@voxgig/sdkgen 4.33.0 → 4.34.1

package/project/.sdk/src/cmp/go/PrepareAuth_go.ts

@@ -87,7 +87,7 @@ func prepareAuthUtil(ctx *core.Context) (*core.Spec, error) {
 import (
 ${withBasic ? `	"encoding/base64"
 
-` : ''}${'cookie' === spec.where ? `	"strings"
+` : ''}${'query' !== spec.where ? `	"strings"
 
 ` : ''}	vs "${spec.gomodule}/utility/struct"
 
@@ -100,6 +100,14 @@ ${'cookie' === spec.where ? `const cookieHeader = "cookie"
 ${withBasic ? `const optionSecret = "secret"
 ` : ''}const notFound = "__NOTFOUND__"
 
+// The client's auth.name option, when set, replaces the name the API declares.
+func authName(options map[string]any) string {
+	if name, ok := vs.GetPath(options, []any{"auth", "name"}).(string); ok && name != "" {
+		return ${caseFold(spec.where, 'name')}
+	}
+	return credName
+}
+
 ${cookieHelper(spec.where)}func prepareAuthUtil(ctx *core.Context) (*core.Spec, error) {
 	spec := ctx.Spec
 	if spec == nil {
@@ -112,10 +120,17 @@ ${cookieHelper(spec.where)}func prepareAuthUtil(ctx *core.Context) (*core.Spec,
 
 	// Public APIs that need no auth omit the options.auth block entirely.
 	if options["auth"] == nil {
-		${clear(spec.where)}
+		${clear(spec.where, 'credName')}
 		return spec, nil
 	}
 
+	name := authName(options)
+
+	// A credential left under the declared name would travel beside the renamed one.
+	if name != credName {
+		${clear(spec.where, 'credName')}
+	}
+
 	apikey := vs.GetProp(options, optionApikey, notFound)
 
 	skip := false
@@ -142,7 +157,7 @@ ${cookieHelper(spec.where)}func prepareAuthUtil(ctx *core.Context) (*core.Spec,
 		}
 
 		if skip {
-			${clear(spec.where)}
+			${clear(spec.where, 'name')}
 		} else {
 			apikeyVal, _ := apikey.(string)
 			b64 := base64.StdEncoding.EncodeToString([]byte(apikeyVal + ":" + secretVal))
@@ -156,9 +171,9 @@ ${cookieHelper(spec.where)}func prepareAuthUtil(ctx *core.Context) (*core.Spec,
 			}
 			// Empty prefix (raw apiKey credential) must not add a leading space.
 			if basicPrefix == "" {
-				${bagName(spec.where)}[credName] = b64
+				${bagName(spec.where)}[name] = b64
 			} else {
-				${bagName(spec.where)}[credName] = basicPrefix + " " + b64
+				${bagName(spec.where)}[name] = basicPrefix + " " + b64
 			}
 		}
 
@@ -168,9 +183,9 @@ ${cookieHelper(spec.where)}func prepareAuthUtil(ctx *core.Context) (*core.Spec,
 
   return head + basicBlock + `
 	if skip {
-		${clear(spec.where)}
+		${clear(spec.where, 'name')}
 	} else {
-${place(spec.where)}
+${place(spec.where, 'name')}
 	}
 
 	return spec, nil
@@ -196,14 +211,20 @@ function bagField(where: string): string {
 }
 
 
+// Header names travel lower-cased; query and cookie names are case-sensitive.
+function caseFold(where: string, expr: string): string {
+  return 'header' === where ? 'strings.ToLower(' + expr + ')' : expr
+}
+
+
 // A cookie has no header of its own: place() writes it into `cookie` as
-// `credName=value`, so clear() must free that slot, not credName.
-function clear(where: string): string {
+// `name=value`, so clear() frees that pair, not a header of that name.
+function clear(where: string, name: string): string {
   if ('cookie' === where) {
-    return `cookieSet(headers, nil)`
+    return `cookieSet(headers, ${name}, nil)`
   }
 
