@voxgig/sdkgen 4.5.2 → 4.6.0

package/project/.sdk/src/cmp/py/ReadmeTopQuick_py.ts

@@ -1,5 +1,5 @@
 
-import { cmp, Content, isAuthActive, envName, canonKey, canonScalarKey, entityIdField, opRequestShape, safeVarName, exampleVarName, matchArg, idLiteral } from '@voxgig/sdkgen'
+import { cmp, Content, isAuthActive, envName, canonKey, canonScalarKey, entityIdField, opRequestShape, safeVarName, exampleVarName, matchArg, idLiteral , serverVariables} from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -41,10 +41,23 @@ const ReadmeTopQuick = cmp(function ReadmeTopQuick(props: any) {
   const exampleEntity = Object.values(entity).find((e: any) => e.active !== false) as any
 
   const authActive = isAuthActive(model)
+
+  // Server variables (a templated server URL) are REQUIRED at construction
+  // - the SDK refuses rather than request a URL with a literal
+  // {account_id} in it - so a quickstart that omits them is a quickstart
+  // that fails on its first line.
+  const svars = serverVariables(model)
+  const pyServerField = 0 === svars.length ? '' :
+    `\n    "server": {` +
+    svars.map((v: any) => `\n        "${v.name}": "<${v.name}>",`).join('') +
+    `\n    },`
+
   const apikeyImport = authActive ? `import os\n` : ''
   const ctor = authActive
-    ? `${model.const.Name}SDK({\n    "apikey": os.environ.get("${envName(model)}_APIKEY"),\n})`
-    : `${model.const.Name}SDK()`
+    ? `${model.const.Name}SDK({\n    "apikey": os.environ.get("${envName(model)}_APIKEY"),${pyServerField}\n})`
+    : ('' === pyServerField
+      ? `${model.const.Name}SDK()`
+      : `${model.const.Name}SDK({${pyServerField}\n})`)
 
   Content(`\`\`\`python
 ${apikeyImport}from ${model.const.Name.toLowerCase()}_sdk import ${model.const.Name}SDK

package/project/.sdk/src/cmp/py/TestDirect_py.ts

@@ -11,7 +11,9 @@ import {
   File,
   cmp,
   snakify,
-  isAuthActive, envName, envToken
+  isAuthActive,
+  serverVarEnv,
+  serverVariables, envName, envToken
 } from '@voxgig/sdkgen'
 
 
@@ -64,12 +66,26 @@ const TestDirect = cmp(function TestDirect(props: any) {
 
   const authActive = isAuthActive(model)
   const apikeyEnvEntry = authActive
-    ? `\n        "${PROJECTNAME}_APIKEY": "NONE",`
+    ? `\n        "${PROJECTNAME}_APIKEY": "",`
     : ''
   const apikeyLiveField = authActive
     ? `\n            "apikey": env.get("${PROJECTNAME}_APIKEY"),`
     : ''
 
+  // A templated server URL (OpenAPI server variables) makes a LIVE client
+  // impossible to construct without values: make_options raises rather than
+  // request a URL with a literal `{account_id}` in it. Taken from the
+  // environment, the same way the apikey is.
+  const svars = serverVariables(model)
+  const serverEnvEntry = svars
+    .map((v: any) => `\n        "${serverVarEnv(PROJECTNAME, v.name)}": ${JSON.stringify(v.dflt)},`).join('')
+  const serverLiveField = 0 === svars.length ? '' :
+    `\n            "server": {` +
+    svars.map((v: any) =>
+      `\n                "${v.name}": env.get("${serverVarEnv(PROJECTNAME, v.name)}"),`).join('') +
+    `\n            },`
+
+
   const opnames = Object.keys(entity.op || {})
   const hasLoad = opnames.includes('load')
   const hasList = opnames.includes('list')
@@ -337,14 +353,17 @@ def _${entity.name}_direct_setup(mockres):
 
