@voxgig/sdkgen 4.30.2 → 4.31.0

package/project/.sdk/src/cmp/clojure/PrepareAuth_clojure.ts

@@ -106,19 +106,21 @@ ${p}          (if (= auth-prefix "") apikey-val (str auth-prefix " " apikey-val)
 
 
 function basicBlock(): string {
-  return `              ;; True HTTP Basic Auth needs TWO credentials, base64-joined - a
-              ;; single token in the header (the branch below) can never
+  return `              ;; True HTTP Basic Auth joins the two credentials, base64-encoded -
+              ;; a single token in the header (the branch below) can never
               ;; authenticate against an API that actually checks
-              ;; \`Authorization: Basic base64(user:pass)\`.
+              ;; \`Authorization: Basic base64(user:pass)\`. The password may
+              ;; be empty (RFC 7617): Lob, for one, documents the key as the
+              ;; user with a blank password (\`curl -u key:\`).
               (if (= true (vs/getpath options "auth.basic"))
                 (let [secret (vs/getprop options OPTION-SECRET NOT-FOUND)
                       missing? (fn [v] (or (nil? v)
                                            (and (string? v) (or (= v NOT-FOUND) (= v "")))))]
-                  (if (or (missing? apikey) (missing? secret))
+                  (if (missing? apikey)
                     (vs/delprop headers HEADER-AUTH)
                     (let [auth-prefix (or (vs/getpath options "auth.prefix") "")
                           b64 (.encodeToString (java.util.Base64/getEncoder)
-                                               (.getBytes ^String (str apikey ":" secret) "UTF-8"))]
+                                               (.getBytes ^String (str apikey ":" (if (missing? secret) "" secret)) "UTF-8"))]
                       (.put ^java.util.Map headers HEADER-AUTH
                             (if (= auth-prefix "") b64 (str auth-prefix " " b64))))))
 ${headerPlace(16)})`

package/project/.sdk/src/cmp/cpp/PrepareAuth_cpp.ts

@@ -165,9 +165,11 @@ ${clear(spec.where, 4)}
 `
 
   const basicBlock = !withBasic ? '' : `
-  // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+  // True HTTP Basic Auth joins the two credentials, base64-encoded - a single
   // token in the header (the branch below) can never authenticate against
   // an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+  // The password may be empty (RFC 7617): Lob, for one, documents the key as
+  // the user with a blank password (\`curl -u key:\`).
   if (is_true(Struct::getpath(options, {"auth", "basic"}))) {
     Value secret = getp(options, "secret", Value(NOT_FOUND));
 
@@ -178,13 +180,13 @@ ${clear(spec.where, 4)}
       noSecret = true;
     }
 
-    if (skip || noSecret) {
+    if (skip) {
 ${clear(spec.where, 6)}
     } else {
       std::string authPrefix = as_str(Struct::getpath(options, {"auth", "prefix"}));
       std::string b64 = authBase64(
         (apikey.is_string() ? apikey.as_string() : "") + ":" +
-        (secret.is_string() ? secret.as_string() : ""));
+        (!noSecret && secret.is_string() ? secret.as_string() : ""));
       if (authPrefix.empty()) {
         map_put(headers, CRED_NAME, Value(b64));
       } else {

package/project/.sdk/src/cmp/csharp/PrepareAuth_csharp.ts

@@ -92,10 +92,12 @@ function renderHeader(Name: string, cred: string, basic: boolean): string {
     private const string OptionSecret = "secret";` : ''
 
   const basicBlock = basic ? `
-        // True HTTP Basic Auth needs TWO credentials, base64-joined - a
+        // True HTTP Basic Auth joins the two credentials, base64-encoded - a
         // single token in the header (the branch below) can never
         // authenticate against an API that actually checks
-        // \`Authorization: Basic base64(user:pass)\`.
+        // \`Authorization: Basic base64(user:pass)\`. The password may be
+        // empty (RFC 7617): Lob, for one, documents the key as the user with
+        // a blank password (\`curl -u key:\`).
         if (StructUtils.GetPath(options, StructUtils.Jt("auth", "basic")) is bool isBasic &&
             isBasic)
         {
@@ -106,7 +108,7 @@ function renderHeader(Name: string, cred: string, basic: boolean): string {
             var noSecret = secret == null ||
                 (secret is string skStr && (skStr == NotFound || skStr == ""));
 