-  return `delete(${bagName(where)}, credName)`
+  return `delete(${bagName(where)}, ${name})`
 }
 
 
@@ -212,23 +233,16 @@ function cookieHelper(where: string): string {
     return ''
   }
 
-  return `func cookieSet(headers map[string]any, value any) {
+  return `func cookieSet(headers map[string]any, name string, value any) {
 	kept := []string{}
 
 	if existing, ok := headers[cookieHeader].(string); ok && existing != "" {
-		for _, part := range strings.Split(existing, ";") {
-			piece := strings.TrimSpace(part)
-			if piece == "" || piece == credName ||
-				strings.HasPrefix(piece, credName+"=") {
-				continue
-			}
-			kept = append(kept, piece)
-		}
+		kept = cookieKeep(existing, map[string]bool{name: true})
 	}
 
 	if value != nil {
 		valStr, _ := value.(string)
-		kept = append(kept, credName+"="+valStr)
+		kept = append(kept, name+"="+valStr)
 	}
 
 	if len(kept) == 0 {
@@ -242,13 +256,13 @@ function cookieHelper(where: string): string {
 }
 
 
-function place(where: string): string {
+function place(where: string, name: string): string {
   if ('query' === where) {
     return `		apikeyVal := ""
 		if av, ok := apikey.(string); ok {
 			apikeyVal = av
 		}
-		query[credName] = apikeyVal`
+		query[${name}] = apikeyVal`
   }
 
   if ('cookie' === where) {
@@ -256,7 +270,7 @@ function place(where: string): string {
 		if av, ok := apikey.(string); ok {
 			apikeyVal = av
 		}
-		cookieSet(headers, apikeyVal)`
+		cookieSet(headers, ${name}, apikeyVal)`
   }
 
   return `		authPrefix := ""
@@ -269,9 +283,9 @@ function place(where: string): string {
 		}
 		// Empty prefix (raw apiKey credential) must not add a leading space.
 		if authPrefix == "" {
-			headers[credName] = apikeyVal
+			headers[${name}] = apikeyVal
 		} else {
-			headers[credName] = authPrefix + " " + apikeyVal
+			headers[${name}] = authPrefix + " " + apikeyVal
 		}`
 }
 

package/project/.sdk/src/cmp/go/ReadmeEntity_go.ts

@@ -17,6 +17,7 @@ const OP_DESC: Record<string, { method: string, desc: string }> = {
   list:   { method: 'List(match, ctrl)',   desc: 'List entities matching the criteria.' },
   create: { method: 'Create(data, ctrl)',  desc: 'Create a new entity with the given data.' },
   update: { method: 'Update(data, ctrl)',  desc: 'Update an existing entity.' },
+  patch:  { method: 'Patch(data, ctrl)',   desc: 'Change part of an existing entity.' },
   remove: { method: 'Remove(match, ctrl)', desc: 'Remove the matching entity.' },
 }
 

package/project/.sdk/src/cmp/go/ReadmeExamplesTest_go.ts

@@ -31,6 +31,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"strconv"
 	"strings"
@@ -53,6 +54,10 @@ const testSeed = \`${goSeed}\`
 // seedRef is how a snippet names the shared fixture; seedFile declares it.
 const seedRef = "readmeTestSeed"
 
+// The client variable, not the word: an import path carries the word between
+// hyphens (github.com/voxgig-sdk/multifon-client-sdk/go).
+var clientVar = regexp.MustCompile(\`(^|[^\\w.\\-/"])client([^\\w\\-/"]|$)\`)
+
 func seedFile(pkg string) []byte {
 	return []byte("package " + pkg + "\\n\\nvar " + seedRef + " = " + testSeed + "\\n")
 }
@@ -524,7 +529,7 @@ func wrapFragment(name, block, modulePath string) string {
 	}
 
 	declaresClient := strings.Contains(block, "client :=")
-	injectClient := !declaresClient && strings.Contains(block, "client")
+	injectClient := !declaresClient && clientVar.MatchString(block)
 
 	needSdk := injectClient || strings.Contains(block, "sdk.")
 	usesFmt := strings.Contains(block, "fmt.")

