@voxgig/sdkgen 4.34.0 → 4.34.1

package/project/.sdk/tm/scala/utility/Transform.scala

@@ -8,7 +8,7 @@ object TransformRequest {
   def transformRequest(ctx: Context): Object = {
     if (ctx.spec != null) ctx.spec.step = "reqform"
 
-    val reqdata = omit(ctx.reqdata, headerArgNames(ctx))
+    val reqdata = omit(ctx.reqdata, routedArgNames(ctx))
 
     val transform = Helpers.toMapAny(Struct.getprop(ctx.point, "transform"))
     if (transform == null) return stripAction(reqdata)
@@ -26,25 +26,21 @@ object TransformRequest {
   // the body is a copy without it. The caller's map is left untouched.
   private def stripAction(reqdata: Object): Object = omit(reqdata, Seq("$action"))
 
-  // A header argument travels as a header, which PrepareHeaders sends, so the
-  // body is built from the request data without it.
-  private def headerArgNames(ctx: Context): Seq[String] = {
-    if (ctx.point == null) return Seq.empty
-    Struct.getpath(ctx.point, java.util.List.of("args", "header")) match {
-      case l: java.util.List[_] =>
-        val names = scala.collection.mutable.ArrayBuffer[String]()
-        val hit = l.iterator()
-        while (hit.hasNext) {
-          val hd = hit.next()
-          Struct.getprop(hd, "name") match {
-            case name: String if name.nonEmpty => names += name
-            case _ =>
-          }
-        }
-        names.toSeq
-      case _ => Seq.empty
+  // A header, cookie or query argument travels where PrepareHeaders or
+  // PrepareQuery sends it, so the body is built from the request data without
+  // it, unless the entity declares it as a field too.
+  private def routedArgNames(ctx: Context): Seq[String] =
+    (Param.callArgs(ctx, "header") ++ Param.callArgs(ctx, "cookie") ++ Param.callArgs(ctx, "query")).map(_._1)
+      .filterNot(name => fieldArg(ctx, name))
+
+  private def fieldArg(ctx: Context, name: String): Boolean =
+    ctx.point != null && Seq("header", "cookie", "query").exists { kind =>
+      Struct.getpath(ctx.point, java.util.List.of("args", kind)) match {
+        case l: java.util.List[_] =>
+          l.toArray.exists(ad => name == Struct.getprop(ad, "name") && java.lang.Boolean.TRUE == Struct.getprop(ad, "field"))
+        case _ => false
+      }
     }
-  }
 
   private def omit(reqdata: Object, names: Seq[String]): Object = {
     reqdata match {

package/project/.sdk/tm/swift/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ Voxgig
+Copyright (c) $$const.year$$ PROJECTPUBLISHER
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/core/Context.swift

@@ -137,7 +137,7 @@ public final class Context {
     let store: Value = config == nil ? .noval : .map(config!)
     let opcfg = getpath(store, jtp("entity", entname, "op", opname))
 
-    let input = (opname == "update" || opname == "create") ? "data" : "match"
+    let input = (opname == "update" || opname == "create" || opname == "patch") ? "data" : "match"
 
     var points: VList = VList()
     if let ocm = opcfg.asMap, let tl = ocm.entries["points"]?.asList {

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/core/Response.swift

@@ -9,6 +9,10 @@ public final class Response {
   public var jsonFunc: NativeCall0? = nil
   public var body: Value = .noval
   public var err: Error? = nil
+  // Set by a transport that could not read a non-blank body as JSON.
+  public var unreadable: Bool = false
+
+  private static let previewLength = 160
 
   public init(_ resmap: VMap?) {
     let m: Value = resmap == nil ? .map(VMap()) : .map(resmap!)
@@ -25,5 +29,58 @@ public final class Response {
     body = getprop(m, .string("body"))
 
