@voxgig/sdkgen 4.34.0 → 4.34.2

package/project/.sdk/tm/c/core/helpers.c

@@ -4,6 +4,7 @@
 
 #include "sdk.h"
 
+#include <ctype.h>
 #include <stdarg.h>
 #include <stdio.h>   // snprintf
 #include <stdlib.h>
@@ -79,6 +80,26 @@ voxgig_value* getpath3(voxgig_value* store, const char* a, const char* b, const
   return getpath_c(store, keys);
 }
 
+bool allow_list_has(voxgig_value* names, const char* item) {
+  if (!voxgig_is_string(names) || NULL == item || '\0' == item[0]) return false;
+  size_t want = strlen(item);
+  const char* p = voxgig_as_string(names);
+  for (;;) {
+    const char* end = strchr(p, ',');
+    const char* s = p;
+    const char* e = end ? end : p + strlen(p);
+    while (s < e && isspace((unsigned char)*s)) s++;
+    while (e > s && isspace((unsigned char)e[-1])) e--;
+    if ((size_t)(e - s) == want) {
+      size_t i = 0;
+      while (i < want && toupper((unsigned char)s[i]) == toupper((unsigned char)item[i])) i++;
+      if (i == want) return true;
+    }
+    if (!end) return false;
+    p = end + 1;
+  }
+}
+
 void setp(voxgig_value* val, const char* key, voxgig_value* newval) {
   if (!val) return;
   voxgig_value* k = voxgig_new_string(key);

package/project/.sdk/tm/c/core/response.c

@@ -2,8 +2,13 @@
 
 #include "sdk.h"
 
+#include <ctype.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <strings.h>
+
+#define PREVIEW_LENGTH 160
 
 static char* dup_str(const char* s) {
   if (!s) s = "";
@@ -25,5 +30,103 @@ Response* response_new(voxgig_value* resmap) {
   r->json = getp(resmap, "json");
   r->body = getp(resmap, "body");
   r->err = NULL;
+  bool unreadable = false;
+  r->unreadable = get_bool(resmap, "unreadable", &unreadable) && unreadable;
   return r;
 }
+
+static const char* header_value(voxgig_value* headers, const char* name) {
+  if (v_is_map(headers)) {
+    voxgig_map* m = voxgig_as_map(headers);
+    for (size_t i = 0; i < m->len; i++) {
+      if (strcasecmp(m->entries[i].key, name) == 0 && voxgig_is_string(m->entries[i].value)) {
+        return voxgig_as_string(m->entries[i].value);
+      }
+    }
+  }
+  return "";
+}
+
+static bool names_json(const char* type) {
+  for (; *type; type++) {
+    if (strncasecmp(type, "json", 4) == 0) return true;
+  }
+  return false;
+}
+
+// Whitespace runs as one space, trimmed. Returns malloc'd.
+static char* flatten_space(const char* s) {
+  char* out = (char*)malloc(strlen(s) + 1);
+  size_t j = 0;
+  bool space = false;
+  for (; *s; s++) {
+    if (isspace((unsigned char)*s)) {
+      space = 0 < j;
+      continue;
+    }
+    if (space) {
+      out[j++] = ' ';
+      space = false;
+    }
+    out[j++] = *s;
+  }
+  out[j] = '\0';
+  return out;
+}
+
+// Cleaned whole: a secret the bound would split could leave its prefix.
+static char* body_preview(Context* ctx, voxgig_value* text) {
+  char* raw = voxgig_is_string(text) ? dup_str(voxgig_as_string(text)) : voxgig_stringify(text, -1);
+  char* spaced = flatten_space(raw);
+  char* flat = clean_str(ctx, spaced);
+  free(raw);
+  free(spaced);
+  size_t points = 0;
+  for (size_t i = 0; flat[i]; i++) {
+    if (((unsigned char)flat[i] & 0xC0) == 0x80) continue;
+    if (points == PREVIEW_LENGTH) {
+      char* out = (char*)malloc(i + 4);
+      memcpy(out, flat, i);
+      memcpy(out + i, "...", 4);
+      free(flat);
+      return out;
+    }
+    points++;
+  }
+  return flat;
+}
+
+PNError* unreadable_body(Context* ctx, int64_t status, voxgig_value* headers,
+                         voxgig_value* text, voxgig_value* sent, PNError* failed) {
+  const char* type = header_value(headers, "content-type");
+  char* agent = clean_str(ctx, header_value(sent, "user-agent"));
+  char* preview = (v_is_noval(text) || v_is_null(text)) ? NULL : body_preview(ctx, text);
+
+  size_t size = strlen(type) + strlen(agent) + (preview ? strlen(preview) : 0) + 128;
+  char* detail = (char*)malloc(size);
+  snprintf(detail, size, "HTTP %lld, content-type %s, user-agent %s%s%s", (long long)status,
+    '\0' == type[0] ? "none" : type, '\0' == agent[0] ? "transport default" : agent,
+    preview ? ", body: " : "", preview ? preview : "");
+  free(agent);
+  free(preview);
+
+  PNError* out = failed;
+  size_t n = strlen(type) + strlen(detail) + (failed ? strlen(failed->msg) : 0) + 64;
+  char* msg = (char*)malloc(n);
+  if (failed) {
+    snprintf(msg, n, "%s (%s)", failed->msg, detail);
+    free(failed->msg);
+    failed->msg = msg;
+  } else {
+    bool json = '\0' == type[0] || names_json(type);
+    if (json) {
+      snprintf(msg, n, "response: body is not valid JSON (%s)", detail);
+    } else {
+      snprintf(msg, n, "response: expected JSON, got %s (%s)", type, detail);
+    }
+    out = context_make_error(ctx, json ? "response_json_invalid" : "response_content_type", msg);
+    free(msg);
+  }
+  free(detail);
+  return out;
+}

