@voxgig/sdkgen 4.5.3 → 4.7.0

package/project/.sdk/src/cmp/ts/TestDirect_ts.ts

@@ -17,9 +17,12 @@ import {
   cmp,
   snakify,
   isAuthActive,
+  serverVarEnv,
+  serverVariables,
   isHttpBasicAuth,
   jsProp,
-  jsOptProp, envName, envToken, liveStrict
+  jsOptProp, envName, envToken, liveStrict,
+  jsKey
 } from '@voxgig/sdkgen'
 
 
@@ -47,7 +50,7 @@ const TestDirect = cmp(function TestDirect(props: any) {
   const authActive = isAuthActive(model)
   const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyEnvEntry = authActive
-    ? `\n    '${PROJECTNAME}_APIKEY': 'NONE',${authBasic ? `\n    '${PROJECTNAME}_SECRET': 'NONE',` : ''}`
+    ? `\n    '${PROJECTNAME}_APIKEY': '',${authBasic ? `\n    '${PROJECTNAME}_SECRET': '',` : ''}`
     : ''
   const apikeyLiveField = authActive
     ? `
@@ -55,6 +58,25 @@ const TestDirect = cmp(function TestDirect(props: any) {
       secret: env.${PROJECTNAME}_SECRET,` : ''}`
     : ''
 
+  // A templated server URL (OpenAPI server variables) makes a LIVE client
+  // impossible to construct without values: makeOptions raises rather than
+  // request a URL with a literal `{account_id}` in it. Taken from the
+  // environment, the same way the apikey is.
+  //
+  // Keys are quoted and the env read is bracketed via jsKey/jsProp: a server
+  // variable name is spec-derived and need not be a JS identifier — the URL
+  // grammar admits a leading digit ({2fa}), and a declared-but-unreferenced
+  // variable ({edge-zone}) is not constrained at all. Bare `name:` and
+  // `env.PROJ_SERVER_EDGE-ZONE` are both syntax errors.
+  const svars = serverVariables(model)
+  const serverEnvEntry = svars
+    .map((v: any) => `\n    '${serverVarEnv(PROJECTNAME, v.name)}': ${JSON.stringify(v.dflt)},`).join('')
+  const serverLiveField = 0 === svars.length ? '' : `
+      server: {${svars
+      .map((v: any) => `
+        ${jsKey(v.name)}: ${jsProp('env', serverVarEnv(PROJECTNAME, v.name))},`).join('')}
+      },`
+
   const opnames = Object.keys(entity.op || {})
   const hasLoad = opnames.includes('load')
   const hasList = opnames.includes('list')
@@ -86,14 +108,17 @@ function directSetup(mockres?: any) {
 
   const env = envOverride({
     '${entidEnvVar}': {},
-    '${PROJECTNAME}_TEST_LIVE': 'FALSE',${apikeyEnvEntry}
+    '${PROJECTNAME}_TEST_LIVE': 'FALSE',${apikeyEnvEntry}${serverEnvEntry}
   })
 
   const live = 'TRUE' === env.${PROJECTNAME}_TEST_LIVE
 
   if (live) {
-    const client = new ${nom(model.const, 'Name')}SDK({${apikeyLiveField}
-    })
+    // Merged so the generated fields win: sdk-test-control.json's
+    // test.client.options adds to the live client, it does not redirect it.
+    const client = new ${nom(model.const, 'Name')}SDK(
+      Object.assign({}, liveClientOptions(), {${apikeyLiveField}${serverLiveField}
+      }))
 
     let idmap: any = env['${entidEnvVar}']
     if ('string' === typeof idmap && idmap.startsWith('{')) {
@@ -210,7 +235,21 @@ function generateDirectGraphql(
 ${varAsserts}`
 