     if let e = getprop(m, .string("err")).asNative as? Error { err = e }
+
+    unreadable = getprop(m, .string("unreadable")) == .bool(true)
+  }
+
+  // A body that is not JSON. An HTTP failure keeps its own error, with the
+  // response described; otherwise the code tells a wrong content type from
+  // malformed JSON.
+  static func unreadableBody(
+    _ ctx: Context, _ status: Int, _ headers: Value, _ text: Value, _ sent: Value, _ failed: Error?
+  ) -> Error {
+    let type = headerValue(headers, "content-type")
+    let agent = clean(ctx, headerValue(sent, "user-agent"))
+    var detail = "HTTP \(status), content-type " + (type.isEmpty ? "none" : type)
+      + ", user-agent " + (agent.isEmpty ? "transport default" : agent)
+    if !isNil(text) {
+      detail += ", body: " + preview(ctx, text)
+    }
+
+    if let sdkErr = failed as? ProjectNameError {
+      sdkErr.message += " (\(detail))"
+      return sdkErr
+    }
+    if let other = failed {
+      return ctx.makeError("", "\(other) (\(detail))")
+    }
+    if type.isEmpty || type.lowercased().contains("json") {
+      return ctx.makeError("response_json_invalid", "response: body is not valid JSON (\(detail))")
+    }
+    return ctx.makeError("response_content_type", "response: expected JSON, got \(type) (\(detail))")
+  }
+
+  private static func headerValue(_ headers: Value, _ name: String) -> String {
+    guard let hm = headers.asMap else { return "" }
+    for (k, v) in hm.entries where k.lowercased() == name {
+      return v.asString ?? stringify(v)
+    }
+    return ""
+  }
+
+  private static func clean(_ ctx: Context, _ s: String) -> String {
+    guard let u = ctx.utility, let c = u.clean else { return s }
+    return c(ctx, .string(s)).asString ?? s
+  }
+
+  // Cleaned whole: a secret the bound would split could leave its prefix.
+  private static func preview(_ ctx: Context, _ text: Value) -> String {
+    let raw = text.asString ?? stringify(text)
+    let flat = clean(ctx, raw.split(whereSeparator: { $0.isWhitespace }).joined(separator: " "))
+    let scalars = flat.unicodeScalars
+    if scalars.count <= previewLength { return flat }
+    var out = String.UnicodeScalarView()
+    out.append(contentsOf: scalars.prefix(previewLength))
+    return String(out) + "..."
   }
 }

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/core/Spec.swift

@@ -16,6 +16,9 @@ public final class Spec {
   public var body: Value = .noval
   public var url: String = ""
   public var path: String = ""
+  // The query parameters prepareAuth placed: the credential, which the
+  // request sends and the entity's match leaves out.
+  public var authquery: [String] = []
 
   public init(_ specmap: VMap?) {
     guard let m = specmap else { return }

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/core/Support.swift

@@ -85,6 +85,14 @@ func gpath(_ m: VMap?, _ segs: String...) -> Value {
 }
 func gpath(_ v: Value, _ segs: String...) -> Value { getpath(v, jtpv(segs)) }
 
+// Whether a comma-separated allow option names the item: whole names, any case.
+func allowed(_ names: Value, _ item: String?) -> Bool {
+  guard let list = names.asString, let item = item, !item.isEmpty else { return false }
+  let want = item.uppercased()
+  return list.split(separator: ",", omittingEmptySubsequences: false)
+    .contains { $0.trimmingCharacters(in: .whitespacesAndNewlines).uppercased() == want }
+}
+
 // regexReplace replaces every match of `pattern` in `input` with the literal
 // `replacement` (template metacharacters in the replacement are escaped).
 func regexReplace(_ input: String, _ pattern: String, _ replacement: String) -> String {

