@voxgig/sdkgen 4.34.0 → 4.34.2

package/project/.sdk/tm/php/test/FeatureCorpusTest.php

@@ -29,7 +29,7 @@ class FeatureCorpusTest extends TestCase
     // SDK generated without a listed feature still skips, not fails.
 
     // The standard operation names, in the order the runner prefers them.
-    private const FEATURE_CORPUS_OPS = ['load', 'list', 'create', 'update', 'remove'];
+    private const FEATURE_CORPUS_OPS = ['load', 'list', 'create', 'update', 'patch', 'remove'];
 
     private static function corpus(): array
     {
@@ -286,6 +286,39 @@ class FeatureCorpusTest extends TestCase
         return $client->$prop ?? null;
     }
 
+    // The first feature a case composes that this SDK does not generate,
+    // probed as a section's own feature is. Such a case is skipped rather
+    // than failed.
+    private static function missingFeature(array $kase, array &$have): ?string
+    {
+        $spec = $kase['feature'] ?? null;
+        $names = [];
+        if (is_array($spec) && array_is_list($spec)) {
+            foreach ($spec as $f) {
+                if (is_array($f) && is_string($f['name'] ?? null)) {
+                    $names[] = $f['name'];
+                }
+            }
+        } elseif (is_array($spec)) {
+            $names = array_keys($spec);
+            sort($names);
+        }
+        foreach ($names as $name) {
+            if (!is_string($name)) {
+                continue;
+            }
+            if (!array_key_exists($name, $have)) {
+                $have[$name] = self::present(
+                    self::buildClient(['feature' => [['name' => $name, 'active' => true]]]),
+                    $name);
+            }
+            if (!$have[$name]) {
+                return $name;
+            }
+        }
+        return null;
+    }
+
     public function testCorpusCarriesAFeatureSection(): void
     {
         // A corpus with no `feature` section is a SKIP, not a failure. Each
@@ -323,6 +356,8 @@ class FeatureCorpusTest extends TestCase
                 . 'the corpus (create-sdkgen .sdk/test/feature/) to run these cases');
         }
 
+        $failed = [];
+        $have = [];
         $names = array_keys(self::corpus()['feature'] ?? []);
         sort($names);
         foreach ($names as $name) {
@@ -356,6 +391,16 @@ class FeatureCorpusTest extends TestCase
             foreach ($cases as $raw) {
                 $need = self::tokensUsed($raw);
                 if ($need > count($ops)) {
+                    fwrite(STDERR, sprintf("skip \"%s\": needs %d operations, this SDK offers %d\n",
+                        $raw['name'] ?? '', $need, count($ops)));
+                    continue;
+                }
+
+                $missing = self::missingFeature($raw, $have);
+                if (null !== $missing) {
+                    fwrite(STDERR, sprintf(
+                        "skip \"%s\": needs the %s feature, which this SDK does not generate\n",
+                        $raw['name'] ?? '', $missing));
                     continue;
                 }
 
@@ -364,52 +409,62 @@ class FeatureCorpusTest extends TestCase
                     $tokens['#OP' . ($i + 1)] = $ops[$i]['key'];
                 }
                 $kase = self::resolve($raw, $tokens);
+                $label = (string)($kase['name'] ?? '');
+                $ran++;
 
