@voxgig/sdkgen 1.3.7 → 1.3.9

package/project/.sdk/tm/clojure/src/sdk/features.clj

@@ -0,0 +1,1027 @@
+;; ProjectName SDK features (generated by @voxgig/sdkgen).
+;;
+;; Each feature is an atom wrapping a map. Metadata (:name :active :version
+;; :_options) lives under keyword keys; the pipeline hook methods live under
+;; string keys ("init", "PrePoint", "PreRequest", ...) so the language-neutral
+;; feature-hook dispatch can look them up by hook name; per-feature mutable
+;; state (counters, caches, spans, seeds) lives in the SAME atom under keyword
+;; keys, mutated in place by the hook closures. Transport-wrapping features
+;; replace ctx.utility.fetcher in their init; hook features implement stage
+;; hooks. All features are inactive by default and self-gate on
+;; options["active"].
+
+(ns sdk.features
+  (:require [sdk.core :as core]
+            [voxgig.struct :as vs]
+            [clojure.string :as str]))
+
+(defn- mget
+  ([m k] (when (instance? java.util.Map m) (.get ^java.util.Map m k)))
+  ([m k d] (let [v (mget m k)] (if (nil? v) d v))))
+
+(defn- opt
+  ([fa k] (mget (:options @fa) k))
+  ([fa k d] (mget (:options @fa) k d)))
+
+(defn- active? [fa] (true? (:active @fa)))
+(defn- opts-active? [options] (= true (mget options "active")))
+
+(defn- now-ms [fa]
+  (let [n (opt fa "now")] (if (fn? n) (n) (System/currentTimeMillis))))
+
+(defn- sleep-ms [fa ms]
+  (when (and (some? ms) (number? ms) (> ms 0))
+    (let [s (opt fa "sleep")]
+      (if (fn? s) (s ms) (Thread/sleep (long ms))))))
+
+(defn- track-get [fa k] (core/client-track (:client @fa) k))
+(defn- track-set! [fa k v] (core/client-track-set! (:client @fa) k v))
+(defn- track-ensure! [fa k default]
+  (or (track-get fa k) (track-set! fa k default)))
+
+;; A feature atom seeded with the common metadata.
+(defn- new-feature [name active version]
+  (atom {:name name :active active :version (or version "0.0.1") :_options nil
+         :client nil :options (vs/jm)}))
+
+;; ---------------------------------------------------------------------------
+;; base
+;; ---------------------------------------------------------------------------
+
+(defn base-feature []
+  (let [fa (new-feature "base" true "0.0.1")]
+    (swap! fa assoc "init" (fn [_ctx _options] nil))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; log
+;; ---------------------------------------------------------------------------
+
+(defn log-feature []
+  (let [fa (new-feature "log" true "0.0.1")
+        loghook (fn [ctx hook]
+                  (when (:logger @fa)
+                    (let [opname (if (core/oget ctx :op) (core/op-name (core/oget ctx :op)) "")]
+                      (binding [*out* *err*]
+                        (println (str "[INFO] hook=" hook " op=" opname))))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client) :options options
+                           :active (opts-active? options))
+                    (when (active? fa)
+                      (swap! fa assoc :logger (if (mget options "logger") (mget options "logger") *err*))))
+           "PostConstruct" (fn [ctx] (loghook ctx "PostConstruct"))
+           "PostConstructEntity" (fn [ctx] (loghook ctx "PostConstructEntity"))
+           "SetData" (fn [ctx] (loghook ctx "SetData"))
+           "GetData" (fn [ctx] (loghook ctx "GetData"))
+           "SetMatch" (fn [ctx] (loghook ctx "SetMatch"))
+           "GetMatch" (fn [ctx] (loghook ctx "GetMatch"))
+           "PrePoint" (fn [ctx] (loghook ctx "PrePoint"))
+           "PreSpec" (fn [ctx] (loghook ctx "PreSpec"))
+           "PreRequest" (fn [ctx] (loghook ctx "PreRequest"))
+           "PreResponse" (fn [ctx] (loghook ctx "PreResponse"))
+           "PreResult" (fn [ctx] (loghook ctx "PreResult")))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; test — installs the in-memory mock transport (optionally net-simulated).
+;; ---------------------------------------------------------------------------
+
+(declare test-build-args make-netsim)
+
+(defn test-feature []
+  (let [fa (new-feature "test" true "0.0.1")]
+    (swap! fa assoc
+           "init"
+           (fn [ctx options]
+             (swap! fa assoc :client (core/oget ctx :client) :options options)
+             (let [entity (let [e (vs/getprop options "entity")] (if (vs/ismap e) e (vs/jm)))]
+               (core/client-set-mode! (core/oget ctx :client) "test")
+               ;; Ensure entity ids are correct (id = key at depth 2).
