@voxgig/sdkgen 4.4.1 → 4.5.1

package/project/.sdk/tm/lua/test/feature_test.lua

@@ -441,7 +441,7 @@ describe("feature", function()
   -- retry ---------------------------------------------------------------
   if has_feature("retry") then describe("retry", function()
 
-    it("retries transient failures then succeeds", function()
+    if has_feature("netsim") then it("retries transient failures then succeeds", function()
       local clock = make_clock()
       local h = make_client({ features = {
         { name = "netsim", options = { failTimes = 2, failStatus = 503 } },
@@ -450,9 +450,9 @@ describe("feature", function()
       } })
       assert.is_true(h.op({ op = "load" }).ok)
       assert.are.equal(2, h.client._retry.attempts)
-    end)
+    end) end
 
-    it("gives up after the budget", function()
+    if has_feature("netsim") then it("gives up after the budget", function()
       local clock = make_clock()
       local h = make_client({ features = {
         { name = "netsim", options = { failTimes = 9, failStatus = 500 } },
@@ -460,7 +460,7 @@ describe("feature", function()
           retries = 2, minDelay = 1, jitter = false, sleep = clock.sleep } },
       } })
       assert.are.equal(500, h.op({ op = "load" }).result.status)
-    end)
+    end) end
 
     it("does not retry a non-retryable status", function()
       local rec = recording_server(function() return make_response(404) end)
@@ -487,7 +487,7 @@ describe("feature", function()
       assert.are.equal(3, n)
     end)
 
-    it("honours a server Retry-After", function()
+    if has_feature("netsim") then it("honours a server Retry-After", function()
       local clock = make_clock()
       local h = make_client({ features = {
         { name = "netsim", options = { rateLimitTimes = 1, retryAfter = 2 } },
@@ -497,15 +497,15 @@ describe("feature", function()
       } })
       assert.is_true(h.op({ op = "load" }).ok)
       assert.are.equal(2000, clock.time())
-    end)
+    end) end
 
-    it("default jitter path still succeeds", function()
+    if has_feature("netsim") then it("default jitter path still succeeds", function()
       local h = make_client({ features = {
         { name = "netsim", options = { failTimes = 1 } },
         { name = "retry", options = { retries = 2, minDelay = 0 } },
       } })
       assert.is_true(h.op({ op = "load" }).ok)
-    end)
+    end) end
 
     it("inactive retry does not wrap", function()
       local rec = recording_server(function() return make_response(503) end)
@@ -551,7 +551,7 @@ describe("feature", function()
   -- shared virtual clock stands in for elapsed transport time.
   if has_feature("timeout") then describe("timeout", function()
 
-    it("a slow request times out", function()
+    if has_feature("netsim") then it("a slow request times out", function()
       local clock = make_clock()
       local h = make_client({ features = {
         { name = "netsim", options = { latency = 80, sleep = clock.sleep } },
@@ -560,7 +560,7 @@ describe("feature", function()
       local res = h.op({ op = "load" })
       assert.are.equal("timeout", res.error.code)
       assert.are.equal(1, h.client._timeout.count)
-    end)
+    end) end
 
     it("a fast request passes through", function()
       local clock = make_clock()
@@ -819,7 +819,7 @@ describe("feature", function()
   -- metrics ---------------------------------------------------------------
   if has_feature("metrics") then describe("metrics", function()
 
-    it("counts ok and err per op", function()
+    if has_feature("netsim") then it("counts ok and err per op", function()
       local h = make_client({ features = {
         { name = "netsim", options = { failTimes = 1, failStatus = 500 } },
         { name = "metrics", options = {} },
@@ -832,7 +832,7 @@ describe("feature", function()
       assert.are.equal(2, m.total.ok)
       assert.are.equal(1, m.total.err)
       assert.are.equal(2, m.ops["widget.load"].count)
-    end)
+    end) end
 
     it("injected clock accumulates durations", function()
       local t = 0
@@ -872,14 +872,14 @@ describe("feature", function()
       assert.is_truthy(string.match(sent["traceparent"], "^00%-.+%-.+%-01$"))
     end)
 
-    it("records a failed span on error", function()
+    if has_feature("netsim") then it("records a failed span on error", function()
       local h = make_client({ features = {
         { name = "netsim", options = { failTimes = 1, failStatus = 500 } },
         { name = "telemetry", options = {} },
       } })
       h.op({ op = "load" })
       assert.is_false(h.client._telemetry.spans[1].ok)
-    end)
+    end) end
 
     it("default id generation and no exporter", function()
       local h = make_client({ features = { { name = "telemetry" } } })
@@ -925,14 +925,14 @@ describe("feature", function()
       assert.are.equal("<redacted>", seen[1].headers.authorization)
     end)
 
