannot fail for an SDK whose credential the
+    -- probe misses: every one of them takes the public-API path instead.
+    it("the probe finds the credential this SDK places", function()
+      assert.are.equal(nil == auth_credential(), nil == auth_any_credential())
+    end)
+
+    it("the apikey is placed where this API puts it", function()
+      local cred = auth_credential()
+      if nil == cred then
+        -- A public API places nothing, and that is the whole assertion.
+        assert.is_nil(auth_placed({ apikey = "K", auth = auth_block("Bearer") }))
+        return
+      end
+      assert.is_true("headers" == cred.where or "query" == cred.where)
+      if "" ~= cred.pair then
+        -- A cookie credential is a `<scheme>=<key>` pair, and the scheme name
+        -- leaves no room for the option's prefix.
+        assert.is_true(is_cookie_pair(cred.value), tostring(cred.value))
+        return
+      end
+      -- A header credential is prefix-joined; a query credential is the raw
+      -- key, because a query parameter has nowhere to put a scheme name.
+      local want = "Bearer K"
+      if "query" == cred.where then want = "K" end
+      assert.are.equal(want, cred.value)
     end)
 
     it("a raw apikey (empty prefix) goes in as-is", function()
-      local ctx = auth_ctx({ apikey = "K", auth = { prefix = "" } }, {})
-      ctx.utility.prepare_auth(ctx)
-      assert.are.equal("K", ctx.spec.headers["authorization"])
+      local cred = auth_credential()
+      local want = nil
+      if nil ~= cred then want = cred.pair .. "K" end
+      assert.are.equal(want, auth_placed({ apikey = "K", auth = auth_block("") }))
     end)
 
-    it("an empty apikey drops the header", function()
-      local ctx = auth_ctx({ apikey = "", auth = { prefix = "Bearer" } },
-        { authorization = "stale" })
-      ctx.utility.prepare_auth(ctx)
-      assert.is_nil(ctx.spec.headers["authorization"])
+    it("an empty apikey drops the credential", function()
+      assert.is_nil(auth_placed({ apikey = "", auth = auth_block("Bearer") }, "stale"))
     end)
 
-    it("a public API (no auth block) drops the header", function()
-      local ctx = auth_ctx({ apikey = "K" }, { authorization = "stale" })
-      ctx.utility.prepare_auth(ctx)
-      assert.is_nil(ctx.spec.headers["authorization"])
+    it("a public API (no auth block) drops the credential", function()
+      assert.is_nil(auth_placed({ apikey = "K" }, "stale"))
     end)
 
-    it("a missing apikey option drops the header", function()
-      local ctx = auth_ctx({ auth = { prefix = "Bearer" } },
-        { authorization = "stale" })
-      ctx.utility.prepare_auth(ctx)
-      assert.is_nil(ctx.spec.headers["authorization"])
+    it("a missing apikey option drops the credential", function()
+      assert.is_nil(auth_placed({ auth = auth_block("Bearer") }, "stale"))
     end)
   end)
 

