@voxgig/sdkgen 4.5.3 → 4.6.0

package/project/.sdk/src/cmp/ts/TestEntity_ts.ts

@@ -30,6 +30,8 @@ import {
   cmp,
   each,
   isAuthActive,
+  serverVarEnv,
+  serverVariables,
   isHttpBasicAuth,
   entityDataIdField, envName, envToken
 } from '@voxgig/sdkgen'
@@ -67,7 +69,7 @@ const TestEntity = cmp(function TestEntity(props: any) {
   const authActive = isAuthActive(model)
   const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyEnvEntry = authActive
-    ? `\n    '${PROJENVNAME}_APIKEY': 'NONE',${authBasic ? `\n    '${PROJENVNAME}_SECRET': 'NONE',` : ''}`
+    ? `\n    '${PROJENVNAME}_APIKEY': '',${authBasic ? `\n    '${PROJENVNAME}_SECRET': 'NONE',` : ''}`
     : ''
   const apikeyLiveField = authActive
     ? `
@@ -75,6 +77,19 @@ const TestEntity = cmp(function TestEntity(props: any) {
         secret: env.${PROJENVNAME}_SECRET,` : ''}`
     : ''
 
+  // A templated server URL (OpenAPI server variables) makes a LIVE client
+  // impossible to construct without values: makeOptions raises rather than
+  // request a URL with a literal `{account_id}` in it. So the live suite
+  // takes them from the environment the same way it takes the apikey.
+  const svars = serverVariables(model)
+  const serverEnvEntry = svars
+    .map((v: any) => `\n    '${serverVarEnv(PROJENVNAME, v.name)}': ${JSON.stringify(v.dflt)},`).join('')
+  const serverLiveField = 0 === svars.length ? '' : `
+        server: {${svars
+      .map((v: any) => `
+          ${v.name}: env.${serverVarEnv(PROJENVNAME, v.name)},`).join('')}
+        },`
+
   // TODO: should be a utility function
   const ff = projectPath('src/cmp/ts/fragment/')
 
@@ -156,7 +171,7 @@ function basicSetup(extra?: any) {
   const env = envOverride({
     '${PROJENVNAME}_TEST_${ENTENVNAME}_ENTID': idmap,
     '${PROJENVNAME}_TEST_LIVE': 'FALSE',
-    '${PROJENVNAME}_TEST_EXPLAIN': 'FALSE',${apikeyEnvEntry}
+    '${PROJENVNAME}_TEST_EXPLAIN': 'FALSE',${apikeyEnvEntry}${serverEnvEntry}
   })
 
   idmap = env['${PROJENVNAME}_TEST_${ENTENVNAME}_ENTID']
@@ -165,9 +180,17 @@ function basicSetup(extra?: any) {
 
   if (live) {
     client = new ${model.Name}SDK(merge([
-      {${apikeyLiveField}
+      // FIRST, so the generated fields below win: sdk-test-control.json's
+      // test.client.options adds to the live client, it does not redirect it.
+      liveClientOptions(),
+      {${apikeyLiveField}${serverLiveField}
       },
-      extra
+      // 'extra || {}', not a bare 'extra': struct.merge returns UNDEFINED when the
+      // last entry is undefined, and basicSetup is normally called with no
+      // argument at all - so a bare 'extra' silently discarded the apikey
+      // and server values above and handed the SDK undefined. Harmless
+      // while there was nothing in that object; not harmless now.
+      extra || {}
     ]))
   }
 

package/project/.sdk/src/cmp/ts/fragment/Direct.test.fragment.ts

@@ -1,6 +1,4 @@
 
-const envlocal = __dirname + '/../../../.env.local'
-require('dotenv').config({ quiet: true, path: [envlocal] })
 
 import { test, describe, afterEach } from 'node:test'
 import assert from 'node:assert'
@@ -10,12 +8,21 @@ import { ProjectNameSDK } from '../../..'
 
 import {
   envOverride,
+  liveClientOptions,
   liveDelay,
+  loadEnvLocal,
   maybeSkipControl,
   skipIfMissingIds,
 } from '../../utility'
 
 
+// AFTER the imports on purpose: TypeScript hoists `import` above any
+// statement in the emitted CommonJS, so a loader placed above them would
+// run only after every imported module had already been evaluated - and
+// anything reading process.env at module scope would miss these values.
+loadEnvLocal(__dirname + '/../../../.env.local')
+
+
 describe('EntityNameDirect', async () => {
 
