@voxgig/sdkgen 4.34.0 → 4.34.1

package/project/.sdk/tm/clojure/src/sdk/features.clj

@@ -112,6 +112,16 @@
 
 (declare test-build-args make-netsim)
 
+;; The key a list's response transform
+;; ["`$EACH`", "body", {"`$MERGE`": "`.<key>`"}] reads each item's record under.
+(defn- item-envelope-key [spec]
+  (when (and (vs/islist spec) (= 3 (count spec))
+             (= "`$EACH`" (first spec)) (= "body" (second spec))
+             (vs/ismap (nth spec 2)))
+    (let [merge (vs/getprop (nth spec 2) "`$MERGE`")]
+      (when (string? merge)
+        (second (re-matches #"`\.([^.`$]+)`" merge))))))
+
 (defn test-feature []
   (let [fa (new-feature "test" true "0.0.1")]
     (swap! fa assoc
@@ -136,16 +146,20 @@
                        ;; scope here, so the point is the one being served.
                        (let [envelope (fn [data]
                                         (let [tm (vs/getprop (core/oget fctx :point) "transform")
-                                              spec (vs/getprop tm "res")]
-                                          ;; Rebuild whatever nesting the transform unwraps;
-                                          ;; GraphQL ops unwrap `body.data.<field>`.
-                                          (if (and (some? data) (string? spec))
+                                              spec (vs/getprop tm "res")
+                                              ikey (item-envelope-key spec)]
+                                          (cond
+                                            (and (some? ikey) (vs/islist data))
+                                            (apply vs/jt (map (fn [item] (vs/jm ikey item)) data))
+                                            ;; Rebuild whatever nesting the transform unwraps;
+                                            ;; GraphQL ops unwrap `body.data.<field>`.
+                                            (and (some? data) (string? spec))
                                             (if-let [m (re-matches #"`body\.(.+)`" spec)]
                                               (reduce (fn [out seg] (vs/jm seg out))
                                                       data
                                                       (reverse (str/split (second m) #"\." -1)))
                                               data)
-                                            data)))
+                                            :else data)))
                              respond (fn [status data extra]
                                        (let [payload (envelope data)
                                              out (vs/jm "status" status "statusText" "OK"
@@ -177,7 +191,7 @@
                              (if (nil? found) (respond 404 nil (vs/jm "statusText" "Not found"))
                                  (do (when (vs/islist found) (doseq [item (vec found)] (vs/delprop item "$KEY")))
                                      (respond 200 (vs/clone found) nil))))
-                           (= opn "update")
+                           (or (= opn "update") (= opn "patch"))
                            (let [update-match (vs/jm)
                                  reqdata (core/oget fctx :reqdata)]
                              (when (vs/ismap reqdata)
@@ -194,7 +208,8 @@
                                ;; update miss: 404, never another record
                                (if (nil? ent) (respond 404 nil (vs/jm "statusText" "Not found"))
                                    (do (when (and (vs/ismap ent) (vs/ismap reqdata))
-                                         (vs/merge (vs/jt ent reqdata)))
+                                         ;; `$body` travels on the wire alone; the record is the rest.
