@voxgig/sdkgen 4.4.1 → 4.5.1

package/project/.sdk/src/cmp/seneca-provider/Extras_seneca-provider.ts

@@ -17,6 +17,18 @@ import {
 // generated provider is verified without a server.
 
 
+// Does this entity's load op have a real identifying param (path or
+// required query), e.g. GET /result?trace_id=? A paramless GET has none.
+function loadHasKey(ent: any): boolean {
+  const point = (ent.op && ent.op.load && ent.op.load.points || [])[0]
+  if (null == point) return false
+  const hasPathParam = (point.parts || []).some((p: string) => p.startsWith('{'))
+  const hasQueryParam = (point.args && point.args.query || [])
+    .some((q: any) => false !== q.reqd)
+  return hasPathParam || hasQueryParam
+}
+
+
 // The name of the entity a parent path param addresses, or '' when the model
 // has none of that name.
 //
@@ -458,7 +470,12 @@ describe('${provider.fileBase}', () => {
     )
   })
 
-
+`)
+          // Paramless read (e.g. GET /usage): every id "misses" the same
+          // way a hit does -- the mock has nothing to filter by -- so a
+          // load-missing test would just assert the happy path again.
+          if (loadHasKey(e.ent)) {
+            Content(`
   // A 404 from a single-item read is an ordinary "not found" answer, not a
   // failure: the provider turns it into null rather than letting the SDK
   // throw.
@@ -472,6 +489,7 @@ describe('${provider.fileBase}', () => {
   })
 
 `)
+          }
         }
       })
 

package/project/.sdk/src/cmp/seneca-provider/Main_seneca-provider.ts

@@ -4,7 +4,7 @@ import {
   entityCollection, entityOps, entityIdField, entityClassName,
   opRequestShape, opParams, ownPoint, entityPath,
   collectDeps, repoInfo, packageName, packageVersion, apiName, envName,
-  authorInfo, contributorList, isAuthActive, jsKey, jsProp,
+  authorInfo, contributorList, isAuthActive, isHttpBasicAuth, jsKey, jsProp,
   SdkGenError,
   PUBLISHER, PUBLISHER_URL,
 } from '@voxgig/sdkgen'
@@ -108,6 +108,14 @@ function recordKey(ent: any): string {
     if (null != lastParam) {
       return lastParam.slice(1, -1)
     }
+
+    // No path param at all (e.g. GET /scan/async/result?trace_id=...): the
+    // record's own key can still be a single required QUERY param.
+    const query = (point && point.args && point.args.query) || []
+    const reqdQuery = query.filter((q: any) => false !== q.reqd)
+    if (1 === reqdQuery.length) {
+      return String(reqdQuery[0].name)
+    }
   }
 
   return 'id'
@@ -462,6 +470,13 @@ const Main = cmp(function Main(props: any) {
     // model and strips the authorization header regardless of options, so
     // plumbing one anyway produces a credential path that cannot work.
     authActive: isAuthActive(model),
+    // Whether this API's scheme is genuine HTTP Basic Auth (two credentials,
+    // base64-joined), matching the SDK's own auth.basic signal. Decides
+    // whether the plugin also plumbs a `secret` alongside `apikey` — a
+    // Basic-Auth SDK's own auth stage deletes the header when either is
+    // missing, so a provider forwarding apikey alone could never
+    // authenticate, the same class of gap `apikey`-only forwarding was.
+    authBasic: isAuthActive(model) && isHttpBasicAuth(model),
   }
 
   // `.gitignore` is EMITTED rather than copied — npm strips that filename
@@ -895,7 +910,17 @@ ${provider.authActive ? `
     if (null != apikey && '' !== apikey) {
       sdkopts.apikey = apikey
     }
-` : `
+${provider.authBasic ? `
+    // Genuine HTTP Basic Auth needs a SECOND credential (the SDK sends
+    // \`Authorization: Basic base64(apikey:secret)\`) — without it the SDK's
+    // auth stage treats the pair as incomplete and deletes the header, same
+    // as a missing apikey.
+    const secret = res?.keymap?.secret?.value
+
+    if (null != secret && '' !== secret) {
+      sdkopts.secret = secret
+    }
+` : ''}` : `
     // This API declares no authentication, so no credential is plumbed. The
     // SDK's auth stage emits nothing for an auth-inactive model and deletes
     // any \`authorization\` header regardless of options, so a keymap lookup