-                $client = self::buildClient($kase);
-                $label = $kase['name'] ?? '';
-
-                foreach (($kase['op'] ?? []) as $step) {
-                    $op = $byKey[$step['op']] ?? null;
-                    $this->assertNotNull($op, "$label: no operation {$step['op']}");
-                    $ctrl = $step['ctrl'] ?? [];
-                    $wanterr = $step['err'] ?? null;
-
-                    try {
-                        self::invoke($client, $op, $ctrl);
-                        $this->assertNull($wanterr,
-                            "$label: {$step['op']} was expected to fail, and did not");
-                    } catch (\PHPUnit\Framework\AssertionFailedError $e) {
-                        throw $e;
-                    } catch (\Throwable $err) {
-                        $this->assertNotNull($wanterr,
-                            "$label: {$step['op']} failed unexpectedly: " . $err->getMessage());
-                        if (is_string($wanterr)) {
-                            // The CODE, not the message: make_error prefixes
-                            // and humanises the text, so matching it would
-                            // pass on any error that mentioned the word.
-                            //
-                            // `sdk_code`, not `code`: Exception::$code is a
-                            // protected int on every PHP throwable, so the
-                            // SDK carries its own string code beside it.
-                            $code = property_exists($err, 'sdk_code') ? $err->sdk_code : null;
-                            $this->assertSame($wanterr, $code,
-                                "$label: wrong error code (" . $err->getMessage() . ')');
+                // Every failing case is reported, not only the first.
+                try {
+                    $client = self::buildClient($kase);
+
+                    foreach (($kase['op'] ?? []) as $step) {
+                        $op = $byKey[$step['op']] ?? null;
+                        $this->assertNotNull($op, "$label: no operation {$step['op']}");
+                        $ctrl = $step['ctrl'] ?? [];
+                        $wanterr = $step['err'] ?? null;
+
+                        try {
+                            self::invoke($client, $op, $ctrl);
+                            $this->assertNull($wanterr,
+                                "$label: {$step['op']} was expected to fail, and did not");
+                        } catch (\PHPUnit\Framework\AssertionFailedError $e) {
+                            throw $e;
+                        } catch (\Throwable $err) {
+                            $this->assertNotNull($wanterr,
+                                "$label: {$step['op']} failed unexpectedly: " . $err->getMessage());
+                            if (is_string($wanterr)) {
+                                // The CODE, not the message: make_error prefixes
+                                // and humanises the text, so matching it would
+                                // pass on any error that mentioned the word.
+                                //
+                                // `sdk_code`, not `code`: Exception::$code is a
+                                // protected int on every PHP throwable, so the
+                                // SDK carries its own string code beside it.
+                                $code = property_exists($err, 'sdk_code') ? $err->sdk_code : null;
+                                $this->assertSame($wanterr, $code,
+                                    "$label: wrong error code (" . $err->getMessage() . ')');
+                            }
                         }
                     }
-                }
 
-                $this->subset(self::record($client, $name), $kase['out'] ?? [],
-                    "$label: _$name");
-                $ran++;
+                    $this->subset(self::record($client, $name), $kase['out'] ?? [],
+                        "$label: _$name");
+                } catch (\Throwable $e) {
+                    $msg = $e->getMessage();
+                    $failed[] = str_starts_with($msg, $label) ? $msg : "$label: $msg";
+                }
             }
 
-            $this->assertGreaterThan(0, $ran, "every feature.$name case was skipped");
             // Say how many ran. A partial run is legitimate (an SDK with one
             // operation skips the cases needing two) but it should be visible
             // rather than inferred from a green tick.
             fwrite(STDERR, sprintf(
                 "feature.%s: ran %d of %d case(s) against %d operation(s)\n",
                 $name, $ran, count($cases), count($ops)));
+            if (0 === $ran) {
+                $failed[] = "every feature.$name case was skipped";
+            }
         }
+
+        $this->assertSame([], $failed, count($failed) . ' feature corpus case(s) failed');
     }
 }

package/project/.sdk/tm/php/test/FeatureTest.php

@@ -13,10 +13,9 @@ declare(strict_types=1);
 // with no live server and no API-specific fixtures. Mirrors
 // tm/ts/test/feature.test.ts + tm/ts/test/feature/harness.ts.
 //
-// Note: the generated PHP pipeline dispatches PrePoint..PreDone; the
-// PreUnexpected hook is dispatched here by the harness failure path (the
-// real pipeline raises via make_error before a PreUnexpected dispatch
-// point), which keeps the features' emit-once semantics covered.
+// Note: the harness failure path dispatches PreUnexpected, as make_error
+// and an operation's catch path do in the real pipeline, which keeps the
+// features' emit-once semantics covered.
 