+               (vs/walk entity (fn [key val _parent path]
+                                 (when (and (= (vs/size path) 2) (vs/ismap val) key)
+                                   (.put ^java.util.Map val "id" key))
+                                 val))
+               (let [test-fetcher
+                     (fn [fctx _fullurl _fetchdef]
+                       (let [respond (fn [status data extra]
+                                       (let [out (vs/jm "status" status "statusText" "OK"
+                                                        "json" (fn [] data) "body" "not-used")]
+                                         (when extra (doseq [item (or (vs/items extra) [])]
+                                                       (.put ^java.util.Map out (vs/getprop item 0) (vs/getprop item 1))))
+                                         [out nil]))
+                             op (core/oget fctx :op)
+                             entmap (let [em (vs/getprop entity (core/op-entity op))] (if (vs/ismap em) em (vs/jm)))
+                             resolve-match (fn [explicit]
+                                             (if (and (vs/ismap explicit) (pos? (vs/size explicit))) explicit
+                                                 (loop [srcs [(core/oget fctx :match) (core/oget fctx :data)]]
+                                                   (if (empty? srcs) (vs/jm)
+                                                       (let [src (first srcs)
+                                                             v (when src (vs/getprop src "id"))]
+                                                         (if (and (some? v) (not= v "__UNDEFINED__")) (vs/jm "id" v)
+                                                             (recur (rest srcs))))))))
+                             opn (core/op-name op)]
+                         (cond
+                           (= opn "load")
+                           (let [args (test-build-args fctx op (resolve-match (core/oget fctx :reqmatch)))
+                                 found (vs/select entmap args)
+                                 ent (vs/getelem found 0)]
+                             (if (nil? ent) (respond 404 nil (vs/jm "statusText" "Not found"))
+                                 (do (vs/delprop ent "$KEY") (respond 200 (vs/clone ent) nil))))
+                           (= opn "list")
+                           (let [args (test-build-args fctx op (core/oget fctx :reqmatch))
+                                 found (vs/select entmap args)]
+                             (if (nil? found) (respond 404 nil (vs/jm "statusText" "Not found"))
+                                 (do (when (vs/islist found) (doseq [item (vec found)] (vs/delprop item "$KEY")))
+                                     (respond 200 (vs/clone found) nil))))
+                           (= opn "update")
+                           (let [update-match (vs/jm)
+                                 reqdata (core/oget fctx :reqdata)]
+                             (when (vs/ismap reqdata)
+                               (when (contains? (into #{} (vs/keysof reqdata)) "id")
+                                 (.put ^java.util.Map update-match "id" (vs/getprop reqdata "id")))
+                               (when-let [am (core/op-alias op)]
+                                 (let [alias-id (vs/getprop am "id")]
+                                   (when (and alias-id (contains? (into #{} (vs/keysof reqdata)) alias-id))
+                                     (.put ^java.util.Map update-match alias-id (vs/getprop reqdata alias-id))))))
+                             (let [update-match (if (zero? (vs/size update-match)) (resolve-match (vs/jm)) update-match)
+                                   args (test-build-args fctx op update-match)
+                                   found (vs/select entmap args)
+                                   ent0 (vs/getelem found 0)
+                                   ent (if (and (nil? ent0) (vs/ismap entmap) (pos? (vs/size entmap)))
+                                         (first (filter vs/ismap (map #(vs/getprop entmap %) (vs/keysof entmap))))
+                                         ent0)]
+                               (if (nil? ent) (respond 404 nil (vs/jm "statusText" "Not found"))
+                                   (do (when (and (vs/ismap ent) reqdata)
+                                         (doseq [item (or (vs/items reqdata) [])]
+                                           (.put ^java.util.Map ent (vs/getprop item 0) (vs/getprop item 1))))
+                                       (vs/delprop ent "$KEY")
+                                       (respond 200 (vs/clone ent) nil)))))
+                           (= opn "remove")
+                           (let [args (test-build-args fctx op (resolve-match (core/oget fctx :reqmatch)))
+                                 found (vs/select entmap args)
+                                 ent (vs/getelem found 0)]
+                             (when (vs/ismap ent) (vs/delprop entmap (vs/getprop ent "id")))
+                             (respond 200 nil nil))
+                           (= opn "create")