package/project/.sdk/tm/lua/test/primary_utility_test.lua

@@ -70,6 +70,64 @@ local function get_spec(base, ...)
 end
 
 
+-- Where this SDK's prepare_auth actually puts the credential: the name is
+-- the API's OWN scheme name, not always `authorization`, so it is discovered
+-- by running prepare_auth once.
+local function auth_credential(auth_client, auth_utility)
+  local ctx = auth_utility.make_context({
+    opname = "load",
+    client = auth_client,
+    utility = auth_utility,
+  }, auth_client:get_root_ctx())
+  ctx.spec = Spec.new({ headers = {}, query = {} })
+  local _, err = auth_utility.prepare_auth(ctx)
+  if err ~= nil then
+    return nil
+  end
+  for _, where in ipairs({ "headers", "query" }) do
+    -- A cookie credential rides the header bag, because a cookie IS a header.
+    local bag = ctx.spec.headers
+    if "query" == where then bag = ctx.spec.query end
+    for name, _value in pairs(bag) do
+      return { where = where, name = name }
+    end
+  end
+  return nil
+end
+
+
+-- Rename the corpus's `headers` bag to the real container, and the
+-- `authorization` key inside it to the real credential name. Applied only to
+-- the prepareAuth section, so real header assertions elsewhere are untouched.
+local function retarget_auth(node, cred)
+  if type(node) ~= "table" then
+    return node
+  end
+
+  -- The metatable carries the corpus's `__jsontype` marker, which the struct
+  -- library's islist/ismap read to tell a one-element list from a map. A
+  -- plain-table copy leaves the rebuilt `set` unrecognisable.
+  local out = setmetatable({}, getmetatable(node))
+  for key, value in pairs(node) do
+    if "headers" == key then
+      local bag = {}
+      if type(value) == "table" then
+        setmetatable(bag, getmetatable(value))
+        for bagkey, bagvalue in pairs(value) do
+          local name = bagkey
+          if "authorization" == bagkey then name = cred.name end
+          bag[name] = retarget_auth(bagvalue, cred)
+        end
+      end
+      out[cred.where] = bag
+    else
+      out[key] = retarget_auth(value, cred)
+    end
+  end
+  return out
+end
+
+
 -- Sections deliberately left empty in the shared corpus
 -- (.sdk/test/primary/<name>.aon carries a PENDING header). Everything else
 -- MUST contribute cases.
@@ -749,7 +807,23 @@ describe("PrimaryUtility", function()
     local auth_client = sdk.test(nil, setup_opts)
     local auth_utility = auth_client:get_utility()
 
-    runsection("prepareAuth", function(cin)
+    -- The corpus writes the credential as `headers.authorization`: a
+    -- PLACEHOLDER each runner points at the container and name this API
+    -- actually uses.
+    local cred = auth_credential(auth_client, auth_utility)
+    assert(cred ~= nil, "prepare_auth placed no credential in headers or query")
+
+    -- An absent section is runsection's report to make.
+    local section = get_spec(spec, "prepareAuth")
+    local original = nil
+    if section ~= nil
+      and not ("headers" == cred.where and "authorization" == cred.name)
+    then
+      original = section.basic
+      section.basic = retarget_auth(original, cred)
+    end
+
+    local subject = function(cin)
       if type(cin) ~= "table" then
         cin = {}
       end
@@ -758,15 +832,21 @@ describe("PrimaryUtility", function()
 
       unwrap(utility.prepare_auth(ctx))
 
-      -- Write live-context spec headers back for match checking
+      -- Write the live-context spec bags back for match checking. QUERY as
+      -- well as headers: this API may place its credential there.
       if ctx.spec ~= nil then
         cin["spec"] = {
           headers = ctx.spec.headers,
+          query = ctx.spec.query,
         }
       end
 
       return nil
-    end)
+    end
+
+    local ok, failure = pcall(runsection, "prepareAuth", subject)
+    if original ~= nil then section.basic = original end
+    if not ok then error(failure) end
   end)
 
 

package/project/.sdk/tm/lua/utility/prepare_query.lua

@@ -29,7 +29,8 @@ local function prepare_query_util(ctx)
     for _, item in ipairs(reqmatch_items) do
       local key = item[1]
       local val = item[2]
-      if val ~= nil and type(key) == "string" and not contains_param(params, key) then
+      if val ~= nil and type(key) == "string" and key ~= "$action"
+          and not contains_param(params, key) then
         out[key] = val
       end
     end

package/project/.sdk/tm/lua/utility/transform_request.lua

@@ -3,6 +3,22 @@
 local vs = require("utility.struct.struct")
 local helpers = require("core.helpers")
 
+-- `$action` selects the point (see make_point_util); it is never an API
+-- field, so the body is a copy without it. The caller's table is left
+-- untouched.
+local function strip_action(reqdata)
+  if not vs.ismap(reqdata) or reqdata["$action"] == nil then
+    return reqdata
+  end
+  local body = {}
+  for k, v in pairs(reqdata) do
+    if k ~= "$action" then
+      body[k] = v
+    end
+  end
+  return body
+end
+
 local function transform_request_util(ctx)
   local spec = ctx.spec
   local point = ctx.point
@@ -13,19 +29,19 @@ local function transform_request_util(ctx)
 
   local transform = helpers.to_map(vs.getprop(point, "transform"))
   if transform == nil then
-    return ctx.reqdata
+    return strip_action(ctx.reqdata)
   end
 
   local reqform = vs.getprop(transform, "req")
   if reqform == nil then
-    return ctx.reqdata
+    return strip_action(ctx.reqdata)
   end
 
   local reqdata = vs.transform({
     reqdata = ctx.reqdata,
   }, reqform)
 