 require_once __DIR__ . '/../projectname_sdk.php';
 
@@ -232,7 +231,7 @@ class FtHarness
         if ($op === 'create') {
             return 'POST';
         }
-        if ($op === 'update') {
+        if ($op === 'update' || $op === 'patch') {
             return 'PATCH';
         }
         if ($op === 'remove') {

package/project/.sdk/tm/php/test/PipelineTest.php

@@ -117,6 +117,20 @@ class PipelineTest extends TestCase
         return ($err instanceof ProjectNameError) ? $err->sdk_code : '';
     }
 
+    // An object is a map to the struct port, so it is a map to a cookie
+    // argument: its properties go out as pairs, read through the port.
+    public function test_prepare_headers_cookie_object(): void
+    {
+        $utility = self::utility();
+        $ctx = self::ctx([
+            'utility' => $utility,
+            'point' => ['args' => ['cookie' => [['name' => 'prefs', 'orig' => 'prefs', 'kind' => 'cookie']]]],
+            'reqmatch' => ['prefs' => (object) ['size' => 2, 'lang' => 'en gb']],
+        ]);
+        $headers = ($utility->prepare_headers)($ctx);
+        $this->assertSame('lang=en%20gb; size=2', $headers['cookie'] ?? null);
+    }
+
 
     // --- feature order (feature #2) -----------------------------------------
     // options['feature'] accepts an ordered LIST (developer add-order) or a map
@@ -750,7 +764,10 @@ class PipelineTest extends TestCase
         if ('' !== $cred['pair']) {
             // A cookie credential is a `<scheme>=<key>` pair, and the scheme
             // name leaves no room for the option's prefix.
-            $this->assertMatchesRegularExpression(self::COOKIE_PAIR, $cred['value']);
+            // preg_match rather than assertMatchesRegularExpression, which
+            // PHPUnit 8 does not have.
+            $this->assertSame(1, preg_match(self::COOKIE_PAIR, (string) $cred['value']),
+                (string) $cred['value']);
             return;
         }
         // A header credential is prefix-joined; a query credential is the raw

package/project/.sdk/tm/php/test/Runner.php

@@ -184,6 +184,92 @@ class ProjectNameTestRunner
         }
         return 500;
     }
+
+    /**
+     * A live check that did not pass, as main.kit.test.live.strict decides:
+     * strict fails the test, lenient skips it with the same reason.
+     */
+    public static function live_miss(bool $strict, string $reason): void
+    {
+        if ($strict) {
+            \PHPUnit\Framework\Assert::fail($reason);
+        }
+        \PHPUnit\Framework\Assert::markTestSkipped($reason);
+    }
+
+    /** An account holding no record for the test to read skips either way. */
+    public static function live_empty(string $reason): void
+    {
+        \PHPUnit\Framework\Assert::markTestSkipped($reason);
+    }
+
+    /** A live list response's records: the body, or the first list an envelope holds. */
+    public static function live_list($data): ?array
+    {
+        if (is_array($data) && array_is_list($data)) {
+            return $data;
+        }
+        if (is_array($data)) {
+            foreach ($data as $value) {
+                if (is_array($value) && array_is_list($value)) {
+                    return $value;
+                }
+            }
+        }
+        return null;
+    }
+
+    /** A live response for a message: the SDK's error, or its status and content type. */
+    public static function live_describe(array $result): string
+    {
+        $err = $result["err"] ?? null;
+        if ($err instanceof \Throwable) {
+            return $err->getMessage();
+        }
+        if (!empty($err)) {
+            return is_string($err) ? $err : json_encode($err);
+        }
+        $type = null;
+        foreach (($result["headers"] ?? []) as $k => $v) {
+            if (strtolower((string)$k) === "content-type") {
+                $type = trim(explode(";", (string)$v)[0]);
+            }
+        }
+        return "HTTP " . ($result["status"] ?? "none") . ($type ? " " . $type : "");
+    }
+
+    /**
+     * The record a create-less flow reads live: the first its list returns,
+     * put where the flow reads the fixture's existing records.
+     */
+    public static function live_existing(array &$setup, bool $strict, string $name, callable $list): void
+    {
+        $found = null;
+        try {
+            $found = $list();
+        } catch (\Throwable $e) {
+            self::live_miss($strict, "Live list discovery failed: " . $e->getMessage());
+        }
+        if (!is_array($found)) {
+            self::live_miss($strict, "Live list discovery returned no list");
+        }
+        if (0 === count($found)) {
+            self::live_empty("The account has no $name record to load");
+        }
+        $first = $found[0];
+        $setup["data"]["existing"][$name] = [
+            "live01" => (is_object($first) && method_exists($first, 'data_get')) ? $first->data_get() : $first,
+        ];
+    }
+
+    /** In a lenient live run a failing check skips, observing the live API. */
+    public static function live_observe(\Throwable $e, array $setup, bool $strict): void
+    {
+        if ($strict || empty($setup["live"]) || $e instanceof \PHPUnit\Framework\SkippedTest) {
+            throw $e;
+        }
+        \PHPUnit\Framework\Assert::markTestSkipped("live run, main.kit.test.live.strict is false: " . $e->getMessage());
+    }
 }
 