package/project/.sdk/src/cmp/go/ReadmeHowto_go.ts

@@ -48,7 +48,7 @@ const ReadmeHowto = cmp(function ReadmeHowto(props: any) {
     testArg = 0 < items.length
       ? `map[string]any{${items.map((it: any) => `"${it.name}": ${it.name === idF ? '"test01"' : goLit(it.type)}`).join(', ')}}`
       : 'nil'
-  } else if (exampleEntity && ('create' === primaryOp || 'update' === primaryOp)) {
+  } else if (exampleEntity && ('create' === primaryOp || 'update' === primaryOp || 'patch' === primaryOp)) {
     const items = opRequestShape(exampleEntity, primaryOp).items
       .filter((it: any) => it.name !== idF && it.name !== 'id')
     const required = items.filter((it: any) => !it.optional)

package/project/.sdk/src/cmp/go/ReadmeInstall_go.ts

@@ -10,14 +10,14 @@ const ReadmeInstall = cmp(function ReadmeInstall(props: any) {
   const gomodule = packageName(model, target.name)
   // `repo` is the directory a `git clone` of this project creates — not
   // `<slug>-sdk`, which is only the DEFAULT repo name.
-  const { releasesUrl, repo } = repoInfo(model)
+  const { hostName, tagsUrl, repo } = repoInfo(model)
 
   Content(`\`\`\`bash
 go get ${gomodule}@latest
 \`\`\`
 
-The Go module proxy resolves the version from the \`go/vX.Y.Z\` GitHub
-release tag — see [Releases](${releasesUrl}) for the available versions.
+The Go module proxy resolves the version from the \`go/vX.Y.Z\` ${hostName}
+release tag — see [Tags](${tagsUrl}) for the available versions.
 
 To vendor from a local checkout instead, clone this repo alongside your
 project and add a \`replace\` directive pointing at the checked-out

package/project/.sdk/src/cmp/go/ReadmeIntro_go.ts

@@ -1,5 +1,5 @@
 
-import { cmp, Content } from '@voxgig/sdkgen'
+import { cmp, Content, modelText } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -10,7 +10,7 @@ import {
 
 const ReadmeIntro = cmp(function ReadmeIntro(props: any) {
   const { target, ctx$: { model } } = props
-  const info = (model.main && model.main.kit && model.main.kit.info) || {}
+  const info = modelText(model)
   const tagline = info.tagline || ''
 
   // Derive a real entity accessor from the model for the semantic-entity
@@ -23,7 +23,7 @@ const ReadmeIntro = cmp(function ReadmeIntro(props: any) {
   // expose (a read-only entity has just List+Load); never claim
   // Create/Update/Remove exist when no entity has them. Go method names are
   // capitalised, so present the ops that way.
-  const CANON_OPS = ['list', 'load', 'create', 'update', 'remove']
+  const CANON_OPS = ['list', 'load', 'create', 'update', 'patch', 'remove']
   const cap = (o: string) => o.charAt(0).toUpperCase() + o.slice(1)
   const opSet = new Set<string>()
   Object.values(entity || {}).forEach((e: any) => {

package/project/.sdk/src/cmp/go/ReadmeModel_go.ts

@@ -28,12 +28,13 @@ const ReadmeModel = cmp(function ReadmeModel(props: any) {
     list: '| `List` | `(reqmatch, ctrl map[string]any) (any, error)` | List entities matching the criteria. |',
     create: '| `Create` | `(reqdata, ctrl map[string]any) (any, error)` | Create a new entity. |',
     update: '| `Update` | `(reqdata, ctrl map[string]any) (any, error)` | Update an existing entity. |',
+    patch: '| `Patch` | `(reqdata, ctrl map[string]any) (any, error)` | Change part of an existing entity. |',
     remove: '| `Remove` | `(reqmatch, ctrl map[string]any) (any, error)` | Remove an entity. |',
   }
-  const opRows = ['load', 'list', 'create', 'update', 'remove']
+  const opRows = ['load', 'list', 'create', 'update', 'patch', 'remove']
     .filter((o) => opUnion.has(o)).map((o) => opRowDefs[o]).join('\n')
 