+                                         (vs/merge (vs/jt ent (doto (vs/clone reqdata) (vs/delprop "$body")))))
                                        (vs/delprop ent "$KEY")
                                        (respond 200 (vs/clone ent) nil)))))
                            (= opn "remove")
@@ -209,7 +224,8 @@
                                             (format "%04x%04x%04x%04x" (rand-int 0x10000) (rand-int 0x10000) (rand-int 0x10000) (rand-int 0x10000)))
                                      ent (vs/clone (core/oget fctx :reqdata))]
                                  (if (vs/ismap ent)
-                                   (do (.put ^java.util.Map ent "id" id)
+                                   (do (vs/delprop ent "$body")
+                                       (.put ^java.util.Map ent "id" id)
                                        (when (string? id) (.put ^java.util.Map entmap (str id) ent))
                                        (vs/delprop ent "$KEY")
                                        (respond 200 (vs/clone ent) nil))
@@ -380,18 +396,24 @@
         (fn [ctx url fetchdef inner]
           (let [ms (opt fa "ms" 30000)]
             (if (<= ms 0) (inner ctx url fetchdef)
-                (let [now (opt fa "now")]
-                  (if (fn? now)
-                    (let [start (now) r (inner ctx url fetchdef)]
-                      (if (> (- (now) start) ms)
-                        (do (track! ms) [nil (core/ctx-error ctx "timeout" (str "Request exceeded timeout of " ms "ms"))])
-                        r))
-                    (let [fut (future (inner ctx url fetchdef))
-                          r (deref fut (long ms) ::timeout)]
-                      (if (= r ::timeout)
-                        (do (future-cancel fut) (track! ms)
-                            [nil (core/ctx-error ctx "timeout" (str "Request exceeded timeout of " ms "ms"))])
-                        r)))))))]
+                ;; The deadline runs from here, not from the deref below: a
+                ;; caller paused between the two would otherwise find a late
+                ;; response complete and take it. The future notes when it
+                ;; finished, so a response or a failure after the deadline is
+                ;; a timeout however late the caller looks.
+                (let [now (let [n (opt fa "now")] (if (fn? n) n #(System/currentTimeMillis)))
+                      start (now)
+                      arrived (atom Long/MAX_VALUE)
+                      fut (future (try (inner ctx url fetchdef) (finally (reset! arrived (now)))))
+                      remaining (max 0 (- ms (- (now) start)))
+                      late? (fn [] (< ms (- @arrived start)))
+                      r (try (deref fut (long remaining) ::timeout)
+                             (catch java.util.concurrent.ExecutionException e
+                               (if (late?) ::timeout (throw (or (.getCause e) e)))))]
+                  (if (or (= r ::timeout) (late?))
+                    (do (future-cancel fut) (track! ms)
+                        [nil (core/ctx-error ctx "timeout" (str "Request exceeded timeout of " ms "ms"))])
+                    r)))))]
     (swap! fa assoc
            "init" (fn [ctx options]
                     (swap! fa assoc :client (core/oget ctx :client)
@@ -1471,6 +1493,8 @@
                     ;; call would be rejected for the one key that made it
                     ;; reachable.
                     (.remove ^java.util.Map out "$action")
+                    ;; Nor is `$body`, the raw request body.
+                    (.remove ^java.util.Map out "$body")
                     out))]
     (swap! fa assoc :spec (vs/jm) :request true :response false :mode "throw")
     (swap! fa assoc