   const checks = strict ?
-    offlineChecks.replace(/^ {6}/gm, '    ').replace(/^ {4}$/gm, '') :
+    `    if (setup.live) {
+      // STRICT live mode: a non-2xx is a real failure - this project owns
+      // the server it points at, so there is nothing to be lenient about.
+      //
+      // What is NOT asserted here is the MOCK's own fixtures. \`direct01\`
+      // is a scripted id and \`calls\` records the mock transport; neither
+      // exists on a live run, so asserting them made strict mode mean
+      // "compare the live server against the mock's script" - a suite that
+      // could not pass against any real API, including this project's own.
+      assert(result.ok === true,
+        'live request failed: ' + result.status + ' ' + JSON.stringify(result.data))
+      assert(result.status >= 200 && result.status < 300)
+      assert(null != result.data)
+    } else {
+${offlineChecks}    }` :
     `    if (setup.live) {
       // Live mode is lenient: synthetic ids frequently fail server-side
       // validation. Skip rather than fail when the call doesn't come back
@@ -429,7 +468,21 @@ ${loadParams.map((p: any, i: number) => `      ${jsProp('params', p.name)} = 'di
 ${paramAsserts}`
 
   const loadChecks = strict ?
-    offlineChecks.replace(/^ {6}/gm, '    ').replace(/^ {4}$/gm, '') :
+    `    if (setup.live) {
+      // STRICT live mode: a non-2xx is a real failure - this project owns
+      // the server it points at, so there is nothing to be lenient about.
+      //
+      // What is NOT asserted here is the MOCK's own fixtures. \`direct01\`
+      // is a scripted id and \`calls\` records the mock transport; neither
+      // exists on a live run, so asserting them made strict mode mean
+      // "compare the live server against the mock's script" - a suite that
+      // could not pass against any real API, including this project's own.
+      assert(result.ok === true,
+        'live request failed: ' + result.status + ' ' + JSON.stringify(result.data))
+      assert(result.status >= 200 && result.status < 300)
+      assert(null != result.data)
+    } else {
+${offlineChecks}    }` :
     `    if (setup.live) {
       // Live mode is lenient: synthetic IDs frequently 4xx. Skip rather
       // than fail when the load endpoint isn't reachable with the IDs we
@@ -543,7 +596,21 @@ ${mockLines}
 ${paramAsserts}`
 
   const listChecks = strict ?
-    offlineChecks.replace(/^ {6}/gm, '    ').replace(/^ {4}$/gm, '') :
+    `    if (setup.live) {
+      // STRICT live mode: a non-2xx is a real failure - this project owns
+      // the server it points at, so there is nothing to be lenient about.
+      //
+      // What is NOT asserted here is the MOCK's own fixtures. \`direct01\`
+      // is a scripted id and \`calls\` records the mock transport; neither
+      // exists on a live run, so asserting them made strict mode mean
+      // "compare the live server against the mock's script" - a suite that
+      // could not pass against any real API, including this project's own.
+      assert(result.ok === true,
+        'live request failed: ' + result.status + ' ' + JSON.stringify(result.data))
+      assert(result.status >= 200 && result.status < 300)
+      assert(null != result.data)
+    } else {
+${offlineChecks}    }` :
     `    if (setup.live) {
       // Live mode is lenient: synthetic IDs frequently 4xx and the list-
       // response shape varies wildly across public APIs. Skip rather than

package/project/.sdk/src/cmp/ts/TestEntity_ts.ts

@@ -30,8 +30,12 @@ import {
   cmp,
   each,
   isAuthActive,
+  serverVarEnv,
+  serverVariables,
   isHttpBasicAuth,
-  entityDataIdField, envName, envToken
+  entityDataIdField, envName, envToken,
+  jsKey,
+  jsProp
 } from '@voxgig/sdkgen'
 
 
@@ -67,7 +71,7 @@ const TestEntity = cmp(function TestEntity(props: any) {
   const authActive = isAuthActive(model)
   const authBasic = authActive && isHttpBasicAuth(model)
   const apikeyEnvEntry = authActive
-    ? `\n    '${PROJENVNAME}_APIKEY': 'NONE',${authBasic ? `\n    '${PROJENVNAME}_SECRET': 'NONE',` : ''}`
+    ? `\n    '${PROJENVNAME}_APIKEY': '',${authBasic ? `\n    '${PROJENVNAME}_SECRET': '',` : ''}`
     : ''
   const apikeyLiveField = authActive
     ? `
@@ -75,6 +79,25 @@ const TestEntity = cmp(function TestEntity(props: any) {
         secret: env.${PROJENVNAME}_SECRET,` : ''}`
     : ''
 