-            if (noApikey || noSecret)
+            if (noApikey)
             {
                 headers.Remove(HeaderAuth);
             }
@@ -118,7 +120,7 @@ function renderHeader(Name: string, cred: string, basic: boolean): string {
                     basicPrefix = bp;
                 }
                 var b64 = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(
-                    (apikey as string ?? "") + ":" + (secret as string ?? "")));
+                    (apikey as string ?? "") + ":" + (noSecret ? "" : secret as string ?? "")));
                 headers[HeaderAuth] = basicPrefix == ""
                     ? b64
                     : basicPrefix + " " + b64;

package/project/.sdk/src/cmp/elixir/PrepareAuth_elixir.ts

@@ -139,21 +139,23 @@ ${bag}
 `
 
   const body = basicHere
-    ? `        # True HTTP Basic Auth needs TWO credentials, base64-joined - a single
-        # token in the header (the branch below) can never authenticate
-        # against an API that actually checks
-        # \`Authorization: Basic base64(user:pass)\`.
+    ? `        # True HTTP Basic Auth joins the two credentials, base64-encoded - a
+        # single token in the header (the branch below) can never
+        # authenticate against an API that actually checks
+        # \`Authorization: Basic base64(user:pass)\`. The password may be
+        # empty (RFC 7617): Lob, for one, documents the key as the user with
+        # a blank password (\`curl -u key:\`).
         if S.getpath(options, "auth.basic") == true do
           secret = S.getprop(options, @option_secret, @not_found)
           no_apikey = not is_binary(apikey) or apikey == @not_found or apikey == ""
           no_secret = not is_binary(secret) or secret == @not_found or secret == ""
 
-          if no_apikey or no_secret do
+          if no_apikey do
             S.delprop(headers, @cred_name)
           else
             ap = S.getpath(options, "auth.prefix")
             auth_prefix = if is_binary(ap), do: ap, else: ""
-            b64 = Base.encode64(apikey <> ":" <> secret)
+            b64 = Base.encode64(apikey <> ":" <> if(no_secret, do: "", else: secret))
             hv = if auth_prefix != "", do: auth_prefix <> " " <> b64, else: b64
             S.setprop(headers, @cred_name, hv)
           end

package/project/.sdk/src/cmp/go/PrepareAuth_go.ts

@@ -128,25 +128,23 @@ ${cookieHelper(spec.where)}func prepareAuthUtil(ctx *core.Context) (*core.Spec,
 `
 
   const basicBlock = !withBasic ? '' : `
-	// True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+	// True HTTP Basic Auth joins the two credentials, base64-encoded - a single
 	// token in the header (the branch below) can never authenticate against
 	// an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+	// The password may be empty (RFC 7617): Lob, for one, documents the key as
+	// the user with a blank password (\`curl -u key:\`).
 	if basicAuth, _ := vs.GetPath(options, []any{"auth", "basic"}).(bool); basicAuth {
 		secret := vs.GetProp(options, optionSecret, notFound)
 
-		noSecret := false
-		if secret == nil {
-			noSecret = true
-		} else if secretStr, ok := secret.(string); ok &&
-			(secretStr == notFound || secretStr == "") {
-			noSecret = true
+		secretVal, _ := secret.(string)
+		if secretVal == notFound {
+			secretVal = ""
 		}
 