+                           (do (test-build-args fctx op (core/oget fctx :reqdata))
+                               (let [id (or ((core/uget fctx :param) fctx "id")
+                                            (format "%04x%04x%04x%04x" (rand-int 0x10000) (rand-int 0x10000) (rand-int 0x10000) (rand-int 0x10000)))
+                                     ent (vs/clone (core/oget fctx :reqdata))]
+                                 (if (vs/ismap ent)
+                                   (do (.put ^java.util.Map ent "id" id)
+                                       (when (string? id) (.put ^java.util.Map entmap (str id) ent))
+                                       (vs/delprop ent "$KEY")
+                                       (respond 200 (vs/clone ent) nil))
+                                   (respond 200 ent nil))))
+                           :else (respond 404 nil (vs/jm "statusText" "Unknown operation")))))
+                     net (let [nn (vs/getprop options "net")] (when (vs/ismap nn) nn))]
+                 (core/oset! (core/oget ctx :utility) :fetcher
+                             (if (nil? net) test-fetcher (make-netsim fa net test-fetcher)))))))
+    fa))
+
+(defn- test-build-args [ctx op args]
+  (let [opname (core/op-name op)
+        points (vs/getpath (core/oget ctx :config)
+                           (str "entity." (core/entity-get-name (core/oget ctx :entity)) ".op." opname ".points"))
+        point (vs/getelem points -1)
+        params-path (vs/getpath point "args.params")
+        reqd-params (vs/select params-path (vs/jm "reqd" true))
+        reqd (vs/transform reqd-params (vs/jt "`$EACH`" "" "`$KEY.name`"))
+        qand (vs/jt)]
+    (when args
+      (doseq [key (or (vs/keysof args) [])]
+        (let [is-id (= key "id")
+              selected (vs/select reqd key)
+              is-reqd (not (vs/isempty selected))]
+          (when (or is-id is-reqd)
+            (let [v ((core/uget ctx :param) ctx key)
+                  ka (when (core/op-alias op) (vs/getprop (core/op-alias op) key))
+                  qor (vs/jt (vs/jm key v))]
+              (when (string? ka) (.add ^java.util.List qor (vs/jm ka v)))
+              (.add ^java.util.List qand (vs/jm "`$OR`" qor)))))))
+    (let [q (vs/jm "`$AND`" qand)]
+      (when-let [ex (core/oget (core/oget ctx :ctrl) :explain)] (.put ^java.util.Map ex "test" (vs/jm "query" q)))
+      q)))
+
+(defn- make-netsim [fa net inner]
+  (swap! fa assoc :netcalls 0)
+  (let [pick-latency (fn []
+                       (let [l (mget net "latency")]
+                         (cond (nil? l) 0
+                               (number? l) (if (< l 0) 0 l)
+                               :else (let [mn (long (or (mget l "min") 0))
+                                           mx (if (nil? (mget l "max")) mn (long (mget l "max")))]
+                                       (if (<= mx mn) mn (+ mn (bit-shift-right (- mx mn) 1)))))))
+        do-sleep (fn [ms] (when (and (some? ms) (number? ms) (> ms 0))
+                            (let [s (mget net "sleep")] (if (fn? s) (s ms) (Thread/sleep (long ms))))))]
+    (fn [fctx fullurl fetchdef]
+      (swap! fa update :netcalls inc)
+      (let [call (:netcalls @fa)]
+        (cond
+          (= true (mget net "offline"))
+          (do (do-sleep (pick-latency))
+              [nil (core/ctx-error fctx "netsim_offline" (str "Simulated network offline (URL was: \"" fullurl "\")"))])
+          (<= call (long (mget net "errorTimes" 0)))
+          (do (do-sleep (pick-latency))
+              [nil (core/ctx-error fctx "netsim_conn" (str "Simulated connection error (call " call ")"))])
+          (<= call (long (mget net "failTimes" 0)))
+          (do (do-sleep (pick-latency))
+              [(vs/jm "status" (mget net "failStatus" 503) "statusText" "Simulated Failure"
+                      "body" "not-used" "json" (fn [] nil) "headers" (vs/jm)) nil])
+          :else (do (do-sleep (pick-latency)) (inner fctx fullurl fetchdef)))))))
+
+;; ---------------------------------------------------------------------------
+;; Transport-wrapping helper.
+;; ---------------------------------------------------------------------------
+
+(defn- wrap-fetcher! [ctx wrapper]
+  (let [utility (core/oget ctx :utility)
+        inner (core/oget utility :fetcher)]
+    (core/oset! utility :fetcher (fn [fctx url fd] (wrapper fctx url fd inner)))))
+
+;; ---------------------------------------------------------------------------
+;; retry
+;; ---------------------------------------------------------------------------
+
+(defn- retry-retryable? [fa res err]
+  (cond (some? err) true
+        (nil? res) true
+        :else (let [status (when (vs/ismap res) (vs/getprop res "status"))]
+                (if (number? status)
+                  (let [statuses (or (opt fa "statuses") (vs/jt 408 425 429 500 502 503 504))]
+                    (boolean (some #(= (long %) (long status)) (vec statuses))))
+                  false))))
+
+(defn- retry-after-ms [res]
+  (when (vs/ismap res)
+    (let [headers (vs/getprop res "headers")]
+      (when (vs/ismap headers)
+        (let [v (atom nil)]
+          (doseq [item (or (vs/items headers) [])]
