@voxgig/sdkgen 4.34.0 → 4.34.1

package/project/.sdk/tm/js/src/feature/netsim/NetsimFeature.js

@@ -52,7 +52,7 @@ class NetsimFeature extends BaseFeature {
 
     // Total outage: every call fails at the transport level.
     if (true === opts.offline) {
-      await this._sleep(this._pickLatency())
+      await this._sleep(this._pickLatency(), fetchdef?.signal)
       applied.offline = true
       this._track(ctx, applied)
       return ctx.error('netsim_offline', 'Simulated network offline (URL was: "' + url + '")')
@@ -60,7 +60,7 @@ class NetsimFeature extends BaseFeature {
 
     // Connection-level errors for the first N calls (e.g. ECONNRESET).
     if (call <= (opts.errorTimes | 0)) {
-      await this._sleep(this._pickLatency())
+      await this._sleep(this._pickLatency(), fetchdef?.signal)
       applied.error = true
       this._track(ctx, applied)
       return ctx.error('netsim_conn', 'Simulated connection error (call ' + call + ')')
@@ -68,7 +68,7 @@ class NetsimFeature extends BaseFeature {
 
     // Rate-limit responses (HTTP 429 + Retry-After) for the first N calls.
     if (call <= (opts.rateLimitTimes | 0)) {
-      await this._sleep(this._pickLatency())
+      await this._sleep(this._pickLatency(), fetchdef?.signal)
       applied.rateLimited = true
       this._track(ctx, applied)
       return this._respond(ctx, 429, undefined, {
@@ -83,7 +83,7 @@ class NetsimFeature extends BaseFeature {
     const failByEvery = 0 < (opts.failEvery | 0) && 0 === call % opts.failEvery
     const failByRate = 0 < (opts.failRate || 0) && this._rand() < opts.failRate
     if (failByCount || failByEvery || failByRate) {
-      await this._sleep(this._pickLatency())
+      await this._sleep(this._pickLatency(), fetchdef?.signal)
       applied.failStatus = failStatus
       this._track(ctx, applied)
       return this._respond(ctx, failStatus, undefined, { statusText: 'Simulated Failure' })
@@ -93,7 +93,7 @@ class NetsimFeature extends BaseFeature {
     const latency = this._pickLatency()
     applied.latency = latency
     this._track(ctx, applied)
-    await this._sleep(latency)
+    await this._sleep(latency, fetchdef?.signal)
     return inner(ctx, url, fetchdef)
   }
 
@@ -116,15 +116,17 @@ class NetsimFeature extends BaseFeature {
   }
 
 
-  _sleep(ms) {
+  _sleep(ms, signal) {
     if (null == ms || 0 >= ms) {
       return Promise.resolve()
     }
     const sleep = this._options.sleep
     if ('function' === typeof sleep) {
-      return Promise.resolve(sleep(ms))
+      return this._untilAbort(Promise.resolve(sleep(ms)), signal)
     }
-    return new Promise((r) => setTimeout(r, ms))
+    let timer
+    return this._untilAbort(new Promise((r) => { timer = setTimeout(r, ms) }), signal,
+      () => clearTimeout(timer))
   }
 
 

package/project/.sdk/tm/js/src/feature/ratelimit/RatelimitFeature.js

@@ -38,13 +38,13 @@ class RatelimitFeature extends BaseFeature {
     const inner = utility.fetcher
 
     utility.fetcher = async function (ctx2, url, fetchdef) {
-      await self._acquire(ctx2)
+      await self._acquire(ctx2, fetchdef?.signal)
       return inner(ctx2, url, fetchdef)
     }
   }
 
 
-  async _acquire(ctx) {
+  async _acquire(ctx, signal) {
     const rate = this._options.rate || 5
     const burst = null == this._options.burst ? rate : this._options.burst
 
@@ -63,7 +63,7 @@ class RatelimitFeature extends BaseFeature {
     const needed = 1 - this._tokens
     const waitMs = Math.ceil((needed / rate) * 1000)
     this._track(ctx, waitMs)
-    await this._sleep(waitMs)
+    await this._sleep(waitMs, signal)
     this._last = this._now()
     this._tokens = 0
   }
@@ -78,15 +78,17 @@ class RatelimitFeature extends BaseFeature {
   }
 