-		if skip || noSecret {
+		if skip {
 			${clear(spec.where)}
 		} else {
 			apikeyVal, _ := apikey.(string)
-			secretVal, _ := secret.(string)
 			b64 := base64.StdEncoding.EncodeToString([]byte(apikeyVal + ":" + secretVal))
 
 			basicPrefix := ""

package/project/.sdk/src/cmp/java/PrepareAuth_java.ts

@@ -100,9 +100,11 @@ final class PrepareAuth {
   ].join('\n')
 
   const basicBlock = basicBranch ? `
-    // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+    // True HTTP Basic Auth joins the two credentials, base64-encoded - a single
     // token in the header (the branch below) can never authenticate against
     // an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+    // The password may be empty (RFC 7617): Lob, for one, documents the key as
+    // the user with a blank password (\`curl -u key:\`).
     if (Boolean.TRUE.equals(Struct.getpath(options, List.of("auth", "basic")))) {
       Object secret = Struct.getprop(options, OPTION_SECRET, NOT_FOUND);
       boolean noApikey = !(apikey instanceof String)
@@ -110,7 +112,7 @@ final class PrepareAuth {
       boolean noSecret = !(secret instanceof String)
           || NOT_FOUND.equals(secret) || "".equals(secret);
 
-      if (noApikey || noSecret) {
+      if (noApikey) {
         headers.remove(CRED_NAME);
       }
       else {
@@ -120,7 +122,7 @@ final class PrepareAuth {
           basicPrefix = (String) bp;
         }
         String b64 = Base64.getEncoder().encodeToString(
-            ((String) apikey + ":" + (String) secret).getBytes(StandardCharsets.UTF_8));
+            ((String) apikey + ":" + (noSecret ? "" : (String) secret)).getBytes(StandardCharsets.UTF_8));
         if ("".equals(basicPrefix)) {
           headers.put(CRED_NAME, b64);
         }

package/project/.sdk/src/cmp/js/PrepareAuth_js.ts

@@ -104,19 +104,21 @@ ${cookieHelper(spec.where)}
   // query parameter or a cookie, so the branch is emitted only where it
   // can mean something.
   const basicBlock = (spec.basic && 'header' === spec.where) ? `
-  // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+  // True HTTP Basic Auth joins the two credentials, base64-encoded - a single
   // token in the header (the branch below) can never authenticate against
   // an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+  // The password may be empty (RFC 7617): Lob, for one, documents the key as
+  // the user with a blank password (\`curl -u key:\`).
   if (true === options.auth.basic) {
     const secret = getprop(options, OPTION_secret, NOTFOUND)
     const noApikey = NOTFOUND === apikey || null == apikey || '' === apikey
-    const noSecret = NOTFOUND === secret || null == secret || '' === secret
+    const pass = NOTFOUND === secret || null == secret ? '' : secret
 
-    if (noApikey || noSecret) {
+    if (noApikey) {
       delprop(headers, CRED_name)
     }
     else {
-      const b64 = Buffer.from(apikey + ':' + secret).toString('base64')
+      const b64 = Buffer.from(apikey + ':' + pass).toString('base64')
       setprop(headers, CRED_name,
         options.auth.prefix ? options.auth.prefix + ' ' + b64 : b64)
     }

package/project/.sdk/src/cmp/js/ReadmeInstall_js.ts

@@ -1,16 +1,33 @@
 
-import { cmp, Content } from '@voxgig/sdkgen'
+import { cmp, Content, isPublished, repoInfo } from '@voxgig/sdkgen'
 
 
 const ReadmeInstall = cmp(function ReadmeInstall(props: any) {
-  const { target } = props
+  const { target, ctx$ } = props
+  const { model } = ctx$
 
-  Content('```js')
-  Content(`
+  if (isPublished(model, target.name)) {
+    Content('```js')
+    Content(`
 npm install ${target.module.name}
 `)
-  Content('```')
+    Content('```')
+    return
+  }
 