+  // A templated server URL (OpenAPI server variables) makes a LIVE client
+  // impossible to construct without values: makeOptions raises rather than
+  // request a URL with a literal `{account_id}` in it. So the live suite
+  // takes them from the environment the same way it takes the apikey.
+  //
+  // Keys are quoted and the env read is bracketed via jsKey/jsProp: a server
+  // variable name is spec-derived and need not be a JS identifier — the URL
+  // grammar admits a leading digit ({2fa}), and a declared-but-unreferenced
+  // variable ({edge-zone}) is not constrained at all. Bare `name:` and
+  // `env.PROJ_SERVER_EDGE-ZONE` are both syntax errors.
+  const svars = serverVariables(model)
+  const serverEnvEntry = svars
+    .map((v: any) => `\n    '${serverVarEnv(PROJENVNAME, v.name)}': ${JSON.stringify(v.dflt)},`).join('')
+  const serverLiveField = 0 === svars.length ? '' : `
+        server: {${svars
+      .map((v: any) => `
+          ${jsKey(v.name)}: ${jsProp('env', serverVarEnv(PROJENVNAME, v.name))},`).join('')}
+        },`
+
   // TODO: should be a utility function
   const ff = projectPath('src/cmp/ts/fragment/')
 
@@ -156,7 +179,7 @@ function basicSetup(extra?: any) {
   const env = envOverride({
     '${PROJENVNAME}_TEST_${ENTENVNAME}_ENTID': idmap,
     '${PROJENVNAME}_TEST_LIVE': 'FALSE',
-    '${PROJENVNAME}_TEST_EXPLAIN': 'FALSE',${apikeyEnvEntry}
+    '${PROJENVNAME}_TEST_EXPLAIN': 'FALSE',${apikeyEnvEntry}${serverEnvEntry}
   })
 
   idmap = env['${PROJENVNAME}_TEST_${ENTENVNAME}_ENTID']
@@ -165,9 +188,17 @@ function basicSetup(extra?: any) {
 
   if (live) {
     client = new ${model.Name}SDK(merge([
-      {${apikeyLiveField}
+      // FIRST, so the generated fields below win: sdk-test-control.json's
+      // test.client.options adds to the live client, it does not redirect it.
+      liveClientOptions(),
+      {${apikeyLiveField}${serverLiveField}
       },
-      extra
+      // 'extra || {}', not a bare 'extra': struct.merge returns UNDEFINED when the
+      // last entry is undefined, and basicSetup is normally called with no
+      // argument at all - so a bare 'extra' silently discarded the apikey
+      // and server values above and handed the SDK undefined. Harmless
+      // while there was nothing in that object; not harmless now.
+      extra || {}
     ]))
   }
 

package/project/.sdk/src/cmp/ts/Test_ts.ts

@@ -3,7 +3,8 @@ import type {
   ModelEntity
 } from '@voxgig/apidef'
 
-import { cmp, each, Folder, entityCollection } from '@voxgig/sdkgen'
+import { cmp, each, Folder, entityCollection,
+  TestControl } from '@voxgig/sdkgen'
 
 
 // import { Quick } from './Quick_ts'
@@ -19,6 +20,9 @@ const Test = cmp(function Test(props: any) {
   const { target } = props
 
   Folder({ name: 'test' }, () => {
+
+    // Write-once: a project's edited control file survives regeneration.
+    TestControl({ target, dir: 'test' })
     // Quick({ target })
     // TestMain({ target })
 

package/project/.sdk/src/cmp/ts/fragment/Direct.test.fragment.ts

@@ -1,6 +1,4 @@
 
-const envlocal = __dirname + '/../../../.env.local'
-require('dotenv').config({ quiet: true, path: [envlocal] })
 
 import { test, describe, afterEach } from 'node:test'
 import assert from 'node:assert'
@@ -10,12 +8,21 @@ import { ProjectNameSDK } from '../../..'
 
 import {
   envOverride,
+  liveClientOptions,
   liveDelay,
+  loadEnvLocal,
   maybeSkipControl,
   skipIfMissingIds,
 } from '../../utility'
 