-  const recordOps = ['load', 'create', 'update', 'remove'].filter((o) => opUnion.has(o))
+  const recordOps = ['load', 'create', 'update', 'patch', 'remove'].filter((o) => opUnion.has(o))
     .map((o) => '`' + o.charAt(0).toUpperCase() + o.slice(1) + '`')
   const resultRows: string[] = []
   if (recordOps.length) resultRows.push('| ' + recordOps.join(' / ') + ' | the entity record (`map[string]any`) |')

package/project/.sdk/src/cmp/go/ReadmeQuick_go.ts

@@ -130,6 +130,20 @@ const ReadmeQuick = cmp(function ReadmeQuick(props: any) {
       usesFmt = true
     }
 
+    if (opnames.includes('patch')) {
+      const patchMembers = (idF
+        ? [`"${idF}": ${exampleValue(exampleEntity, exampleEntity.op.patch, idF, 'example_id')}`]
+        : []).concat(exampleFields('patch'))
+      body.push(`    // Patch a ${eLower}: only the fields given are sent.`)
+      body.push(`    patched, err := client.${eName}(nil).Patch(map[string]any{${patchMembers.join(', ')}}, nil)`)
+      body.push(`    if err != nil {`)
+      body.push(`        panic(err)`)
+      body.push(`    }`)
+      body.push(`    fmt.Println(patched)`)
+      body.push(``)
+      usesFmt = true
+    }
+
     if (opnames.includes('remove')) {
       body.push(`    // Remove a ${eLower}.`)
       body.push(`    removed, err := client.${eName}(nil).Remove(${matchArg('remove')}, nil)`)

package/project/.sdk/src/cmp/go/ReadmeRef_go.ts

@@ -1,5 +1,5 @@
 
-import { cmp, each, Content, canonToType, File, isAuthActive, entityIdField, entityOps, opRequestShape , targetFeatures } from '@voxgig/sdkgen'
+import { cmp, each, Content, canonToType, File, isAuthActive, entityIdField, entityOps, opRequestShape , targetFeatures, bodyNote } from '@voxgig/sdkgen'
 import { ReadmeRefFeatures } from '@voxgig/sdkgen'
 
 import {
@@ -31,6 +31,12 @@ const OP_SIGNATURES: Record<string, { sig: string, returns: string, desc: string
     returns: '(any, error)',
     desc: 'Update an existing entity. The data must include the entity `id`.',
   },
+  patch: {
+    sig: 'Patch(reqdata, ctrl map[string]any) (any, error)',
+    returns: '(any, error)',
+    desc: 'Change part of an existing entity: only the fields given are sent. ' +
+      'The data must include the entity `id`.',
+  },
   remove: {
     sig: 'Remove(reqmatch, ctrl map[string]any) (any, error)',
     returns: '(any, error)',
@@ -210,7 +216,7 @@ fmt.Println(${eVar}.GetName()) // "${ent.name}"
           // Only emit columns for operations this entity actually exposes —
           // never advertise a create/update/remove column the entity lacks
           // (opnames already carries active ops only).
-          const opcols = ['load', 'list', 'create', 'update', 'remove']
+          const opcols = ['load', 'list', 'create', 'update', 'patch', 'remove']
             .filter((op: string) => opnames.includes(op))
           Content(`### Field Usage by Operation
 
@@ -312,20 +318,20 @@ fmt.Println(result)
 