 
-  _sleep(ms) {
+  _sleep(ms, signal) {
     if (null == ms || 0 >= ms) {
       return Promise.resolve()
     }
     const sleep = this._options.sleep
     if ('function' === typeof sleep) {
-      return Promise.resolve(sleep(ms))
+      return this._untilAbort(Promise.resolve(sleep(ms)), signal)
     }
-    return new Promise((r) => setTimeout(r, ms))
+    let timer
+    return this._untilAbort(new Promise((r) => { timer = setTimeout(r, ms) }), signal,
+      () => clearTimeout(timer))
   }
 
 

package/project/.sdk/tm/js/src/feature/retry/RetryFeature.js

@@ -44,6 +44,7 @@ class RetryFeature extends BaseFeature {
     const maxDelay = null == opts.maxDelay ? 2000 : opts.maxDelay
     const factor = null == opts.factor ? 2 : opts.factor
 
+    const signal = fetchdef?.signal
     let attempt = 0
     let last
 
@@ -60,6 +61,12 @@ class RetryFeature extends BaseFeature {
 
       last = res
 
+      // An abort is never retried, whatever the transport threw for it: the
+      // reason need not be an Error, so decide before the retryable test.
+      if (threw && true === signal?.aborted) {
+        throw signal.reason
+      }
+
       const retryable = this._retryable(res)
       if (!retryable || attempt >= max) {
         // Out of attempts: rethrow a thrown error to preserve pipeline
@@ -70,9 +77,13 @@ class RetryFeature extends BaseFeature {
         return res
       }
 
+      if (true === signal?.aborted) {
+        throw signal.reason
+      }
+
       const wait = this._backoff(res, attempt, minDelay, maxDelay, factor)
       this._track(ctx, attempt + 1, res, wait)
-      await this._sleep(wait)
+      await this._sleep(wait, signal)
       attempt++
     }
   }
@@ -125,15 +136,17 @@ class RetryFeature extends BaseFeature {
   }
 
 
-  _sleep(ms) {
+  _sleep(ms, signal) {
     if (null == ms || 0 >= ms) {
       return Promise.resolve()
     }
     const sleep = this._options.sleep
     if ('function' === typeof sleep) {
-      return Promise.resolve(sleep(ms))
+      return this._untilAbort(Promise.resolve(sleep(ms)), signal)
     }
-    return new Promise((r) => setTimeout(r, ms))
+    let timer
+    return this._untilAbort(new Promise((r) => { timer = setTimeout(r, ms) }), signal,
+      () => clearTimeout(timer))
   }
 
 

package/project/.sdk/tm/js/src/feature/test/TestFeature.js

@@ -16,6 +16,28 @@ function mintId() {
 
 
 
+// The record the mock keeps: the request data without `$body`, which only the
+// wire carries.
+function recordOf(reqdata) {
+  const out = { ...(reqdata || {}) }
+  delete out.$body
+  return out
+}
+
+
+// The key a list response wraps each record under, where the response
+// transform is `["`$EACH`", "body", { "`$MERGE`": "`.<key>`" }]`.
+function itemEnvelopeKey(restf) {
+  if (!Array.isArray(restf) || 3 !== restf.length ||
+    '`$EACH`' !== restf[0] || 'body' !== restf[1]) {
+    return null
+  }
+  const merge = restf[2]?.['`$MERGE`']
+  const m = 'string' === typeof merge ? merge.match(/^`\.([^.`$]+)`$/) : null
+  return null == m ? null : m[1]
+}
+
+
 class TestFeature extends BaseFeature {
   version = '0.0.1'
   name = 'test'
@@ -69,6 +91,10 @@ class TestFeature extends BaseFeature {
       // whose responses happen to be unwrapped.
       function envelope(data) {
         const restf = getprop(getprop(ctx.point, 'transform', {}), 'res')
+        const itemkey = itemEnvelopeKey(restf)
+        if (null != itemkey && Array.isArray(data)) {
+          return data.map((item) => ({ [itemkey]: item }))
+        }
         if (null == data || 'string' !== typeof restf) {
           return data
         }
@@ -143,8 +169,8 @@ class TestFeature extends BaseFeature {
           return respond(200, out)
         }
       }
-      else if ('update' === op.name) {
-        const args = self.buildArgs(ctx, op, ctx.reqdata)
+      else if ('update' === op.name || 'patch' === op.name) {
+        const args = self.buildArgs(ctx, op, recordOf(ctx.reqdata))
         const found = select(entmap, args)
         const ent = getelem(found, 0)
         if (null == ent) {
@@ -152,7 +178,7 @@ class TestFeature extends BaseFeature {
           return respond(404, undefined, { statusText: S_NOT_FOUND })
         }
         else {
-          merge([ent, (ctx.reqdata || {})])
+          merge([ent, recordOf(ctx.reqdata)])
           delprop(ent, '$KEY')
           const out = clone(ent)
           return respond(200, out)
@@ -170,13 +196,13 @@ class TestFeature extends BaseFeature {
         return respond(200)
       }
       else if ('create' === op.name) {
-        const args = self.buildArgs(ctx, op, ctx.reqdata)
+        const args = self.buildArgs(ctx, op, recordOf(ctx.reqdata))
         let id = param(ctx, 'id')
         if (null == id) {
           id = mintId()
         }
 