+  // Publish pending, as in the ts target: a tag may not exist, so a clone is
+  // always offered. The js target needs no build.
+  const { releasesUrl, repoUrl, repo } = repoInfo(model)
+  Content(`This package is not yet published to npm. Install it from the GitHub
+release tag (\`${target.name}/vX.Y.Z\`, see [Releases](${releasesUrl})), or from a
+clone:
+
+\`\`\`bash
+git clone ${repoUrl}
+npm install ./${repo}/${target.name}
+\`\`\`
+
+`)
 })
 
 

package/project/.sdk/src/cmp/js/TestDefinition_js.ts

@@ -0,0 +1,40 @@
+import { cmp, File, Content, definitionPlan } from '@voxgig/sdkgen'
+
+
+// Every operation checked against the API definition, offline, in the SDK's
+// own suite: see test/definition-runner. Mirrors the ts component.
+const TestDefinition = cmp(function TestDefinition(props: any) {
+  const plan = definitionPlan(props.ctx$)
+  if (0 === plan.length) return
+
+  File({ name: 'definition.test.js' }, () => Content(`const { describe, test } = require('node:test')
+const { SDK } = require('..')
+const { runDefinitionPoint } = require('./definition-runner')
+const { isControlSkipped } = require('./utility')
+
+
+// Generated from the API definition, not from the model this SDK was built
+// from: the route, the declared query parameters, the credential the security
+// scheme names, and the definition's own response example.
+const PLAN = ${JSON.stringify(plan, null, 2)}
+
+
+describe('definition', () => {
+  for (const point of PLAN) {
+    test(point.entity + '.' + point.op + ' ' + point.method + ' ' + point.path, async (t) => {
+      const control = isControlSkipped('entityOp', point.entity + '.' + point.op, 'definition')
+      if (control.skip) {
+        t.skip(control.reason || 'skipped via sdk-test-control.json')
+        return
+      }
+      await runDefinitionPoint(SDK, point)
+    })
+  }
+})
+`))
+})
+
+
+export {
+  TestDefinition
+}

package/project/.sdk/src/cmp/js/Test_js.ts

@@ -8,6 +8,7 @@ import { cmp, each, Folder, entityCollection,
 
 
 import { TestLive } from './TestLive_js'
+import { TestDefinition } from './TestDefinition_js'
 import { TestDirect } from './TestDirect_js'
 import { TestEntity } from './TestEntity_js'
 
@@ -21,6 +22,7 @@ const Test = cmp(function Test(props: any) {
     // Write-once: a project's edited control file survives regeneration.
     TestControl({ target, dir: 'test' })
     TestLive({ target })
+    TestDefinition({ target })
 
     Folder({ name: 'entity' }, () => {
       const entity = each(entityCollection(model))

package/project/.sdk/src/cmp/kotlin/PrepareAuth_kotlin.ts

@@ -156,9 +156,11 @@ function basicBlock(spec: AuthSpec): string {
   if (!spec.basic) return ''
 
   return `
-  // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+  // True HTTP Basic Auth joins the two credentials, base64-encoded - a single
   // token in the header (the branch below) can never authenticate against
   // an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+  // The password may be empty (RFC 7617): Lob, for one, documents the key as
+  // the user with a blank password (\`curl -u key:\`).
   val basicOpt = Struct.getpath(options, listOf("auth", "basic"))
   if (basicOpt is Boolean && basicOpt) {
     val secret = Struct.getprop(options, OPTION_SECRET, NOT_FOUND)
@@ -167,7 +169,7 @@ function basicBlock(spec: AuthSpec): string {
     val noSecret = secret == null ||
       (secret is String && (NOT_FOUND == secret || "" == secret))
 