 `)
           }
-          else if ('update' === opname) {
+          else if ('update' === opname || 'patch' === opname) {
             // The id key plus every REQUIRED data member — the same shape
             // that generates the op's request data — then the patch-fields
             // note.
-            const updateItems = opRequestShape(ent, 'update').items
+            const updateItems = opRequestShape(ent, opname).items
               .filter((it: any) => !it.optional || it.name === idF)
               .sort((a: any, b: any) =>
                 (a.name === idF ? 0 : 1) - (b.name === idF ? 0 : 1))
             const updateLines = updateItems.map((it: any) =>
-              `    "${it.name}": ${exampleValue(ent, ent.op && ent.op.update, it.name,
+              `    "${it.name}": ${exampleValue(ent, ent.op && ent.op[opname], it.name,
                 it.name === idF ? ent.name + '_id' : it.name)},\n`).join('')
             Content(`\`\`\`go
-result, err := client.${ent.Name}(nil).Update(map[string]any{
-${updateLines}    // Fields to update
+result, err := client.${ent.Name}(nil).${'patch' === opname ? 'Patch' : 'Update'}(map[string]any{
+${updateLines}    // ${'patch' === opname ? 'Only the fields to change' : 'Fields to update'}
 }, nil)
 if err != nil {
     panic(err)
@@ -335,6 +341,14 @@ fmt.Println(result)
 
 `)
           }
+
+          if ('create' === opname || 'update' === opname || 'patch' === opname) {
+            const note = bodyNote(ent.op[opname], {
+              values: 'a `[]byte`, a `string` or an `io.Reader`',
+              once: 'an `io.Reader`',
+            })
+            if ('' !== note) Content(note)
+          }
         })
       }
 
@@ -356,6 +370,14 @@ Get or set the entity match criteria. Works the same as \`Data()\`.
 Create a new \`${ent.Name}Entity\` instance with the same client and
 options.
 
+#### \`Stream(action string, args map[string]any, callopts map[string]any) <-chan StreamItem\`
+
+Run an operation through the pipeline and send its result items on the
+returned channel, which closes when the stream ends. A \`StreamItem\` holds
+one item in \`Item\`, or in \`Err\` the error that ended the stream: the
+error the operation itself would return, sent as the last value. Under
+\`throw: false\` in \`callopts["ctrl"]\`, no error is sent.
+
 #### \`GetName() string\`
 
 Return the entity name.

package/project/.sdk/src/cmp/go/ReadmeTopTest_go.ts

@@ -45,7 +45,7 @@ client := sdk.Test()
     let arg = 'nil'
     if (isMatchOp) {
       arg = idF ? `map[string]any{"${idF}": "test01"}` : 'nil'
-    } else if ('create' === primaryOp || 'update' === primaryOp) {
+    } else if ('create' === primaryOp || 'update' === primaryOp || 'patch' === primaryOp) {
       const items = opRequestShape(exampleEntity, primaryOp).items
         .filter((it: any) => it.name !== idF && it.name !== 'id')
       const required = items.filter((it: any) => !it.optional)