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/TestFeature.swift

@@ -5,6 +5,20 @@
 
 import Foundation
 
+// The key a list's response transform
+// ["`$EACH`", "body", {"`$MERGE`": "`.<key>`"}] reads each item's record under.
+private func testItemEnvelopeKey(_ restf: Value?) -> String? {
+  guard case .list(let spec)? = restf, spec.items.count == 3,
+        case .string(let each) = spec.items[0], each == "`$EACH`",
+        case .string(let body) = spec.items[1], body == "body",
+        case .map(let child) = spec.items[2],
+        case .string(let merge)? = child.entries["`$MERGE`"],
+        merge.count > 3, merge.hasPrefix("`."), merge.hasSuffix("`") else { return nil }
+  let key = String(merge.dropFirst(2).dropLast(1))
+  guard !key.contains(where: { $0 == "." || $0 == "`" || $0 == "$" }) else { return nil }
+  return key
+}
+
 // THE MOCK HAS TO AGREE WITH THE MODEL. A point carrying
 // `transform.res: `body.item`` describes an API that answers {"item": {...}},
 // and the response transform unwraps that key on the way back. Returning the
@@ -15,6 +29,13 @@ private func testEnvelope(_ ctx: Context, _ data: Value) -> Value {
   if case .null = data { return data }
   guard let point = ctx.point else { return data }
   guard case .map(let tm)? = point.entries["transform"] else { return data }
+  if let key = testItemEnvelopeKey(tm.entries["res"]), case .list(let items) = data {
+    return .list(VList(items.items.map { item -> Value in
+      let wrapped = VMap()
+      wrapped.entries[key] = item
+      return .map(wrapped)
+    }))
+  }
   guard case .string(let spec)? = tm.entries["res"] else { return data }
   // Rebuild whatever nesting the transform unwraps. Multi-segment on purpose:
   // GraphQL ops unwrap `body.data.<field>`, not just one envelope property.
@@ -58,6 +79,16 @@ private func testResolveMatch(_ ctx2: Context, _ explicitMatch: VMap) -> VMap {
   return VMap()
 }
 
+// The record the mock keeps: the request data without `$body`, which only the
+// wire carries.
+private func testRecord(_ reqdata: VMap) -> VMap {
+  let out = VMap()
+  for (k, v) in reqdata.entries where k != "$body" {
+    out.entries[k] = v
+  }
+  return out
+}
+
 private func testBuildArgs(_ ctx: Context, _ op: Operation, _ args: VMap?) -> Value {
   let opname = op.name
 
@@ -197,7 +228,7 @@ public final class TestFeature: BaseFeature {
           for item in fl.items { delprop(item, .string("$KEY")) }
         }
         return testRespond(ctx2, 200, clone(found), nil)
-      } else if op.name == "update" {
+      } else if op.name == "update" || op.name == "patch" {
         var updateMatch = VMap()
         if let idv = ctx2.reqdata.entries["id"] {
           updateMatch.entries["id"] = idv
@@ -219,7 +250,7 @@ public final class TestFeature: BaseFeature {
           return testRespond(ctx2, 404, .noval, extra)
         }
         if ent.isMap {
-          _ = merge(.list(VList([ent, .map(ctx2.reqdata)])))
+          _ = merge(.list(VList([ent, .map(testRecord(ctx2.reqdata))])))
         }
         delprop(ent, .string("$KEY"))
         return testRespond(ctx2, 200, clone(ent), nil)
@@ -241,7 +272,7 @@ public final class TestFeature: BaseFeature {
             Int.random(in: 0..<0x10000), Int.random(in: 0..<0x10000),
             Int.random(in: 0..<0x10000), Int.random(in: 0..<0x10000)))
         }
-        let ent = clone(.map(ctx2.reqdata))
+        let ent = clone(.map(testRecord(ctx2.reqdata)))
         if let entm = ent.asMap {
           entm.entries["id"] = id
           if let idStr = id.asString { entmap.entries[idStr] = .map(entm) }

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/TimeoutFeature.swift

@@ -43,6 +43,7 @@ public final class TimeoutFeature: BaseFeature {
   private final class Box: @unchecked Sendable {
     var result: Value = .noval
     var err: Error? = nil
+    var arrived: Int64 = Int64.max
   }
 
   private func withTimeout(_ ctx: Context, _ url: String, _ fetchdef: VMap,
@@ -52,6 +53,12 @@ public final class TimeoutFeature: BaseFeature {
       return try inner(ctx, url, fetchdef)
     }
 
+    // The deadline runs from here, not from the wait below: a caller paused
+    // between the two would otherwise find a late response complete and take
+    // it. The worker notes when it finished, so a response or a failure after
+    // the deadline is a timeout however late the caller looks.
+    let now = foptNow(options)
+    let start = now()
     let box = Box()
     let sem = DispatchSemaphore(value: 0)
 