package/project/.sdk/tm/c/core/sdk.h

@@ -87,6 +87,8 @@ voxgig_value* getpath_c(voxgig_value* store, const char** keys);
 // Convenience: up to a few string keys.
 voxgig_value* getpath2(voxgig_value* store, const char* a, const char* b);
 voxgig_value* getpath3(voxgig_value* store, const char* a, const char* b, const char* c);
+// Whether a comma-separated allow option names the item: whole names, any case.
+bool allow_list_has(voxgig_value* names, const char* item);
 // Property write (no-op when val is not a node). Borrows newval.
 void setp(voxgig_value* val, const char* key, voxgig_value* newval);
 
@@ -201,10 +203,14 @@ struct Spec {
   voxgig_value* body;
   char* url;
   char* path;
+  // List: the query parameters prepare_auth placed, the credential the
+  // request sends and the entity's match leaves out.
+  voxgig_value* authquery;
 };
 
 Spec* spec_new(voxgig_value* specmap);
 voxgig_value* spec_to_value(Spec* s);
+bool spec_authquery_has(Spec* s, const char* key);
 // mutable string setters (free old, dup new)
 void spec_set_step(Spec* s, const char* v);
 void spec_set_method(Spec* s, const char* v);
@@ -222,10 +228,18 @@ struct Response {
   voxgig_value* json;
   voxgig_value* body;
   PNError* err;
+  // Set by a transport that could not read a non-blank body as JSON.
+  bool unreadable;
 };
 
 Response* response_new(voxgig_value* resmap);
 
+// A body that is not JSON. An HTTP failure keeps its own error (failed, whose
+// message is extended in place), with the response described; otherwise the
+// code tells a wrong content type from malformed JSON.
+PNError* unreadable_body(Context* ctx, int64_t status, voxgig_value* headers,
+                         voxgig_value* text, voxgig_value* sent, PNError* failed);
+
 // ===========================================================================
 // SdkResult (mirrors core/result.rs)
 // ===========================================================================
@@ -333,6 +347,7 @@ typedef struct EntityVT {
   Entity** (*list)(Entity*, voxgig_value* reqmatch, voxgig_value* ctrl, PNError** err);
   Entity* (*create)(Entity*, voxgig_value* reqdata, voxgig_value* ctrl, PNError** err);
   Entity* (*update)(Entity*, voxgig_value* reqdata, voxgig_value* ctrl, PNError** err);
+  Entity* (*patch)(Entity*, voxgig_value* reqdata, voxgig_value* ctrl, PNError** err);
   Entity* (*remove)(Entity*, voxgig_value* reqmatch, voxgig_value* ctrl, PNError** err);
 } EntityVT;
 