   // Per-test live pacing. Delay is read from sdk-test-control.json's

package/project/.sdk/src/cmp/ts/fragment/Entity.test.fragment.ts

@@ -1,6 +1,4 @@
 
-const envlocal = __dirname + '/../../../.env.local'
-require('dotenv').config({ quiet: true, path: [envlocal] })
 
 import Path from 'node:path'
 import * as Fs from 'node:fs'
@@ -13,7 +11,9 @@ import { ProjectNameSDK, BaseFeature, stdutil } from '../../..'
 
 import {
   envOverride,
+  liveClientOptions,
   liveDelay,
+  loadEnvLocal,
   makeCtrl,
   makeMatch,
   makeReqdata,
@@ -23,6 +23,13 @@ import {
 } from '../../utility'
 
 
+// AFTER the imports on purpose: TypeScript hoists `import` above any
+// statement in the emitted CommonJS, so a loader placed above them would
+// run only after every imported module had already been evaluated - and
+// anything reading process.env at module scope would miss these values.
+loadEnvLocal(__dirname + '/../../../.env.local')
+
+
 describe('EntityNameEntity', async () => {
 
   // Per-test live pacing. Delay is read from sdk-test-control.json's

package/project/.sdk/src/cmp/ts/fragment/Main.fragment.ts

@@ -9,6 +9,7 @@ import { Utility } from './utility/Utility'
 
 
 import { BaseFeature } from './feature/base/BaseFeature'
+// #SecretsImport
 
 
 const stdutil = new Utility()
@@ -20,6 +21,7 @@ class ProjectNameSDK {
   _utility = new Utility()
   _features: Feature[]
   _rootctx: Context
+  // #SecretsField
 
   constructor(options?: any) {
 
@@ -92,6 +94,8 @@ class ProjectNameSDK {
     return this._utility.struct.clone(this._utility)
   }
 
+  // #SecretsAccessor
+
 
   async prepare(fetchargs?: any) {
     const utility = this._utility
@@ -138,6 +142,8 @@ class ProjectNameSDK {
       }
     }
 
+    // #SecretsResolve
+
     // Apply SDK auth (apikey, auth prefix, etc.)
     const authResult = prepareAuth(ctx)
     if (authResult instanceof Error) {
@@ -334,6 +340,7 @@ const SDK = ProjectNameSDK
 export {
   stdutil,
   config,
+  // #SecretsExport
 
   BaseFeature,
   ProjectNameEntityBase,

package/project/.sdk/src/cmp/zig/Config_zig.ts

@@ -8,6 +8,7 @@ import {
   each,
   isAuthActive,
   isConfigData,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -32,7 +33,10 @@ const Config = cmp(async function Config(props: any) {
 
   const model: Model = ctx$.model
 
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   // The canonical config OBJECT and its JSON, from the shared helper. Both
   // representations render from the same `def`, so they cannot describe

package/project/.sdk/tm/c/utility/make_options.c

@@ -22,6 +22,23 @@ voxgig_value* make_options_util(Context* ctx) {
     }
   }
 
+  /* `auth: null` is the documented way to disable auth outright, and
+   * prepare_auth honours it before it ever reads the apikey. validate would
+   * erase it: this port follows the Group A rule, so a stored null reads as
+   * "no value" and the optspec's `auth` default fires instead - transmitting
+   * the credential the caller withheld. Put the null back afterwards.
+   *
+   * Unlike js, no delete-before-validate is needed here: Group A means
+   * validate DEFAULTS rather than rejecting, so the key can travel through.
+   *
+   * Read the map DIRECTLY rather than through getp, which applies that same
+   * rule and so cannot tell an absent auth from a suppressed one. */
+  bool auth_suppressed = false;
+  if (voxgig_is_map(options)) {
+    voxgig_value* authval = voxgig_map_get(voxgig_as_map(options), "auth");
+    auth_suppressed = (NULL != authval && voxgig_is_null(authval));
+  }
+
   voxgig_value* opts = voxgig_clone(options);
 
   // Feature add-order. options.feature may be an ordered list of
@@ -93,6 +110,11 @@ voxgig_value* make_options_util(Context* ctx) {
     opts = validated;
   }
 