+            (when (= (str/lower-case (str (vs/getprop item 0))) "retry-after")
+              (reset! v (vs/getprop item 1))))
+          (when (some? @v)
+            (try (long (* (Double/parseDouble (str @v)) 1000)) (catch Exception _ nil))))))))
+
+(defn- retry-backoff [fa res attempt min-delay max-delay factor]
+  (let [ra (retry-after-ms res)]
+    (if (some? ra) (min max-delay ra)
+        (let [base (* min-delay (Math/pow factor attempt))
+              jitter (if (= false (opt fa "jitter")) 0 (long (Math/floor (* (rand) min-delay))))]
+          (min max-delay (+ base jitter))))))
+
+(defn retry-feature []
+  (let [fa (new-feature "retry" false "0.0.1")
+        with-retry
+        (fn [ctx url fetchdef inner]
+          (let [max (long (opt fa "retries" 2))
+                min-delay (opt fa "minDelay" 50)
+                max-delay (opt fa "maxDelay" 2000)
+                factor (opt fa "factor" 2)]
+            (loop [attempt 0]
+              (let [[res err] (inner ctx url fetchdef)]
+                (if (or (not (retry-retryable? fa res err)) (>= attempt max))
+                  [res err]
+                  (let [wait (retry-backoff fa res attempt min-delay max-delay factor)]
+                    (let [track (track-ensure! fa "_retry" (vs/jm "attempts" 0 "retries" (vs/jt)))]
+                      (.put ^java.util.Map track "attempts" (inc (long (mget track "attempts"))))
+                      (.add ^java.util.List (mget track "retries")
+                            (vs/jm "attempt" (inc attempt)
+                                   "status" (when (vs/ismap res) (vs/getprop res "status"))
+                                   "error" (when (some? err) (core/err-msg err)) "wait" wait)))
+                    (sleep-ms fa wait)
+                    (recur (inc attempt))))))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options))
+                    (when (active? fa)
+                      (wrap-fetcher! ctx (fn [fctx url fd inner] (with-retry fctx url fd inner))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; timeout
+;; ---------------------------------------------------------------------------
+
+(defn timeout-feature []
+  (let [fa (new-feature "timeout" false "0.0.1")
+        track! (fn [ms]
+                 (let [t (track-ensure! fa "_timeout" (vs/jm "count" 0 "ms" ms))]
+                   (.put ^java.util.Map t "count" (inc (long (mget t "count"))))))
+        with-timeout
+        (fn [ctx url fetchdef inner]
+          (let [ms (opt fa "ms" 30000)]
+            (if (<= ms 0) (inner ctx url fetchdef)
+                (let [now (opt fa "now")]
+                  (if (fn? now)
+                    (let [start (now) r (inner ctx url fetchdef)]
+                      (if (> (- (now) start) ms)
+                        (do (track! ms) [nil (core/ctx-error ctx "timeout" (str "Request exceeded timeout of " ms "ms"))])
+                        r))
+                    (let [fut (future (inner ctx url fetchdef))
+                          r (deref fut (long ms) ::timeout)]
+                      (if (= r ::timeout)
+                        (do (future-cancel fut) (track! ms)
+                            [nil (core/ctx-error ctx "timeout" (str "Request exceeded timeout of " ms "ms"))])
+                        r)))))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options))
+                    (when (active? fa)
+                      (wrap-fetcher! ctx (fn [fctx url fd inner] (with-timeout fctx url fd inner))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; ratelimit
+;; ---------------------------------------------------------------------------
+
+(defn ratelimit-feature []
+  (let [fa (new-feature "ratelimit" false "0.0.1")
+        track! (fn [wait-ms]
+                 (let [t (track-ensure! fa "_ratelimit" (vs/jm "throttled" 0 "waitMs" 0))]
+                   (.put ^java.util.Map t "throttled" (inc (long (mget t "throttled"))))
+                   (.put ^java.util.Map t "waitMs" (+ (long (mget t "waitMs")) (long wait-ms)))))
+        acquire (fn [_ctx]
+                  (let [rate (opt fa "rate" 5)
+                        burst (opt fa "burst" rate)
+                        now (now-ms fa)
+                        elapsed (- now (:last @fa))]
+                    (swap! fa assoc :last now)
+                    (swap! fa assoc :tokens (min burst (+ (:tokens @fa) (* (/ elapsed 1000.0) rate))))
+                    (if (>= (:tokens @fa) 1)
+                      (swap! fa update :tokens dec)
+                      (let [needed (- 1 (:tokens @fa))
+                            wait-ms (long (Math/ceil (* (/ needed (double rate)) 1000)))]
+                        (track! wait-ms)
+                        (sleep-ms fa wait-ms)
+                        (swap! fa assoc :last (now-ms fa) :tokens 0)))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options))
+                    (when (active? fa)
+                      (let [burst (opt fa "burst" (opt fa "rate" 5))]
+                        (swap! fa assoc :tokens burst :last (now-ms fa)))
+                      (wrap-fetcher! ctx (fn [fctx url fd inner] (acquire fctx) (inner fctx url fd))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; cache