@@ -61,12 +68,16 @@ public final class TimeoutFeature: BaseFeature {
       } catch {
         box.err = error
       }
+      box.arrived = now()
       sem.signal()
     }
 
-    if sem.wait(timeout: .now() + .milliseconds(msLimit)) == .timedOut {
-      track(msLimit)
-      throw ctx.makeError("timeout", "Request exceeded timeout of \(msLimit)ms")
+    let remaining = max(Int64(0), Int64(msLimit) - (now() - start))
+    if sem.wait(timeout: .now() + .milliseconds(Int(remaining))) == .timedOut {
+      throw timeout(ctx, msLimit)
+    }
+    if Int64(msLimit) < box.arrived - start {
+      throw timeout(ctx, msLimit)
     }
 
     // Unwraps any inner exception.
@@ -76,6 +87,11 @@ public final class TimeoutFeature: BaseFeature {
     return box.result
   }
 
+  private func timeout(_ ctx: Context, _ msLimit: Int) -> Error {
+    track(msLimit)
+    return ctx.makeError("timeout", "Request exceeded timeout of \(msLimit)ms")
+  }
+
   private func track(_ msLimit: Int) {
     count += 1
     ms = msLimit

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/ValidateFeature.swift

@@ -190,6 +190,8 @@ public final class ValidateFeature: BaseFeature {
     // fields will never name it - and under `strict` every custom-action call
     // would be rejected for the one key that made it reachable.
     out.entries.removeValue(forKey: "$action")
+    // Nor is `$body`, the raw request body.
+    out.entries.removeValue(forKey: "$body")
 
     return .map(out)
   }

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/Fetcher.swift

@@ -43,22 +43,24 @@ private let manualRedirectSession = URLSession(
   delegate: ManualRedirectDelegate(), delegateQueue: nil)
 
 func defaultHttpFetch(_ fullurl: String, _ fetchdef: VMap) throws -> Value {
+  // A request that cannot be sent fails the operation.
   guard let url = URL(string: fullurl) else {
-    let m = VMap()
-    m.entries["status"] = .int(0)
-    m.entries["statusText"] = .string("bad url")
-    m.entries["headers"] = .map(VMap())
-    m.entries["json"] = .nat({ () -> Value in .noval } as NativeCall0)
-    m.entries["body"] = .string("")
-    return .map(m)
+    throw ProjectNameError("fetch_transport", "the URL could not be parsed", nil)
   }
 
   var req = URLRequest(url: url)
   req.httpMethod = gp(fetchdef, "method").asString ?? "GET"
 
-  if let body = gp(fetchdef, "body").asString, body != "" {
-    req.httpBody = body.data(using: .utf8)
+  let body = gp(fetchdef, "body")
+  if let text = body.asString, text != "" {
+    req.httpBody = text.data(using: .utf8)
     req.setValue("application/json", forHTTPHeaderField: "Content-Type")
+  } else if case .native(let ref) = body {
+    if let data = ref.value as? Data {
+      req.httpBody = data
+    } else if let bytes = ref.value as? [UInt8] {
+      req.httpBody = Data(bytes)
+    }
   }
 
   var hasUA = false
@@ -70,8 +72,13 @@ func defaultHttpFetch(_ fullurl: String, _ fetchdef: VMap) throws -> Value {
       }
     }
   }
+  // The default User-Agent is recorded with the headers the request sent.
   if !hasUA {
-    req.setValue("Mozilla/5.0 (compatible; ProjectNameSDK/1.0)", forHTTPHeaderField: "User-Agent")
+    let agent = "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)"
+    req.setValue(agent, forHTTPHeaderField: "User-Agent")
+    if let sent = gp(fetchdef, "headers").asMap {
+      sent.entries["user-agent"] = .string(agent)
+    }
   }
 