package/project/.sdk/tm/clojure/test/sdk/test/feature.clj

@@ -21,7 +21,7 @@
 (defn fspec [name & kvs] {"name" name "options" (if (seq kvs) (apply vs/jm kvs) (vs/jm))})
 
 (defn default-method [opname]
-  (cond (= opname "create") "POST" (= opname "update") "PATCH" (= opname "remove") "DELETE" :else "GET"))
+  (cond (= opname "create") "POST" (or (= opname "update") (= opname "patch")) "PATCH" (= opname "remove") "DELETE" :else "GET"))
 
 (defn make-response [status data headers]
   (let [h (vs/jm)]
@@ -51,6 +51,11 @@
 (defn clock-sleeper [c] (fn [ms] (swap! c + (or ms 0))))
 (defn clock-advance [c ms] (swap! c + ms))
 
+;; A clock standing at 0 for the calling thread and at `later` for any other.
+(defn worker-clock [later]
+  (let [caller (Thread/currentThread)]
+    (fn [] (if (identical? (Thread/currentThread) caller) 0 later))))
+
 (defn fake-entity [name] {:get-name (fn [] name)})
 
 (defn- merge-headers [base extra]
@@ -265,6 +270,21 @@
            (fn [] (let [c (make-clock)
                         h (make-harness [(fspec "timeout" "ms" 1000 "now" (clock-now c))])]
                     (t/is-eq (get (h-op h) "ok") true "ok"))))
+    ;; The deadline runs from the request's start, not from the wait: the
+    ;; clock stands at the start for the caller and 300 ms later for the worker.
+    (check "timeout-late-response-however-late-the-caller-looks" "timeout"
+           (fn [] (let [h (make-harness [(fspec "timeout" "ms" 20 "now" (worker-clock 300))])
+                        res (h-op h)]
+                    (t/is-eq (rcode res) "timeout" "timeout")
+                    (t/is-eq (mget (h-track h "_timeout") "count") 1 "count"))))
+    ;; A transport failure after the deadline is a timeout too, not the failure.
+    (check "timeout-late-failure-times-out" "timeout"
+           (fn [] (let [failing (fn [fctx _url _fetchdef]
+                                  (core/sdk-throw (core/ctx-error fctx "socket_closed" "socket closed")))
+                        h (make-harness [(fspec "timeout" "ms" 20 "now" (worker-clock 300))] :server failing)
+                        res (h-op h)]
+                    (t/is-eq (rcode res) "timeout" "timeout")
+                    (t/is-eq (mget (h-track h "_timeout") "count") 1 "count"))))
     (check "timeout-ms-zero-disables" "timeout"
            (fn [] (let [h (make-harness [(fspec "timeout" "ms" 0)])]
                     (t/is-eq (get (h-op h) "ok") true "ok"))))

package/project/.sdk/tm/clojure/test/sdk/test_runner.clj

@@ -89,6 +89,14 @@
   (first (filter (fn [p] (.exists (java.io.File. ^String p)))
                  ["../.sdk/test/test.json" ".sdk/test/test.json" "../../.sdk/test/test.json" "test/test.json"])))
 
+;; The agent pool keeps the JVM alive for a minute after the last task, so a
+;; run that passes exits as one that fails does.
+(defn- all-green []
+  (println "ALL GREEN")
+  (flush)
+  (shutdown-agents)
+  (System/exit 0))
+
 ;; `--sdk-only` runs the SDK's OWN suites and skips the three steps that read
 ;; the shared corpus (.sdk/test/test.json): the omni smoke test, the primary
 ;; corpus and the struct corpus. create-sdkgen compiles that corpus into
@@ -126,7 +134,7 @@
             (flush)
             (if (pos? nf)
               (System/exit 1)
-              (println "ALL GREEN")))
+              (all-green)))
         (let [cf (find-corpus-file)]
           (if (nil? cf)
             (do (println "STRUCT CORPUS: test.json not found on any candidate path") (flush) (System/exit 1))
@@ -136,4 +144,4 @@
               (flush)
               (if (or (pos? nf) (pos? cfail))
                 (System/exit 1)
-                (println "ALL GREEN")))))))))
+                (all-green)))))))))

package/project/.sdk/tm/cpp/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ Voxgig
+Copyright (c) $$const.year$$ PROJECTPUBLISHER
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/cpp/core/types.hpp

@@ -11,6 +11,8 @@
 #ifndef SDK_CORE_TYPES_HPP
 #define SDK_CORE_TYPES_HPP
 
+#include <algorithm>
+#include <cctype>
 #include <functional>
 #include <map>
 #include <memory>
@@ -70,6 +72,26 @@ inline long long toLong(const Value& v, long long def) {
 }
 inline Value toMapAny(const Value& v) { return v.is_map() ? v : Value::undef(); }
 
+// Whether a comma-separated allow option names the item: whole names, any case.
+inline bool allowed(const Value& names, const std::string& item) {
+  if (!names.is_string() || item.empty()) return false;
+  const std::string list = names.as_string();
+  size_t start = 0;
+  for (;;) {
+    size_t end = list.find(',', start);
+    size_t s = start;
+    size_t e = std::string::npos == end ? list.size() : end;
+    while (s < e && std::isspace((unsigned char)list[s])) s++;
+    while (e > s && std::isspace((unsigned char)list[e - 1])) e--;
+    if (e - s == item.size() && std::equal(item.begin(), item.end(), list.begin() + s,
+          [](char a, char b) { return std::toupper((unsigned char)a) == std::toupper((unsigned char)b); })) {
+      return true;
+    }
+    if (std::string::npos == end) return false;
+    start = end + 1;
+  }
+}
+
 SdkErrorPtr unsupportedOp(const std::string& opname, const std::string& entityname);
 