+;; ---------------------------------------------------------------------------
+
+(defn cache-feature []
+  (let [fa (new-feature "cache" false "0.0.1")
+        track! (fn [kind]
+                 (let [t (track-ensure! fa "_cache" (vs/jm "hit" 0 "miss" 0 "bypass" 0))]
+                   (.put ^java.util.Map t kind (inc (long (mget t kind))))))
+        cacheable? (fn [res] (and (vs/ismap res)
+                                  (let [s (vs/getprop res "status")] (and (number? s) (>= s 200) (< s 300)))))
+        snapshot (fn [res]
+                   (let [jf (vs/getprop res "json")
+                         data (when (fn? jf) (try (jf) (catch Throwable _ nil)))
+                         headers (if (vs/ismap (vs/getprop res "headers")) (vs/clone (vs/getprop res "headers")) (vs/jm))]
+                     (vs/jm "status" (vs/getprop res "status") "statusText" (vs/getprop res "statusText")
+                            "data" data "headers" headers)))
+        replay (fn [snap]
+                 (let [data (mget snap "data")]
+                   (vs/jm "status" (mget snap "status") "statusText" (mget snap "statusText")
+                          "body" "not-used" "json" (fn [] data)
+                          "headers" (if (vs/ismap (mget snap "headers")) (vs/clone (mget snap "headers")) (vs/jm)))))
+        evict! (fn []
+                 (let [max (opt fa "max" 256)]
+                   (while (>= (count (:store @fa)) max)
+                     (let [oldest (first (keys (:store @fa)))]
+                       (if (nil? oldest) (swap! fa assoc :store {})
+                           (swap! fa update :store dissoc oldest))))))
+        through (fn [ctx url fetchdef inner]
+                  (let [method (str/upper-case (str (or (and (vs/ismap fetchdef) (vs/getprop fetchdef "method")) "GET")))
+                        methods (or (opt fa "methods") (vs/jt "GET"))]
+                    (if (not (some #(= % method) (vec methods)))
+                      (inner ctx url fetchdef)
+                      (let [key (str method " " url)
+                            now (now-ms fa)
+                            hit (get (:store @fa) key)]
+                        (if (and (some? hit) (> (mget hit "expiry") now))
+                          (do (track! "hit") [(replay (mget hit "snapshot")) nil])
+                          (let [[res err] (inner ctx url fetchdef)]
+                            (if (and (nil? err) (cacheable? res))
+                              (let [snap (snapshot res)
+                                    ttl (opt fa "ttl" 5000)]
+                                (evict!)
+                                (swap! fa update :store assoc key (vs/jm "expiry" (+ now ttl) "snapshot" snap))
+                                (track! "miss")
+                                [(replay snap) nil])
+                              (do (track! "bypass") [res err]))))))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options) :store {})
+                    (when (active? fa)
+                      (wrap-fetcher! ctx (fn [fctx url fd inner] (through fctx url fd inner))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; idempotency
+;; ---------------------------------------------------------------------------
+
+(defn idempotency-feature []
+  (let [fa (new-feature "idempotency" false "0.0.1")
+        mutating? (fn [ctx]
+                    (let [methods (or (opt fa "methods") (vs/jt "POST" "PUT" "PATCH" "DELETE"))
+                          spec (core/oget ctx :spec)
+                          method (if (and spec (core/oget spec :method)) (str/upper-case (str (core/oget spec :method))) "")]
+                      (if (and (seq method) (some #(= % method) (vec methods))) true
+                          (let [opname (when (core/oget ctx :op) (core/op-name (core/oget ctx :op)))
+                                ops (or (opt fa "ops") (vs/jt "create" "update" "remove"))]
+                            (boolean (some #(= % opname) (vec ops)))))))
+        existing (fn [headers header]
+                   (let [lower (str/lower-case header) v (atom nil)]
+                     (doseq [item (or (vs/items headers) [])]
+                       (when (= (str/lower-case (str (vs/getprop item 0))) lower) (reset! v (vs/getprop item 1))))
+                     @v))
+        genkey (fn []
+                 (let [kg (opt fa "keygen")]
+                   (if (fn? kg) (kg)
+                       (let [h (fn [] (Long/toHexString (long (rand-int 0x10000000))))]
+                         (subs (apply str (take 24 (concat (str (h) (h) (h) (h)) (repeat "0")))) 0 24)))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options)))
+           "PreRequest" (fn [ctx]
+                          (when (active? fa)
+                            (let [spec (core/oget ctx :spec)]
+                              (when (and spec (mutating? ctx))
+                                (let [header (opt fa "header" "Idempotency-Key")]
+                                  (when (nil? (core/oget spec :headers)) (core/oset! spec :headers (vs/jm)))