   // Also per request, so no store reached another way can rewrite the
@@ -110,8 +117,9 @@ func defaultHttpFetch(_ fullurl: String, _ fetchdef: VMap) throws -> Value {
   }
 
   var jsonBody: Value = .noval
-  if !bodyText.isEmpty {
-    if let parsed = try? JSON.parse(bodyText) { jsonBody = parsed }
+  var unreadable = false
+  if !bodyText.allSatisfy({ $0.isWhitespace }) {
+    if let parsed = try? JSON.parse(bodyText) { jsonBody = parsed } else { unreadable = true }
   }
   let captured = jsonBody
 
@@ -121,6 +129,7 @@ func defaultHttpFetch(_ fullurl: String, _ fetchdef: VMap) throws -> Value {
   m.entries["headers"] = .map(resheaders)
   m.entries["json"] = .nat({ () -> Value in captured } as NativeCall0)
   m.entries["body"] = .string(bodyText)
+  m.entries["unreadable"] = .bool(unreadable)
   return .map(m)
 }
 

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/Make.swift

@@ -4,6 +4,36 @@
 
 import Foundation
 
+// The {name} placeholders in a text, in order.
+func pathPlaceholders(_ text: String) -> [String] {
+  var out: [String] = []
+  var open: String.Index? = nil
+  for i in text.indices {
+    let ch = text[i]
+    if ch == "{" {
+      open = i
+    } else if ch == "}" || ch == "/" {
+      if ch == "}", let o = open, text.index(after: o) < i {
+        out.append(String(text[o...i]))
+      }
+      open = nil
+    }
+  }
+  return out
+}
+
+// The path parameters of a point that neither the call nor the entity gives a
+// value for, looked up as paramUtil looks them up.
+private func unfilledParams(_ ctx: Context, _ point: VMap) -> [String] {
+  var missing: [String] = []
+  for part in gp(point, "parts").asList?.items ?? [] {
+    guard let text = part.asString, pathPlaceholders(text) == [text] else { continue }
+    let name = String(text.dropFirst().dropLast())
+    if isNil(paramValue(ctx, point, name)) { missing.append(name) }
+  }
+  return missing
+}
+
 func makePointUtil(_ ctx: Context) throws -> VMap? {
   if let stored = ctx.out["point"], let sp = stored {
     // A PrePoint feature hook (e.g. rbac) may short-circuit the operation by
@@ -16,7 +46,7 @@ func makePointUtil(_ ctx: Context) throws -> VMap? {
   let options = ctx.options
 
   let allowOp = gpath(options, "allow", "op").asString ?? ""
-  if !allowOp.contains(op.name) {
+  if !allowed(gpath(options, "allow", "op"), op.name) {
     throw ctx.makeError("point_op_allow",
       "Operation \"\(op.name)\" not allowed by SDK option allow.op value: \"\(allowOp)\"")
   }
@@ -100,18 +130,38 @@ func makePointUtil(_ ctx: Context) throws -> VMap? {
         return (last.asString ?? "").hasPrefix("{")
       }
 
-      point = op.points.first
-      for candidate in op.points {
-        guard let best = point else { break }
-        let candTerm = terminalParam(candidate)
-        let bestTerm = terminalParam(best)
-        if candTerm != bestTerm {
-          if candTerm { point = candidate }
-        }
-        else if partsLen(candidate) < partsLen(best) {
-          point = candidate
+      func ownPoint(_ points: [VMap]) -> VMap {
+        var best = points[0]
+        for candidate in points {
+          let candTerm = terminalParam(candidate)
+          let bestTerm = terminalParam(best)
+          if candTerm != bestTerm {
+            if candTerm { best = candidate }
+          }
+          else if partsLen(candidate) < partsLen(best) {
+            best = candidate
+          }
         }
+        return best
+      }
+
+      // A call without an action falls back to a point without one, as
+      // generation does, and only to a route the call can fill.
+      let plain = op.points.filter { isNil(gp(gp($0, "select"), "$action")) }
+      if plain.isEmpty {
+        throw ctx.makeError("point_action_required",
+          "Operation \"\(op.name)\" has only action endpoints; pass $action to choose one.")
       }
+
+      let fillable = plain.filter { unfilledParams(ctx, $0).isEmpty }
+
+      if fillable.isEmpty {
+        throw ctx.makeError("point_no_match",
+          "Operation \"\(op.name)\" has no endpoint whose path parameters are all given (missing: " +
+          unfilledParams(ctx, ownPoint(plain)).joined(separator: ", ") + ").")
+      }
+
+      point = ownPoint(fillable)
     }
 