package/project/.sdk/src/cmp/swift/ReadmeRef_swift.ts

@@ -1,5 +1,6 @@
 
 import { cmp, each, Content, canonToType, canonKey, canonScalarKey, File, isAuthActive, entityIdField, opRequestShape } from '@voxgig/sdkgen'
+import { ReadmeRefFeatures } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -376,6 +377,10 @@ let client = ${SDK}(options)
 \`\`\`
 
 `)
+      // The shared feature reference: options, defaults, usage and the
+      // considerations. Model facts, identical in every target, so they are
+      // written once in cmp/ReadmeRefFeatures.ts rather than here.
+      ReadmeRefFeatures({ target })
     }
 
   })

package/project/.sdk/src/cmp/ts/Config_ts.ts

@@ -15,6 +15,7 @@ import {
   indent,
   isAuthActive,
   isConfigData,
+  isHttpBasicAuth,
   resolveAuthPrefix,
   serverVariables,
 } from '@voxgig/sdkgen'
@@ -49,9 +50,11 @@ const Config = cmp(async function Config(props: any) {
   const authActive = isAuthActive(model)
   // config.auth.prefix override -> spec-derived info.security.prefix -> 'Bearer'
   const authPrefix = resolveAuthPrefix(model)
+  const authBasic = isHttpBasicAuth(model)
   const authBlock = authActive
     ? `auth: {
-      prefix: '${authPrefix}',
+      prefix: '${authPrefix}',${authBasic ? `
+      basic: true,` : ''}
     },
 
     `

package/project/.sdk/src/cmp/ts/ReadmeHowto_ts.ts

@@ -1,5 +1,5 @@
 
-import { cmp, Content, isAuthActive, envName, entityIdField, entityDataIdField, pickExampleEntity, opRequestShape, safeVarName, exampleVarName, jsKey } from '@voxgig/sdkgen'
+import { cmp, Content, isAuthActive, isHttpBasicAuth, envName, entityIdField, entityDataIdField, pickExampleEntity, opRequestShape, safeVarName, exampleVarName, jsKey } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -92,11 +92,16 @@ ${stateDataLine}
     : ''
 
   const authActive = isAuthActive(model)
+  const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyTesterCtor = authActive
-    ? `new ${model.const.Name}SDK({ apikey: '...' })`
+    ? `new ${model.const.Name}SDK({ apikey: '...'${authBasic ? `, secret: '...'` : ''} })`
     : `new ${model.const.Name}SDK()`
-  const apikeyExtendField = authActive ? `\n  apikey: '...',` : ''
-  const apikeyEnvLine = authActive ? `\n${envName(model)}_APIKEY=<your-key>` : ''
+  const apikeyExtendField = authActive
+    ? `\n  apikey: '...',${authBasic ? `\n  secret: '...',` : ''}`
+    : ''
+  const apikeyEnvLine = authActive
+    ? `\n${envName(model)}_APIKEY=<your-key>${authBasic ? `\n${envName(model)}_SECRET=<your-secret>` : ''}`
+    : ''
 
   Content(`### Make a direct HTTP request
 

package/project/.sdk/src/cmp/ts/ReadmeModel_ts.ts

@@ -1,5 +1,5 @@
 
-import { cmp, each, Content, isAuthActive } from '@voxgig/sdkgen'
+import { cmp, each, Content, isAuthActive, isHttpBasicAuth } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -51,17 +51,22 @@ const ReadmeModel = cmp(function ReadmeModel(props: any) {
   const returnBullets = retBullets.join('\n')
 
   const authActive = isAuthActive(model)
+  const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyOptionType = authActive ? `\n  apikey?: string` : ''
+  const secretOptionType = authBasic ? `\n  secret?: string` : ''
   const apikeyOptionRow = authActive
     ? '| `apikey` | `string` | API key for authentication. |\n'
     : ''
+  const secretOptionRow = authBasic
+    ? '| `secret` | `string` | API secret for authentication. |\n'
+    : ''
 