 
+// AFTER the imports on purpose: TypeScript hoists `import` above any
+// statement in the emitted CommonJS, so a loader placed above them would
+// run only after every imported module had already been evaluated - and
+// anything reading process.env at module scope would miss these values.
+loadEnvLocal(__dirname + '/../../../.env.local')
+
+
 describe('EntityNameDirect', async () => {
 
   // Per-test live pacing. Delay is read from sdk-test-control.json's

package/project/.sdk/src/cmp/ts/fragment/Entity.test.fragment.ts

@@ -1,6 +1,4 @@
 
-const envlocal = __dirname + '/../../../.env.local'
-require('dotenv').config({ quiet: true, path: [envlocal] })
 
 import Path from 'node:path'
 import * as Fs from 'node:fs'
@@ -13,7 +11,9 @@ import { ProjectNameSDK, BaseFeature, stdutil } from '../../..'
 
 import {
   envOverride,
+  liveClientOptions,
   liveDelay,
+  loadEnvLocal,
   makeCtrl,
   makeMatch,
   makeReqdata,
@@ -23,6 +23,13 @@ import {
 } from '../../utility'
 
 
+// AFTER the imports on purpose: TypeScript hoists `import` above any
+// statement in the emitted CommonJS, so a loader placed above them would
+// run only after every imported module had already been evaluated - and
+// anything reading process.env at module scope would miss these values.
+loadEnvLocal(__dirname + '/../../../.env.local')
+
+
 describe('EntityNameEntity', async () => {
 
   // Per-test live pacing. Delay is read from sdk-test-control.json's

package/project/.sdk/src/cmp/ts/fragment/Main.fragment.ts

@@ -9,6 +9,7 @@ import { Utility } from './utility/Utility'
 
 
 import { BaseFeature } from './feature/base/BaseFeature'
+// #SecretsImport
 
 
 const stdutil = new Utility()
@@ -20,6 +21,7 @@ class ProjectNameSDK {
   _utility = new Utility()
   _features: Feature[]
   _rootctx: Context
+  // #SecretsField
 
   constructor(options?: any) {
 
@@ -92,6 +94,8 @@ class ProjectNameSDK {
     return this._utility.struct.clone(this._utility)
   }
 
+  // #SecretsAccessor
+
 
   async prepare(fetchargs?: any) {
     const utility = this._utility
@@ -138,6 +142,8 @@ class ProjectNameSDK {
       }
     }
 
+    // #SecretsResolve
+
     // Apply SDK auth (apikey, auth prefix, etc.)
     const authResult = prepareAuth(ctx)
     if (authResult instanceof Error) {
@@ -334,6 +340,7 @@ const SDK = ProjectNameSDK
 export {
   stdutil,
   config,
+  // #SecretsExport
 
   BaseFeature,
   ProjectNameEntityBase,

package/project/.sdk/src/cmp/zig/Config_zig.ts

@@ -8,6 +8,7 @@ import {
   each,
   isAuthActive,
   isConfigData,
+  targetFeatures,
 } from '@voxgig/sdkgen'
 
 
@@ -32,7 +33,10 @@ const Config = cmp(async function Config(props: any) {
 
   const model: Model = ctx$.model
 
-  const feature = getModelPath(model, `main.${KIT}.feature`)
+  // Gated by the applicability tags, so this target never imports or
+  // registers a feature it has no source for. One rule, one place:
+  // helpers/applicability.
+  const feature = targetFeatures(model, target)
 
   // The canonical config OBJECT and its JSON, from the shared helper. Both
   // representations render from the same `def`, so they cannot describe

package/project/.sdk/tm/c/utility/make_options.c

@@ -22,6 +22,23 @@ voxgig_value* make_options_util(Context* ctx) {
     }
   }
 
+  /* `auth: null` is the documented way to disable auth outright, and
+   * prepare_auth honours it before it ever reads the apikey. validate would
+   * erase it: this port follows the Group A rule, so a stored null reads as
+   * "no value" and the optspec's `auth` default fires instead - transmitting
+   * the credential the caller withheld. Put the null back afterwards.
+   *
+   * Unlike js, no delete-before-validate is needed here: Group A means
+   * validate DEFAULTS rather than rejecting, so the key can travel through.
+   *
+   * Read the map DIRECTLY rather than through getp, which applies that same
+   * rule and so cannot tell an absent auth from a suppressed one. */
+  bool auth_suppressed = false;
+  if (voxgig_is_map(options)) {
+    voxgig_value* authval = voxgig_map_get(voxgig_as_map(options), "auth");
+    auth_suppressed = (NULL != authval && voxgig_is_null(authval));
+  }
+
   voxgig_value* opts = voxgig_clone(options);
 