-    it("captures failures", function()
+    if has_feature("netsim") then it("captures failures", function()
       local h = make_client({ features = {
         { name = "netsim", options = { failTimes = 1, failStatus = 500 } },
         { name = "debug", options = {} },
       } })
       h.op({ op = "load" })
       assert.is_false(h.client._debug.entries[1].ok)
-    end)
+    end) end
 
     it("injected clock + custom redact", function()
       local h = make_client({ features = {
@@ -957,7 +957,7 @@ describe("feature", function()
   -- audit -----------------------------------------------------------------
   if has_feature("audit") then describe("audit", function()
 
-    it("one record per op with sink + actor", function()
+    if has_feature("netsim") then it("one record per op with sink + actor", function()
       local sink = {}
       local h = make_client({ features = {
         { name = "netsim", options = { failTimes = 1, failStatus = 500 } },
@@ -972,7 +972,7 @@ describe("feature", function()
       assert.are.equal("svc", recs[1].actor)
       assert.are.equal("per-call", recs[2].actor)
       assert.are.equal(2, #sink)
-    end)
+    end) end
 
     it("default actor is anonymous", function()
       local h = make_client({ features = { { name = "audit" } } })

package/project/.sdk/tm/lua/utility/make_options.lua

@@ -75,11 +75,13 @@ local function make_options_util(ctx)
 
   local optspec = {
     apikey = "",
+    secret = "",
     base = "http://localhost:8000",
     prefix = "",
     suffix = "",
     auth = {
       prefix = "",
+      basic = false,
     },
     headers = {
       ["`$CHILD`"] = "`$STRING`",

package/project/.sdk/tm/ocaml/sdk_features.ml

@@ -813,6 +813,11 @@ let cost_feature () : feature =
             end
           end
         | "PreDone" -> finish ctx true
+        (* A failed operation never reaches PreDone - make_error dispatches
+           PreUnexpected - so its attempts would be priced and discarded, and
+           repeated failures could slip past an onBudget "deny" ceiling.
+           `false` keeps a call that made NO attempt from being counted. *)
+        | "PreUnexpected" -> finish ctx false
         | _ -> ());
   f
 

package/project/.sdk/tm/ocaml/sdk_runtime.ml

@@ -937,10 +937,13 @@ let fetcher_util (ctx : ctx) (fullurl : string) (fetchdef : value) : (value * sd
 let opt_spec_value () : value =
   jo [
     ("apikey", Str "");
+    ("secret", Str "");
     ("base", Str "http://localhost:8000");
     ("prefix", Str "");
     ("suffix", Str "");
-    ("auth", jo [("prefix", Str "")]);
+    (* `basic` and `secret`: HTTP Basic Auth needs a second credential and a
+       flag to say the pair is Basic rather than a single bearer token. *)
+    ("auth", jo [("prefix", Str ""); ("basic", Bool false)]);
     ("headers", jo [("`$CHILD`", Str "`$STRING`")]);
     ("allow", jo [("method", Str "GET,PUT,POST,PATCH,DELETE,OPTIONS");
                   ("op", Str "create,update,load,list,remove,command,direct,graphql")]);

package/project/.sdk/tm/perl/t/feature_corpus.t

@@ -29,9 +29,10 @@ unless (defined $TEST_JSON && -e $TEST_JSON) {
   plan skip_all => 'test.json corpus not found';
 }
 
-# Features with a corpus section. A name here with no section is a skip, not
-# a failure: an SDK generated without the feature has nothing to run.
-my @FEATURE_CORPUS_NAMES = ('cost');
+# Features with a corpus section are read from the corpus itself (see the
+# loop below), so a project-authored section - a custom feature added under
+# .sdk/test/feature/ - runs without editing this file. An SDK generated
+# without a listed feature still skips, not fails.
 