@@ -515,8 +530,19 @@ voxgig_value* make_point_util(Context* ctx, PNError** err);
 Spec* make_spec_util(Context* ctx, PNError** err);
 char* make_url_util(Context* ctx, PNError** err); // malloc'd
 voxgig_value* param_util(Context* ctx, voxgig_value* paramdef);
+voxgig_value* param_value(Context* ctx, voxgig_value* point, const char* key);
+voxgig_value* call_args(Context* ctx, const char* kind); // list of [name, wire, val]
 Spec* prepare_auth_util(Context* ctx, PNError** err);
 voxgig_value* prepare_body_util(Context* ctx);
+// The caller's cookie pieces with every owned cookie removed (utility/prepare_headers.c).
+char* cookie_keep(const char* header, bool (*named)(const char* name, size_t nlen, void* ud), void* ud); // malloc'd, NULL when none
+// The media types a point declares (utility/media.c).
+bool media_is_json(const char* media);
+char* media_accept_of(voxgig_value* point);
+bool media_is_raw_request(voxgig_value* point);
+bool media_is_json_request(voxgig_value* point);
+void media_headers(voxgig_value* point, voxgig_value* headers);
+voxgig_value* media_raw_body(voxgig_value* reqdata);
 voxgig_value* prepare_headers_util(Context* ctx);
 const char* prepare_method_util(Context* ctx); // static string
 voxgig_value* prepare_params_util(Context* ctx);

package/project/.sdk/tm/c/core/spec.c

@@ -38,6 +38,7 @@ Spec* spec_new(voxgig_value* specmap) {
   s->body = voxgig_new_undef();
   s->url = dup_str("");
   s->path = dup_str("");
+  s->authquery = voxgig_new_list();
 
   if (!voxgig_is_map(specmap)) return s;
 
@@ -92,3 +93,12 @@ voxgig_value* spec_to_value(Spec* s) {
   if (s->url[0] != '\0') setp(out, "url", v_str(s->url));
   return out;
 }
+
+bool spec_authquery_has(Spec* s, const char* key) {
+  if (!s || !v_is_list(s->authquery)) return false;
+  voxgig_list* names = voxgig_as_list(s->authquery);
+  for (size_t i = 0; i < names->len; i++) {
+    if (v_str_eq(names->items[i], key)) return true;
+  }
+  return false;
+}

package/project/.sdk/tm/c/feature/test.c

@@ -10,6 +10,36 @@
 #include <stdlib.h>
 #include <string.h>
 
+// The key a list's response transform
+// ["`$EACH`", "body", {"`$MERGE`": "`.<key>`"}] reads each item's record under,
+// copied into buf; NULL for any other transform.
+static const char* item_envelope_key(voxgig_value* restf, char* buf, size_t cap) {
+  if (!voxgig_is_list(restf)) {
+    return NULL;
+  }
+  voxgig_list* spec = voxgig_as_list(restf);
+  if (3 != spec->len || !v_str_eq(spec->items[0], "`$EACH`") ||
+      !v_str_eq(spec->items[1], "body")) {
+    return NULL;
+  }
+  const char* merge = get_str(spec->items[2], "`$MERGE`");
+  if (NULL == merge) {
+    return NULL;
+  }
+  size_t n = strlen(merge);
+  if (n < 4 || 0 != strncmp(merge, "`.", 2) || '`' != merge[n - 1] || n - 3 >= cap) {
+    return NULL;
+  }
+  for (size_t i = 2; i < n - 1; i++) {
+    if ('.' == merge[i] || '`' == merge[i] || '$' == merge[i]) {
+      return NULL;
+    }
+  }
+  memcpy(buf, merge + 2, n - 3);
+  buf[n - 3] = '\0';
+  return buf;
+}
+
 // THE MOCK HAS TO AGREE WITH THE MODEL.
 //
 // A point carrying `transform.res: `body.item`` describes an API that answers
@@ -26,6 +56,16 @@ static voxgig_value* envelope(Context* ctx, voxgig_value* data) {
     return data;
   }
   voxgig_value* tm = getp(ctx->point, "transform");
+  char keybuf[256];
+  const char* key = item_envelope_key(getp(tm, "res"), keybuf, sizeof(keybuf));
+  if (NULL != key && voxgig_is_list(data)) {
+    voxgig_list* items = voxgig_as_list(data);
+    voxgig_value* out = v_list();
+    for (size_t i = 0; i < items->len; i++) {
+      voxgig_list_push(voxgig_as_list(out), cmap(1, key, items->items[i]));
+    }
+    return out;
+  }
   const char* spec = get_str(tm, "res");
   if (NULL == spec) {
     return data;
@@ -226,7 +266,7 @@ static voxgig_value* test_fetch(voxgig_value* entity, Context* ctx, const char*
     return respond(ctx, 200, voxgig_clone(found));
   }
 