 } // namespace Helpers
@@ -146,6 +168,9 @@ public:
   Value body = Value::undef();
   std::string url = "";
   std::string path = "";
+  // The query parameters prepareAuth placed: the credential, which the
+  // request sends and the entity's match leaves out.
+  std::vector<std::string> authquery;
 
   Spec() {
     headers = vmap();
@@ -214,6 +239,8 @@ public:
   JsonFunc jsonFunc;
   Value body = Value::undef();
   SdkErrorPtr err;
+  // Set by a transport that could not read a non-blank body as JSON.
+  bool unreadable = false;
 
   Response() = default;
 
@@ -237,6 +264,8 @@ public:
       };
     }
     body = getp(m, "body");
+    Value ur = getp(m, "unreadable");
+    unreadable = ur.is_bool() && ur.as_bool();
   }
 };
 
@@ -650,6 +679,7 @@ public:
   virtual std::vector<SdkEntityPtr> list(const Value& reqmatch, const Value& ctrl) = 0;
   virtual SdkEntityPtr create(const Value& reqdata, const Value& ctrl) = 0;
   virtual SdkEntityPtr update(const Value& reqdata, const Value& ctrl) = 0;
+  virtual SdkEntityPtr patch(const Value& reqdata, const Value& ctrl) = 0;
   virtual SdkEntityPtr remove(const Value& reqmatch, const Value& ctrl) = 0;
 };
 
@@ -806,7 +836,7 @@ inline OperationPtr Context::resolveOp(const std::string& opname) {
   Value opcfg = Struct::getpath(config, {"entity", entname, "op", opname});
 
   std::string input = "match";
-  if (opname == "update" || opname == "create") input = "data";
+  if (opname == "update" || opname == "create" || opname == "patch") input = "data";
 
   Value points = Value::undef();
   if (opcfg.is_map()) {
@@ -954,6 +984,14 @@ inline Value SdkClient::prepare(const Value& fetchargs_) {
   Value methodRaw = getp(fetchargs, "method");
   std::string method = methodRaw.is_string() ? methodRaw.as_string() : "";
   if (method.empty()) method = "GET";
+  for (auto& ch : method) ch = (char)std::toupper((unsigned char)ch);
+
+  Value allowMethod = Struct::getpath(opts, {"allow", "method"});
+  if (!Helpers::allowed(allowMethod, method)) {
+    throw ctx->makeError("spec_method_allow",
+        "Method \"" + method + "\" not allowed by SDK option allow.method value: \"" +
+        (allowMethod.is_string() ? allowMethod.as_string() : std::string()) + "\"");
+  }
 
   Value params = Helpers::toMapAny(getp(fetchargs, "params"));
   if (!params.is_map()) params = vmap();
@@ -993,9 +1031,7 @@ inline Value SdkClient::prepare(const Value& fetchargs_) {
 
 // Is this raw-access op permitted by the SDK's allow.op option?
 inline bool SdkClient::opAllowed(const std::string& op) {
-  Value allow = Struct::getpath(options, {"allow", "op"});
-  if (!allow.is_string()) return false;
-  return std::string::npos != allow.as_string().find(op);
+  return Helpers::allowed(Struct::getpath(options, {"allow", "op"}), op);
 }
 
 inline Value SdkClient::opDenied(const std::string& op) {
@@ -1061,6 +1097,74 @@ inline Value SdkClient::graphql(const std::string& query, const Value& variables
   return res;
 }
 