 // Aliases for test convenience.

package/project/.sdk/tm/php/utility/Clean.php

@@ -99,26 +99,31 @@ class ProjectNameClean
 
     // A feature's name is not a field name: only the sensitive names inside
     // its settings count, so `secrets` does not make every setting a secret.
-    // Entity blocks (per-entity settings, seeded records) hold no credential.
+    // Entity blocks (per-entity settings, seeded records) hold no credential,
+    // and nor do rbac's rules, keyed by entity and operation names.
     public static function add_options(?ProjectNameContext $ctx, array $opts): void
     {
         $feature = $opts['feature'] ?? null;
         unset($opts['feature'], $opts['entity']);
         if (array_key_exists('test', $opts)) {
-            $opts['test'] = self::no_entity($opts['test']);
+            $opts['test'] = self::plain_settings($opts['test'], null);
         }
         self::add_sensitive($ctx, $opts);
         $feature = is_object($feature) ? get_object_vars($feature) : $feature;
-        foreach (is_array($feature) ? $feature : [$feature] as $fopts) {
-            self::add_sensitive($ctx, self::no_entity($fopts));
+        foreach (is_array($feature) ? $feature : [$feature] as $fname => $fopts) {
+            self::add_sensitive($ctx, self::plain_settings($fopts, is_string($fname) ? $fname : null));
         }
     }
 
-    private static function no_entity(mixed $block): mixed
+    private static function plain_settings(mixed $block, ?string $name): mixed
     {
         $block = is_object($block) ? get_object_vars($block) : $block;
         if (is_array($block)) {
+            $name ??= is_string($block['name'] ?? null) ? $block['name'] : null;
             unset($block['entity']);
+            if ('rbac' === $name) {
+                unset($block['rules']);
+            }
         }
         return $block;
     }

package/project/.sdk/tm/php/utility/Fetcher.php

@@ -32,6 +32,9 @@ class ProjectNameFetcher
     {
         $method_str = strtoupper($fetchdef['method'] ?? 'GET');
         $body_str = $fetchdef['body'] ?? null;
+        if (is_resource($body_str)) {
+            $body_str = stream_get_contents($body_str);
+        }
         $headers = $fetchdef['headers'] ?? [];
 
         $header_lines = [];
@@ -83,8 +86,16 @@ class ProjectNameFetcher
         }
 
         $context = stream_context_create($opts);
+        error_clear_last();
         $response_body = @file_get_contents($fullurl, false, $context);
 