 # The standard operation names, in the order the runner prefers them.
 my @FEATURE_CORPUS_OPS = qw(load list create update remove);
@@ -282,7 +283,7 @@ ok(scalar(@ops) > 0,
   exit 0;
 };
 
-for my $name (@FEATURE_CORPUS_NAMES) {
+for my $name (sort keys %{ $CORPUS->{feature} || {} }) {
   my $section = ($CORPUS->{feature} || {})->{$name};
   next unless defined $section;
 

package/project/.sdk/tm/perl/utility/make_options.pm

@@ -108,9 +108,12 @@ $REGISTRY{make_options} = sub {
   my $optspec = {
     'apikey' => '',
     'base' => 'http://localhost:8000',
+    'secret' => '',
     'prefix' => '',
     'suffix' => '',
-    'auth' => { 'prefix' => '' },
+    # `basic` and `secret`: HTTP Basic Auth needs a second credential and a
+    # flag to say the pair is Basic rather than a single bearer token.
+    'auth' => { 'prefix' => '', 'basic' => $JF },
     'headers' => { '`$CHILD`' => '`$STRING`' },
     'allow' => {
       'method' => 'GET,PUT,POST,PATCH,DELETE,OPTIONS',

package/project/.sdk/tm/php/feature/TestFeature.php

@@ -69,10 +69,16 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
                 if (!is_string($restf)) {
                     return $data;
                 }
-                if (!preg_match('/^`body\.([^`.]+)`$/', $restf, $m)) {
+                if (!preg_match('/^`body\.(.+)`$/', $restf, $m)) {
                     return $data;
                 }
-                return [$m[1] => $data];
+                // Multi-segment on purpose: GraphQL ops unwrap body.data.<field>
+                // (and body.data.<field>.<entity> for mutations), not just one level.
+                $out = $data;
+                foreach (array_reverse(explode('.', $m[1])) as $seg) {
+                    $out = [$seg => $out];
+                }
+                return $out;
             };
 
             $respond = function (int $status, mixed $data, ?array $extra = null) use ($envelope): array {
@@ -433,13 +439,18 @@ class ProjectNameTestFeature extends ProjectNameBaseFeature
                     }
                 }
             }
+            // Path AND query: a path-only read misses a query-addressed
+            // record (e.g. GET /result?trace_id=), which has no path param.
             $params = is_array($point) ? ($point['args']['params'] ?? null) : null;
-            if (is_array($params)) {
-                foreach ($params as $p) {
-                    if (is_array($p) && (($p['reqd'] ?? false) === true)) {
-                        $n = $p['name'] ?? null;
-                        if ($n !== null) {
-                            $reqd_names[] = $n;
+            $query = is_array($point) ? ($point['args']['query'] ?? null) : null;
+            foreach ([$params, $query] as $arglist) {
+                if (is_array($arglist)) {
+                    foreach ($arglist as $p) {
+                        if (is_array($p) && (($p['reqd'] ?? false) === true)) {
+                            $n = $p['name'] ?? null;
+                            if ($n !== null) {
+                                $reqd_names[] = $n;
+                            }
                         }
                     }
                 }

package/project/.sdk/tm/php/test/FeatureCorpusTest.php

@@ -23,9 +23,10 @@ use PHPUnit\Framework\TestCase;
 
 class FeatureCorpusTest extends TestCase
 {
-    // Features with a corpus section. A name here with no section is a skip,
-    // not a failure: an SDK generated without the feature has nothing to run.
-    private const FEATURE_CORPUS_NAMES = ['cost'];
+    // Features with a corpus section are read from the corpus itself (see
+    // testFeatureCorpus), so a project-authored section - a custom feature
+    // added under .sdk/test/feature/ - runs without editing this file. An
+    // SDK generated without a listed feature still skips, not fails.
 
     // The standard operation names, in the order the runner prefers them.
     private const FEATURE_CORPUS_OPS = ['load', 'list', 'create', 'update', 'remove'];
@@ -300,7 +301,9 @@ class FeatureCorpusTest extends TestCase
                 . 'the corpus (create-sdkgen .sdk/test/feature/) to run these cases');
         }
 
-        foreach (self::FEATURE_CORPUS_NAMES as $name) {
+        $names = array_keys(self::corpus()['feature'] ?? []);
+        sort($names);
+        foreach ($names as $name) {
             $section = self::corpus()['feature'][$name] ?? null;
             if (null === $section) {
                 continue;

package/project/.sdk/tm/php/utility/MakeOptions.php

@@ -130,10 +130,11 @@ class ProjectNameMakeOptions
 
         $optspec = [
             'apikey' => '',
+            'secret' => '',
             'base' => 'http://localhost:8000',
             'prefix' => '',
             'suffix' => '',
-            'auth' => ['prefix' => ''],
+            'auth' => ['prefix' => '', 'basic' => false],
             'headers' => ['`$CHILD`' => '`$STRING`'],
             'allow' => [
                 'method' => 'GET,PUT,POST,PATCH,DELETE,OPTIONS',

package/project/.sdk/tm/py/pkg/feature/test_feature.py

@@ -11,7 +11,7 @@ from projectname_sdk.feature.base_feature import ProjectNameBaseFeature
 