package/project/.sdk/src/cmp/go/TestClean_go.ts

@@ -242,8 +242,43 @@ var cleanScenarios = []cleanScenario{
 	}},
 }
 
+// Offline, as every generated suite is: the test OPTION resolves a required
+// server variable to test-<name>, and installs no transport.
+func cleanOffline(opts map[string]any) map[string]any {
+	opts["test"] = map[string]any{"active": true}
+	return opts
+}
+
+// A client the sweep cannot build leaves nothing swept: a harness error, not
+// a leak, which cleanHarness reports instead of letting the panic end the run.
+type cleanHarnessError struct{ cause any }
+
+func cleanNew(opts map[string]any) *sdk.${Name}SDK {
+	defer func() {
+		if r := recover(); r != nil {
+			panic(cleanHarnessError{r})
+		}
+	}()
+	return sdk.New${Name}SDK(cleanOffline(opts))
+}
+
+func cleanHarness(t *testing.T) {
+	if r := recover(); r != nil {
+		if h, ok := r.(cleanHarnessError); ok {
+			t.Fatalf("clean harness: the client could not be constructed, so nothing was swept: %v",
+				h.cause)
+		}
+		panic(r)
+	}
+}
+
 func cleanMakeSdk(scenario cleanScenario, sinks *[]cleanSink, cleanopts map[string]any,
 	extra ...any) *sdk.${Name}SDK {
+	return cleanNew(cleanOptions(scenario, sinks, cleanopts, extra...))
+}
+
+func cleanOptions(scenario cleanScenario, sinks *[]cleanSink, cleanopts map[string]any,
+	extra ...any) map[string]any {
 	capture := func(name string) func(map[string]any) {
 		return func(rec map[string]any) {
 			*sinks = append(*sinks, cleanSurfaces(name, rec)...)
@@ -281,7 +316,7 @@ func cleanMakeSdk(scenario cleanScenario, sinks *[]cleanSink, cleanopts map[stri
 		clean[k] = v
 	}
 
-	return sdk.New${Name}SDK(map[string]any{
+	return map[string]any{
 		"apikey":  cleanCanary["apikey"],
 		"secret":  cleanCanary["secret"],
 		"headers": map[string]any{"X-Custom-Token": cleanCanary["header"]},
@@ -293,7 +328,7 @@ func cleanMakeSdk(scenario cleanScenario, sinks *[]cleanSink, cleanopts map[stri
 				return scenario.respond(url, fetchdef)
 			}),
 		},
-	})
+	}
 }
 
 // One operation this SDK can perform: the client method returning the
@@ -309,12 +344,12 @@ func cleanEntity(client *sdk.${Name}SDK, accessor string) reflect.Value {
 		Call([]reflect.Value{reflect.ValueOf(map[string]any(nil))})[0]
 }
 
-func cleanInvoke(client *sdk.${Name}SDK, op cleanOp, ctrl map[string]any) (any, error) {
+func cleanInvoke(entity reflect.Value, op cleanOp, ctrl map[string]any) (any, error) {
 	match := map[string]any{}
 	for k, v := range op.match {
 		match[k] = v
 	}
-	rets := cleanEntity(client, op.accessor).MethodByName(op.method).Call([]reflect.Value{
+	rets := entity.MethodByName(op.method).Call([]reflect.Value{
 		reflect.ValueOf(match),
 		reflect.ValueOf(ctrl),
 	})
@@ -348,7 +383,7 @@ func cleanFilled(client *sdk.${Name}SDK, entity string, method string) map[strin
 // returning something that answers GetName().
 func cleanUsableOp() (cleanOp, bool) {
 	plain := func() *sdk.${Name}SDK {
-		return sdk.New${Name}SDK(map[string]any{
+		return cleanNew(map[string]any{
 			"apikey": cleanCanary["apikey"],
 			"utility": map[string]any{
 				"fetcher": sdk.FetcherFunc(func(*sdk.Context, string, map[string]any) (any, error) {
@@ -383,7 +418,7 @@ func cleanUsableOp() (cleanOp, bool) {
 	sort.Strings(accessors)
 