-  if (strcmp(opname, "update") == 0) {
+  if (strcmp(opname, "update") == 0 || strcmp(opname, "patch") == 0) {
     // Match the existing entity by id only (or its alias); reqdata's new
     // field values would otherwise cause select to filter it out.
     voxgig_value* reqdata = ctx->reqdata;
@@ -254,7 +294,10 @@ static voxgig_value* test_fetch(voxgig_value* entity, Context* ctx, const char*
       return r;
     }
     if (voxgig_is_map(ent) && voxgig_is_map(reqdata)) {
-      ent = voxgig_merge(clist(2, v_share(ent), v_share(reqdata)), VOXGIG_MAXDEPTH);
+      // `$body` travels on the wire alone; the record is the rest.
+      voxgig_value* rec = voxgig_clone(reqdata);
+      voxgig_delprop(rec, v_str("$body"));
+      ent = voxgig_merge(clist(2, v_share(ent), rec), VOXGIG_MAXDEPTH);
     }
     voxgig_delprop(ent, v_str("$KEY"));
     return respond(ctx, 200, voxgig_clone(ent));
@@ -289,6 +332,7 @@ static voxgig_value* test_fetch(voxgig_value* entity, Context* ctx, const char*
 
     voxgig_value* ent = voxgig_clone(ctx->reqdata);
     if (voxgig_is_map(ent)) {
+      voxgig_delprop(ent, v_str("$body"));
       setp(ent, "id", id);
       if (voxgig_is_string(id)) {
         setp(entmap, voxgig_as_string(id), ent);

package/project/.sdk/tm/c/feature/validate.c

@@ -128,6 +128,8 @@ static voxgig_value* validate_payload(Context* ctx, const char* opname) {
   // fields will never name it - and under `strict` every custom-action call
   // would be rejected for the one key that made it reachable.
   voxgig_map_erase(voxgig_as_map(out), "$action");
+  // Nor is `$body`, the raw request body.
+  voxgig_map_erase(voxgig_as_map(out), "$body");
 
   return out;
 }

package/project/.sdk/tm/c/tests/feature_harness.h

@@ -224,7 +224,7 @@ typedef struct {
 
 FH const char* fh_default_method(const char* op) {
   if (strcmp(op, "create") == 0) return "POST";
-  if (strcmp(op, "update") == 0) return "PATCH";
+  if (strcmp(op, "update") == 0 || strcmp(op, "patch") == 0) return "PATCH";
   if (strcmp(op, "remove") == 0) return "DELETE";
   return "GET";
 }

package/project/.sdk/tm/c/tests/primary_utility_test.c

@@ -481,10 +481,14 @@ static void test_primary_feature_init_inactive(void) {
   CHECK(!init_called, "feature_init skips inactive feature");
 }
 