-        const ent = clone(ctx.reqdata)
+        const ent = clone(recordOf(ctx.reqdata))
         setprop(ent, 'id', id)
         setprop(entmap, id, ent)
         delprop(ent, '$KEY')
@@ -213,10 +239,12 @@ class TestFeature extends BaseFeature {
       return max <= min ? min : min + ((max - min) >> 1)
     }
 
-    function sleep(ms) {
+    function sleep(ms, signal) {
       if (null == ms || 0 >= ms) { return Promise.resolve() }
-      if ('function' === typeof net.sleep) { return Promise.resolve(net.sleep(ms)) }
-      return new Promise((r) => setTimeout(r, ms))
+      if ('function' === typeof net.sleep) { return self._untilAbort(Promise.resolve(net.sleep(ms)), signal) }
+      let timer
+      return self._untilAbort(new Promise((r) => { timer = setTimeout(r, ms) }), signal,
+        () => clearTimeout(timer))
     }
 
     return async function netsimFetcher(ctx, url, fetchdef) {
@@ -224,15 +252,15 @@ class TestFeature extends BaseFeature {
       const call = self._netcalls
 
       if (true === net.offline) {
-        await sleep(pickLatency())
+        await sleep(pickLatency(), fetchdef?.signal)
         return ctx.error('netsim_offline', 'Simulated network offline (URL was: "' + url + '")')
       }
       if (call <= (net.errorTimes | 0)) {
-        await sleep(pickLatency())
+        await sleep(pickLatency(), fetchdef?.signal)
         return ctx.error('netsim_conn', 'Simulated connection error (call ' + call + ')')
       }
       if (call <= (net.failTimes | 0)) {
-        await sleep(pickLatency())
+        await sleep(pickLatency(), fetchdef?.signal)
         const status = null == net.failStatus ? 503 : net.failStatus
         return {
           status,
@@ -242,7 +270,7 @@ class TestFeature extends BaseFeature {
           headers: { forEach(_cb) { }, get(_k) { return undefined } },
         }
       }
-      await sleep(pickLatency())
+      await sleep(pickLatency(), fetchdef?.signal)
       return inner(ctx, url, fetchdef)
     }
   }

package/project/.sdk/tm/js/src/feature/timeout/TimeoutFeature.js

@@ -5,9 +5,9 @@ const { BaseFeature } = require('../base/BaseFeature')
 
 // Per-request timeout. Wraps the active transport and races each attempt
 // against a deadline; if the deadline wins, the request resolves to a
-// timeout error instead of hanging. An `AbortController` is signalled (via
-// `fetchdef.signal`) so a live `fetch` is actually cancelled, while the
-// mock transport simply loses the race.
+// timeout error instead of hanging. The `AbortController` behind
+// `fetchdef.signal` cancels a live `fetch` at the deadline or at the caller's
+// own abort, while the mock transport simply loses the race.
 class TimeoutFeature extends BaseFeature {
   version = '0.0.1'
   name = 'timeout'
@@ -44,9 +44,20 @@ class TimeoutFeature extends BaseFeature {
 
     // Attach an abort signal so a real fetch can be cancelled on timeout.
     let controller
+    const caller = fetchdef.signal
+    let follow
     if ('function' === typeof globalThis.AbortController) {
       controller = new globalThis.AbortController()
       fetchdef = { ...fetchdef, signal: controller.signal }
+      if (null != caller) {
+        follow = () => controller.abort(caller.reason)
+        if (caller.aborted) {
+          follow()
+        }
+        else {
+          caller.addEventListener('abort', follow, { once: true })
+        }
+      }
     }
 
     let timer
@@ -82,6 +93,9 @@ class TimeoutFeature extends BaseFeature {
       else if (null != timer) {
         clearTimeout(timer)
       }
+      if (null != follow) {
+        caller.removeEventListener('abort', follow)
+      }
     }
   }
 