+  /* Restore the suppression the optspec default would otherwise erase. */
+  if (auth_suppressed) {
+    setp(opts, "auth", voxgig_new_null());
+  }
+
   // Restore system.fetch.
   if (!v_is_noval(sys_fetch)) {
     voxgig_value* sys = getp(opts, "system");

package/project/.sdk/tm/clojure/src/sdk/core.clj

@@ -988,7 +988,22 @@
             (if (and member (not= member :custom) (contains? members member))
               (oset! util member v)
               (.put ^java.util.Map (oget util :custom) k v))))))
-    (let [opts0 (let [c (vs/clone options)] (if (vs/ismap c) c (vs/jm)))
+    (let [;; `auth` nil is the documented way to disable auth outright, and
+          ;; u-prepare-auth honours it before it ever reads the apikey. It
+          ;; cannot survive validate: a stored null reads as "no value", so the
+          ;; optspec's `auth` default fires and the suppression silently
+          ;; becomes "use default auth" - transmitting the credential the
+          ;; caller withheld. Withhold the key for validate, then put the nil
+          ;; back. Same fix as ts/js/go makeOptions.
+          ;;
+          ;; `.containsKey` rather than a nil check on the value: the latter
+          ;; cannot tell an ABSENT auth from a suppressed one, and only the
+          ;; second is a suppression.
+          auth-suppressed (and (vs/ismap options)
+                               (.containsKey ^java.util.Map options "auth")
+                               (nil? (.get ^java.util.Map options "auth")))
+          opts0 (let [c (vs/clone options)] (if (vs/ismap c) c (vs/jm)))
+          _ (when auth-suppressed (.remove ^java.util.Map opts0 "auth"))
           ;; Feature add-order. options.feature may be given as an ordered
           ;; ARRAY of {name active ...opts} entries (array position = add
           ;; order) or a {name {opts}} map. Normalize an array to a map (so
@@ -1037,6 +1052,8 @@
           merged (vs/merge (vs/jt (vs/jm) cfgopts opts0))
           validated (vs/validate merged optspec)
           opts (if (vs/ismap validated) validated (vs/jm))
+          ;; Restore the suppression the optspec default would otherwise erase.
+          _ (when auth-suppressed (.put ^java.util.Map opts "auth" nil))
           ;; Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
           ;; Every placeholder must resolve to a non-empty value: from
           ;; options["server"] (user), else the config default. A placeholder

package/project/.sdk/tm/cpp/utility/pipeline.hpp

@@ -1107,8 +1107,26 @@ inline Value makeOptions(CtxPtr ctx) {
     }
   }
 
+  // `auth: null` is the documented way to disable auth outright, and
+  // prepareAuth honours it before it ever reads the apikey. It cannot survive
+  // validate: this port follows the Group A rule, so a stored null reads as
+  // "no value" and the optspec's `auth` default fires instead - transmitting
+  // the credential the caller withheld. Withhold the key for validate, then
+  // put the null back. Same fix as ts/js/go makeOptions.
+  //
+  // mapget rather than getp: getp applies Group A and collapses a stored null
+  // to undef, so it cannot tell an ABSENT auth from a suppressed one. And the
+  // test is is_null, NOT is_nullish - a present-but-UNDEF auth is a missing
+  // value, which the ts/js reference lets the optspec default fill in. Only an
+  // explicit null is a suppression.
+  bool authSuppressed = mapget(options, "auth").is_null();
+
   Value opts = Struct::clone(options);
 
+  if (authSuppressed) {
+    map_remove(opts, "auth");
+  }
+
   // Feature add-order. options.feature may be an ordered list of
   // { name, active, ...opts } entries (the list position IS the order in which
   // features are added), or a { name: {opts} } map. Normalize a list to a map
@@ -1159,6 +1177,11 @@ inline Value makeOptions(CtxPtr ctx) {
   Value validated = Struct::validate(merged, optspec, vopts);
   opts = validated;
 
+  // Restore the suppression the optspec default would otherwise erase.
+  if (authSuppressed) {
+    map_put(opts, "auth", Value(nullptr));
+  }
+
   if (!is_nullish(sysFetch)) {
     Value sys = Helpers::toMapAny(getp(opts, "system"));
     if (sys.is_map()) {

package/project/.sdk/tm/csharp/test/CustomUtilityTest.cs

@@ -85,8 +85,13 @@ public class CustomUtilityTest
         // transport: 'base' - it REPLACES the transport by design - so a client
         // in test mode would shadow the scripted fetcher and this would assert
         // nothing.
+        // ["test"] is the OPTION, not the `test` FEATURE: it says "this
+        // client is not live", so a REQUIRED OpenAPI server variable resolves
+        // to a deterministic test-<name> instead of failing construction. It
+        // installs no transport, so the override under test still stands.
         var client = new ProjectNameSDK(new Dictionary<string, object?>
         {
+            ["test"] = new Dictionary<string, object?> { ["active"] = true },
             ["utility"] = new Dictionary<string, object?> { ["fetcher"] = scripted },
         });
 