+// Concrete base: a live construction must satisfy any server variables a
+// templated base URL declares; a literal base sidesteps the requirement.
+#define PU_LIVE_BASE "http://localhost:8080"
+
 static void test_primary_fetcher_live(void) {
   voxgig_value* calls = v_list();
-  ProjectNameSDK* live = projectname_sdk_new(
-      cmap(1, "system", cmap(1, "fetch", vfn(pu_sysfetch, calls))));
+  ProjectNameSDK* live = projectname_sdk_new(cmap(2, "base", v_str(PU_LIVE_BASE),
+      "system", cmap(1, "fetch", vfn(pu_sysfetch, calls))));
   Utility* util = sdk_get_utility(live);
   CtxSpec cs;
   memset(&cs, 0, sizeof(cs));
@@ -503,8 +507,8 @@ static void test_primary_fetcher_live(void) {
 }
 
 static void test_primary_fetcher_blocked_test_mode(void) {
-  ProjectNameSDK* blocked = projectname_sdk_new(
-      cmap(1, "system", cmap(1, "fetch", vfn(pu_sysfetch, v_list()))));
+  ProjectNameSDK* blocked = projectname_sdk_new(cmap(2, "base", v_str(PU_LIVE_BASE),
+      "system", cmap(1, "fetch", vfn(pu_sysfetch, v_list()))));
   free(blocked->mode);
   blocked->mode = strdup("test");
   Utility* util = sdk_get_utility(blocked);
@@ -524,7 +528,7 @@ static void test_primary_fetcher_blocked_test_mode(void) {
 }
 
 static void test_primary_new_sdk_smoke(void) {
-  ProjectNameSDK* client = projectname_sdk_new(v_undef());
+  ProjectNameSDK* client = projectname_sdk_new(cmap(1, "base", v_str(PU_LIVE_BASE)));
   CHECK_STR_EQ(client->mode, "live", "new sdk mode live");
 }
 

package/project/.sdk/tm/c/tests/server_variable_test.c

@@ -0,0 +1,80 @@
+// A templated base URL takes each {name} from the `server` option. A missing
+// or empty value stops construction; test mode fills in test-<name>.
+
+#include "ctest.h"
+
+#include <stdlib.h>
+
+#ifndef _WIN32
+#include <sys/resource.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
+
+// A variable no API declares, so the API's own server defaults cannot fill it.
+#define BASE "https://api.example.test/bot{zzvar}"
+
+static const char* base_of(ProjectNameSDK* sdk) {
+  return get_str(sdk_options_map(sdk), "base");
+}
+
+#ifndef _WIN32
+// Construction stops the process, so it runs in a child: what it printed is
+// read back, and the status says whether construction returned.
+static const char* construct_in_child(voxgig_value* server, int* status) {
+  static char buf[4096];
+  int fds[2];
+  if (0 != pipe(fds)) return NULL;
+  fflush(NULL);
+  pid_t pid = fork();
+  if (0 == pid) {
+    struct rlimit nocore = {0, 0};
+    setrlimit(RLIMIT_CORE, &nocore);
+    dup2(fds[1], 2);
+    close(fds[0]);
+    projectname_sdk_new(cmap(2, "base", v_str(BASE), "server", server));
+    _exit(0);
+  }
+  close(fds[1]);
+  size_t len = 0;
+  ssize_t n;
+  while (0 < (n = read(fds[0], buf + len, sizeof(buf) - 1 - len))) len += (size_t)n;
+  buf[len] = '\0';
+  close(fds[0]);
+  waitpid(pid, status, 0);
+  return buf;
+}
+#endif
+
+int main(void) {
+#ifndef _WIN32
+  voxgig_value* servers[2] = { v_map(), cmap(1, "zzvar", v_str("")) };
+  for (int i = 0; i < 2; i++) {
+    int status = 0;
+    const char* err = construct_in_child(servers[i], &status);
+    CHECK(NULL != err, "the construction could be run in a child process");
+    CHECK(!(WIFEXITED(status) && 0 == WEXITSTATUS(status)),
+          "construction stops without a value for zzvar");
+    CHECK(err && strstr(err, "the server variable 'zzvar' is required"),
+          "the error names the variable");
+    CHECK(err && strstr(err, BASE), "the error quotes the base URL");
+  }
+#else
+  printf("server_variable_test: no fork() here, so the stopped construction is not run\n");
+#endif
+
+  ProjectNameSDK* filled = projectname_sdk_new(cmap(2,
+    "base", v_str(BASE), "server", cmap(1, "zzvar", v_str("T1"))));
+  CHECK_STR_EQ(base_of(filled), "https://api.example.test/botT1", "a server value fills the base");
+
+  ProjectNameSDK* testmode = projectname_sdk_new(cmap(2,
+    "base", v_str(BASE), "test", cmap(1, "active", v_bool(true))));
+  CHECK_STR_EQ(base_of(testmode), "https://api.example.test/bottest-zzvar",
+               "the test option fills test-<name>");
+
+  ProjectNameSDK* mock = test_sdk(NULL, cmap(1, "base", v_str(BASE)));
+  CHECK_STR_EQ(base_of(mock), "https://api.example.test/bottest-zzvar",
+               "the test feature fills test-<name>");
+
+  TEST_SUMMARY("server_variable_test");
+}