     env = runner.env_override({
         "${entidEnvVar}": {},
-        "${PROJECTNAME}_TEST_LIVE": "FALSE",${apikeyEnvEntry}
+        "${PROJECTNAME}_TEST_LIVE": "FALSE",${apikeyEnvEntry}${serverEnvEntry}
     })
 
     live = env.get("${PROJECTNAME}_TEST_LIVE") == "TRUE"
 
     if live:
-        merged_opts = {${apikeyLiveField}
-        }
+        # sdk-test-control.json's test.client.options seeds the live
+        # client; the generated fields below overwrite anything they name.
+        merged_opts = dict(runner.live_client_options())
+        merged_opts.update({${apikeyLiveField}${serverLiveField}
+        })
         client = ${model.const.Name}SDK(merged_opts)
         return {
             "client": client,

package/project/.sdk/src/cmp/py/TestEntity_py.ts

@@ -24,6 +24,8 @@ import {
   buildIdNames,
   getMatchEntries,
   isAuthActive,
+  serverVarEnv,
+  serverVariables,
   entityDataIdField, envName, envToken
 } from '@voxgig/sdkgen'
 
@@ -60,12 +62,26 @@ const TestEntity = cmp(function TestEntity(props: any) {
 
   const authActive = isAuthActive(model)
   const apikeyEnvEntry = authActive
-    ? `\n        "${PROJUPPER}_APIKEY": "NONE",`
+    ? `\n        "${PROJUPPER}_APIKEY": "",`
     : ''
   const apikeyLiveField = authActive
     ? `\n                "apikey": env.get("${PROJUPPER}_APIKEY"),`
     : ''
 
+  // A templated server URL (OpenAPI server variables) makes a LIVE client
+  // impossible to construct without values: make_options raises rather than
+  // request a URL with a literal `{account_id}` in it. Taken from the
+  // environment, the same way the apikey is.
+  const svars = serverVariables(model)
+  const serverEnvEntry = svars
+    .map((v: any) => `\n        "${serverVarEnv(PROJUPPER, v.name)}": ${JSON.stringify(v.dflt)},`).join('')
+  const serverLiveField = 0 === svars.length ? '' :
+    `\n                "server": {` +
+    svars.map((v: any) =>
+      `\n                    "${v.name}": env.get("${serverVarEnv(PROJUPPER, v.name)}"),`).join('') +
+    `\n                },`
+
+
   const idnames = buildIdNames(entity, basicflow)
   const idnamesStr = idnames.map(n => `"${n}"`).join(', ')
 
@@ -235,7 +251,7 @@ def _${entity.name}_basic_setup(extra):
     env = runner.env_override({
         "${PROJUPPER}_TEST_${envToken(entity.name)}_ENTID": idmap,
         "${PROJUPPER}_TEST_LIVE": "FALSE",
-        "${PROJUPPER}_TEST_EXPLAIN": "FALSE",${apikeyEnvEntry}
+        "${PROJUPPER}_TEST_EXPLAIN": "FALSE",${apikeyEnvEntry}${serverEnvEntry}
     })
 
     idmap_resolved = helpers.to_map(
@@ -254,7 +270,11 @@ def _${entity.name}_basic_setup(extra):
     Content(`
     if env.get("${PROJUPPER}_TEST_LIVE") == "TRUE":
         merged_opts = vs.merge([
-            {${apikeyLiveField}
+            # FIRST, so the generated fields below win: sdk-test-control.json's
+            # test.client.options adds to the live client, it does not
+            # redirect it.
+            runner.live_client_options(),
+            {${apikeyLiveField}${serverLiveField}
             },
             extra or {},
         ])

package/project/.sdk/src/cmp/rb/Config_rb.ts

@@ -16,6 +16,7 @@ import {
   rawStringLiteral,
   resolveAuthPrefix,
   serverVariables,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -40,7 +41,10 @@ const Config = cmp(async function Config(props: any) {
   const model: Model = ctx$.model
 