     let reqAction = gp(reqselector, "$action")
@@ -161,7 +211,7 @@ func makeSpecUtil(_ ctx: Context) throws -> Spec {
   ctx.spec!.method = utility.prepareMethod(ctx)
 
   let allowMethod = gpath(options, "allow", "method").asString ?? ""
-  if !allowMethod.contains(ctx.spec!.method) {
+  if !allowed(gpath(options, "allow", "method"), ctx.spec!.method) {
     throw ctx.makeError("spec_method_allow",
       "Method \"\(ctx.spec!.method)\" not allowed by SDK option allow.method value: \"\(allowMethod)\"")
   }
@@ -192,7 +242,12 @@ func makeSpecUtil(_ ctx: Context) throws -> Spec {
     explain.entries["spec"] = .nat(ctx.spec!)
   }
 
+  // Whatever prepareAuth sets in the query, under whichever name, is the
+  // credential; a key it leaves as it was is the caller's.
+  let query = ctx.spec!.query.entries
+
   let spec = try utility.prepareAuth(ctx)
+  spec.authquery = spec.query.entries.keys.filter { query[$0] != spec.query.entries[$0] }
   ctx.spec = spec
   return spec
 }
@@ -208,6 +263,9 @@ func makeUrlUtil(_ ctx: Context) throws -> String {
   var url = join(jtp(spec.base, spec.prefix, spec.path, spec.suffix), "/", true)
   let resmatch = VMap()
 
+  // Sent with the request, never recorded as the entity's match.
+  let authquery = spec.authquery
+
   // A route the definition ends with a slash keeps it: a server such as a
   // Django REST one redirects or refuses the route without it.
   if let orig = gp(ctx.point, "orig").asString, orig.hasSuffix("/"), spec.suffix.isEmpty,
@@ -225,6 +283,17 @@ func makeUrlUtil(_ ctx: Context) throws -> String {
     }
   }
 
+  // A placeholder left in the route would send the request to the wrong route.
+  // The base's own placeholders are server variables, resolved with the options.
+  var base = spec.base
+  while base.hasSuffix("/") { base.removeLast() }
+  let route = !base.isEmpty && url.hasPrefix(base) ? String(url.dropFirst(base.count)) : url
+  let unfilled = pathPlaceholders(route)
+  if !unfilled.isEmpty {
+    throw ctx.makeError("url_param_missing",
+      "URL path has no value for " + unfilled.joined(separator: ", ") + ".")
+  }
+
   var qsep = "?"
   for item in items(.map(spec.query)) {
     let key = item[0].asString ?? ""
@@ -232,7 +301,9 @@ func makeUrlUtil(_ ctx: Context) throws -> String {
     if !isNil(val) {
       url += qsep + escurl(.string(key)) + "=" + escurl(.string(stringify(val)))
       qsep = "&"
-      resmatch.entries[key] = val
+      if !authquery.contains(key) {
+        resmatch.entries[key] = val
+      }
     }
   }
 
@@ -258,11 +329,7 @@ func makeFetchDefUtil(_ ctx: Context) throws -> VMap {
   fetchdef.entries["headers"] = .map(spec.headers)
 
   if !isNil(spec.body) {
-    if spec.body.isMap {
-      fetchdef.entries["body"] = .string(jsonify(spec.body, indent: 0))
-    } else {
-      fetchdef.entries["body"] = spec.body
-    }
+    fetchdef.entries["body"] = requestBody(ctx.point, spec.body)
   }
 
   return fetchdef

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/MakeOptions.swift

@@ -139,6 +139,16 @@ func makeOptionsUtil(_ ctx: Context) -> VMap {
     }
   }
 
+  if let base = result.entries["base"]?.asString, base.contains("{") {
+    do {
+      let resolved = try resolveServerBase(base, result, config, ctx)
+      result.entries["base"] = .string(resolved)
+    } catch {
+      // The initializer cannot throw, so a construction error traps, as zig's panics.
+      fatalError(errMessage(error))
+    }
+  }
+
   // Resolve the feature add-order: an explicit list order (above) wins;
   // otherwise order the map test-first, then the remaining names sorted, so
   // the outcome is deterministic and `test` is always the base transport.
@@ -176,25 +186,81 @@ func makeOptionsUtil(_ ctx: Context) -> VMap {
   return result
 }
 