package/project/.sdk/tm/js/src/feature/validate/ValidateFeature.js

@@ -195,6 +195,8 @@ class ValidateFeature extends BaseFeature {
     // fields will never name it — and under `strict` every custom-action
     // call would be rejected for the one key that made it reachable.
     delete out.$action
+    // Nor is `$body`, the raw request body.
+    delete out.$body
 
     return out
   }

package/project/.sdk/tm/js/src/utility/CleanUtility.js

@@ -239,7 +239,7 @@ function clean(ctx, val) {
   }
 
   if (val instanceof Error) {
-    val.message = cleanString(cfg, String(val.message))
+    setMessage(val, cleanString(cfg, String(val.message)))
     if ('string' === typeof val.stack) {
       val.stack = cleanString(cfg, val.stack)
     }
@@ -265,6 +265,29 @@ function clean(ctx, val) {
 
 
 // Is this key name sensitive under the context's clean configuration?
+// Assigned where assignment works. A DOMException's message is an inherited
+// getter with no setter, which strict code cannot assign, so it is defined
+// on the instance; an own message that can be neither is left as it is.
+function setMessage(err, text) {
+  let owner = err
+  let desc = Object.getOwnPropertyDescriptor(owner, 'message')
+  while (null == desc && null != (owner = Object.getPrototypeOf(owner))) {
+    desc = Object.getOwnPropertyDescriptor(owner, 'message')
+  }
+  if (null == desc || desc.writable || null != desc.set) {
+    err.message = text
+  }
+  else if (owner !== err || desc.configurable) {
+    Object.defineProperty(err, 'message', {
+      value: text,
+      writable: true,
+      enumerable: owner === err && !!desc.enumerable,
+      configurable: true,
+    })
+  }
+}
+
+
 function cleanKey(ctx, key) {
   return sensitiveKey(cleanConfig(ctx), key)
 }
@@ -300,5 +323,6 @@ module.exports = {
   cleanAddSensitive,
   cleanKey,
   makeCleanConfig,
+  setMessage,
   splitvalues,
 }

package/project/.sdk/tm/js/src/utility/FetcherUtility.js

@@ -1,4 +1,23 @@
 
+// Several CDNs refuse a library's own agent, so outside a browser a request
+// without one carries the browser-shaped agent most other targets send.
+const DEFAULT_USER_AGENT = 'Mozilla/5.0 (compatible; ProjectNameSDK/1.0)'
+
+
+function defaultUserAgent(fetchdef) {
+  if (null == globalThis.process?.versions?.node) {
+    return
+  }
+  const headers = fetchdef.headers = fetchdef.headers || {}
+  for (const name of Object.keys(headers)) {
+    if ('user-agent' === name.toLowerCase()) {
+      return
+    }
+  }
+  headers['user-agent'] = DEFAULT_USER_AGENT
+}
+
+
 // Make HTTP call using library. Replace this utility for mocking etc.
 async function fetcher(ctx, fullurl, fetchdef) {
 
@@ -18,11 +37,14 @@ async function fetcher(ctx, fullurl, fetchdef) {
 
   const fetch = options.system.fetch
 
+  defaultUserAgent(fetchdef)
+
   const response = await fetch(fullurl, fetchdef)
 
   return response
 }
 
 module.exports = {
-  fetcher
+  fetcher,
+  DEFAULT_USER_AGENT,
 }

package/project/.sdk/tm/js/src/utility/MakeErrorUtility.js

@@ -1,7 +1,7 @@
 
 const { Result } = require('../Result')
 
-const { clean } = require('./CleanUtility')
+const { clean, setMessage } = require('./CleanUtility')
 const { clone, delprop } = require('./StructUtility')
 
 function makeError(ctx, err) {
@@ -27,7 +27,7 @@ function makeError(ctx, err) {
   }
 
   const errmsg = err.message || 'unknown error'
-  err.message = 'ProjectNameSDK: ' + op.name + ': ' + errmsg
+  setMessage(err, 'ProjectNameSDK: ' + op.name + ': ' + errmsg)
 
   // The context stays reachable for a debugger, but not for a serialiser:
   // a transport error carries none, and a pipeline error's is enumerable

package/project/.sdk/tm/js/src/utility/MakeFetchDefUtility.js

@@ -1,5 +1,6 @@
 
 const { Result } = require('../Result')
+const { isJsonRequest, isRawValue, isStream } = require('./MediaUtility')
 
 function makeFetchDef(ctx) {
   const spec = ctx.spec
@@ -31,9 +32,20 @@ function makeFetchDef(ctx) {
     headers: spec.headers,
   }
 