+                                  (when (nil? (existing (core/oget spec :headers) header))
+                                    (let [key (genkey)]
+                                      (.put ^java.util.Map (core/oget spec :headers) header key)
+                                      (let [track (track-ensure! fa "_idempotency" (vs/jm "issued" 0 "last" nil))]
+                                        (.put ^java.util.Map track "issued" (inc (long (mget track "issued"))))
+                                        (.put ^java.util.Map track "last" key))))))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; paging
+;; ---------------------------------------------------------------------------
+
+(defn- header-of [headers name]
+  (let [lower (str/lower-case name) v (atom nil)]
+    (doseq [item (or (vs/items headers) [])]
+      (when (= (str/lower-case (str (vs/getprop item 0))) lower) (reset! v (vs/getprop item 1))))
+    @v))
+
+(defn- to-num [v]
+  (when (some? v)
+    (let [s (str v)]
+      (or (try (Long/parseLong s) (catch Exception _ nil))
+          (try (Double/parseDouble s) (catch Exception _ nil))))))
+
+(defn paging-feature []
+  (let [fa (new-feature "paging" false "0.0.1")
+        list? (fn [ctx] (let [ops (or (opt fa "ops") (vs/jt "list"))
+                              opn (when (core/oget ctx :op) (core/op-name (core/oget ctx :op)))]
+                          (boolean (some #(= % opn) (vec ops)))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options)))
+           "PreRequest"
+           (fn [ctx]
+             (when (and (active? fa) (list? ctx))
+               (let [spec (core/oget ctx :spec)]
+                 (when spec
+                   (when (nil? (core/oget spec :query)) (core/oset! spec :query (vs/jm)))
+                   (let [q (core/oget spec :query)
+                         page-param (opt fa "pageParam" "page")
+                         limit-param (opt fa "limitParam" "limit")
+                         cursor-param (opt fa "cursorParam" "cursor")
+                         ctrl (core/oget ctx :ctrl)
+                         paging (let [p (when ctrl (core/oget ctrl :paging))] (if (vs/ismap p) p (vs/jm)))]
+                     (cond
+                       (some? (mget paging "cursor")) (.put ^java.util.Map q cursor-param (mget paging "cursor"))
+                       (nil? (mget q page-param))
+                       (.put ^java.util.Map q page-param (if (nil? (mget paging "page")) (opt fa "startPage" 1) (mget paging "page"))))
+                     (when (and (some? (opt fa "limit")) (nil? (mget q limit-param)))
+                       (.put ^java.util.Map q limit-param (opt fa "limit"))))))))
+           "PreResult"
+           (fn [ctx]
+             (when (and (active? fa) (list? ctx))
+               (let [result (core/oget ctx :result)]
+                 (when result
+                   (let [headers (or (core/oget result :headers) (vs/jm))
+                         body (core/oget result :body)
+                         paging (vs/jm "page" (to-num (header-of headers "x-page"))
+                                       "totalCount" (to-num (header-of headers "x-total-count"))
+                                       "nextPage" (to-num (header-of headers "x-next-page"))
+                                       "next" nil "cursor" nil "hasMore" false)
+                         link (header-of headers "link")]
+                     (when (some? link)
+                       (when-let [m (re-find #"(?i)<([^>]+)>\s*;\s*rel=\"?next\"?" (str link))]
+                         (.put ^java.util.Map paging "next" (nth m 1))))
+                     (when (vs/ismap body)
+                       (when (some? (mget body "next")) (when (nil? (mget paging "next")) (.put ^java.util.Map paging "next" (mget body "next"))))
+                       (when (some? (mget body "cursor")) (.put ^java.util.Map paging "cursor" (mget body "cursor")))
+                       (when (some? (mget body "nextCursor")) (.put ^java.util.Map paging "cursor" (mget body "nextCursor")))
+                       (let [hm (mget body "hasMore")] (when (or (= hm true) (= hm false)) (.put ^java.util.Map paging "hasMore" hm))))
+                     (.put ^java.util.Map paging "hasMore"
+                           (boolean (or (mget paging "hasMore") (some? (mget paging "next"))
+                                        (some? (mget paging "cursor")) (some? (mget paging "nextPage")))))
+                     (core/oset! result :paging paging)
+                     (track-set! fa "_paging" (vs/jm "last" paging)))))))
+           )
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; streaming
+;; ---------------------------------------------------------------------------
+
+(defn streaming-feature []
+  (let [fa (new-feature "streaming" false "0.0.1")
+        streamable? (fn [ctx] (let [ops (or (opt fa "ops") (vs/jt "list"))
+                                    opn (when (core/oget ctx :op) (core/op-name (core/oget ctx :op)))]
+                                (boolean (some #(= % opn) (vec ops)))))
+        make-stream (fn [result]
+                      ;; A lazy sequence realised on demand from result.resdata.