   const entity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   const headers = getModelPath(model, `main.${KIT}.config.headers`) || {}
 

package/project/.sdk/src/cmp/rb/Main_rb.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -31,7 +32,10 @@ const Main = cmp(async function Main(props: any) {
   const { model } = props.ctx$
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   Package({ target })
 

package/project/.sdk/src/cmp/rust/Config_rust.ts

@@ -9,6 +9,7 @@ import {
   isAuthActive,
   isConfigData,
   resolveAuthPrefix,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -35,7 +36,10 @@ const Config = cmp(async function Config(props: any) {
   const model: Model = ctx$.model
 
   const entity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   const headers = getModelPath(model, `main.${KIT}.config.headers`) || {}
 

package/project/.sdk/src/cmp/rust/Main_rust.ts

@@ -5,6 +5,7 @@ import {
   cmp, each,
   File, Content, Copy, Folder, Fragment,
   entityClassName,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -35,7 +36,10 @@ const Main = cmp(async function Main(props: any) {
   const { model } = props.ctx$
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   // The rust crate identifier (RUSTCRATE placeholder), e.g. solar_sdk —
   // used in every `use <crate>::...` path in the test templates.

package/project/.sdk/src/cmp/scala/Config_scala.ts

@@ -6,6 +6,7 @@ import {
   each,
   isAuthActive,
   resolveAuthPrefix,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -35,7 +36,10 @@ const Config = cmp(async function Config(props: any) {
   const scalapackage = scalaPackage(model)
 
   const entity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   const headers = getModelPath(model, `main.${KIT}.config.headers`) || {}
 

package/project/.sdk/src/cmp/scala/Main_scala.ts

@@ -4,6 +4,7 @@ import * as Path from 'node:path'
 import {
   cmp, each,
   File, Content, Copy, Folder, Fragment,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -33,7 +34,10 @@ const Main = cmp(async function Main(props: any) {
   const { model } = props.ctx$
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   // The Scala package root for every runtime piece (like GOMODULE for go).
   const scalapackage = scalaPackage(model)

package/project/.sdk/src/cmp/swift/Config_swift.ts

@@ -5,6 +5,7 @@ import {
   cmp,
   configDefinition,
   each,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -26,7 +27,10 @@ const Config = cmp(async function Config(props: any) {
 
   const model: Model = ctx$.model
 
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   // The config as data, built by the shared helper so every target embeds
   // the same model by construction. Passing target.name opts this target

package/project/.sdk/src/cmp/ts/Config_ts.ts

@@ -18,6 +18,7 @@ import {
   isHttpBasicAuth,
   resolveAuthPrefix,
   serverVariables,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -41,7 +42,10 @@ const Config = cmp(async function Config(props: any) {
   const model: Model = ctx$.model
 
   const entity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   const ff = Path.normalize(__dirname + '/../../../src/cmp/ts/fragment/')
 

package/project/.sdk/src/cmp/ts/Main_ts.ts

@@ -5,6 +5,7 @@ import {
   cmp, each, names, cmap,
   List, File, Content, Copy, Folder, Fragment, Line, FeatureHook,
   entityClassName, entityCollection, srcFeatureExcludes, stationLibrary,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -35,7 +36,14 @@ const Main = cmp(async function Main(props: any) {
   const { model } = props.ctx$
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
+
+  // Does the secrets feature apply here and is it switched on? Both, since
+  // targetFeatures already dropped it for a target with no sekreto port.
+  const secrets = null != feature.secrets
 
   Package({ target })
 
@@ -74,6 +82,54 @@ const Main = cmp(async function Main(props: any) {
           replace: {
             ...props.ctx$.stdrep,
 