+        // A request that got no answer fails the operation. The stream
+        // wrapper's warning names the URL, which is left out.
+        if ($response_body === false) {
+            $warning = error_get_last()['message'] ?? 'request failed';
+            return [null, preg_replace('/^file_get_contents\(.*?\):\s*/', '', $warning)];
+        }
+
         $status = 0;
         $status_text = '';
         $resp_headers = [];
@@ -108,10 +119,13 @@ class ProjectNameFetcher
         }
 
         $json_body = null;
-        if ($response_body !== false && $response_body !== '') {
+        $unreadable = false;
+        if (trim($response_body) !== '') {
             $decoded = json_decode($response_body, true);
             if (json_last_error() === JSON_ERROR_NONE) {
                 $json_body = $decoded;
+            } else {
+                $unreadable = true;
             }
         }
 
@@ -121,7 +135,8 @@ class ProjectNameFetcher
                 'statusText' => $status_text,
                 'headers' => $resp_headers,
                 'json' => function () use ($json_body) { return $json_body; },
-                'body' => $response_body !== false ? $response_body : '',
+                'body' => $response_body,
+                'unreadable' => $unreadable,
             ],
             null,
         ];
@@ -201,10 +216,13 @@ class ProjectNameFetcher
         }
 
         $json_body = null;
-        if ($response_body !== '' && $response_body !== false) {
+        $unreadable = false;
+        if ($response_body !== false && trim((string)$response_body) !== '') {
             $decoded = json_decode($response_body, true);
             if (json_last_error() === JSON_ERROR_NONE) {
                 $json_body = $decoded;
+            } else {
+                $unreadable = true;
             }
         }
 
@@ -215,6 +233,7 @@ class ProjectNameFetcher
                 'headers' => $resp_kv,
                 'json' => function () use ($json_body) { return $json_body; },
                 'body' => (string)$response_body,
+                'unreadable' => $unreadable,
             ],
             null,
         ];
@@ -239,9 +258,10 @@ class ProjectNameFetcher
         // fall through to the default HTTP fetcher. The options builder
         // sometimes materializes `system.fetch` as an empty stdClass even
         // when the user didn't set one — that's a placeholder, not a value.
-        $is_empty_obj = ($sys_fetch instanceof \stdClass) && empty(get_object_vars($sys_fetch));
-        $is_empty_arr = is_array($sys_fetch) && empty($sys_fetch);
-        if ($sys_fetch === null || $is_empty_obj || $is_empty_arr) {
+        if (self::usesDefault($ctx)) {
+            if (null !== $ctx->spec) {
+                $ctx->spec->headers = self::sentHeaders($ctx->spec->headers);
+            }
             return self::defaultHttpFetch($fullurl, $fetchdef);
         }
         if (is_callable($sys_fetch)) {
@@ -250,4 +270,26 @@ class ProjectNameFetcher
 
         return [null, $ctx->make_error('fetch_invalid', 'system.fetch is not a valid function')];
     }
+
+    public static function usesDefault(ProjectNameContext $ctx): bool
+    {
+        $sys_fetch = \Voxgig\Struct\Struct::getpath($ctx->client->options_map(), 'system.fetch');
+        $is_empty_obj = ($sys_fetch instanceof \stdClass) && empty(get_object_vars($sys_fetch));
+        $is_empty_arr = is_array($sys_fetch) && empty($sys_fetch);
+        return $sys_fetch === null || $is_empty_obj || $is_empty_arr;
+    }
+
+    // The headers the default transport sends: the request's own, with its
+    // agent when they name none. A request's headers travel by value, so the
+    // transport cannot record the agent where the response is read.
+    public static function sentHeaders(array $headers): array
+    {
+        foreach ($headers as $k => $v) {
+            if (is_string($v) && strcasecmp((string)$k, 'user-agent') === 0) {
+                return $headers;
+            }
+        }
+        $headers['user-agent'] = self::DEFAULT_USER_AGENT;
+        return $headers;
+    }
 }

package/project/.sdk/tm/php/utility/MakeFetchDef.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 // ProjectName SDK utility: make_fetch_def
 