+                      (fn []
+                        (let [chunk-delay (opt fa "chunkDelay" 0)
+                              chunk-size (opt fa "chunkSize" 0)
+                              items (let [rd (core/oget result :resdata)] (if (vs/islist rd) (vec rd) []))]
+                          (if (> chunk-size 0)
+                            (mapv (fn [batch] (when (> chunk-delay 0) (sleep-ms fa chunk-delay)) batch)
+                                  (mapv vec (partition-all chunk-size items)))
+                            (mapv (fn [item] (when (> chunk-delay 0) (sleep-ms fa chunk-delay)) item) items)))))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options)))
+           "PreResult"
+           (fn [ctx]
+             (when (and (active? fa) (streamable? ctx))
+               (let [result (core/oget ctx :result)]
+                 (when result
+                   (core/oset! result :streaming true)
+                   (core/oset! result :stream (make-stream result))
+                   (let [t (track-ensure! fa "_streaming" (vs/jm "opened" 0))]
+                     (.put ^java.util.Map t "opened" (inc (long (mget t "opened"))))))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; proxy
+;; ---------------------------------------------------------------------------
+
+(defn proxy-feature []
+  (let [fa (new-feature "proxy" false "0.0.1")
+        bypass? (fn [url]
+                  (let [no-proxy (:no-proxy @fa)]
+                    (if (empty? no-proxy) false
+                        (let [host (if-let [m (re-find #"(?i)\A[a-z]+://([^/:]+)" url)] (nth m 1) url)]
+                          (boolean (some (fn [np] (or (= np "*") (= host np)
+                                                      (str/ends-with? host (str "." (str/replace np #"\A\." ""))))) no-proxy))))))
+        route (fn [url fetchdef]
+                (if (or (nil? (:url @fa)) (bypass? url)) fetchdef
+                    (let [out (if (vs/ismap fetchdef) (vs/clone fetchdef) (vs/jm))]
+                      (.put ^java.util.Map out "proxy" (:url @fa))
+                      (let [agent (opt fa "agent")]
+                        (when (fn? agent)
+                          (let [made (agent (:url @fa) url)]
+                            (.put ^java.util.Map out "dispatcher" made)
+                            (.put ^java.util.Map out "agent" made))))
+                      (let [t (track-ensure! fa "_proxy" (vs/jm "routed" 0 "url" (:url @fa)))]
+                        (.put ^java.util.Map t "routed" (inc (long (mget t "routed")))))
+                      out)))]
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options))
+                    (when (active? fa)
+                      (let [url0 (opt fa "url")
+                            no-proxy0 (opt fa "noProxy")
+                            from-env (= true (opt fa "fromEnv"))
+                            url (if from-env (or url0 (System/getenv "HTTPS_PROXY") (System/getenv "https_proxy")
+                                                  (System/getenv "HTTP_PROXY") (System/getenv "http_proxy")) url0)
+                            no-proxy1 (if from-env (or no-proxy0 (System/getenv "NO_PROXY") (System/getenv "no_proxy")) no-proxy0)
+                            no-proxy (->> (cond (string? no-proxy1) (str/split no-proxy1 #"\s*,\s*")
+                                                (vs/islist no-proxy1) (vec no-proxy1)
+                                                :else [])
+                                          (remove (fn [s] (or (nil? s) (= s "")))))]
+                        (swap! fa assoc :url url :no-proxy (vec no-proxy)))
+                      (wrap-fetcher! ctx (fn [fctx url fd inner] (inner fctx url (route url fd)))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; telemetry
+;; ---------------------------------------------------------------------------
+
+(defn telemetry-feature []
+  (let [fa (new-feature "telemetry" false "0.0.1")
+        telem (fn [] (track-get fa "_telemetry"))
+        gen-id2 (fn [kind]
+                  (let [idgen (opt fa "idgen")]
+                    (if (fn? idgen) (idgen kind)
+                        (do (swap! fa update :seq inc)
+                            (let [n (let [h (Long/toHexString (long (:seq @fa)))]
+                                      (str (apply str (repeat (max 0 (- 4 (count h))) "0")) h))
+                                  padded (apply str n (repeat (max 0 (- 16 (count n))) "0"))]
+                              (str (if (= kind "trace") "t" "s") (subs padded 0 16)))))))
+        close (fn [ctx ok]
+                (let [span (get (:spans @fa) ctx)]
+                  (when span
+                    (swap! fa update :spans dissoc ctx)
+                    (.put ^java.util.Map span "end" (now-ms fa))
+                    (.put ^java.util.Map span "durationMs" (max 0 (- (mget span "end") (mget span "start"))))
+                    (.put ^java.util.Map span "ok" ok)
+                    (when-let [t (telem)]
+                      (.put ^java.util.Map t "active" (dec (long (mget t "active"))))
+                      (.add ^java.util.List (mget t "spans") span))
+                    (let [exporter (opt fa "exporter")]
+                      (when (fn? exporter) (try (exporter span) (catch Throwable _ nil)))))))]
+    (swap! fa assoc :spans {} :seq 0)
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options) :spans {} :seq 0)
+                    (when (active? fa)
+                      (when (nil? (track-get fa "_telemetry"))
+                        (track-set! fa "_telemetry" (vs/jm "spans" (vs/jt) "active" 0)))))
+           "PrePoint"
+           (fn [ctx]
+             (when (active? fa)
+               (let [op (core/oget ctx :op)
+                     span (vs/jm "traceId" (gen-id2 "trace") "spanId" (gen-id2 "span")
+                                 "name" (str (if op (core/op-entity op) "_") "." (if op (core/op-name op) "_"))
+                                 "start" (now-ms fa) "end" nil "durationMs" nil "ok" nil)]