+// A body that is not JSON. An HTTP failure keeps its own error, with the
+// response described; otherwise the code tells a wrong content type from
+// malformed JSON.
+inline SdkErrorPtr unreadableBody(CtxPtr ctx, int status, const Value& headers, const Value& text,
+                                  const Value& sent, SdkErrorPtr failed) {
+  auto lower = [](std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+  };
+  auto headerValue = [&lower](const Value& h, const std::string& name) -> std::string {
+    if (!h.is_map()) return "";
+    for (const auto& kv : *h.as_map()) {
+      if (lower(kv.first) == name) {
+        return kv.second.is_string() ? kv.second.as_string() : Struct::stringify(kv.second);
+      }
+    }
+    return "";
+  };
+  auto clean = [&ctx](const std::string& s) -> std::string {
+    if (!ctx->utility || !ctx->utility->clean) return s;
+    Value v = ctx->utility->clean(ctx, Value(s));
+    return v.is_string() ? v.as_string() : s;
+  };
+
+  std::string type = headerValue(headers, "content-type");
+  std::string agent = clean(headerValue(sent, "user-agent"));
+  std::string detail = "HTTP " + std::to_string(status) + ", content-type " +
+    (type.empty() ? std::string("none") : type) + ", user-agent " +
+    (agent.empty() ? std::string("transport default") : agent);
+
+  if (!is_nullish(text)) {
+    // Cleaned whole: a secret the bound would split could leave its prefix.
+    std::string raw = text.is_string() ? text.as_string() : Struct::stringify(text);
+    std::string flat;
+    bool space = false;
+    for (unsigned char c : raw) {
+      if (std::isspace(c)) {
+        space = !flat.empty();
+        continue;
+      }
+      if (space) {
+        flat += ' ';
+        space = false;
+      }
+      flat += static_cast<char>(c);
+    }
+    flat = clean(flat);
+    size_t points = 0;
+    size_t end = 0;
+    for (; end < flat.size(); end++) {
+      if ((static_cast<unsigned char>(flat[end]) & 0xC0) == 0x80) continue;
+      if (160 == points) break;
+      points++;
+    }
+    detail += ", body: " + (end < flat.size() ? flat.substr(0, end) + "..." : flat);
+  }
+
+  if (failed) {
+    failed->msg += " (" + detail + ")";
+    return failed;
+  }
+  if (type.empty() || lower(type).find("json") != std::string::npos) {
+    return ctx->makeError("response_json_invalid", "response: body is not valid JSON (" + detail + ")");
+  }
+  return ctx->makeError("response_content_type",
+    "response: expected JSON, got " + type + " (" + detail + ")");
+}
+
 // Ungated request path shared by direct and graphql, each of which checks its
 // own allow.op token first. Private, rather than a flag on fetchargs: a
 // caller-supplied marker would let anyone opt straight back out of the gate
@@ -1125,10 +1229,24 @@ inline Value SdkClient::rawRequest(const Value& fetchargs_) {
       }
     }
 
-    map_put(out, "ok", Value(status >= 200 && status < 300));
+    SdkErrorPtr bodyErr;
+    Value ur = getp(fetched, "unreadable");
+    if (!noBody && ur.is_bool() && ur.as_bool()) {
+      SdkErrorPtr failed;
+      if (status < 200 || status >= 300) {
+        Value st = getp(fetched, "statusText");
+        failed = ctx->makeError("request_status", "request: " + std::to_string(status) + ": " +
+          (st.is_string() ? st.as_string() : std::string("")));
+      }
+      bodyErr = unreadableBody(ctx, status, headers, getp(fetched, "body"),
+        getp(fetchdef, "headers"), failed);
+    }
+
+    map_put(out, "ok", Value(!bodyErr && status >= 200 && status < 300));
     map_put(out, "status", Value(status));
     map_put(out, "headers", headers);
     map_put(out, "data", jsonData);
+    if (bodyErr) map_put(out, "err", vmap({{"message", u->clean(ctx, Value(bodyErr->msg))}}));
     return out;
   }
 
@@ -1233,8 +1351,14 @@ inline std::vector<Value> EntityBase::stream(const std::string& action,
 
   Value streamOpts = callopts.is_map() ? callopts : vmap();
 