-    if (noApikey || noSecret) {
+    if (noApikey) {
       headers.remove(HEADER_AUTH)
     } else {
       var basicPrefix = ""
@@ -176,7 +178,7 @@ function basicBlock(spec: AuthSpec): string {
         basicPrefix = bp
       }
       val b64 = Base64.getEncoder().encodeToString(
-        (apikey.toString() + ":" + secret.toString()).toByteArray(Charsets.UTF_8))
+        (apikey.toString() + ":" + (if (noSecret) "" else secret.toString())).toByteArray(Charsets.UTF_8))
       if ("" == basicPrefix) {
         headers[HEADER_AUTH] = b64
       } else {

package/project/.sdk/src/cmp/lua/PrepareAuth_lua.ts

@@ -189,15 +189,19 @@ function place(where: string): string {
 
 
 const BASIC = `
-  -- True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+  -- True HTTP Basic Auth joins the two credentials, base64-encoded - a single
   -- token in the header (the branch below) can never authenticate against
   -- an API that actually checks "Authorization: Basic base64(user:pass)".
+  -- The password may be empty (RFC 7617): Lob, for one, documents the key as
+  -- the user with a blank password ("curl -u key:").
   if vs.getpath(options, "auth.basic") == true then
     local secret = vs.getprop(options, OPTION_SECRET, NOT_FOUND)
+    if secret == nil or secret == NOT_FOUND then
+      secret = ""
+    end
 
-    if apikey == nil or secret == nil
+    if apikey == nil
       or (type(apikey) == "string" and (apikey == NOT_FOUND or apikey == ""))
-      or (type(secret) == "string" and (secret == NOT_FOUND or secret == ""))
     then
       headers[HEADER_AUTH] = nil
     else

package/project/.sdk/src/cmp/ocaml/PrepareAuth_ocaml.ts

@@ -255,20 +255,22 @@ let prepare_auth_util (ctx : ctx) : (spec option * sdk_error option) =
 
 
 const BASIC = `       if (match getpath_s options "auth.basic" with Bool b -> b | _ -> false) then begin
-         (* True HTTP Basic Auth needs TWO credentials, base64-joined - a
-          * single token in the header (the branch below) can never
+         (* True HTTP Basic Auth joins the two credentials, base64-encoded -
+          * a single token in the header (the branch below) can never
           * authenticate against an API that actually checks
-          * \`Authorization: Basic base64(user:pass)\`. *)
+          * \`Authorization: Basic base64(user:pass)\`. The password may be
+          * empty (RFC 7617): Lob, for one, documents the key as the user
+          * with a blank password (\`curl -u key:\`). *)
          let secret = getprop ~alt:(Str not_found) options (Str option_secret) in
          let no_secret =
            (match secret with Str s -> s = not_found | _ -> false)
            || is_noval secret || secret = Str "" in
-         if no_apikey || no_secret then
+         if no_apikey then
            ignore (delprop headers (Str cred_name))
          else begin
            let auth_prefix = match getpath_s options "auth.prefix" with Str s -> s | _ -> "" in
            let apikey_val = match apikey with Str s -> s | _ -> "" in
-           let secret_val = match secret with Str s -> s | _ -> "" in
+           let secret_val = if no_secret then "" else match secret with Str s -> s | _ -> "" in
            let joined = base64_encode (apikey_val ^ ":" ^ secret_val) in
            setp headers cred_name
              (Str (if auth_prefix <> "" then auth_prefix ^ " " ^ joined else joined))

package/project/.sdk/src/cmp/perl/PrepareAuth_perl.ts

@@ -266,9 +266,11 @@ function basicBlock(spec: AuthSpec, wantBasic: boolean): string {
   }
 
   return `
-  # True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+  # True HTTP Basic Auth joins the two credentials, base64-encoded - a single
   # token in the header (the branch below) can never authenticate against
   # an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+  # The password may be empty (RFC 7617): Lob, for one, documents the key as
+  # the user with a blank password (\`curl -u key:\`).
   if (${spec.Name}Helpers::is_true(${spec.Name}Helpers::gpath($options, 'auth.basic'))) {
     my $secret = Voxgig::Struct::getprop($options, $OPTION_SECRET, $NOT_FOUND);
 