@@ -122,8 +127,13 @@ public class CustomUtilityTest
             };
         };
 
+        // ["test"] is the OPTION, not the `test` FEATURE: it says "this
+        // client is not live", so a REQUIRED OpenAPI server variable resolves
+        // to a deterministic test-<name> instead of failing construction. It
+        // installs no transport, so the override under test still stands.
         var client = new ProjectNameSDK(new Dictionary<string, object?>
         {
+            ["test"] = new Dictionary<string, object?> { ["active"] = true },
             ["utility"] = new Dictionary<string, object?> { ["fetcher"] = scripted },
         });
 
@@ -141,8 +151,13 @@ public class CustomUtilityTest
     [Fact]
     public void AnUnknownKeyIsStillAttached()
     {
+        // ["test"] is the OPTION, not the `test` FEATURE: it says "this
+        // client is not live", so a REQUIRED OpenAPI server variable resolves
+        // to a deterministic test-<name> instead of failing construction. It
+        // installs no transport, so the override under test still stands.
         var client = new ProjectNameSDK(new Dictionary<string, object?>
         {
+            ["test"] = new Dictionary<string, object?> { ["active"] = true },
             ["utility"] = new Dictionary<string, object?>
             {
                 ["notAUtilityMember"] = Util("EXTRA"),

package/project/.sdk/tm/csharp/utility/MakeOptions.cs

@@ -114,9 +114,26 @@ public static partial class SdkUtility
             }
         }
 
+        // `auth: null` is the documented way to disable auth outright, and
+        // PrepareAuth honours it before it ever reads the apikey. It cannot
+        // survive validate: depending on the struct port a stored null is
+        // either REPLACED by the optspec default - transmitting the credential
+        // the caller withheld - or REJECTED outright. Withhold the key for
+        // validate, then put the null back. Same fix as ts/js/go makeOptions.
+        //
+        // Suppliedness cannot be recovered after validate, hence here, and it
+        // must tell an ABSENT auth from a present null: TryGetValue rather
+        // than an indexer null check, which cannot distinguish them.
+        var authSuppressed = options.TryGetValue("auth", out var authval) && null == authval;
+
         var opts = StructUtils.Clone(options) as Dictionary<string, object?>
             ?? new Dictionary<string, object?>();
 
+        if (authSuppressed)
+        {
+            opts.Remove("auth");
+        }
+
         // Feature add-order. options.feature may be given as an ordered LIST of
         // { name, active, ...opts } entries (the list position IS the order in
         // which features are added), or as a { name: {opts} } map. Normalize a
@@ -230,6 +247,12 @@ public static partial class SdkUtility
         var validated = StructUtils.Validate(merged, optspec);
         opts = validated as Dictionary<string, object?> ?? new Dictionary<string, object?>();
 
+        // Restore the suppression the optspec default would otherwise erase.
+        if (authSuppressed)
+        {
+            opts["auth"] = null;
+        }
+
         // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
         // Every placeholder must resolve to a non-empty value: from
         // options.server (user), else the Config default. A placeholder that

package/project/.sdk/tm/dart/lib/utility/MakeOptionsUtility.dart

@@ -106,12 +106,34 @@ dynamic makeOptions(dynamic ctx) {
     mergeOptions['feature'] = fmap;
   }
 
+  // `auth: null` is the documented way to disable auth outright, and
+  // prepareAuth honours it before it ever reads the apikey. It cannot survive
+  // validate: depending on the struct port a stored null is either REPLACED
+  // by the optspec default — transmitting the credential the caller withheld
+  // — or REJECTED outright. Withhold the key for validate, then put the null
+  // back. Same fix as ts/js/go makeOptions.
+  //
+  // Suppliedness cannot be recovered after validate, hence here, and it must
+  // tell an ABSENT auth from a present null: containsKey rather than a null
+  // check on the value, which cannot distinguish them.
+  final authSuppressed =
+      options is Map && options.containsKey('auth') && null == options['auth'];
+
   // User option maps are cloned first — their (possibly narrow) literal
   // types must not constrain the merged structures.
   dynamic opts = vs.merge([{}, cfgopts, vs.clone(mergeOptions)]);
 