   // Feature add-order. options.feature may be an ordered list of
@@ -93,6 +110,11 @@ voxgig_value* make_options_util(Context* ctx) {
     opts = validated;
   }
 
+  /* Restore the suppression the optspec default would otherwise erase. */
+  if (auth_suppressed) {
+    setp(opts, "auth", voxgig_new_null());
+  }
+
   // Restore system.fetch.
   if (!v_is_noval(sys_fetch)) {
     voxgig_value* sys = getp(opts, "system");

package/project/.sdk/tm/clojure/src/sdk/core.clj

@@ -988,7 +988,22 @@
             (if (and member (not= member :custom) (contains? members member))
               (oset! util member v)
               (.put ^java.util.Map (oget util :custom) k v))))))
-    (let [opts0 (let [c (vs/clone options)] (if (vs/ismap c) c (vs/jm)))
+    (let [;; `auth` nil is the documented way to disable auth outright, and
+          ;; u-prepare-auth honours it before it ever reads the apikey. It
+          ;; cannot survive validate: a stored null reads as "no value", so the
+          ;; optspec's `auth` default fires and the suppression silently
+          ;; becomes "use default auth" - transmitting the credential the
+          ;; caller withheld. Withhold the key for validate, then put the nil
+          ;; back. Same fix as ts/js/go makeOptions.
+          ;;
+          ;; `.containsKey` rather than a nil check on the value: the latter
+          ;; cannot tell an ABSENT auth from a suppressed one, and only the
+          ;; second is a suppression.
+          auth-suppressed (and (vs/ismap options)
+                               (.containsKey ^java.util.Map options "auth")
+                               (nil? (.get ^java.util.Map options "auth")))
+          opts0 (let [c (vs/clone options)] (if (vs/ismap c) c (vs/jm)))
+          _ (when auth-suppressed (.remove ^java.util.Map opts0 "auth"))
           ;; Feature add-order. options.feature may be given as an ordered
           ;; ARRAY of {name active ...opts} entries (array position = add
           ;; order) or a {name {opts}} map. Normalize an array to a map (so
@@ -1037,6 +1052,8 @@
           merged (vs/merge (vs/jt (vs/jm) cfgopts opts0))
           validated (vs/validate merged optspec)
           opts (if (vs/ismap validated) validated (vs/jm))
+          ;; Restore the suppression the optspec default would otherwise erase.
+          _ (when auth-suppressed (.put ^java.util.Map opts "auth" nil))
           ;; Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
           ;; Every placeholder must resolve to a non-empty value: from
           ;; options["server"] (user), else the config default. A placeholder

package/project/.sdk/tm/cpp/utility/pipeline.hpp

@@ -1107,8 +1107,26 @@ inline Value makeOptions(CtxPtr ctx) {
     }
   }
 
+  // `auth: null` is the documented way to disable auth outright, and
+  // prepareAuth honours it before it ever reads the apikey. It cannot survive
+  // validate: this port follows the Group A rule, so a stored null reads as
+  // "no value" and the optspec's `auth` default fires instead - transmitting
+  // the credential the caller withheld. Withhold the key for validate, then
+  // put the null back. Same fix as ts/js/go makeOptions.
+  //
+  // mapget rather than getp: getp applies Group A and collapses a stored null
+  // to undef, so it cannot tell an ABSENT auth from a suppressed one. And the
+  // test is is_null, NOT is_nullish - a present-but-UNDEF auth is a missing
+  // value, which the ts/js reference lets the optspec default fill in. Only an
+  // explicit null is a suppression.
+  bool authSuppressed = mapget(options, "auth").is_null();
+
   Value opts = Struct::clone(options);
 