package/project/.sdk/tm/c/utility/make_fetch_def.c

@@ -28,9 +28,13 @@ voxgig_value* make_fetch_def_util(Context* ctx, PNError** err) {
   setp(fetchdef, "method", v_str(spec->method));
   setp(fetchdef, "headers", v_share(spec->headers));
 
+  // A map or a list is JSON, and so is a scalar on a point that declares a
+  // JSON body. Anything else goes as given.
   voxgig_value* body = spec->body;
   if (!v_is_noval(body)) {
-    if (voxgig_is_map(body)) {
+    bool scalar = voxgig_is_string(body) || voxgig_is_number(body) || voxgig_is_bool(body);
+    bool encode = voxgig_is_node(body) || (scalar && media_is_json_request(ctx->point));
+    if (encode) {
       char* js = voxgig_jsonify(body, NULL);
       setp(fetchdef, "body", v_str(js ? js : ""));
       free(js);

package/project/.sdk/tm/c/utility/make_options.c

@@ -2,6 +2,7 @@
 
 #include "sdk.h"
 
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -9,13 +10,15 @@ static int mo_cmp_cstr(const void* a, const void* b) {
   return strcmp(*(const char* const*)a, *(const char* const*)b);
 }
 
-static voxgig_value* mo_noentity(voxgig_value* val) {
+static voxgig_value* mo_plain(voxgig_value* val, const char* name) {
   if (!voxgig_is_map(val)) return voxgig_retain(val);
   voxgig_value* out = v_map();
   voxgig_map* m = voxgig_as_map(val);
+  int rbac = NULL != name && 0 == strcmp(name, "rbac");
   for (size_t i = 0; i < m->len; i++) {
-    if (0 != strcmp(m->entries[i].key, "entity")) {
-      setp(out, m->entries[i].key, voxgig_retain(m->entries[i].value));
+    const char* k = m->entries[i].key;
+    if (0 != strcmp(k, "entity") && !(rbac && 0 == strcmp(k, "rules"))) {
+      setp(out, k, voxgig_retain(m->entries[i].value));
     }
   }
   return out;
@@ -24,7 +27,8 @@ static voxgig_value* mo_noentity(voxgig_value* val) {
 // The options to scan for secrets. The feature map is keyed by feature
 // names, not field names, so it is scanned as a list: `secrets` must not
 // make every setting of that feature a secret. Entity blocks hold entity
-// settings and seeded records, never a credential, so none is scanned.
+// settings and seeded records, never a credential, so none is scanned, and
+// nor are rbac's rules, keyed by entity and operation names.
 static voxgig_value* mo_without(voxgig_value* val, const char* k1, const char* k2) {
   voxgig_value* out = v_map();
   if (!voxgig_is_map(val)) return out;
@@ -38,11 +42,11 @@ static voxgig_value* mo_without(voxgig_value* val, const char* k1, const char* k
       voxgig_value* list = v_list();
       voxgig_map* fm = voxgig_as_map(v);
       for (size_t f = 0; f < fm->len; f++) {
-        voxgig_list_push(voxgig_as_list(list), mo_noentity(fm->entries[f].value));
+        voxgig_list_push(voxgig_as_list(list), mo_plain(fm->entries[f].value, fm->entries[f].key));
       }
       v = list;
     } else if (0 == strcmp(k, "test")) {
-      v = mo_noentity(v);
+      v = mo_plain(v, NULL);
     } else {
       voxgig_retain(v);
     }
@@ -58,6 +62,78 @@ static voxgig_value* mo_clean_block(voxgig_value* opts) {
   return voxgig_is_map(block) ? voxgig_clone(block) : v_map();
 }
 