 	for _, accessor := range accessors {
-		for _, method := range []string{"List", "Load", "Create", "Update", "Remove"} {
+		for _, method := range []string{"List", "Load", "Create", "Update", "Patch", "Remove"} {
 			om := cleanEntity(probe, accessor).MethodByName(method)
 			if !om.IsValid() || om.Type().NumIn() != 2 || om.Type().NumOut() != 2 {
 				continue
@@ -392,7 +427,7 @@ func cleanUsableOp() (cleanOp, bool) {
 				Call(nil)[0].String()
 			for _, match := range []map[string]any{{}, cleanFilled(probe, name, method)} {
 				op := cleanOp{accessor: accessor, method: method, match: match}
-				if _, err := cleanInvoke(plain(), op, map[string]any{}); err == nil {
+				if _, err := cleanInvoke(cleanEntity(plain(), accessor), op, map[string]any{}); err == nil {
 					return op, true
 				}
 			}
@@ -404,13 +439,17 @@ func cleanUsableOp() (cleanOp, bool) {
 func cleanDrive(client *sdk.${Name}SDK, op cleanOp, ctrl map[string]any, sinks *[]cleanSink) error {
 	// A caller may keep the record it passed rather than read ctrl["explain"].
 	held, _ := ctrl["explain"].(map[string]any)
-	out, err := cleanInvoke(client, op, ctrl)
+	entity := cleanEntity(client, op.accessor)
+	out, err := cleanInvoke(entity, op, ctrl)
 	if err != nil {
 		*sinks = append(*sinks, cleanSurfaces("error", err)...)
 	}
 	if out != nil {
 		*sinks = append(*sinks, cleanSurfaces("result", out)...)
 	}
+	// Raw, as a caller copying the match into another query reads it.
+	*sinks = append(*sinks, cleanSurfaces("match",
+		entity.MethodByName("Match").Call(nil)[0].Interface())...)
 	explain, ok := ctrl["explain"].(map[string]any)
 	if ok {
 		*sinks = append(*sinks, cleanSurfaces("explain", explain)...)
@@ -491,6 +530,9 @@ func (f *cleanStreamPanic) PreDone(ctx *sdk.Context) {
 func cleanCatch(name string, sinks *[]cleanSink, fn func() error) (err error) {
 	defer func() {
 		if r := recover(); r != nil {
+			if _, harness := r.(cleanHarnessError); harness {
+				panic(r)
+			}
 			*sinks = append(*sinks, cleanSurfaces(name+":panic", r)...)
 			err = fmt.Errorf("panic: %v", r)
 		}
@@ -501,6 +543,7 @@ func cleanCatch(name string, sinks *[]cleanSink, fn func() error) (err error) {
 const cleanNoOp = "no operation of this SDK completes against a plain 200; nothing to sweep"
 
 func TestCleanSweep(t *testing.T) {
+	defer cleanHarness(t)
 	op, found := cleanUsableOp()
 	if !found {
 		t.Skip(cleanNoOp)
@@ -538,15 +581,21 @@ func TestCleanSweep(t *testing.T) {
 		}
 	}
 
+	// A name given at run time replaces the declared one: the match leaves
+	// out whichever name PrepareAuth placed.
+	renamed := cleanOptions(cleanScenarios[0], &sinks, nil)
+	renamed["auth"] = map[string]any{"name": "zzcred"}
+	cleanDrive(cleanNew(renamed), op, map[string]any{}, &sinks)
+
 	// A credential mistyped as a map. The go validator substitutes the
 	// default rather than rejecting it, so there is no rejection to sweep:
 	// sweep what the constructor produced, and what clean makes of the value
 	// should anything later quote it.
 	cleanCatch("mistyped", &sinks, func() error {
-		client := sdk.New${Name}SDK(map[string]any{
+		client := sdk.New${Name}SDK(cleanOffline(map[string]any{
 			"apikey": map[string]any{"value": cleanCanary["apikey"]},
 			"clean":  map[string]any{"values": cleanCanary["value"]},
-		})
+		}))
 		sinks = append(sinks, cleanSurfaces("mistyped", client)...)
 		sinks = append(sinks, cleanSurfaces("mistyped:quoted",
 			client.GetUtility().Clean(client.GetRootCtx(), "found map: "+cleanCanary["apikey"]))...)
@@ -572,9 +621,9 @@ func TestCleanSweep(t *testing.T) {
 		}
 	}
 