-  Value ctrl = Helpers::toMapAny(getp(streamOpts, "ctrl"));
-  if (!ctrl.is_map()) ctrl = vmap();
+  // A copy: the caller's ctrl gains no key, and explain stays its own record.
+  Value ctrl = vmap();
+  Value given = Helpers::toMapAny(getp(streamOpts, "ctrl"));
+  if (given.is_map()) {
+    for (const auto& kv : *given.as_map()) {
+      map_put(ctrl, kv.first, kv.second);
+    }
+  }
   map_put(ctrl, "stream", streamOpts);
 
   CtxSpec cs;

package/project/.sdk/tm/cpp/feature/test.hpp

@@ -57,6 +57,22 @@ public:
   }
 
 private:
+  // The key a list's response transform
+  // ["`$EACH`", "body", {"`$MERGE`": "`.<key>`"}] reads each item's record
+  // under; empty for any other transform.
+  static std::string itemEnvelopeKey(const Value& restf) {
+    if (!restf.is_list()) return "";
+    const List& spec = *restf.as_list();
+    if (3 != spec.size() || !spec[0].is_string() || "`$EACH`" != spec[0].as_string() ||
+        !spec[1].is_string() || "body" != spec[1].as_string()) return "";
+    Value merge = getp(spec[2], Value("`$MERGE`"));
+    if (!merge.is_string()) return "";
+    std::string m = merge.as_string();
+    if (m.size() < 4 || 0 != m.compare(0, 2, "`.") || '`' != m[m.size() - 1]) return "";
+    std::string key = m.substr(2, m.size() - 3);
+    return std::string::npos == key.find_first_of(".`$") ? key : "";
+  }
+
   // THE MOCK HAS TO AGREE WITH THE MODEL. A point carrying
   // `transform.res: `body.item`` describes an API that answers {"item": {...}}
   // and the response transform unwraps that key on the way back. Returning the
@@ -66,6 +82,16 @@ private:
     if (is_nullish(data) || !ctx) return data;
     Value tm = getp(ctx->point, "transform");
     Value restf = getp(tm, "res");
+    std::string key = itemEnvelopeKey(restf);
+    if (!key.empty() && data.is_list()) {
+      Value out = vlist();
+      for (const auto& item : *data.as_list()) {
+        Value wrapped = vmap();
+        map_put(wrapped, key, item);
+        out.as_list()->push_back(wrapped);
+      }
+      return out;
+    }
     if (!restf.is_string()) return data;
     std::string spec = restf.as_string();
     // Rebuild whatever nesting the transform unwraps. Multi-segment on purpose:
@@ -148,7 +174,7 @@ private:
       }
       Value out = Struct::clone(outlist);
       return respond(ctx, 200, out, Value::undef());
-    } else if (op->name == "update") {
+    } else if (op->name == "update" || op->name == "patch") {
       Value updateMatch = vmap();
       if (ctx->reqdata.is_map()) {
         if (map_contains(ctx->reqdata, "id")) {
@@ -173,7 +199,10 @@ private:
       // update miss: 404, never another record
       if (is_nullish(ent)) return respond(ctx, 404, Value(nullptr), extra1("statusText", Value("Not found")));
       if (ent.is_map() && ctx->reqdata.is_map()) {
-        Struct::merge(vlist({ent, ctx->reqdata}));
+        // `$body` travels on the wire alone; the record is the rest.
+        Value rec = Struct::clone(ctx->reqdata);
+        Struct::delprop(rec, Value("$body"));
+        Struct::merge(vlist({ent, rec}));
       }
       Struct::delprop(ent, Value("$KEY"));
       Value out = Struct::clone(ent);
@@ -203,6 +232,7 @@ private:
       }
       Value ent = Struct::clone(ctx->reqdata);
       if (ent.is_map()) {
+        Struct::delprop(ent, Value("$body"));
         map_put(ent, "id", id);
         if (id.is_string()) map_put(entmap, id.as_string(), ent);
         Struct::delprop(ent, Value("$KEY"));

package/project/.sdk/tm/cpp/feature/timeout.hpp

@@ -8,7 +8,10 @@
 #ifndef SDK_FEATURE_TIMEOUT_HPP
 #define SDK_FEATURE_TIMEOUT_HPP
 