@@ -279,7 +281,7 @@ function basicBlock(spec: AuthSpec, wantBasic: boolean): string {
       || Voxgig::Struct::is_jnull($secret)
       || (!ref $secret && ($secret eq $NOT_FOUND || $secret eq ''));
 
-    if ($no_apikey || $no_secret) {
+    if ($no_apikey) {
       delete $headers->{$CRED_NAME};
     }
     else {
@@ -287,7 +289,8 @@ function basicBlock(spec: AuthSpec, wantBasic: boolean): string {
       $auth_prefix = '' unless defined $auth_prefix && !ref $auth_prefix;
       # '' as the eol: encode_base64 wraps at 76 columns by default, and a
       # newline inside a header value is not a header value.
-      my $b64 = MIME::Base64::encode_base64("$apikey:$secret", '');
+      my $pass = $no_secret ? '' : $secret;
+      my $b64 = MIME::Base64::encode_base64("$apikey:$pass", '');
       $headers->{$CRED_NAME} =
         ('' eq $auth_prefix) ? $b64 : "$auth_prefix $b64";
     }

package/project/.sdk/src/cmp/php/PrepareAuth_php.ts

@@ -201,16 +201,18 @@ function basicBlock(spec: AuthSpec): string {
   }
 
   return `
-        // True HTTP Basic Auth needs TWO credentials, base64-joined - a
+        // True HTTP Basic Auth joins the two credentials, base64-encoded - a
         // single token in the header (the branch below) can never
         // authenticate against an API that actually checks
-        // \`Authorization: Basic base64(user:pass)\`.
+        // \`Authorization: Basic base64(user:pass)\`. The password may be
+        // empty (RFC 7617): Lob, for one, documents the key as the user with
+        // a blank password (\`curl -u key:\`).
         if (true === (\\Voxgig\\Struct\\Struct::getpath($options, 'auth.basic') ?? false)) {
             $secret = \\Voxgig\\Struct\\Struct::getprop($options, self::OPTION_SECRET, self::NOT_FOUND);
             $apikey_val = is_string($apikey) && $apikey !== self::NOT_FOUND ? $apikey : '';
             $secret_val = is_string($secret) && $secret !== self::NOT_FOUND ? $secret : '';
 
-            if ($apikey_val === '' || $secret_val === '') {
+            if ($apikey_val === '') {
                 unset($headers[self::HEADER_AUTH]);
             } else {
                 $auth_prefix = \\Voxgig\\Struct\\Struct::getpath($options, 'auth.prefix') ?? '';

package/project/.sdk/src/cmp/php/ReadmeInstall_php.ts

@@ -1,5 +1,5 @@
 
-import { cmp, Content, installCommand, isPublished, repoInfo } from '@voxgig/sdkgen'
+import { cmp, Content, installCommand, isPublished, packageName, repoInfo } from '@voxgig/sdkgen'
 
 
 const ReadmeInstall = cmp(function ReadmeInstall(props: any) {
@@ -15,12 +15,18 @@ ${installCommand(model, target.name)}
     return
   }
 
-  // Publish pending: not yet on Packagist. Install from the git release tag.
-  const { releasesUrl } = repoInfo(model)
+  // Publish pending: not yet on Packagist. Install from the git release tag,
+  // or from a clone as a Composer path repository, since a tag may not exist.
+  const { releasesUrl, repoUrl, repo } = repoInfo(model)
   Content(`This package is not yet published to Packagist. Install it from the
-GitHub release tag (\`${target.name}/vX.Y.Z\`):
+GitHub release tag (\`${target.name}/vX.Y.Z\`, see [Releases](${releasesUrl})), or
+from a clone as a Composer path repository:
 