 # The `body.<key>` form of an op's response transform: the mock wraps its
 # payload in <key> so the transform can unwrap it again.
-ENVELOPE_RES_RE = re.compile(r"^`body\.([^`.]+)`$")
+ENVELOPE_RES_RE = re.compile(r"^`body\.(.+)`$")
 
 
 class ProjectNameTestFeature(ProjectNameBaseFeature):
@@ -60,7 +60,14 @@ class ProjectNameTestFeature(ProjectNameBaseFeature):
                 if not isinstance(restf, str):
                     return data
                 m = ENVELOPE_RES_RE.match(restf)
-                return data if m is None else {m.group(1): data}
+                if m is None:
+                    return data
+                # Multi-segment on purpose: GraphQL ops unwrap body.data.<field>
+                # (and body.data.<field>.<entity> for mutations), not just one level.
+                out = data
+                for seg in reversed(m.group(1).split(".")):
+                    out = {seg: out}
+                return out
 
             def respond(status, data, extra=None):
                 payload = envelope(data)
@@ -260,10 +267,14 @@ class ProjectNameTestFeature(ProjectNameBaseFeature):
         points = vs.getpath(ctx.config, "entity." + ctx.entity.get_name() + ".op." + opname + ".points")
         point = vs.getelem(points, -1)
 
-        # Get required params.
+        # Path AND query: a path-only read misses a query-addressed record
+        # (e.g. GET /result?trace_id=), which has no path param at all.
         params_path = vs.getpath(point, "args.params")
         reqd_params = vs.select(params_path, {"reqd": True})
-        reqd = vs.transform(reqd_params, ["`$EACH`", "", "`$KEY.name`"])
+        query_path = vs.getpath(point, "args.query")
+        reqd_query = vs.select(query_path, {"reqd": True})
+        reqd = (vs.transform(reqd_params, ["`$EACH`", "", "`$KEY.name`"]) or []) + \
+            (vs.transform(reqd_query, ["`$EACH`", "", "`$KEY.name`"]) or [])
 
         qand = []
         q = {"`$AND`": qand}

package/project/.sdk/tm/py/pkg/utility/make_options.py

@@ -97,11 +97,13 @@ def make_options_util(ctx):
 
     optspec = {
         "apikey": "",
+        "secret": "",
         "base": "http://localhost:8000",
         "prefix": "",
         "suffix": "",
         "auth": {
             "prefix": "",
+            "basic": False,
         },
         "headers": {
             "`$CHILD`": "`$STRING`",

package/project/.sdk/tm/py/test/test_feature.py

@@ -105,6 +105,10 @@ class TestNetsimFeature:
 @pytest.mark.skipif(not has_feature("retry"), reason="retry not in this SDK")
 class TestRetryFeature:
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_retries_transient_failures_then_succeeds(self):
         clock = make_clock()
         h = make_client([
@@ -115,6 +119,10 @@ class TestRetryFeature:
         assert h.op(op="load")["ok"] is True
         assert h.client._retry["attempts"] == 2
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_gives_up_after_the_budget(self):
         clock = make_clock()
         h = make_client([
@@ -163,6 +171,10 @@ class TestRetryFeature:
         assert h.op(op="load")["ok"] is True
         assert state["n"] == 2
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_honours_a_server_retry_after(self):
         clock = make_clock()
         h = make_client([
@@ -174,6 +186,10 @@ class TestRetryFeature:
         assert h.op(op="load")["ok"] is True
         assert clock.time == 2000
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_default_jitter_path_still_succeeds(self):
         h = make_client([
             {"name": "netsim", "options": {"failTimes": 1}},
@@ -202,6 +218,10 @@ class TestRetryFeature:
 @pytest.mark.skipif(not has_feature("timeout"), reason="timeout not in this SDK")
 class TestTimeoutFeature:
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_a_slow_request_times_out(self):
         clock = make_clock()
         h = make_client([
@@ -438,6 +458,10 @@ class TestRbacFeature:
 @pytest.mark.skipif(not has_feature("metrics"), reason="metrics not in this SDK")
 class TestMetricsFeature:
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_counts_ok_and_err_per_op(self):
         h = make_client([
             {"name": "netsim", "options": {"failTimes": 1, "failStatus": 500}},
@@ -490,6 +514,10 @@ class TestTelemetryFeature:
         assert sent["X-Trace-Id"] == h.client._telemetry["spans"][0]["traceId"]
         assert re.match(r"^00-.+-.+-01$", sent["traceparent"])
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_records_a_failed_span_on_error(self):
         h = make_client([
             {"name": "netsim", "options": {"failTimes": 1, "failStatus": 500}},
@@ -498,6 +526,10 @@ class TestTelemetryFeature:
         h.op(op="load")
         assert h.client._telemetry["spans"][0]["ok"] is False
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_closes_each_span_exactly_once(self):
         h = make_client([
             {"name": "netsim", "options": {"failTimes": 1, "failStatus": 500}},
@@ -542,6 +574,10 @@ class TestDebugFeature:
         assert len(seen) == 2
         assert seen[0]["headers"]["authorization"] == "<redacted>"
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_captures_failures(self):
         h = make_client([
             {"name": "netsim", "options": {"failTimes": 1, "failStatus": 500}},
@@ -571,6 +607,10 @@ class TestDebugFeature:
 @pytest.mark.skipif(not has_feature("audit"), reason="audit not in this SDK")
 class TestAuditFeature:
 