   Content(`### ${model.const.Name}SDK
 
 #### Constructor
 
 \`\`\`ts
-new ${model.const.Name}SDK(options?: {${apikeyOptionType}
+new ${model.const.Name}SDK(options?: {${apikeyOptionType}${secretOptionType}
   base?: string
   prefix?: string
   suffix?: string
@@ -72,7 +77,7 @@ new ${model.const.Name}SDK(options?: {${apikeyOptionType}
 
 | Option | Type | Description |
 | --- | --- | --- |
-${apikeyOptionRow}| \`base\` | \`string\` | Base URL of the API server. |
+${apikeyOptionRow}${secretOptionRow}| \`base\` | \`string\` | Base URL of the API server. |
 | \`prefix\` | \`string\` | URL path prefix prepended to all requests. |
 | \`suffix\` | \`string\` | URL path suffix appended to all requests. |
 | \`feature\` | \`object\` | Feature activation flags (e.g. \`{ test: { active: true } }\`). |

package/project/.sdk/src/cmp/ts/ReadmeQuick_ts.ts

@@ -1,5 +1,5 @@
 
-import { cmp, each, Content, isAuthActive, packageName, envName, opRequestShape, entityIdField, entityDataIdField, entityOps, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
+import { cmp, each, Content, isAuthActive, isHttpBasicAuth, packageName, envName, opRequestShape, entityIdField, entityDataIdField, entityOps, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -41,7 +41,8 @@ const ReadmeQuick = cmp(function ReadmeQuick(props: any) {
   ) as any
 
   const ctor = isAuthActive(model)
-    ? `new ${model.const.Name}SDK({\n  apikey: process.env.${envName(model)}_APIKEY,\n})`
+    ? `new ${model.const.Name}SDK({\n  apikey: process.env.${envName(model)}_APIKEY,${
+      isHttpBasicAuth(model) ? `\n  secret: process.env.${envName(model)}_SECRET,` : ''}\n})`
     : `new ${model.const.Name}SDK()`
 
   Content(`### 1. Create a client

package/project/.sdk/src/cmp/ts/ReadmeRef_ts.ts

@@ -1,5 +1,6 @@
 
-import { cmp, each, Content, canonToType, File, isAuthActive, entityIdField, entityActions, opRequestShape, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
+import { cmp, each, Content, canonToType, File, isAuthActive, isHttpBasicAuth, entityIdField, entityActions, opRequestShape, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
+import { ReadmeRefFeatures } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -83,7 +84,7 @@ Create a new SDK client instance.
 | Name | Type | Description |
 | --- | --- | --- |
 | \`options\` | \`object\` | SDK configuration options. |
-${isAuthActive(model) ? '| \`options.apikey\` | \`string\` | API key for authentication. |\n' : ''}| \`options.base\` | \`string\` | Base URL for API requests. |
+${isAuthActive(model) ? '| \`options.apikey\` | \`string\` | API key for authentication. |\n' : ''}${isAuthActive(model) && isHttpBasicAuth(model) ? '| \`options.secret\` | \`string\` | API secret for authentication. |\n' : ''}| \`options.base\` | \`string\` | Base URL for API requests. |
 | \`options.prefix\` | \`string\` | URL prefix appended after base. |
 | \`options.suffix\` | \`string\` | URL suffix appended after path. |
 | \`options.headers\` | \`object\` | Custom headers for all requests. |
@@ -454,6 +455,10 @@ const client = new ${model.Name}SDK({
 \`\`\`
 
 `)
+      // The shared feature reference: options, defaults, usage and the
+      // considerations. Model facts, identical in every target, so they are
+      // written once in cmp/ReadmeRefFeatures.ts rather than here.
+      ReadmeRefFeatures({ target })
     }
 