-- Releases: [${releasesUrl}](${releasesUrl})
+\`\`\`bash
+git clone ${repoUrl}
+composer config repositories.${repo} path ./${repo}/${target.name}
+composer require ${packageName(model, target.name)}:@dev
+\`\`\`
 
 `)
 })

package/project/.sdk/src/cmp/py/PrepareAuth_py.ts

@@ -140,9 +140,11 @@ function basicBlock(spec: AuthSpec): string {
   if (!spec.basic) return ''
 
   return `
-    # True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+    # True HTTP Basic Auth joins the two credentials, base64-encoded - a single
     # token in the header (the branch below) can never authenticate against
     # an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+    # The password may be empty (RFC 7617): Lob, for one, documents the key as
+    # the user with a blank password (\`curl -u key:\`).
     if vs.getpath(options, "auth.basic") is True:
         secret = vs.getprop(options, OPTION_SECRET, NOT_FOUND)
         no_apikey = (
@@ -156,7 +158,7 @@ function basicBlock(spec: AuthSpec): string {
             or secret == ""
         )
 
-        if no_apikey or no_secret:
+        if no_apikey:
             headers.pop(HEADER_AUTH, None)
         else:
             auth_prefix = ""
@@ -164,7 +166,7 @@ function basicBlock(spec: AuthSpec): string {
             if isinstance(ap, str):
                 auth_prefix = ap
             b64 = base64.b64encode(
-                (str(apikey) + ":" + str(secret)).encode("utf-8")
+                (str(apikey) + ":" + ("" if no_secret else str(secret))).encode("utf-8")
             ).decode("ascii")
             headers[HEADER_AUTH] = (
                 auth_prefix + " " + b64 if auth_prefix else b64

package/project/.sdk/src/cmp/rb/PrepareAuth_rb.ts

@@ -124,21 +124,23 @@ end
 `
 
   const basicBlock = !basicHere ? '' : `
-    # True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+    # True HTTP Basic Auth joins the two credentials, base64-encoded - a single
     # token in the header (the branch below) can never authenticate against
     # an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+    # The password may be empty (RFC 7617): Lob, for one, documents the key as
+    # the user with a blank password (\`curl -u key:\`).
     if VoxgigStruct.getpath(options, "auth.basic") == true
       secret = VoxgigStruct.getprop(options, OPTION_SECRET, NOT_FOUND)
       no_apikey = apikey.nil? || !apikey.is_a?(String) || apikey == NOT_FOUND || apikey == ""
       no_secret = secret.nil? || !secret.is_a?(String) || secret == NOT_FOUND || secret == ""
 
-      if no_apikey || no_secret
+      if no_apikey
         headers.delete(HEADER_AUTH)
       else
         auth_prefix = VoxgigStruct.getpath(options, "auth.prefix") || ""
         # \`pack("m0")\` rather than \`Base64.strict_encode64\`: base64 left
         # Ruby's default gems in 3.4, and pack is core.
-        b64 = ["#{apikey}:#{secret}"].pack("m0")
+        b64 = ["#{apikey}:#{no_secret ? "" : secret}"].pack("m0")
         headers[HEADER_AUTH] =
           auth_prefix.empty? ? b64 : "#{auth_prefix} #{b64}"
       end

package/project/.sdk/src/cmp/rb/ReadmeInstall_rb.ts

@@ -27,12 +27,22 @@ bundle install
     return
   }
 
-  // Publish pending: not yet on RubyGems. Install from the git release tag.
-  const { releasesUrl } = repoInfo(model)
+  // Publish pending: not yet on RubyGems. Install from the git release tag,
+  // or from a clone through Bundler, since a tag may not exist.
+  const { releasesUrl, repoUrl, repo } = repoInfo(model)
   Content(`This package is not yet published to RubyGems. Install it from the
-GitHub release tag (\`${target.name}/vX.Y.Z\`):
+GitHub release tag (\`${target.name}/vX.Y.Z\`, see [Releases](${releasesUrl})), or
+from a clone:
 