+            // SECRETS. All five slots are emitted only when the secrets
+            // feature applies to this target AND the model activates it.
+            // An unconditional edit here would land in every generated SDK
+            // and break the inactive-output gate: a model without the
+            // feature must generate byte-identically to pre-migration.
+            //
+            // `feature` is already gated by targetFeatures, so a target
+            // that does not provide 'sekreto' never reaches these.
+            '// #SecretsImport': () => secrets ?
+              Line(`import * as sekreto from './feature/secrets/sekreto'`) : undefined,
+
+            '// #SecretsField': ({ indent }: any) => secrets ?
+              Line({ indent }, '_secrets?: any') : undefined,
+
+            // The LIVE instance, not a clone: sekreto holds provider and
+            // cache state, so a clone would resolve into a copy that
+            // prepareAuth never sees.
+            '// #SecretsAccessor': ({ indent }: any) => secrets ?
+              Content({ indent }, `
+secrets() {
+  return this._secrets && this._secrets.sekreto()
+}
+`) : undefined,
+
+            // prepare() bypasses the feature hook pipeline, so the PreSpec
+            // hook that resolves the secret for entity ops never runs on
+            // this path and the resolve has to be explicit.
+            //
+            // It RETURNS the Error rather than rejecting: _rawRequest
+            // awaits prepare() outside its try, and direct()/graphql() are
+            // documented to return a value or an Error, never reject. The
+            // prototype rejected here, which would have turned a broken
+            // vault into an unhandled rejection on the direct path.
+            '// #SecretsResolve': ({ indent }: any) => secrets ?
+              Content({ indent }, `
+if (null != this._secrets) {
+  try {
+    await this._secrets.resolve()
+  }
+  catch (err: any) {
+    return err instanceof Error ? err : new Error(String(err))
+  }
+}
+`) : undefined,
+
+            '// #SecretsExport': ({ indent }: any) => secrets ?
+              Line({ indent }, 'sekreto,') : undefined,
+
             '#BuildFeatures': ({ indent }: any) => {
               List({ item: feature, line: false }, ({ item }: any) =>
                 Line({ indent },

package/project/.sdk/src/cmp/ts/Package_ts.ts

@@ -13,6 +13,7 @@ import {
   PUBLISHER_URL,
   packageVersion,
   authorInfo,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -36,7 +37,9 @@ const Package = cmp(async function Package(props: any) {
   // constant here did.
   const author = authorInfo(model, target.name)
 
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by applicability: a feature that does not apply to this
+  // target must not inject its deps into the generated manifest.
+  const feature = targetFeatures(model, target)
 
   const only = (kind: string, deps: any) =>
     omap(deps, ([k, v]: any) => [v.active && kind === v.kind ? k : undefined, v.version])

package/project/.sdk/src/cmp/ts/ReadmeModel_ts.ts

@@ -1,5 +1,5 @@
 
-import { cmp, each, Content, isAuthActive, isHttpBasicAuth } from '@voxgig/sdkgen'
+import { cmp, each, Content, isAuthActive, isHttpBasicAuth, serverVariables } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -61,12 +61,24 @@ const ReadmeModel = cmp(function ReadmeModel(props: any) {
     ? '| `secret` | `string` | API secret for authentication. |\n'
     : ''
 
+  // Server variables are not one option among many: without them the
+  // constructor THROWS, because the base URL is a template. Documented
+  // first for that reason, and named individually so a reader knows what
+  // to supply without going back to the spec.
+  const svars = serverVariables(model)
+  const serverOptionType = 0 === svars.length ? '' :
+    `\n  server?: { ${svars.map((v: any) => `${v.name}: string`).join(', ')} }`
+  const serverOptionRow = 0 === svars.length ? '' :
+    '| `server` | `object` | **Required.** Values for the server-URL variables: ' +
+    svars.map((v: any) => '`' + v.name + '`').join(', ') +
+    '. The API base URL is a template over them. |\n'
+
   Content(`### ${model.const.Name}SDK
 