   })

package/project/.sdk/src/cmp/ts/ReadmeTopQuick_ts.ts

@@ -1,5 +1,5 @@
 
-import { cmp, Content, isAuthActive, packageName, envName, entityIdField, entityOps, opRequestShape, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
+import { cmp, Content, isAuthActive, isHttpBasicAuth, packageName, envName, entityIdField, entityOps, opRequestShape, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -29,7 +29,8 @@ const ReadmeTopQuick = cmp(function ReadmeTopQuick(props: any) {
 
   const authActive = isAuthActive(model)
   const ctor = authActive
-    ? `new ${model.const.Name}SDK({\n  apikey: process.env.${envName(model)}_APIKEY,\n})`
+    ? `new ${model.const.Name}SDK({\n  apikey: process.env.${envName(model)}_APIKEY,${
+      isHttpBasicAuth(model) ? `\n  secret: process.env.${envName(model)}_SECRET,` : ''}\n})`
     : `new ${model.const.Name}SDK()`
 
   Content(`\`\`\`ts

package/project/.sdk/src/cmp/ts/TestDirect_ts.ts

@@ -17,6 +17,7 @@ import {
   cmp,
   snakify,
   isAuthActive,
+  isHttpBasicAuth,
   jsProp,
   jsOptProp, envName, envToken, liveStrict
 } from '@voxgig/sdkgen'
@@ -44,12 +45,14 @@ const TestDirect = cmp(function TestDirect(props: any) {
   const entidEnvVar = `${PROJECTNAME}_TEST_${envToken(entity.name)}_ENTID`
 
   const authActive = isAuthActive(model)
+  const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyEnvEntry = authActive
-    ? `\n    '${PROJECTNAME}_APIKEY': 'NONE',`
+    ? `\n    '${PROJECTNAME}_APIKEY': 'NONE',${authBasic ? `\n    '${PROJECTNAME}_SECRET': 'NONE',` : ''}`
     : ''
   const apikeyLiveField = authActive
     ? `
-      apikey: env.${PROJECTNAME}_APIKEY,`
+      apikey: env.${PROJECTNAME}_APIKEY,${authBasic ? `
+      secret: env.${PROJECTNAME}_SECRET,` : ''}`
     : ''
 
   const opnames = Object.keys(entity.op || {})

package/project/.sdk/src/cmp/ts/TestEntity_ts.ts

@@ -30,6 +30,7 @@ import {
   cmp,
   each,
   isAuthActive,
+  isHttpBasicAuth,
   entityDataIdField, envName, envToken
 } from '@voxgig/sdkgen'
 
@@ -64,12 +65,14 @@ const TestEntity = cmp(function TestEntity(props: any) {
   const PROJENVNAME = envName(model)
   const ENTENVNAME = envToken(entity.name)
   const authActive = isAuthActive(model)
+  const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyEnvEntry = authActive
-    ? `\n    '${PROJENVNAME}_APIKEY': 'NONE',`
+    ? `\n    '${PROJENVNAME}_APIKEY': 'NONE',${authBasic ? `\n    '${PROJENVNAME}_SECRET': 'NONE',` : ''}`
     : ''
   const apikeyLiveField = authActive
     ? `
-        apikey: env.${PROJENVNAME}_APIKEY,`
+        apikey: env.${PROJENVNAME}_APIKEY,${authBasic ? `
+        secret: env.${PROJENVNAME}_SECRET,` : ''}`
     : ''
 
   // TODO: should be a utility function

package/project/.sdk/src/cmp/zig/ReadmeRef_zig.ts

@@ -1,5 +1,6 @@
 
 import { cmp, each, Content, canonKey, canonScalarKey, File, isAuthActive, entityIdField, opRequestShape } from '@voxgig/sdkgen'
+import { ReadmeRefFeatures } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -389,6 +390,10 @@ const client = sdk.${model.const.Name}SDK.new(h.jo(&.{
 \`\`\`
 
 `)
+      // The shared feature reference: options, defaults, usage and the
+      // considerations. Model facts, identical in every target, so they are
+      // written once in cmp/ReadmeRefFeatures.ts rather than here.
+      ReadmeRefFeatures({ target })
     }
 