-- Releases: [${releasesUrl}](${releasesUrl})
+\`\`\`bash
+git clone ${repoUrl}
+\`\`\`
+
+Then add it to your \`Gemfile\` by path, and run \`bundle install\`:
+
+\`\`\`ruby
+gem "${packageName(model, target.name)}", path: "./${repo}/${target.name}"
+\`\`\`
 
 `)
 })

package/project/.sdk/src/cmp/rust/PrepareAuth_rust.ts

@@ -136,9 +136,11 @@ pub fn prepare_auth_util(ctx: &Rc<Context>) -> Result<Rc<RefCell<Spec>>, ${spec.
 `
 
   const basicBlock = !withBasic ? '' : `
-    // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+    // True HTTP Basic Auth joins the two credentials, base64-encoded - a single
     // token in the header (the branch below) can never authenticate against
     // an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+    // The password may be empty (RFC 7617): Lob, for one, documents the key as
+    // the user with a blank password (\`curl -u key:\`).
     if let Value::Bool(true) = getpath(&["auth", "basic"], &options) {
         let secret = vs::get_prop(&options, &Value::str(OPTION_SECRET), Value::str(NOT_FOUND));
 
@@ -148,7 +150,7 @@ pub fn prepare_auth_util(ctx: &Rc<Context>) -> Result<Rc<RefCell<Spec>>, ${spec.
             _ => false,
         };
 
-        if skip || no_secret {
+        if skip {
             vs::del_prop(headers, &Value::str(CRED_NAME));
         } else {
             let apikey_val = match &apikey {
@@ -156,7 +158,7 @@ pub fn prepare_auth_util(ctx: &Rc<Context>) -> Result<Rc<RefCell<Spec>>, ${spec.
                 _ => String::new(),
             };
             let secret_val = match &secret {
-                Value::Str(s) => s.clone(),
+                Value::Str(s) if !no_secret => s.clone(),
                 _ => String::new(),
             };
             let b64 = base64_encode(format!("{}:{}", apikey_val, secret_val).as_bytes());

package/project/.sdk/src/cmp/scala/PrepareAuth_scala.ts

@@ -146,22 +146,24 @@ function basicBlock(spec: AuthSpec): string {
   if (!spec.basic) return ''
 
   return `
-    // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+    // True HTTP Basic Auth joins the two credentials, base64-encoded - a single
     // token in the header (the branch below) can never authenticate against
     // an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+    // The password may be empty (RFC 7617): Lob, for one, documents the key as
+    // the user with a blank password (\`curl -u key:\`).
     if (java.lang.Boolean.TRUE == Struct.getpath(options, java.util.List.of("auth", "basic"))) {
       val secret = Struct.getprop(options, OPTION_SECRET, NOT_FOUND)
       val noApikey = apikey == null || (apikey match { case s: String => NOT_FOUND == s || "" == s; case _ => false })
       val noSecret = secret == null || (secret match { case s: String => NOT_FOUND == s || "" == s; case _ => false })
 
-      if (noApikey || noSecret) {
+      if (noApikey) {
         headers.remove(CRED_NAME)
       } else {
         var basicPrefix = ""
         Struct.getpath(options, java.util.List.of("auth", "prefix")) match { case s: String => basicPrefix = s; case _ => }
         val b64 = Base64.getEncoder.encodeToString(
           ((apikey match { case s: String => s; case _ => "" }) + ":" +
-            (secret match { case s: String => s; case _ => "" })).getBytes(StandardCharsets.UTF_8))
+            (if (noSecret) "" else secret match { case s: String => s; case _ => "" })).getBytes(StandardCharsets.UTF_8))
         if ("" == basicPrefix) headers.put(CRED_NAME, b64)
         else headers.put(CRED_NAME, basicPrefix + " " + b64)
       }