 #### Constructor
 
 \`\`\`ts
-new ${model.const.Name}SDK(options?: {${apikeyOptionType}${secretOptionType}
+new ${model.const.Name}SDK(options?: {${apikeyOptionType}${secretOptionType}${serverOptionType}
   base?: string
   prefix?: string
   suffix?: string
@@ -77,7 +89,7 @@ new ${model.const.Name}SDK(options?: {${apikeyOptionType}${secretOptionType}
 
 | Option | Type | Description |
 | --- | --- | --- |
-${apikeyOptionRow}${secretOptionRow}| \`base\` | \`string\` | Base URL of the API server. |
+${serverOptionRow}${apikeyOptionRow}${secretOptionRow}| \`base\` | \`string\` | Base URL of the API server. |
 | \`prefix\` | \`string\` | URL path prefix prepended to all requests. |
 | \`suffix\` | \`string\` | URL path suffix appended to all requests. |
 | \`feature\` | \`object\` | Feature activation flags (e.g. \`{ test: { active: true } }\`). |

package/project/.sdk/src/cmp/ts/ReadmeQuick_ts.ts

@@ -1,5 +1,5 @@
 
-import { cmp, each, Content, isAuthActive, isHttpBasicAuth, packageName, envName, opRequestShape, entityIdField, entityDataIdField, entityOps, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
+import { cmp, each, Content, isAuthActive, isHttpBasicAuth, packageName, envName, serverVariables, opRequestShape, entityIdField, entityDataIdField, entityOps, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -40,10 +40,23 @@ const ReadmeQuick = cmp(function ReadmeQuick(props: any) {
       !it.optional && it.name !== entityIdField(e))
   ) as any
 
-  const ctor = isAuthActive(model)
-    ? `new ${model.const.Name}SDK({\n  apikey: process.env.${envName(model)}_APIKEY,${
-      isHttpBasicAuth(model) ? `\n  secret: process.env.${envName(model)}_SECRET,` : ''}\n})`
-    : `new ${model.const.Name}SDK()`
+  // Server variables (a templated server URL) are REQUIRED at construction
+  // — makeOptions refuses rather than request a URL with a literal
+  // `{account_id}` in it — so a quickstart that omits them is a quickstart
+  // that throws on its first line.
+  const svarLines = serverVariables(model)
+    .map((v: any) => `\n    ${v.name}: '<${v.name}>',`).join('')
+  const serverField = '' === svarLines ? '' :
+    `\n  // Required: this API's server URL is templated on these.\n  server: {${svarLines}\n  },`
+
+  const ctorFields = (isAuthActive(model)
+    ? `\n  apikey: process.env.${envName(model)}_APIKEY,${
+      isHttpBasicAuth(model) ? `\n  secret: process.env.${envName(model)}_SECRET,` : ''}`
+    : '') + serverField
+
+  const ctor = '' === ctorFields
+    ? `new ${model.const.Name}SDK()`
+    : `new ${model.const.Name}SDK({${ctorFields}\n})`
 
   Content(`### 1. Create a client
 

package/project/.sdk/src/cmp/ts/ReadmeTopQuick_ts.ts

@@ -1,5 +1,5 @@
 
-import { cmp, Content, isAuthActive, isHttpBasicAuth, packageName, envName, entityIdField, entityOps, opRequestShape, safeVarName, exampleVarName, jsKey, matchArg, idLiteral } from '@voxgig/sdkgen'
+import { cmp, Content, isAuthActive, isHttpBasicAuth, packageName, envName, entityIdField, entityOps, opRequestShape, safeVarName, exampleVarName, jsKey, matchArg, idLiteral , serverVariables} from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -28,10 +28,24 @@ const ReadmeTopQuick = cmp(function ReadmeTopQuick(props: any) {
   const exampleEntity = Object.values(entity).find((e: any) => e.active !== false) as any
 