+  if (null != ctx.ctrl?.signal) {
+    fetchdef.signal = ctx.ctrl.signal
+  }
+
   if (null != spec.body) {
-    fetchdef.body =
-      'object' === typeof spec.body ? jsonify(spec.body) : spec.body
+    const body = spec.body
+    // A JSON point's body is JSON whatever its value; a scalar elsewhere goes as given.
+    fetchdef.body = isRawValue(body) || ('object' !== typeof body && !isJsonRequest(ctx.point)) ?
+      body : jsonify(body)
+
+    // Node's fetch refuses a stream body without it.
+    if (isStream(body)) {
+      fetchdef.duplex = 'half'
+    }
   }
 
   return fetchdef

package/project/.sdk/tm/js/src/utility/MakeOptionsUtility.js

@@ -176,16 +176,16 @@ function makeOptions(ctx) {
   return opts
 }
 
-// Registration skips entity blocks: entity settings and seed records hold no credential.
+// Registration skips entity blocks, and rbac's rules, keyed by entity and op names.
 function settings(opts) {
-  const noent = (b) => null != b && 'object' === typeof b && !Array.isArray(b)
-    ? { ...b, entity: undefined } : b
-  const feature = Array.isArray(opts.feature) ? opts.feature.map(noent)
+  const plain = (b, name) => null != b && 'object' === typeof b && !Array.isArray(b)
+    ? { ...b, entity: undefined, ...('rbac' === name ? { rules: undefined } : {}) } : b
+  const feature = Array.isArray(opts.feature) ? opts.feature.map((b) => plain(b, b?.name))
     : null != opts.feature && 'object' === typeof opts.feature
-      ? Object.fromEntries(Object.entries(opts.feature).map(([k, v]) => [k, noent(v)]))
+      ? Object.fromEntries(Object.entries(opts.feature).map(([k, v]) => [k, plain(v, k)]))
       : opts.feature
   return { ...opts, clean: undefined, __derived__: undefined, entity: undefined,
-    test: noent(opts.test), feature }
+    test: plain(opts.test), feature }
 }
 
 

package/project/.sdk/tm/js/src/utility/MakePointUtility.js

@@ -1,3 +1,6 @@
+const { paramValue } = require('./ParamUtility')
+const { allowed } = require('./PrepareMethodUtility')
+
 
 // The entity's OWN route among an op's points, as opposed to a
 // CROSS-REFERENCE: another resource's route that happens to return this
@@ -45,6 +48,23 @@ function ownPoint(points) {
 }
 
 
+// The path parameters of a point that neither the call nor the entity gives a
+// value for, looked up as prepareParams looks them up.
+function unfilled(ctx, point) {
+  const missing = []
+
+  for (const part of (point.parts || [])) {
+    const found = /^\{([^{}\/]+)\}$/.exec(String(part))
+    const name = found && found[1]
+    if (null != name && null == paramValue(ctx, point, name)) {
+      missing.push(name)
+    }
+  }
+
+  return missing
+}
+
+
 function makePoint(ctx) {
   if (ctx.out.point) {
     return ctx.point = ctx.out.point
@@ -54,7 +74,7 @@ function makePoint(ctx) {
   const op = ctx.op
   const options = ctx.options
 
-  if (!options.allow.op.includes(op.name)) {
+  if (!allowed(options.allow.op, op.name)) {
     return ctx.error('point_op_allow', 'Operation "' + op.name +
       '" not allowed by SDK option allow.op value: "' + options.allow.op + '"')
   }
@@ -124,7 +144,24 @@ function makePoint(ctx) {
           '" action "' + reqselector.$action + '" is not valid.')
       }
 