+// A templated base URL takes each {name} from options.server. An empty value
+// cannot make a working URL, so it is an error, except in test mode, where it
+// becomes test-<name>.
+func resolveServerBase(_ base: String, _ opts: VMap, _ config: VMap, _ ctx: Context?) throws -> String {
+  let testmode = gpath(opts, "test", "active") == .bool(true)
+    || gpath(opts, "feature", "test", "active") == .bool(true)
+  let server = gp(opts, "server").asMap ?? VMap()
+  var sdkname = gpath(config, "main", "name").asString ?? ""
+  if sdkname.isEmpty { sdkname = "SDK" }
+
+  let chars = Array(base)
+  var out = ""
+  var i = 0
+  while i < chars.count {
+    var j = i + 1
+    if "{" == chars[i] {
+      while j < chars.count, "_" == chars[j] || (chars[j].isASCII && (chars[j].isLetter || chars[j].isNumber)) {
+        j += 1
+      }
+    }
+    // A placeholder only when it closes and the name is [A-Za-z0-9_]+.
+    if "{" != chars[i] || j == i + 1 || j >= chars.count || "}" != chars[j] {
+      out.append(chars[i])
+      i += 1
+      continue
+    }
+    let name = String(chars[(i + 1)..<j])
+    let value = gp(server, name).asString ?? ""
+    if !value.isEmpty {
+      out += value
+    } else if testmode {
+      out += "test-" + name
+    } else {
+      let hint = "options.entries[\"server\"] = .map(server) with server.entries[\"\(name)\"]"
+        + " = .string(\"...\")"
+      throw ProjectNameError("server_var_required",
+        "\(sdkname): the server variable '\(name)' is required: the API base URL is '\(base)'"
+          + " - pass \(hint) in the SDK options", ctx)
+    }
+    i = j + 1
+  }
+  return out
+}
+
 // A feature's name is not a field name: only the sensitive names inside its
 // settings count, so `secrets` does not make every setting a secret. Entity
-// blocks hold entity settings and seeded records, never a credential.
+// blocks hold entity settings and seeded records, never a credential, and
+// rbac's rules are keyed by entity and operation names.
 private func cleanAddOptions(_ ctx: Context, _ opts: VMap) {
   let top = cleanOmit(opts, ["feature", "entity"])
   if let test = top.entries["test"] {
-    top.entries["test"] = cleanWithoutEntity(test)
+    top.entries["test"] = cleanPlain(test, nil)
   }
   cleanAddSensitiveUtil(ctx, .map(top))
   let feature = opts.entries["feature"] ?? .noval
-  let settings: [Value] = feature.asMap?.entries.values ?? feature.asList?.items ?? [feature]
-  for fopts in settings {
-    cleanAddSensitiveUtil(ctx, cleanWithoutEntity(fopts))
+  var settings: [(String?, Value)] = []
+  if let fmap = feature.asMap {
+    for (name, fopts) in fmap.entries {
+      settings.append((name, fopts))
+    }
+  } else if let flist = feature.asList {
+    for fopts in flist.items {
+      settings.append((fopts.asMap?.entries["name"]?.asString, fopts))
+    }
+  } else {
+    settings.append((nil, feature))
+  }
+  for (name, fopts) in settings {
+    cleanAddSensitiveUtil(ctx, cleanPlain(fopts, name))
   }
 }
 
-private func cleanWithoutEntity(_ block: Value) -> Value {
+private func cleanPlain(_ block: Value, _ name: String?) -> Value {
   guard let m = block.asMap else { return block }
-  return .map(cleanOmit(m, ["entity"]))
+  return .map(cleanOmit(m, "rbac" == name ? ["entity", "rules"] : ["entity"]))
 }
 
 private func cleanOmit(_ src: VMap, _ names: [String]) -> VMap {