+#include <algorithm>
+#include <atomic>
 #include <chrono>
+#include <climits>
 #include <exception>
 #include <future>
 #include <memory>
@@ -53,14 +56,24 @@ private:
       return inner(ctx, url, fetchdef);
     }
 
-    // Run inner on a detached thread; the shared promise keeps the future's
-    // shared state alive even after the loser resolves unobserved.
+    // The deadline runs from here, not from the wait below: a caller paused
+    // between the two would otherwise find a late response complete and take
+    // it. The worker notes when it finished, so a response or a failure after
+    // the deadline is a timeout however late the caller looks. The shared
+    // promise keeps the future's state alive after the loser resolves
+    // unobserved on its detached thread.
+    fopt::NowFn now = fopt::foptNow(options);
+    const long long start = now();
+    auto arrived = std::make_shared<std::atomic<long long>>(LLONG_MAX);
     auto prom = std::make_shared<std::promise<Value>>();
     std::future<Value> fut = prom->get_future();
-    std::thread([ctx, url, fetchdef, inner, prom]() {
+    std::thread([ctx, url, fetchdef, inner, prom, now, arrived]() {
       try {
-        prom->set_value(inner(ctx, url, fetchdef));
+        Value out = inner(ctx, url, fetchdef);
+        arrived->store(now());
+        prom->set_value(out);
       } catch (...) {
+        arrived->store(now());
         try {
           prom->set_exception(std::current_exception());
         } catch (...) {
@@ -68,15 +81,22 @@ private:
       }
     }).detach();
 
-    if (fut.wait_for(std::chrono::milliseconds(deadline)) == std::future_status::timeout) {
-      track(deadline);
-      throw ctx->makeError("timeout",
-          "Request exceeded timeout of " + std::to_string(deadline) + "ms");
+    long long remaining = std::max(0LL, static_cast<long long>(deadline) - (now() - start));
+    if (fut.wait_for(std::chrono::milliseconds(remaining)) == std::future_status::timeout) {
+      throw timeout(ctx, deadline);
+    }
+    if (deadline < arrived->load() - start) {
+      throw timeout(ctx, deadline);
     }
-
     return fut.get();
   }
 
+  SdkErrorPtr timeout(CtxPtr ctx, int deadline) {
+    track(deadline);
+    return ctx->makeError("timeout",
+        "Request exceeded timeout of " + std::to_string(deadline) + "ms");
+  }
+
   void track(int deadline) {
     count++;
     ms = deadline;

package/project/.sdk/tm/cpp/feature/validate.hpp

@@ -183,6 +183,8 @@ private:
     // fields will never name it — and under `strict` every custom-action call
     // would be rejected for the one key that made it reachable.
     map_remove(out, "$action");
+    // Nor is `$body`, the raw request body.
+    map_remove(out, "$body");
 
     return out;
   }

package/project/.sdk/tm/cpp/test/feature_test.cpp

@@ -4,6 +4,7 @@
 // its feature is present in this SDK.
 
 #include <chrono>
+#include <memory>
 #include <regex>
 #include <thread>
 #include <vector>
@@ -246,6 +247,40 @@ static void timeout_slowRequestTimesOut() {
   ASSERT_EQ(f->count, 1, "expected 1 timeout");
 }
 