+  if (authSuppressed) {
+    map_remove(opts, "auth");
+  }
+
   // Feature add-order. options.feature may be an ordered list of
   // { name, active, ...opts } entries (the list position IS the order in which
   // features are added), or a { name: {opts} } map. Normalize a list to a map
@@ -1159,6 +1177,11 @@ inline Value makeOptions(CtxPtr ctx) {
   Value validated = Struct::validate(merged, optspec, vopts);
   opts = validated;
 
+  // Restore the suppression the optspec default would otherwise erase.
+  if (authSuppressed) {
+    map_put(opts, "auth", Value(nullptr));
+  }
+
   if (!is_nullish(sysFetch)) {
     Value sys = Helpers::toMapAny(getp(opts, "system"));
     if (sys.is_map()) {

package/project/.sdk/tm/csharp/test/CustomUtilityTest.cs

@@ -85,8 +85,13 @@ public class CustomUtilityTest
         // transport: 'base' - it REPLACES the transport by design - so a client
         // in test mode would shadow the scripted fetcher and this would assert
         // nothing.
+        // ["test"] is the OPTION, not the `test` FEATURE: it says "this
+        // client is not live", so a REQUIRED OpenAPI server variable resolves
+        // to a deterministic test-<name> instead of failing construction. It
+        // installs no transport, so the override under test still stands.
         var client = new ProjectNameSDK(new Dictionary<string, object?>
         {
+            ["test"] = new Dictionary<string, object?> { ["active"] = true },
             ["utility"] = new Dictionary<string, object?> { ["fetcher"] = scripted },
         });
 
@@ -122,8 +127,13 @@ public class CustomUtilityTest
             };
         };
 
+        // ["test"] is the OPTION, not the `test` FEATURE: it says "this
+        // client is not live", so a REQUIRED OpenAPI server variable resolves
+        // to a deterministic test-<name> instead of failing construction. It
+        // installs no transport, so the override under test still stands.
         var client = new ProjectNameSDK(new Dictionary<string, object?>
         {
+            ["test"] = new Dictionary<string, object?> { ["active"] = true },
             ["utility"] = new Dictionary<string, object?> { ["fetcher"] = scripted },
         });
 
@@ -141,8 +151,13 @@ public class CustomUtilityTest
     [Fact]
     public void AnUnknownKeyIsStillAttached()
     {
+        // ["test"] is the OPTION, not the `test` FEATURE: it says "this
+        // client is not live", so a REQUIRED OpenAPI server variable resolves
+        // to a deterministic test-<name> instead of failing construction. It
+        // installs no transport, so the override under test still stands.
         var client = new ProjectNameSDK(new Dictionary<string, object?>
         {
+            ["test"] = new Dictionary<string, object?> { ["active"] = true },
             ["utility"] = new Dictionary<string, object?>
             {
                 ["notAUtilityMember"] = Util("EXTRA"),

package/project/.sdk/tm/csharp/test/Runner.cs

@@ -153,6 +153,51 @@ public static class TestRunner
         return _testControl;
     }
 
+    // LiveClientOptions returns the extra SDK options every LIVE client is
+    // constructed with, read from sdk-test-control.json `test.client.options`.
+    //
+    // The generated live client knows two things: the base URL (from the
+    // spec) and the credential (from the environment). Everything else about
+    // how a particular API wants to be talked to - which features to switch
+    // on, and with what settings - is a property of THAT API, known to the
+    // project and to nothing in the toolchain.
+    //
+    // Merged UNDER the generated fields, so the suite's own
+    // base/apikey/server values win: this ADDS to the live client, it does
+    // not redirect it.
+    //
+    // Reserved fields are stripped HERE rather than at each merge site: the
+    // generated dictionary only names a field when the model calls for one,
+    // so a "base" in this block would face no competing value and would
+    // silently redirect the whole suite - credential included - to another
+    // host.
+    private static readonly string[] LiveReserved =
+        { "base", "prefix", "suffix", "server", "apikey", "secret" };
+
+    public static Dictionary<string, object?> LiveClientOptions()
+    {
+        var ctrl = LoadTestControl();
+        if (!ctrl.TryGetValue("test", out var testRaw) ||
+            testRaw is not Dictionary<string, object?> test ||
+            !test.TryGetValue("client", out var clientRaw) ||
+            clientRaw is not Dictionary<string, object?> client ||
+            !client.TryGetValue("options", out var optsRaw) ||
+            optsRaw is not Dictionary<string, object?> opts)
+        {
+            return new Dictionary<string, object?>();
+        }
+
+        var out_ = new Dictionary<string, object?>();
+        foreach (var kv in opts)
+        {
+            if (Array.IndexOf(LiveReserved, kv.Key) < 0)
+            {
+                out_[kv.Key] = kv.Value;
+            }
+        }
+        return out_;
+    }
+
     // IsControlSkipped checks sdk-test-control.json for a skip entry.
     // Returns (skip, reason).
     public static (bool, string) IsControlSkipped(string kind, string name, string mode)