+  if (authSuppressed && opts is Map) {
+    opts.remove('auth');
+  }
+
   opts = vs.validate(opts, optspec);
 
+  // Restore the suppression the optspec default would otherwise erase.
+  if (authSuppressed && opts is Map) {
+    opts['auth'] = null;
+  }
+
   // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
   // Every placeholder must resolve to a non-empty value: from options.server
   // (user), else the Config default. A placeholder that resolves to '' is a

package/project/.sdk/tm/elixir/lib/projectname/utility.ex

@@ -243,8 +243,24 @@ defmodule ProjectName.Utility do
       end
     end
 
+    # `auth` nil is the documented way to disable auth outright, and
+    # prepare_auth honours it before it ever reads the apikey. It cannot
+    # survive validate: a stored null reads as "no value", so the optspec's
+    # `auth` default fires and the suppression silently becomes "use default
+    # auth" - transmitting the credential the caller withheld. Withhold the
+    # key for validate, then put the nil back. Same fix as ts/js/go
+    # makeOptions.
+    #
+    # keysof rather than S.haskey: haskey is `getprop(...) != nil`, which
+    # collapses a stored null and so cannot tell an ABSENT auth from a
+    # suppressed one. keysof lists the key either way.
+    auth_suppressed =
+      S.ismap(options) and "auth" in S.keysof(options) and
+        S.getprop(options, "auth") == nil
+
     opts0 = S.clone(options)
     opts0 = if S.ismap(opts0), do: opts0, else: S.jm([])
+    if auth_suppressed, do: S.delprop(opts0, "auth")
 
     # Feature add-order. options.feature may be given as an ordered LIST of
     # {name, active, ...opts} entries (list position = add order) or a
@@ -329,6 +345,9 @@ defmodule ProjectName.Utility do
     validated = S.validate(merged, optspec)
     opts = if S.ismap(validated), do: validated, else: S.jm([])
 
+    # Restore the suppression the optspec default would otherwise erase.
+    if auth_suppressed, do: S.setprop(opts, "auth", nil)
+
     # Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
     # Every placeholder must resolve to a non-empty value: from options.server
     # (user), else the Config default. A placeholder that resolves to "" is a

package/project/.sdk/tm/go/core/context.go

@@ -245,7 +245,7 @@ func (ctx *Context) resolveOp(opname string) *Operation {
 		return NewOperation(map[string]any{})
 	}
 
-	opcfg := vs.GetPath([]any{"entity", entname, "op", opname}, ctx.Config)
+	opcfg := vs.GetPath(ctx.Config, []any{"entity", entname, "op", opname})
 
 	input := "match"
 	if opname == "update" || opname == "create" {

package/project/.sdk/tm/go/feature/cost_feature.go

@@ -367,7 +367,7 @@ func (f *CostFeature) body(ctx *core.Context) (float64, bool) {
 		return 0, false
 	}
 
-	switch n := vs.GetPath(path, ctx.Result.Body).(type) {
+	switch n := vs.GetPath(ctx.Result.Body, path).(type) {
 	case int:
 		return float64(n) * f.perUnit(), true
 	case int64:

package/project/.sdk/tm/go/feature/paging_feature.go

@@ -109,7 +109,7 @@ func (f *PagingFeature) graphqlPreRequest(ctx *core.Context, paging map[string]a
 	// Only bind variables the operation actually declares, or the server
 	// rejects the document.
 	declared := map[string]bool{}
-	if varlist, ok := vs.GetPath([]any{"graphql", "vars"}, ctx.Point).([]any); ok {
+	if varlist, ok := vs.GetPath(ctx.Point, []any{"graphql", "vars"}).([]any); ok {
 		for _, v := range varlist {
 			if name, ok := vs.GetProp(v, "name").(string); ok {
 				declared[name] = true
@@ -160,7 +160,7 @@ func (f *PagingFeature) PreResult(ctx *core.Context) {
 