+// A clock standing at 0 for the calling thread and at `later` for any other.
+static vs::Injector workerClock(long long later) {
+  auto caller = std::this_thread::get_id();
+  return [caller, later](vs::Injection&, const Value&, const std::string&, const Value&) -> Value {
+    return Value(std::this_thread::get_id() == caller ? 0LL : later);
+  };
+}
+
+// The deadline runs from the request's start, not from the wait: a response
+// that arrives after it is a timeout even when the caller only looks once it
+// is complete. The clock stands at the start for the caller and 300 ms later
+// for the worker.
+static void timeout_lateResponseTimesOutHoweverLateTheCallerLooks() {
+  if (!have({"timeout"})) return;
+  auto f = std::make_shared<TimeoutFeature>();
+  auto h = fhMake(nullptr, {FF(f, fhMap({{"ms", Value(20)}, {"now", Value(workerClock(300))}}))});
+  FhOpResult res = h->op(fhOp("load"));
+  ASSERT_EQ(fhErrCode(res.err), std::string("timeout"), "expected timeout error");
+  ASSERT_EQ(f->count, 1, "expected 1 timeout");
+}
+
+// A transport failure after the deadline is a timeout too, not the failure.
+static void timeout_lateFailureTimesOut() {
+  if (!have({"timeout"})) return;
+  auto f = std::make_shared<TimeoutFeature>();
+  FetcherFn failing = [](CtxPtr ctx, const std::string&, const Value&) -> Value {
+    throw ctx->makeError("socket_closed", "socket closed");
+  };
+  auto h = fhMake(failing, {FF(f, fhMap({{"ms", Value(20)}, {"now", Value(workerClock(300))}}))});
+  FhOpResult res = h->op(fhOp("load"));
+  ASSERT_EQ(fhErrCode(res.err), std::string("timeout"), "expected timeout error");
+  ASSERT_EQ(f->count, 1, "expected 1 timeout");
+}
+
 static void timeout_fastRequestPasses() {
   if (!have({"timeout"})) return;
   auto h = fhMake(nullptr, {FF(std::make_shared<TimeoutFeature>(), fhMap({{"ms", Value(1000)}}))});
@@ -857,6 +892,8 @@ int main() {
   T_RUN(retry_inactiveDoesNotWrap);
 
   T_RUN(timeout_slowRequestTimesOut);
+  T_RUN(timeout_lateResponseTimesOutHoweverLateTheCallerLooks);
+  T_RUN(timeout_lateFailureTimesOut);
   T_RUN(timeout_fastRequestPasses);
   T_RUN(timeout_msZeroDisables);
   T_RUN(timeout_inactiveDoesNotWrap);

package/project/.sdk/tm/cpp/test/harness.hpp

@@ -142,7 +142,7 @@ struct FhOpResult {
 
 inline std::string fhDefaultMethod(const std::string& op) {
   if (op == "create") return "POST";
-  if (op == "update") return "PATCH";
+  if (op == "update" || op == "patch") return "PATCH";
   if (op == "remove") return "DELETE";
   return "GET";
 }

package/project/.sdk/tm/cpp/test/primary_utility_test.cpp

@@ -308,7 +308,10 @@ static void fetcherLive() {
     calls->push_back(vmap({{"url", url}, {"init", fetchdef}}));
     return vmap({{"status", Value(200)}, {"statusText", Value("OK")}});
   };
-  Value opts = fhMap({{"system", fhMap({{"fetch", Value(fetchFn)}})}});
+  // Concrete base: a live construction must satisfy any server variables a
+  // templated base URL declares; a literal base sidesteps the requirement.
+  Value opts = fhMap({{"base", Value("http://localhost:8080")},
+                      {"system", fhMap({{"fetch", Value(fetchFn)}})}});
   auto liveClient = std::make_shared<ProjectNameSDK>(opts);
   UtilityPtr liveUtility = liveClient->getUtility();
 
@@ -328,7 +331,8 @@ static void fetcherBlockedTestMode() {
   vs::Injector fetchFn = [](vs::Injection&, const Value&, const std::string&, const Value&) -> Value {
     return vmap();
   };
-  Value opts = fhMap({{"system", fhMap({{"fetch", Value(fetchFn)}})}});
+  Value opts = fhMap({{"base", Value("http://localhost:8080")},
+                      {"system", fhMap({{"fetch", Value(fetchFn)}})}});
   auto blockedClient = std::make_shared<ProjectNameSDK>(opts);
   blockedClient->mode = "test";