+    # Drives netsim as the simulated network: runnable only when this
+    # SDK was generated with it (the harness skips absent features).
+    @pytest.mark.skipif(not has_feature("netsim"),
+                        reason="netsim not in this SDK")
     def test_one_record_per_op_with_sink_and_actor(self):
         sink = []
         h = make_client([

package/project/.sdk/tm/py/test/test_feature_corpus.py

@@ -23,9 +23,20 @@ from projectname_sdk import ProjectNameSDK
 
 _TEST_DIR = os.path.dirname(os.path.abspath(__file__))
 
-# Features with a corpus section. A name here with no section is a skip, not
-# a failure: an SDK generated without the feature has nothing to run.
-FEATURE_CORPUS_NAMES = ["cost"]
+# Features with a corpus section — read from the corpus itself, so a
+# project-authored section (a custom feature added under
+# .sdk/test/feature/) runs without editing this file. Read eagerly:
+# parametrize needs the names at collection time. An SDK generated
+# without a listed feature still skips, not fails.
+def _corpus_feature_names():
+    try:
+        with open(os.path.join(_TEST_DIR, "../../.sdk/test/test.json"), "r") as f:
+            return sorted((json.loads(f.read()).get("feature") or {}).keys())
+    except OSError:
+        return []
+
+
+FEATURE_CORPUS_NAMES = _corpus_feature_names()
 
 # The standard operation names, in the order the runner prefers them.
 FEATURE_CORPUS_OPS = ["load", "list", "create", "update", "remove"]

package/project/.sdk/tm/rb/test/feature_corpus_test.rb

@@ -19,9 +19,10 @@ require_relative "../ProjectName_sdk"
 
 class FeatureCorpusTest < Minitest::Test
 
-  # Features with a corpus section. A name here with no section is a skip,
-  # not a failure: an SDK generated without the feature has nothing to run.
-  FEATURE_CORPUS_NAMES = ["cost"].freeze
+  # Features with a corpus section are read from the corpus itself (see
+  # test_feature_corpus), so a project-authored section - a custom feature
+  # added under .sdk/test/feature/ - runs without editing this file. An SDK
+  # generated without a listed feature still skips, not fails.
 
   # The standard operation names, in the order the runner prefers them.
   FEATURE_CORPUS_OPS = %w[load list create update remove].freeze
@@ -192,6 +193,13 @@ class FeatureCorpusTest < Minitest::Test
   end
 
   def record(client, name)
+    # A corpus key is any manifest item name, so it may carry characters
+    # (foo-bar, foo.2) that cannot form a Ruby instance-variable name. The
+    # probe uses this lookup to SKIP such a section, so answer nil rather
+    # than letting instance_variable_get raise NameError for a feature this
+    # SDK could never have stored under that name anyway.
+    return nil unless name.match?(/\A[A-Za-z0-9_]+\z/)
+
     client.instance_variable_get(:"@_#{name}")
   end
 