-      point = ownPoint(op.points)
+      // A call without an action falls back to a point without one, as
+      // generation does, and only to a route the call can fill.
+      const plain = op.points.filter((cand) => null == (cand.select && cand.select.$action))
+
+      if (0 === plain.length) {
+        return ctx.error('point_action_required', 'Operation "' + op.name +
+          '" has only action endpoints; pass $action to choose one.')
+      }
+
+      const fillable = plain.filter((cand) => 0 === unfilled(ctx, cand).length)
+
+      if (0 === fillable.length) {
+        return ctx.error('point_no_match', 'Operation "' + op.name +
+          '" has no endpoint whose path parameters are all given (missing: ' +
+          unfilled(ctx, ownPoint(plain)).join(', ') + ').')
+      }
+
+      point = ownPoint(fillable)
     }
 
     if (

package/project/.sdk/tm/js/src/utility/MakeRequestUtility.js

@@ -1,6 +1,7 @@
 
 const { Response } = require('../Response')
 const { Result } = require('../Result')
+const { isStream, readStream } = require('./MediaUtility')
 
 async function makeRequest(ctx) {
   // PreRequest feature hook has already provided a result.
@@ -29,6 +30,16 @@ async function makeRequest(ctx) {
       throw fetchdef
     }
 
+    if (true === fetchdef.signal?.aborted) {
+      throw fetchdef.signal.reason
+    }
+
+    // A stream can be read once; read it now, so that a retry sends the same bytes.
+    if (isStream(fetchdef.body)) {
+      fetchdef.body = await readStream(fetchdef.body)
+      delete fetchdef.duplex
+    }
+
     if (ctx.ctrl.explain) {
       ctx.ctrl.explain.fetchdef = fetchdef
     }
@@ -41,14 +52,14 @@ async function makeRequest(ctx) {
       response = new Response({ err: ctx.error('request_no_response', 'response: undefined') })
     }
     else if (fetched instanceof Error) {
-      response = new Response({ err: fetched })
+      response = new Response({ err: abortError(ctx, fetched) })
     }
     else {
       response = new Response(fetched)
     }
   }
   catch (err) {
-    response.err = err
+    response.err = abortError(ctx, err)
   }
 
   spec.step = 'postrequest'
@@ -58,6 +69,20 @@ async function makeRequest(ctx) {
   return response
 }
 
+// A request that failed once its signal aborted failed because of it, whatever
+// the transport rejected with.
+function abortError(ctx, err) {
+  const signal = ctx.ctrl?.signal
+  if (true !== signal?.aborted) {
+    return err
+  }
+  const abort = ctx.error('request_aborted', 'request aborted')
+  // Not enumerable, as a native cause is: the reason is the caller's own value.
+  Object.defineProperty(abort, 'cause', { value: signal.reason, writable: true, configurable: true })
+  return abort
+}
+
 module.exports = {
+  abortError,
   makeRequest
 }

package/project/.sdk/tm/js/src/utility/MakeResponseUtility.js

@@ -1,3 +1,4 @@
+const { abortError } = require('./MakeRequestUtility')
 
 async function makeResponse(ctx) {
   // PreResponse feature hook has already provided a result.
@@ -47,7 +48,7 @@ async function makeResponse(ctx) {
     }
   }
   catch (err) {
-    result.err = err
+    result.err = abortError(ctx, err)
   }
 
   if (ctx.ctrl.explain) {

package/project/.sdk/tm/js/src/utility/MakeSpecUtility.js

@@ -1,8 +1,15 @@
 
 const { Spec } = require('../Spec')
+const { allowed } = require('./PrepareMethodUtility')
 
 // Create request specificaton.
 function makeSpec(ctx) {
+  // A PreSpec hook (validate) rejects the operation by placing its error
+  // here; the pipeline raises it, and ctx.spec stays a request spec.
+  if (ctx.out.spec instanceof Error) {
+    return ctx.out.spec
+  }
+
   if (ctx.out.spec) {
     return ctx.spec = ctx.out.spec
   }
@@ -29,7 +36,7 @@ function makeSpec(ctx) {
 
   ctx.spec.method = prepareMethod(ctx)
 
-  if (!options.allow.method.includes(ctx.spec.method)) {
+  if (!allowed(options.allow.method, ctx.spec.method)) {
     return ctx.error('spec_method_allow', 'Method "' + ctx.spec.method +
       '" not allowed by SDK option allow.method value: "' + options.allow.method + '"')
   }
@@ -61,9 +68,15 @@ function makeSpec(ctx) {
     ctx.ctrl.explain.spec = ctx.spec
   }
 
+  // Whatever prepareAuth sets in the query, under whichever name, is the
+  // credential; a key it leaves as it was is the caller's.
+  const query = { ...ctx.spec.query }
+
   const spec = prepareAuth(ctx)
 
   if (!(spec instanceof Error)) {
+    spec.authquery = Object.keys(spec.query || {})
+      .filter((key) => spec.query[key] !== query[key])
     ctx.spec = spec
   }