-  return reqdata
+  return strip_action(reqdata)
 end
 
 return transform_request_util

package/project/.sdk/tm/ocaml/sdk_features.ml

@@ -1121,9 +1121,15 @@ let paging_feature () : feature =
                 | Noval | Null ->
                   (match getp q page_param with
                    | Noval ->
-                     let page = (match getp paging "page" with
-                         | Noval | Null -> (match getp !options "startPage" with Num n -> Num n | _ -> Num 1.)
-                         | p -> p) in
+                     (* A record written back by PreResult holds the page just
+                      * fetched as `page` and the one to fetch as `nextPage`,
+                      * so nextPage wins. *)
+                     let page = (match getp paging "nextPage" with
+                         | Noval | Null ->
+                           (match getp paging "page" with
+                            | Noval | Null -> (match getp !options "startPage" with Num n -> Num n | _ -> Num 1.)
+                            | p -> p)
+                         | np -> np) in
                      setp q page_param page
                    | _ -> ())
                 | c -> setp q cursor_param c);
@@ -1176,11 +1182,20 @@ let paging_feature () : feature =
              (match body with
               | Map _ ->
                 (match getp body "next" with Noval | Null -> () | n -> if is_nullish (getp paging "next") then setp paging "next" n);
+                (* Both spellings, camelCase last so it wins when a body
+                 * carries the two. *)
+                (match getp body "next_cursor" with Noval | Null -> () | c -> setp paging "cursor" c);
                 (match getp body "cursor" with Noval | Null -> () | c -> setp paging "cursor" c);
                 (match getp body "nextCursor" with Noval | Null -> () | c -> setp paging "cursor" c);
-                (match getp body "hasMore" with
-                 | Bool b -> setp paging "hasMore" (Bool b); explicit_more := true
-                 | _ -> ())
+                if is_nullish (getp paging "nextPage") then begin
+                  let np = (match getp body "nextPage" with
+                      | Noval | Null -> getp body "next_page"
+                      | v -> v) in
+                  (match np with Num _ | Str _ -> setp paging "nextPage" np | _ -> ())
+                end;
+                List.iter (fun k -> match getp body k with
+                    | Bool b -> setp paging "hasMore" (Bool b); explicit_more := true
+                    | _ -> ()) ["has_more"; "hasMore"]
               | _ -> ());
              (* Cursor presence only INFERS another page. When the server
               * stated the answer outright — relay's `hasNextPage: false`, or
@@ -1196,6 +1211,16 @@ let paging_feature () : feature =
                setp paging "hasMore" (Bool hm)
              end;
              result.rt_paging <- paging;
+             (* The record reached the caller through ctrl in every other typed
+              * port and through nothing here, so a caller who asked for paging
+              * got the pages and never the signals to continue. *)
+             (match ctx.c_ctrl.ctrl_paging with
+              | Map _ as held ->
+                (* The caller holds this map: refill it in place. Every key of
+                 * the record is written, so no key of an earlier page lives on. *)
+                List.iter (fun k -> setp held k (getp paging k))
+                  ["page"; "totalCount"; "nextPage"; "next"; "cursor"; "hasMore"]
+              | _ -> ctx.c_ctrl.ctrl_paging <- paging);
              track_set (cc ctx) "paging" (jo [("last", paging)]))
         | _ -> ());
   f
@@ -1408,21 +1433,43 @@ let test_feature () : feature =
     let out = jo [("status", vint_of status); ("statusText", Str "OK"); ("json", json_thunk (envelope ctx data)); ("body", Str "not-used")] in
     (match extra with Some (Map _ as e) -> List.iter (fun k -> setp out k (getp e k)) (keysof e) | _ -> ());
     (out, None) in
+  let point_terminal p =
+    match getp p "parts" with
+    | List r -> (match List.rev !r with Str s :: _ -> String.length s > 0 && s.[0] = '{' | _ -> false)
+    | _ -> false in
+  let point_depth p = match getp p "parts" with List r -> List.length !r | _ -> 0 in