   const authActive = isAuthActive(model)
-  const ctor = authActive
-    ? `new ${model.const.Name}SDK({\n  apikey: process.env.${envName(model)}_APIKEY,${
-      isHttpBasicAuth(model) ? `\n  secret: process.env.${envName(model)}_SECRET,` : ''}\n})`
-    : `new ${model.const.Name}SDK()`
+
+  // Server variables (a templated server URL) are REQUIRED at construction
+  // - makeOptions refuses rather than request a URL with a literal
+  // {account_id} in it - so a quickstart that omits them is a quickstart
+  // that throws on its first line.
+  const svarLines = serverVariables(model)
+    .map((v: any) => `\n    ${v.name}: '<${v.name}>',`).join('')
+  const serverField = '' === svarLines ? '' :
+    `\n  // Required: this API's server URL is templated on these.\n  server: {${svarLines}\n  },`
+
+  const ctorFields = (authActive
+    ? `\n  apikey: process.env.${envName(model)}_APIKEY,${
+      isHttpBasicAuth(model) ? `\n  secret: process.env.${envName(model)}_SECRET,` : ''}`
+    : '') + serverField
+
+  const ctor = '' === ctorFields
+    ? `new ${model.const.Name}SDK()`
+    : `new ${model.const.Name}SDK({${ctorFields}\n})`
 
   Content(`\`\`\`ts
 import { ${model.const.Name}SDK } from '${packageName(model, target.name)}'

package/project/.sdk/src/cmp/ts/TestDirect_ts.ts

@@ -17,6 +17,8 @@ import {
   cmp,
   snakify,
   isAuthActive,
+  serverVarEnv,
+  serverVariables,
   isHttpBasicAuth,
   jsProp,
   jsOptProp, envName, envToken, liveStrict
@@ -47,7 +49,7 @@ const TestDirect = cmp(function TestDirect(props: any) {
   const authActive = isAuthActive(model)
   const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyEnvEntry = authActive
-    ? `\n    '${PROJECTNAME}_APIKEY': 'NONE',${authBasic ? `\n    '${PROJECTNAME}_SECRET': 'NONE',` : ''}`
+    ? `\n    '${PROJECTNAME}_APIKEY': '',${authBasic ? `\n    '${PROJECTNAME}_SECRET': 'NONE',` : ''}`
     : ''
   const apikeyLiveField = authActive
     ? `
@@ -55,6 +57,19 @@ const TestDirect = cmp(function TestDirect(props: any) {
       secret: env.${PROJECTNAME}_SECRET,` : ''}`
     : ''
 
+  // A templated server URL (OpenAPI server variables) makes a LIVE client
+  // impossible to construct without values: makeOptions raises rather than
+  // request a URL with a literal `{account_id}` in it. Taken from the
+  // environment, the same way the apikey is.
+  const svars = serverVariables(model)
+  const serverEnvEntry = svars
+    .map((v: any) => `\n    '${serverVarEnv(PROJECTNAME, v.name)}': ${JSON.stringify(v.dflt)},`).join('')
+  const serverLiveField = 0 === svars.length ? '' : `
+      server: {${svars
+      .map((v: any) => `
+        ${v.name}: env.${serverVarEnv(PROJECTNAME, v.name)},`).join('')}
+      },`
+
   const opnames = Object.keys(entity.op || {})
   const hasLoad = opnames.includes('load')
   const hasList = opnames.includes('list')
@@ -86,14 +101,17 @@ function directSetup(mockres?: any) {
 
   const env = envOverride({
     '${entidEnvVar}': {},
-    '${PROJECTNAME}_TEST_LIVE': 'FALSE',${apikeyEnvEntry}
+    '${PROJECTNAME}_TEST_LIVE': 'FALSE',${apikeyEnvEntry}${serverEnvEntry}
   })
 