@@ -218,7 +226,7 @@ class FeatureCorpusTest < Minitest::Test
   end
 
   def test_feature_corpus
-    FEATURE_CORPUS_NAMES.each do |name|
+    (corpus["feature"] || {}).keys.sort.each do |name|
       section = (corpus["feature"] || {})[name]
       next if section.nil?
 

package/project/.sdk/tm/rb/utility/make_options.rb

@@ -69,9 +69,12 @@ module ProjectNameUtilities
     optspec = {
       "apikey" => "",
       "base" => "http://localhost:8000",
+      "secret" => "",
       "prefix" => "",
       "suffix" => "",
-      "auth" => { "prefix" => "" },
+      # `basic` and `secret`: HTTP Basic Auth needs a second credential and
+      # a flag to say the pair is Basic rather than a single bearer token.
+      "auth" => { "prefix" => "", "basic" => false },
       "headers" => { "`$CHILD`" => "`$STRING`" },
       "allow" => {
         "method" => "GET,PUT,POST,PATCH,DELETE,OPTIONS",

package/project/.sdk/tm/ts/src/feature/test/TestFeature.ts

@@ -43,6 +43,13 @@ function ownIdField(config: any, getpath: any, entityName: string): string {
     // key, so move on to the next op rather than guess from it.
     const lastPart = 0 < parts.length ? String(parts[parts.length - 1]) : ''
     if (lastPart.startsWith('{')) return lastPart.slice(1, -1)
+
+    // No path param at all (or the route ends in a literal, e.g.
+    // /orgs/{org}/private-registries/public-key): a single required QUERY
+    // param can still be the record's own key (e.g. GET /result?trace_id=).
+    const query = (best && best.args && best.args.query) || []
+    const reqdQuery = query.filter((q: any) => false !== q.reqd)
+    if (1 === reqdQuery.length) return String(reqdQuery[0].name)
   }
   return 'id'
 }
@@ -332,10 +339,17 @@ class TestFeature extends BaseFeature {
       }
     }
 
-    const reqd = transform(
+    // Path AND query: a path-only read misses a query-addressed record
+    // (e.g. GET /result?trace_id=), which has no path param at all.
+    const reqdParams = transform(
       select(getpath(point, ['args', 'params']), { reqd: true }),
       ['`$EACH`', '', '`$KEY.name`']
     )
+    const reqdQuery = transform(
+      select(getpath(point, ['args', 'query']), { reqd: true }),
+      ['`$EACH`', '', '`$KEY.name`']
+    )
+    const reqd = [...(reqdParams || []), ...(reqdQuery || [])]
 
     const qand: any[] = []
     const q = { '`$AND`': qand }

package/project/.sdk/tm/ts/src/utility/MakeOptionsUtility.ts

@@ -44,11 +44,13 @@ function makeOptions(ctx: Context) {
   // Standard SDK option values.
   const optspec = {
     apikey: '',
+    secret: '',
     base: 'http://localhost:8000',
     prefix: '',
     suffix: '',
     auth: {
-      prefix: ''
+      prefix: '',
+      basic: false
     },
     headers: {
       '`$CHILD`': '`$STRING`'

package/project/.sdk/tm/ts/src/utility/PrepareAuthUtility.ts

@@ -5,6 +5,7 @@ import { Context, Spec } from '../types'
 const HEADER_auth = 'authorization'
 
 const OPTION_apikey = 'apikey'
+const OPTION_secret = 'secret'
 
 const NOTFOUND = '__NOTFOUND__'
 
@@ -40,6 +41,25 @@ function prepareAuth(ctx: Context): Spec | Error {
 
   const apikey = getprop(options, OPTION_apikey, NOTFOUND)
 
+  // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+  // token in the header (the branch below) can never authenticate against
+  // an API that actually checks `Authorization: Basic base64(user:pass)`.
+  if (true === options.auth.basic) {
+    const secret = getprop(options, OPTION_secret, NOTFOUND)
+    const noApikey = NOTFOUND === apikey || null == apikey || '' === apikey
+    const noSecret = NOTFOUND === secret || null == secret || '' === secret
+
+    if (noApikey || noSecret) {
+      delprop(headers, HEADER_auth)
+    }
+    else {
+      const b64 = Buffer.from(apikey + ':' + secret).toString('base64')
+      setprop(headers, HEADER_auth, prefix ? prefix + ' ' + b64 : b64)
+    }
+
+    return spec
+  }
+
   if (NOTFOUND === apikey || null == apikey || '' === apikey) {
     delprop(headers, HEADER_auth)
   }