   })

package/project/.sdk/tm/clojure/src/sdk/core.clj

@@ -1012,8 +1012,12 @@
           config (or (oget ctx :config) (vs/jm))
           cfgopts (let [c (vs/getprop config "options")] (if (vs/ismap c) c (vs/jm)))
           optspec (vs/jm
-                   "apikey" "" "base" "http://localhost:8000" "prefix" "" "suffix" ""
-                   "auth" (vs/jm "prefix" "")
+                   "apikey" "" "secret" "" "base" "http://localhost:8000" "prefix" "" "suffix" ""
+                   ;; `basic` and `secret`: HTTP Basic Auth needs a second
+                   ;; credential and a flag to say the pair is Basic rather
+                   ;; than a single bearer token. Absent from the shape, a
+                   ;; client passing them is refused with "Unexpected keys".
+                   "auth" (vs/jm "prefix" "" "basic" false)
                    "headers" (vs/jm "`$CHILD`" "`$STRING`")
                    "allow" (vs/jm "method" "GET,PUT,POST,PATCH,DELETE,OPTIONS"
                                   "op" "create,update,load,list,remove,command,direct,graphql")

package/project/.sdk/tm/clojure/src/sdk/features.clj

@@ -619,6 +619,180 @@
            )
     fa))
 
+;; ---------------------------------------------------------------------------
+;; cost
+;; ---------------------------------------------------------------------------
+;; Prices every transport ATTEMPT and commits the spend once per OPERATION.
+;; Mirrors tm/ts/src/feature/cost/CostFeature.ts; the cases are
+;; .sdk/test/feature/cost.aon.
+;;
+;; ORDER MATTERS. Cost must sit INSIDE the cache, or a response served from
+;; cache is charged for money that was never spent. Activate in list form with
+;; cost first: [{name "cost"} {name "cache"}].
+
+(defn cost-feature []
+  (let [fa (new-feature "cost" false "0.0.1")
+        per-unit (fn [] (let [p (opt fa "perUnit")] (if (number? p) p 0)))
+        budget-limit (fn [] (let [b (opt fa "budget")] (if (number? b) b 0)))
+        record! (fn []
+                  (track-ensure! fa "_cost"
+                    (vs/jm "currency" (or (opt fa "currency") "USD")
+                           "total" (vs/jm "calls" 0 "attempts" 0 "amount" 0 "reported" 0 "estimated" 0)
+                           "ops" (vs/jm) "actors" (vs/jm)
+                           "budget" (vs/jm "limit" (budget-limit) "spent" 0
+                                           "remaining" (budget-limit) "exceeded" false)
+                           "last" nil)))
+        bump! (fn [m k by] (.put ^java.util.Map m k (+ (or (mget m k) 0) by)))
+        ;; Accumulated per context, committed once at PreDone: adding each
+        ;; attempt to the running total and subtracting it again when a body
+        ;; figure supersedes it loses precision to catastrophic cancellation.
+        pending (fn [ctx]
+                  (let [id (core/oget ctx :id)]
+                    (or (get (:pending @fa) id)
+                        (let [p (vs/jm "attempts" 0 "amount" 0 "reported" 0 "estimated" 0
+                                       "source" "none" "piped" false)]
+                          (swap! fa update :pending assoc id p) p))))
+        price-header (fn [res]
+                       (let [name (opt fa "header")]
+                         (when (and (string? name) (seq name))
+                           (let [v (header-of (vs/getprop res "headers") name)
+                                 n (to-num v)]
+                             (when (number? n) [(* n (per-unit)) "header"])))))
+        ;; Same lookup grammar as rbac's rules: '<entity>.<op>', then '<op>',
+        ;; then '*'.
+        price-rate (fn [ctx]
+                     (let [rates (let [r (opt fa "rates")] (if (vs/ismap r) r (vs/jm)))
+                           op (core/oget ctx :op)
+                           ent (or (when-let [e (core/oget ctx :entity)] (core/entity-get-name e))
+                                   (when op (core/op-entity op)) "")
+                           opname (if op (core/op-name op) "")
+                           pick (fn [k] (let [v (vs/getprop rates k)] (when (number? v) v)))]
+                       (when-let [n (or (pick (str ent "." opname)) (pick opname) (pick "*"))]
+                         [n "table"])))
+        price (fn [ctx res]
+                (or (price-header res)
+                    (price-rate ctx)
+                    (let [u (opt fa "unit")]
+                      (if (and (number? u) (not= 0 u)) [u "unit"] [0 "none"]))))
+        ;; A usage figure from the parsed result body, priced by perUnit. Read
+        ;; at commit, not at the transport seam, because the body is one-shot.
+        price-body (fn [ctx]
+                     (let [path (opt fa "path")]
+                       (when (and (string? path) (seq path))
+                         (when-let [result (core/oget ctx :result)]
+                           (let [body (core/oget result :body)]
+                             (when (vs/ismap body)
+                               (let [n (to-num (vs/getpath body path))]
+                                 (when (number? n) (* n (per-unit))))))))))
+        spend! (fn [rec amount reported estimated]
+                 (let [total (mget rec "total") budget (mget rec "budget")
+                       lim (or (mget budget "limit") 0)]
+                   (bump! total "amount" amount)
+                   (bump! total "reported" reported)
+                   (bump! total "estimated" estimated)
+                   (let [spent (or (mget total "amount") 0)]
+                     (.put ^java.util.Map budget "spent" spent)
+                     (.put ^java.util.Map budget "remaining"
+                           (if (> lim 0) (max 0 (- lim spent)) 0))
+                     (when (and (> lim 0) (>= spent lim))
+                       (.put ^java.util.Map budget "exceeded" true)))))
+        bump-bucket! (fn [bucket key amount]
+                       (let [b (let [x (vs/getprop bucket key)]
+                                 (if (vs/ismap x) x