+  (* The entity's own endpoint: a terminal `{param}` marks a record route, and
+     among equals the shallower path wins (the same rule as make_point). *)
+  let pick_point points =
+    match points with
+    | List r ->
+      (match !r with
+       | [] -> Noval
+       | first :: rest ->
+         List.fold_left (fun point cand ->
+             if point_terminal cand <> point_terminal point then (if point_terminal cand then cand else point)
+             else if point_depth cand < point_depth point then cand
+             else point) first rest)
+    | _ -> Noval in
+  let reqd_names point kind =
+    let reqd_args = select (getpath_s point ("args." ^ kind)) (jo [("reqd", Bool true)]) in
+    transform reqd_args (ja [Str "`$EACH`"; Str ""; Str "`$KEY.name`"]) in
   let build_args ctx (op : operation) args =
     let opname = op.op_name in
     let entname = match ctx.c_entity with Some e -> e.e_name | None -> "_" in
     let points = getpath_s ctx.c_config ("entity." ^ entname ^ ".op." ^ opname ^ ".points") in
-    let point = getelem points (Num (-1.0)) in
-    let params_path = getpath_s point "args.params" in
-    let reqd_params = select params_path (jo [("reqd", Bool true)]) in
-    let reqd = transform reqd_params (ja [Str "`$EACH`"; Str ""; Str "`$KEY.name`"]) in
+    let point = pick_point points in
+    (* Path AND query: a path-only read misses a query-addressed record
+       (e.g. GET /result?trace_id=), which has no path param at all. *)
+    let reqd_params = reqd_names point "params" in
+    let reqd_query = reqd_names point "query" in
     let qand = ref [] in
     (match args with
      | Map _ ->
        List.iter (fun key ->
            let is_id = key = "id" in
-           let selected = select reqd (Str key) in
-           let is_reqd = not (isempty selected) in
+           let is_reqd = not (isempty (select reqd_params (Str key)))
+                         || not (isempty (select reqd_query (Str key))) in
            if is_id || is_reqd then begin
              let v = (cu ctx).u_param ctx (Str key) in
              let ka = (match op.op_alias with Map _ -> (match getp op.op_alias key with Str s -> Some s | _ -> None) | _ -> None) in
@@ -1463,18 +1510,22 @@ let test_feature () : feature =
          end
        | "update" ->
          let update_match = empty_map () in
-         (match fctx.c_reqdata with Map _ -> (match getp fctx.c_reqdata "id" with Noval -> () | v -> setp update_match "id" v) | _ -> ());
+         (match fctx.c_reqdata with
+          | Map _ ->
+            (match getp fctx.c_reqdata "id" with Noval -> () | v -> setp update_match "id" v);
+            (match getp op.op_alias "id" with
+             | Str alias_id -> (match getp fctx.c_reqdata alias_id with Noval -> () | v -> setp update_match alias_id v)
+             | _ -> ())
+          | _ -> ());
          let update_match = if size update_match > 0 then update_match else resolve_match fctx (empty_map ()) in
          let args = build_args fctx op update_match in
-         let ent = ref (getelem (select entmap args) (Num 0.0)) in
-         (if is_nullish !ent then match entmap with
-           | Map m -> (try (match List.find (fun (_, v) -> match v with Map _ -> true | _ -> false) m.entries with (_, v) -> ent := v) with Not_found -> ())
-           | _ -> ());
-         if is_nullish !ent then respond fctx 404 Noval (Some (jo [("statusText", Str "Not found")]))
+         let ent = getelem (select entmap args) (Num 0.0) in
+         (* update miss: 404, never another record *)
+         if is_nullish ent then respond fctx 404 Noval (Some (jo [("statusText", Str "Not found")]))
          else begin
-           (match !ent with Map _ -> (match fctx.c_reqdata with Map _ -> List.iter (fun k -> setp !ent k (getp fctx.c_reqdata k)) (keysof fctx.c_reqdata) | _ -> ()) | _ -> ());
-           ignore (delprop !ent (Str "$KEY"));
-           respond fctx 200 (clone !ent) None
+           (match ent, fctx.c_reqdata with Map _, Map _ -> ignore (merge (ja [ent; fctx.c_reqdata])) | _ -> ());
+           ignore (delprop ent (Str "$KEY"));
+           respond fctx 200 (clone ent) None
          end
        | "remove" ->
          let args = build_args fctx op (resolve_match fctx fctx.c_reqmatch) in