 require_once __DIR__ . '/../core/Result.php';
+require_once __DIR__ . '/Media.php';
 
 class ProjectNameMakeFetchDef
 {
@@ -28,7 +29,7 @@ class ProjectNameMakeFetchDef
 
         $fetchdef = ['url' => $url, 'method' => $spec->method, 'headers' => $spec->headers];
         if ($spec->body !== null) {
-            $fetchdef['body'] = is_array($spec->body) ? \Voxgig\Struct\Struct::jsonify($spec->body) : $spec->body;
+            $fetchdef['body'] = ProjectNameMedia::requestBody($ctx->point, $spec->body);
         }
 
         return [$fetchdef, null];

package/project/.sdk/tm/php/utility/MakePoint.php

@@ -4,9 +4,26 @@ declare(strict_types=1);
 // ProjectName SDK utility: make_point
 
 require_once __DIR__ . '/../core/Helpers.php';
+require_once __DIR__ . '/Param.php';
+require_once __DIR__ . '/PrepareMethod.php';
 
 class ProjectNameMakePoint
 {
+    // The path parameters of a point that neither the call nor the entity
+    // gives a value for, looked up as prepareParams looks them up.
+    private static function unfilled(ProjectNameContext $ctx, mixed $point): array
+    {
+        $parts = \Voxgig\Struct\Struct::getprop($point, 'parts');
+        $missing = [];
+        foreach (is_array($parts) ? $parts : [] as $part) {
+            if (is_string($part) && preg_match('/^\{([^{}\/]+)\}$/D', $part, $found) &&
+                null === ProjectNameParam::value($ctx, $point, $found[1])) {
+                $missing[] = $found[1];
+            }
+        }
+        return $missing;
+    }
+
     public static function call(ProjectNameContext $ctx): array
     {
         if (isset($ctx->out['point'])) {
@@ -24,10 +41,11 @@ class ProjectNameMakePoint
         $op = $ctx->op;
         $options = $ctx->options;
 
-        $allow_op = \Voxgig\Struct\Struct::getpath($options, 'allow.op') ?? '';
-        if (strpos($allow_op, $op->name) === false) {
+        $allow_op = \Voxgig\Struct\Struct::getpath($options, 'allow.op');
+        if (!ProjectNamePrepareMethod::allowed($allow_op, $op->name)) {
+            $shown = is_string($allow_op) ? $allow_op : '';
             return [null, $ctx->make_error('point_op_allow',
-                "Operation \"{$op->name}\" not allowed by SDK option allow.op value: \"{$allow_op}\"")];
+                "Operation \"{$op->name}\" not allowed by SDK option allow.op value: \"{$shown}\"")];
         }
 
         if (empty($op->points)) {
@@ -47,7 +65,9 @@ class ProjectNameMakePoint
                 $select_def = ProjectNameHelpers::to_map(\Voxgig\Struct\Struct::getprop($p, 'select'));
                 $found = true;
 