+                                     (let [m (vs/jm "calls" 0 "amount" 0)]
+                                       (.put ^java.util.Map bucket key m) m)))]
+                         (bump! b "calls" 1)
+                         (bump! b "amount" amount)))
+        commit! (fn [ctx p entity opname]
+                  (let [rec (record!)
+                        body (price-body ctx)
+                        amount (if (some? body) body (or (mget p "amount") 0))
+                        reported (if (some? body) body (or (mget p "reported") 0))
+                        estimated (if (some? body) 0 (or (mget p "estimated") 0))
+                        source (if (some? body) "body" (mget p "source"))
+                        actor (or (core/oget (core/oget ctx :ctrl) :actor)
+                                  (opt fa "actor") "anonymous")]
+                    (spend! rec amount reported estimated)
+                    (bump! (mget rec "total") "calls" 1)
+                    (bump-bucket! (mget rec "ops") (str entity "." opname) amount)
+                    (bump-bucket! (mget rec "actors") (str actor) amount)
+                    (swap! fa update :seq (fnil inc 0))
+                    (.put ^java.util.Map rec "last"
+                          (vs/jm "seq" (:seq @fa) "entity" entity "op" opname "actor" (str actor)
+                                 "amount" amount "currency" (mget rec "currency")
+                                 "source" source "attempts" (mget p "attempts")))))
+        finish! (fn [ctx done]
+                  (when (active? fa)
+                    (let [id (core/oget ctx :id) p (get (:pending @fa) id)]
+                      (when (some? p)
+                        (swap! fa update :pending dissoc id)
+                        ;; A FAILED operation that made no attempt never reached
+                        ;; the network - the budget gate refused it - and must
+                        ;; not be counted. A SUCCEEDED one that made no attempt
+                        ;; was served from the cache: a real call that cost
+                        ;; nothing, which is the point of ordering cost inside
+                        ;; the cache.
+                        (when (or done (> (or (mget p "attempts") 0) 0))
+                          (let [op (core/oget ctx :op)
+                                entity (if (and op (seq (core/op-entity op))) (core/op-entity op) "_")
+                                opname (if (and op (seq (core/op-name op))) (core/op-name op) "_")]
+                            (commit! ctx p entity opname)))))))
+        charge (fn [ctx url fetchdef inner]
+                 ;; A rejecting transport still costs an attempt: without this a
+                 ;; run of connection-level failures under retry would be
+                 ;; charged nothing, and an onBudget "deny" ceiling could never
+                 ;; stop it.
+                 (let [[res err] (inner ctx url fetchdef)
+                       [amount source] (price ctx res)
+                       p (pending ctx)]
+                   (bump! p "attempts" 1)
+                   (bump! p "amount" amount)
+                   (bump! p (if (or (= source "header") (= source "body")) "reported" "estimated") amount)
+                   (.put ^java.util.Map p "source" source)
+                   (bump! (mget (record!) "total") "attempts" 1)
+                   ;; direct() and graphql() dispatch no pipeline hooks, so
+                   ;; their spend is committed here or never. `piped` is set by
+                   ;; PrePoint, so its absence is the signal.
+                   (when (not= true (mget p "piped"))
+                     (swap! fa update :pending dissoc (core/oget ctx :id))
+                     (commit! ctx p "_" "direct"))
+                   [res err]))]
+    (swap! fa assoc :pending {} :seq 0)
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm))
+                           :active (opts-active? options) :pending {} :seq 0)
+                    (when (active? fa)
+                      (record!)
+                      (wrap-fetcher! ctx (fn [fctx url fd inner] (charge fctx url fd inner)))))
+           "PrePoint"
+           (fn [ctx]
+             (when (active? fa)
+               ;; Mark the context as piped, so charge knows a PreDone follows.
+               (.put ^java.util.Map (pending ctx) "piped" true)
+               (let [lim (budget-limit)]
+                 (when (> lim 0)
+                   (let [rec (record!)
+                         spent (or (mget (mget rec "total") "amount") 0)]
+                     (when (>= spent lim)
+                       (.put ^java.util.Map (mget rec "budget") "exceeded" true)
+                       (when (= "deny" (opt fa "onBudget"))
+                         (let [err (core/ctx-error ctx "cost_budget"
+                                     (str "Cost budget of " lim " " (mget rec "currency")
+                                          " is spent (" spent " used)"))]
+                           (core/out-set! ctx "point" err)
+                           err))))))))
+           "PreDone" (fn [ctx] (finish! ctx true))
+           ;; A failed operation never reaches PreDone - make-error dispatches
+           ;; PreUnexpected instead - so without this its attempts are priced
+           ;; and then discarded: repeated connection failures would slip past
+           ;; an onBudget "deny" ceiling and leak the pending entry. `false`
+           ;; keeps a call that made NO attempt (refused at the budget gate)
+           ;; from being counted.
+           "PreUnexpected" (fn [ctx] (finish! ctx false)))
+    fa))
+
 ;; ---------------------------------------------------------------------------
 ;; streaming
 ;; ---------------------------------------------------------------------------
@@ -1108,4 +1282,5 @@
     "clienttrack" (clienttrack-feature)
     "rbac" (rbac-feature)
     "netsim" (netsim-feature)
+    "cost" (cost-feature)
     (base-feature)))