 	// Relay connections carry the cursor in pageInfo, at the path the model
 	// recorded for this op.
-	page := vs.GetPath([]any{"graphql", "page"}, ctx.Point)
+	page := vs.GetPath(ctx.Point, []any{"graphql", "page"})
 	if pm, ok := page.(map[string]any); ok {
 		if _, isMap := body.(map[string]any); isMap {
 			// `connpath` locates the connection object inside the response
@@ -168,18 +168,18 @@ func (f *PagingFeature) PreResult(ctx *core.Context) {
 			// to it.
 			conn := body
 			if cp, ok := pm["connpath"].(string); ok && cp != "" {
-				if sub := vs.GetPath(cp, body); sub != nil {
+				if sub := vs.GetPath(body, cp); sub != nil {
 					conn = sub
 				}
 			}
 
 			if cp, ok := pm["cursor"].(string); ok && cp != "" {
-				if cursor := vs.GetPath(cp, conn); cursor != nil {
+				if cursor := vs.GetPath(conn, cp); cursor != nil {
 					paging["cursor"] = cursor
 				}
 			}
 			if mp, ok := pm["more"].(string); ok && mp != "" {
-				if more, ok := vs.GetPath(mp, conn).(bool); ok {
+				if more, ok := vs.GetPath(conn, mp).(bool); ok {
 					paging["hasMore"] = more
 					explicitMore = true
 				}

package/project/.sdk/tm/go/feature/test_feature.go

@@ -323,7 +323,7 @@ func (f *TestFeature) buildArgs(ctx *core.Context, op *core.Operation, args map[
 	// back to, so the seed-data query is built from the endpoint the request
 	// will actually be sent to: a terminal `{id}` marks a record route, and
 	// failing that the shallower path wins.
-	points := vs.GetPath([]any{"entity", ctx.Entity.GetName(), "op", opname, "points"}, ctx.Config)
+	points := vs.GetPath(ctx.Config, []any{"entity", ctx.Entity.GetName(), "op", opname, "points"})
 	point := vs.GetElem(points, 0)
 	if plist, ok := points.([]any); ok {
 		partsLen := func(p any) int {
@@ -355,12 +355,19 @@ func (f *TestFeature) buildArgs(ctx *core.Context, op *core.Operation, args map[
 
 	// Path AND query: a path-only read misses a query-addressed record
 	// (e.g. GET /result?trace_id=), which has no path param at all.
-	paramsPath := vs.GetPath([]any{"args", "params"}, point)
+	paramsPath := vs.GetPath(point, []any{"args", "params"})
 	reqdParams := vs.Select(paramsPath, map[string]any{"reqd": true})
-	reqdFromParams := vs.Transform(reqdParams, []any{"`$EACH`", "", "`$KEY.name`"})
-	queryPath := vs.GetPath([]any{"args", "query"}, point)
+	// The error return Transform gained in struct go 0.1.3 is discarded
+	// DELIBERATELY here, unlike in transform_request/response: these two
+	// transform a spec the SDK itself built from the point definition, not
+	// user data, so an error means a generator bug rather than something a
+	// caller can act on — and buildArgs has no error seam to route it
+	// through. An empty result is the conservative outcome: no required
+	// fields, which is what an absent spec already produces.
+	reqdFromParams, _ := vs.Transform(reqdParams, []any{"`$EACH`", "", "`$KEY.name`"})
+	queryPath := vs.GetPath(point, []any{"args", "query"})
 	reqdQuery := vs.Select(queryPath, map[string]any{"reqd": true})
-	reqdFromQuery := vs.Transform(reqdQuery, []any{"`$EACH`", "", "`$KEY.name`"})
+	reqdFromQuery, _ := vs.Transform(reqdQuery, []any{"`$EACH`", "", "`$KEY.name`"})
 
 	qand := []any{}
 	q := map[string]any{"`$AND`": &qand}

package/project/.sdk/tm/go/test/custom_utility_test.go

@@ -109,7 +109,12 @@ func TestCustomUtility(t *testing.T) {
 		// that was broken: a plain function literal in a map[string]any has the
 		// unnamed signature, so an override that only accepted the named type
 		// shelved it in Custom. Converting here would have hidden that.
+		// "test" is the OPTION, not the `test` FEATURE: it says "this client
+		// is not live", so a REQUIRED OpenAPI server variable resolves to a
+		// deterministic test-<name> instead of panicking at construction. It
+		// installs no transport, so the override under test still stands.
 		client := sdk.NewProjectNameSDK(map[string]any{
+			"test":    map[string]any{"active": true},
 			"utility": map[string]any{"fetcher": scripted},
 		})
 