+static bool mo_true(voxgig_value* v) {
+  return voxgig_is_bool(v) && voxgig_as_bool(v);
+}
+
+static bool mo_namechar(char c) {
+  return ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z') || ('0' <= c && c <= '9') || '_' == c;
+}
+
+static void mo_append(char** out, size_t* len, size_t* cap, const char* s, size_t n) {
+  while (*len + n + 1 > *cap) {
+    *cap *= 2;
+    *out = (char*)realloc(*out, *cap);
+  }
+  memcpy(*out + *len, s, n);
+  *len += n;
+  (*out)[*len] = '\0';
+}
+
+/* A templated base URL takes each {name} from options.server. An empty value
+ * cannot make a working URL, so construction stops, as a rust or zig panic
+ * does, except in test mode, where it becomes test-<name>. */
+static void mo_resolve_base(voxgig_value* opts, voxgig_value* config) {
+  const char* base = get_str(opts, "base");
+  if (NULL == base || NULL == strchr(base, '{')) return;
+
+  bool testmode = mo_true(getpath2(opts, "test", "active"))
+    || mo_true(getpath3(opts, "feature", "test", "active"));
+  voxgig_value* server = to_map(getp(opts, "server"));
+  const char* sdkname = get_str(getp(config, "main"), "name");
+  if (NULL == sdkname || '\0' == sdkname[0]) sdkname = "SDK";
+
+  size_t blen = strlen(base);
+  size_t len = 0;
+  size_t cap = blen + 1;
+  char* out = (char*)malloc(cap);
+  out[0] = '\0';
+  size_t i = 0;
+  while (i < blen) {
+    size_t j = i + 1;
+    if ('{' == base[i]) {
+      while (j < blen && mo_namechar(base[j])) j++;
+    }
+    // A placeholder only when it closes and the name is [A-Za-z0-9_]+.
+    if ('{' != base[i] || j == i + 1 || j >= blen || '}' != base[j]) {
+      mo_append(&out, &len, &cap, base + i, 1);
+      i++;
+      continue;
+    }
+    size_t nlen = j - i - 1;
+    char* name = (char*)malloc(nlen + 1);
+    memcpy(name, base + i + 1, nlen);
+    name[nlen] = '\0';
+    const char* val = get_str(server, name);
+    if (NULL != val && '\0' != val[0]) {
+      mo_append(&out, &len, &cap, val, strlen(val));
+    } else if (testmode) {
+      mo_append(&out, &len, &cap, "test-", 5);
+      mo_append(&out, &len, &cap, name, nlen);
+    } else {
+      fprintf(stderr, "%s: the server variable '%s' is required: the API base URL is '%s'"
+              " - pass cmap(1, \"server\", cmap(1, \"%s\", v_str(\"...\"))) in the SDK options\n",
+              sdkname, name, base, name);
+      fflush(stderr);
+      abort();
+    }
+    free(name);
+    i = j + 1;
+  }
+  setp(opts, "base", v_str(out));
+  free(out);
+}
+
 voxgig_value* make_options_util(Context* ctx) {
   voxgig_value* options = voxgig_is_map(ctx->options) ? ctx->options : voxgig_new_map();
 
@@ -180,6 +256,8 @@ voxgig_value* make_options_util(Context* ctx) {
     }
   }
 
+  mo_resolve_base(opts, config);
+
   // Resolve the feature add-order: an explicit list order (above) wins;
   // otherwise order the map test-first, then the remaining names sorted, so
   // the outcome is deterministic and `test` is always the base transport.