package/project/.sdk/tm/csharp/utility/MakeOptions.cs

@@ -150,12 +150,17 @@ public static partial class SdkUtility
         var optspec = new Dictionary<string, object?>
         {
             ["apikey"] = "",
+            ["secret"] = "",
             ["base"] = "http://localhost:8000",
             ["prefix"] = "",
             ["suffix"] = "",
+            // `basic` and `secret`: HTTP Basic Auth needs a second credential
+            // and a flag to say the pair is Basic rather than a single bearer
+            // token.
             ["auth"] = new Dictionary<string, object?>
             {
                 ["prefix"] = "",
+                ["basic"] = false,
             },
             ["headers"] = new Dictionary<string, object?>
             {

package/project/.sdk/tm/dart/lib/utility/MakeOptionsUtility.dart

@@ -21,10 +21,14 @@ dynamic makeOptions(dynamic ctx) {
   final optspec = {
     'apikey': '',
     'base': 'http://localhost:8000',
+    'secret': '',
     'prefix': '',
     'suffix': '',
+    // `basic` and `secret`: HTTP Basic Auth needs a second credential and a
+    // flag to say the pair is Basic rather than a single bearer token.
     'auth': {
       'prefix': '',
+      'basic': false,
     },
     'headers': {
       '`\$CHILD`': '`\$STRING`',