-	// Stream has no error channel: a panic inside it must end the stream
-	// through MakeError, cleaned, and not crash the process. However it
-	// ends, the explain record the caller passed is left clean.
+	// A panic inside a stream must end it through MakeError, its cleaned
+	// error the last value sent, and not crash the process. However it ends,
+	// the explain record the caller passed is left clean.
 	for _, streamed := range []struct {
 		name  string
 		saw   string
@@ -597,8 +646,13 @@ func TestCleanSweep(t *testing.T) {
 			reflect.ValueOf(strings.ToLower(op.method)),
 			reflect.ValueOf(map[string]any{"reqmatch": reqmatch}),
 			reflect.ValueOf(map[string]any{"ctrl": map[string]any{"explain": explain}}),
-		})[0].Interface().(<-chan any)
-		for range items {
+		})[0].Interface().(<-chan core.StreamItem)
+		var streamerr error
+		for item := range items {
+			if item.Err != nil {
+				streamerr = item.Err
+				sinks = append(sinks, cleanSurfaces(streamed.name, item.Err)...)
+			}
 		}
 		sinks = append(sinks, cleanSurfaces(streamed.name+":explain", explain)...)
 		if 0 == len(explain) {
@@ -608,6 +662,9 @@ func TestCleanSweep(t *testing.T) {
 		if ("" == streamed.saw) != (nil == explain["err"]) || !strings.Contains(msg, streamed.saw) {
 			t.Errorf("%s: only a failing stream ends as the SDK error, got %v", streamed.name, explain)
 		}
+		if ("" == streamed.saw) != (nil == streamerr) {
+			t.Errorf("%s: only a failing stream sends an error, got %v", streamed.name, streamerr)
+		}
 	}
 
 	// A registered value used as a property name is masked; names that mask
@@ -644,7 +701,7 @@ func TestCleanSweep(t *testing.T) {
 	}
 
 	// With no clean option at all, the schema defaults still apply.
-	bare := sdk.New${Name}SDK(map[string]any{
+	bare := cleanNew(map[string]any{
 		"apikey":  cleanCanary["apikey"],
 		"secret":  cleanCanary["secret"],
 		"headers": map[string]any{"X-Custom-Token": cleanCanary["header"]},
@@ -660,12 +717,14 @@ func TestCleanSweep(t *testing.T) {
 
 	// A feature's name is not a field name: only the sensitive names inside
 	// its settings register. An entity block, of per-entity settings or seeded
-	// records keyed by entity name and id, is not read at all.
-	featured := sdk.New${Name}SDK(map[string]any{
+	// records keyed by entity name and id, is not read at all, and nor are
+	// rbac's rules, keyed by entity and operation names.
+	featured := cleanNew(map[string]any{
 		"apikey": cleanCanary["apikey"],
 		"feature": map[string]any{
 			"zzsecrets": map[string]any{"active": false, "kind": "PLAINSETTING-q8w2e4r6"},
 			"zzfeat":    map[string]any{"active": false, "apitoken": "FEATTOKEN-z9y8x7w6"},
+			"rbac":      map[string]any{"active": false, "rules": map[string]any{"zztoken.load": "PLAINRULE-k7j5h3g1"}},
 			"test": map[string]any{"active": false, "entity": map[string]any{
 				"zztoken": map[string]any{"ZZTOKEN01": map[string]any{"note": "PLAINRECORD-t5r3e1w9"}},
 			}},
@@ -684,6 +743,9 @@ func TestCleanSweep(t *testing.T) {
 			t.Errorf("an entity block was registered: %q", got)
 		}
 	}
+	if got, _ := fclean(featured.GetRootCtx(), "rule PLAINRULE-k7j5h3g1").(string); got != "rule PLAINRULE-k7j5h3g1" {
+		t.Errorf("an rbac rule keyed by entity and operation was registered: %q", got)
+	}
 
 	leaked := []string{}
 	for _, s := range sinks {
@@ -747,6 +809,7 @@ func TestCleanSweep(t *testing.T) {
 }
 
 func TestCleanSensitivity(t *testing.T) {
+	defer cleanHarness(t)
 	op, found := cleanUsableOp()
 	if !found {
 		t.Skip(cleanNoOp)