   const live = 'TRUE' === env.${PROJECTNAME}_TEST_LIVE
 
   if (live) {
-    const client = new ${nom(model.const, 'Name')}SDK({${apikeyLiveField}
-    })
+    // Merged so the generated fields win: sdk-test-control.json's
+    // test.client.options adds to the live client, it does not redirect it.
+    const client = new ${nom(model.const, 'Name')}SDK(
+      Object.assign({}, liveClientOptions(), {${apikeyLiveField}${serverLiveField}
+      }))
 
     let idmap: any = env['${entidEnvVar}']
     if ('string' === typeof idmap && idmap.startsWith('{')) {
@@ -210,7 +228,21 @@ function generateDirectGraphql(
 ${varAsserts}`
 
   const checks = strict ?
-    offlineChecks.replace(/^ {6}/gm, '    ').replace(/^ {4}$/gm, '') :
+    `    if (setup.live) {
+      // STRICT live mode: a non-2xx is a real failure - this project owns
+      // the server it points at, so there is nothing to be lenient about.
+      //
+      // What is NOT asserted here is the MOCK's own fixtures. \`direct01\`
+      // is a scripted id and \`calls\` records the mock transport; neither
+      // exists on a live run, so asserting them made strict mode mean
+      // "compare the live server against the mock's script" - a suite that
+      // could not pass against any real API, including this project's own.
+      assert(result.ok === true,
+        'live request failed: ' + result.status + ' ' + JSON.stringify(result.data))
+      assert(result.status >= 200 && result.status < 300)
+      assert(null != result.data)
+    } else {
+${offlineChecks}    }` :
     `    if (setup.live) {
       // Live mode is lenient: synthetic ids frequently fail server-side
       // validation. Skip rather than fail when the call doesn't come back
@@ -429,7 +461,21 @@ ${loadParams.map((p: any, i: number) => `      ${jsProp('params', p.name)} = 'di
 ${paramAsserts}`
 
   const loadChecks = strict ?
-    offlineChecks.replace(/^ {6}/gm, '    ').replace(/^ {4}$/gm, '') :
+    `    if (setup.live) {
+      // STRICT live mode: a non-2xx is a real failure - this project owns
+      // the server it points at, so there is nothing to be lenient about.
+      //
+      // What is NOT asserted here is the MOCK's own fixtures. \`direct01\`
+      // is a scripted id and \`calls\` records the mock transport; neither
+      // exists on a live run, so asserting them made strict mode mean
+      // "compare the live server against the mock's script" - a suite that
+      // could not pass against any real API, including this project's own.
+      assert(result.ok === true,
+        'live request failed: ' + result.status + ' ' + JSON.stringify(result.data))
+      assert(result.status >= 200 && result.status < 300)
+      assert(null != result.data)
+    } else {
+${offlineChecks}    }` :
     `    if (setup.live) {
       // Live mode is lenient: synthetic IDs frequently 4xx. Skip rather
       // than fail when the load endpoint isn't reachable with the IDs we
@@ -543,7 +589,21 @@ ${mockLines}
 ${paramAsserts}`
 
   const listChecks = strict ?
-    offlineChecks.replace(/^ {6}/gm, '    ').replace(/^ {4}$/gm, '') :
+    `    if (setup.live) {
+      // STRICT live mode: a non-2xx is a real failure - this project owns
+      // the server it points at, so there is nothing to be lenient about.
+      //
+      // What is NOT asserted here is the MOCK's own fixtures. \`direct01\`
+      // is a scripted id and \`calls\` records the mock transport; neither
+      // exists on a live run, so asserting them made strict mode mean
+      // "compare the live server against the mock's script" - a suite that
+      // could not pass against any real API, including this project's own.
+      assert(result.ok === true,
+        'live request failed: ' + result.status + ' ' + JSON.stringify(result.data))
+      assert(result.status >= 200 && result.status < 300)
+      assert(null != result.data)
+    } else {
+${offlineChecks}    }` :
     `    if (setup.live) {
       // Live mode is lenient: synthetic IDs frequently 4xx and the list-
       // response shape varies wildly across public APIs. Skip rather than