-                if ($selector && $select_def) {
+                // An empty stored match is falsy in PHP; the point's exist
+                // list is tested regardless.
+                if (null !== $selector && $select_def) {
                     $exist = \Voxgig\Struct\Struct::getprop($select_def, 'exist');
                     if (is_array($exist)) {
                         foreach ($exist as $ek) {
@@ -110,16 +130,40 @@ class ProjectNameMakePoint
                     $last = $parts[count($parts) - 1];
                     return is_string($last) && 0 === strpos($last, '{');
                 };
-                $point = $op->points[0];
-                foreach ($op->points as $p) {
-                    if ($terminal_param($p) !== $terminal_param($point)) {
-                        if ($terminal_param($p)) {
-                            $point = $p;
+                $own_point = function (array $points) use ($parts_len, $terminal_param) {
+                    $best = $points[0];
+                    foreach ($points as $p) {
+                        if ($terminal_param($p) !== $terminal_param($best)) {
+                            if ($terminal_param($p)) {
+                                $best = $p;
+                            }
+                        } elseif ($parts_len($p) < $parts_len($best)) {
+                            $best = $p;
                         }
-                    } elseif ($parts_len($p) < $parts_len($point)) {
-                        $point = $p;
                     }
+                    return $best;
+                };
+
+                // A call without an action falls back to a point without one,
+                // as generation does, and only to a route the call can fill.
+                $plain = array_values(array_filter($op->points, fn($p) => null ===
+                    \Voxgig\Struct\Struct::getprop(
+                        ProjectNameHelpers::to_map(\Voxgig\Struct\Struct::getprop($p, 'select')), '$action')));
+                if (0 === count($plain)) {
+                    return [null, $ctx->make_error('point_action_required',
+                        "Operation \"{$op->name}\" has only action endpoints; pass \$action to choose one.")];
+                }
+
+                $fillable = array_values(array_filter($plain,
+                    fn($p) => 0 === count(self::unfilled($ctx, $p))));
+
+                if (0 === count($fillable)) {
+                    return [null, $ctx->make_error('point_no_match',
+                        "Operation \"{$op->name}\" has no endpoint whose path parameters are all given (missing: " .
+                        implode(', ', self::unfilled($ctx, $own_point($plain))) . ").")];
                 }
+
+                $point = $own_point($fillable);
             }
 
             if ($reqselector) {

package/project/.sdk/tm/php/utility/MakeSpec.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 // ProjectName SDK utility: make_spec
 
 require_once __DIR__ . '/Graphql.php';
+require_once __DIR__ . '/PrepareMethod.php';
 
 require_once __DIR__ . '/../core/Spec.php';
 
@@ -12,6 +13,11 @@ class ProjectNameMakeSpec
     public static function call(ProjectNameContext $ctx): array
     {
         if (isset($ctx->out['spec'])) {
+            // A PreSpec hook (validate) rejects the operation by placing its
+            // error here; the pipeline raises it, and ctx->spec stays a spec.
+            if ($ctx->out['spec'] instanceof \Throwable) {
+                return [null, $ctx->out['spec']];
+            }
             $ctx->spec = $ctx->out['spec'];
             return [$ctx->spec, null];
         }
@@ -43,12 +49,12 @@ class ProjectNameMakeSpec
         // never a silently-allowed empty method.
         $method = ($utility->prepare_method)($ctx);
 
-        $allow_method = \Voxgig\Struct\Struct::getpath($options, 'allow.method') ?? '';
-        if (!is_string($method) || '' === $method
-            || strpos($allow_method, $method) === false) {
+        $allow_method = \Voxgig\Struct\Struct::getpath($options, 'allow.method');
+        if (!ProjectNamePrepareMethod::allowed($allow_method, $method)) {
             $shown = is_string($method) ? $method : '';
+            $list = is_string($allow_method) ? $allow_method : '';
             return [null, $ctx->make_error('spec_method_allow',
-                "Method \"{$shown}\" not allowed by SDK option allow.method value: \"{$allow_method}\"")];
+                "Method \"{$shown}\" not allowed by SDK option allow.method value: \"{$list}\"")];
         }
         $ctx->spec->method = $method;
 
@@ -78,11 +84,22 @@ class ProjectNameMakeSpec
             $ctx->ctrl->explain['spec'] = $ctx->spec;
         }
 
+        // Whatever prepare_auth sets in the query, under whichever name, is
+        // the credential; a key it leaves as it was is the caller's.
+        $query = $ctx->spec->query;
+
         [$spec, $err] = ($utility->prepare_auth)($ctx);
         if ($err) {
             return [null, $err];
         }
 
+        $spec->authquery = [];
+        foreach ($spec->query as $key => $val) {
+            if (!array_key_exists($key, $query) || $query[$key] !== $val) {
+                $spec->authquery[] = $key;
+            }
+        }
+
         $ctx->spec = $spec;
         return [$spec, null];
     }