package/project/.sdk/tm/csharp/utility/MakeOptions.cs

@@ -114,9 +114,26 @@ public static partial class SdkUtility
             }
         }
 
+        // `auth: null` is the documented way to disable auth outright, and
+        // PrepareAuth honours it before it ever reads the apikey. It cannot
+        // survive validate: depending on the struct port a stored null is
+        // either REPLACED by the optspec default - transmitting the credential
+        // the caller withheld - or REJECTED outright. Withhold the key for
+        // validate, then put the null back. Same fix as ts/js/go makeOptions.
+        //
+        // Suppliedness cannot be recovered after validate, hence here, and it
+        // must tell an ABSENT auth from a present null: TryGetValue rather
+        // than an indexer null check, which cannot distinguish them.
+        var authSuppressed = options.TryGetValue("auth", out var authval) && null == authval;
+
         var opts = StructUtils.Clone(options) as Dictionary<string, object?>
             ?? new Dictionary<string, object?>();
 
+        if (authSuppressed)
+        {
+            opts.Remove("auth");
+        }
+
         // Feature add-order. options.feature may be given as an ordered LIST of
         // { name, active, ...opts } entries (the list position IS the order in
         // which features are added), or as a { name: {opts} } map. Normalize a
@@ -230,6 +247,12 @@ public static partial class SdkUtility
         var validated = StructUtils.Validate(merged, optspec);
         opts = validated as Dictionary<string, object?> ?? new Dictionary<string, object?>();
 
+        // Restore the suppression the optspec default would otherwise erase.
+        if (authSuppressed)
+        {
+            opts["auth"] = null;
+        }
+
         // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
         // Every placeholder must resolve to a non-empty value: from
         // options.server (user), else the Config default. A placeholder that

package/project/.sdk/tm/dart/lib/utility/MakeOptionsUtility.dart

@@ -106,12 +106,34 @@ dynamic makeOptions(dynamic ctx) {
     mergeOptions['feature'] = fmap;
   }
 
+  // `auth: null` is the documented way to disable auth outright, and
+  // prepareAuth honours it before it ever reads the apikey. It cannot survive
+  // validate: depending on the struct port a stored null is either REPLACED
+  // by the optspec default — transmitting the credential the caller withheld
+  // — or REJECTED outright. Withhold the key for validate, then put the null
+  // back. Same fix as ts/js/go makeOptions.
+  //
+  // Suppliedness cannot be recovered after validate, hence here, and it must
+  // tell an ABSENT auth from a present null: containsKey rather than a null
+  // check on the value, which cannot distinguish them.
+  final authSuppressed =
+      options is Map && options.containsKey('auth') && null == options['auth'];
+
   // User option maps are cloned first — their (possibly narrow) literal
   // types must not constrain the merged structures.
   dynamic opts = vs.merge([{}, cfgopts, vs.clone(mergeOptions)]);
 
+  if (authSuppressed && opts is Map) {
+    opts.remove('auth');
+  }
+
   opts = vs.validate(opts, optspec);
 
+  // Restore the suppression the optspec default would otherwise erase.
+  if (authSuppressed && opts is Map) {
+    opts['auth'] = null;
+  }
+
   // Resolve a templated base URL (e.g. https://{tenant_id}.hanko.io).
   // Every placeholder must resolve to a non-empty value: from options.server
   // (user), else the Config default. A placeholder that resolves to '' is a