@@ -138,7 +143,12 @@ func TestCustomUtility(t *testing.T) {
 	// the subtest above, and broken by any fix that swaps one for the other.
 	t.Run("a converted fetcher is accepted too", func(t *testing.T) {
 		reached := 0
+		// "test" is the OPTION, not the `test` FEATURE: it says "this client
+		// is not live", so a REQUIRED OpenAPI server variable resolves to a
+		// deterministic test-<name> instead of panicking at construction. It
+		// installs no transport, so the override under test still stands.
 		client := sdk.NewProjectNameSDK(map[string]any{
+			"test": map[string]any{"active": true},
 			"utility": map[string]any{
 				"fetcher": sdk.FetcherFunc(func(
 					ctx *sdk.Context, fullurl string, fetchdef map[string]any,
@@ -171,7 +181,12 @@ func TestCustomUtility(t *testing.T) {
 	// An unknown key must still be attached rather than dropped, so the two
 	// halves cannot be satisfied by a switch that also swallows extras.
 	t.Run("an unknown key is still attached", func(t *testing.T) {
+		// "test" is the OPTION, not the `test` FEATURE: it says "this client
+		// is not live", so a REQUIRED OpenAPI server variable resolves to a
+		// deterministic test-<name> instead of panicking at construction. It
+		// installs no transport, so the override under test still stands.
 		client := sdk.NewProjectNameSDK(map[string]any{
+			"test": map[string]any{"active": true},
 			"utility": map[string]any{
 				"notAUtilityMember": func() string { return "EXTRA" },
 			},

package/project/.sdk/tm/go/test/feature_corpus_test.go

@@ -114,7 +114,14 @@ func fcFetcher(res []any) sdk.FetcherFunc {
 // REPLACES the transport, so a client in test mode would shadow the script.
 func fcClient(kase map[string]any) *sdk.ProjectNameSDK {
 	res, _ := kase["res"].([]any)
+	// "test" here is the OPTION, not the `test` FEATURE. It says "this
+	// client is not live", which is what makes a REQUIRED OpenAPI server
+	// variable resolve to a deterministic test-<name> rather than panic at
+	// construction (see makeOptions). It installs no transport, so the
+	// scripted fetcher still stands — the FEATURE is transport: 'base' and
+	// would shadow it, which is why this cannot just turn the feature on.
 	opts := map[string]any{
+		"test":    map[string]any{"active": true},
 		"utility": map[string]any{"fetcher": fcFetcher(res)},
 	}
 	if f, ok := kase["feature"]; ok {

package/project/.sdk/tm/go/test/runner_test.go

@@ -156,6 +156,52 @@ func isControlSkipped(kind, name, mode string) (bool, string) {
 }
 
 // liveDelayMs returns the configured per-test live delay in ms; default 500.
+// liveClientOptions returns the extra SDK options every LIVE client is
+// constructed with, from sdk-test-control.json `test.client.options`.
+//
+// The generated live client knows two things: the base URL (from the spec)
+// and the credential (from the environment). Everything else about how a
+// particular API wants to be talked to - which features to switch on, and
+// with what settings - is a property of THAT API, known to the project and
+// to nothing in the toolchain.
+//
+// Merged UNDER the generated fields, so the suite's own base/apikey/server
+// values win: this ADDS to the live client, it does not redirect it.
+//
+// That contract is enforced HERE rather than left to each merge site: the
+// generated map only names a field when the model calls for one, so a
+// "base" in this block would face no competing value and would silently
+// redirect the whole suite - credential included - to another host.
+var liveReserved = map[string]bool{
+	"base": true, "prefix": true, "suffix": true,
+	"server": true, "apikey": true, "secret": true,
+}
+
+func liveClientOptions() map[string]any {
+	ctrl := loadTestControl()
+	test, _ := ctrl["test"].(map[string]any)
+	if test == nil {
+		return map[string]any{}
+	}
+	client, _ := test["client"].(map[string]any)
+	if client == nil {
+		return map[string]any{}
+	}
+	opts, _ := client["options"].(map[string]any)
+	if opts == nil {
+		return map[string]any{}
+	}
+
+	out := map[string]any{}
+	for k, v := range opts {
+		if !liveReserved[k] {
+			out[k] = v
+		}
+	}
+	return out
+}
+
+
 func liveDelayMs() int {
 	ctrl := loadTestControl()
 	test, _ := ctrl["test"].(map[string]any)