+                 (swap! fa update :spans assoc ctx span)
+                 (when-let [t (telem)] (.put ^java.util.Map t "active" (inc (long (mget t "active"))))))))
+           "PreRequest"
+           (fn [ctx]
+             (when (active? fa)
+               (let [span (get (:spans @fa) ctx) spec (core/oget ctx :spec)]
+                 (when (and span spec)
+                   (when (nil? (core/oget spec :headers)) (core/oset! spec :headers (vs/jm)))
+                   (let [h (or (opt fa "headers") (vs/jm)) headers (core/oget spec :headers)]
+                     (.put ^java.util.Map headers (or (mget h "trace") "X-Trace-Id") (mget span "traceId"))
+                     (.put ^java.util.Map headers (or (mget h "span") "X-Span-Id") (mget span "spanId"))
+                     (.put ^java.util.Map headers (or (mget h "parent") "traceparent")
+                           (str "00-" (mget span "traceId") "-" (mget span "spanId") "-01")))))))
+           "PreDone"
+           (fn [ctx]
+             (when (active? fa)
+               (let [result (core/oget ctx :result)
+                     ok (and (some? result) (= true (core/oget result :ok)) (nil? (core/oget result :err)))]
+                 (close ctx ok))))
+           "PreUnexpected" (fn [ctx] (when (active? fa) (close ctx false))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; metrics
+;; ---------------------------------------------------------------------------
+
+(defn metrics-feature []
+  (let [fa (new-feature "metrics" false "0.0.1")
+        bump! (fn [bucket ok dur]
+                (.put ^java.util.Map bucket "count" (inc (long (mget bucket "count"))))
+                (.put ^java.util.Map bucket (if ok "ok" "err") (inc (long (mget bucket (if ok "ok" "err")))))
+                (.put ^java.util.Map bucket "totalMs" (+ (long (mget bucket "totalMs")) (long dur)))
+                (when (> dur (mget bucket "maxMs")) (.put ^java.util.Map bucket "maxMs" dur)))
+        record! (fn [ctx ok]
+                  (when (contains? (:starts @fa) ctx)
+                    (let [start (get (:starts @fa) ctx)
+                          _ (swap! fa update :starts dissoc ctx)
+                          dur (if (nil? start) 0 (max 0 (- (now-ms fa) start)))
+                          m (track-get fa "_metrics")]
+                      (when m
+                        (let [op (core/oget ctx :op)
+                              key (str (if op (core/op-entity op) "_") "." (if op (core/op-name op) "_"))
+                              opm (or (mget (mget m "ops") key)
+                                      (let [b (vs/jm "count" 0 "ok" 0 "err" 0 "totalMs" 0 "maxMs" 0)]
+                                        (.put ^java.util.Map (mget m "ops") key b) b))]
+                          (bump! (mget m "total") ok dur)
+                          (bump! opm ok dur))))))]
+    (swap! fa assoc :starts {})
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options) :starts {})
+                    (when (active? fa)
+                      (when (nil? (track-get fa "_metrics"))
+                        (track-set! fa "_metrics"
+                                    (vs/jm "total" (vs/jm "count" 0 "ok" 0 "err" 0 "totalMs" 0 "maxMs" 0) "ops" (vs/jm))))))
+           "PrePoint" (fn [ctx] (when (active? fa) (swap! fa update :starts assoc ctx (now-ms fa))))
+           "PreDone" (fn [ctx]
+                       (when (active? fa)
+                         (let [result (core/oget ctx :result)
+                               ok (and (some? result) (= true (core/oget result :ok)) (nil? (core/oget result :err)))]
+                           (record! ctx ok))))
+           "PreUnexpected" (fn [ctx] (when (active? fa) (record! ctx false))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; debug
+;; ---------------------------------------------------------------------------
+
+(def REDACT-DEFAULT ["authorization" "cookie" "set-cookie" "api-key" "apikey" "x-api-key" "idempotency-key"])
+
+(defn debug-feature []
+  (let [fa (new-feature "debug" false "0.0.1")
+        redact (fn [headers]
+                 (if (nil? headers) (vs/jm)
+                     (let [patterns (or (opt fa "redact") REDACT-DEFAULT)
+                           pset (into #{} (map str (vec patterns)))
+                           out (vs/jm)]
+                       (doseq [item (or (vs/items headers) [])]
+                         (let [k (vs/getprop item 0) v (vs/getprop item 1)]
+                           (.put ^java.util.Map out k (if (contains? pset (str/lower-case (str k))) "<redacted>" v))))
+                       out)))
+        finish (fn [ctx ok]
+                 (let [entry (get (:entries @fa) ctx)]
+                   (when entry
+                     (swap! fa update :entries dissoc ctx)
+                     (let [result (core/oget ctx :result)]
+                       (.put ^java.util.Map entry "ok" (boolean (and ok (or (nil? result) (= true (core/oget result :ok))))))
+                       (.put ^java.util.Map entry "durationMs" (max 0 (- (now-ms fa) (mget entry "start"))))
+                       (when (and (nil? (mget entry "status")) result)
+                         (.put ^java.util.Map entry "status" (core/oget result :status)))
+                       (let [track (track-ensure! fa "_debug" (vs/jm "entries" (vs/jt)))
+                             buf (mget track "entries")
+                             max (opt fa "max" 100)]
+                         (.add ^java.util.List buf entry)
+                         (while (> (.size ^java.util.List buf) max) (.remove ^java.util.List buf 0))
+                         (let [on-entry (opt fa "on_entry")]
+                           (when (fn? on-entry) (try (on-entry entry) (catch Throwable _ nil)))))))))]
+    (swap! fa assoc :entries {})
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options) :entries {})
+                    (when (active? fa)
+                      (when (nil? (track-get fa "_debug")) (track-set! fa "_debug" (vs/jm "entries" (vs/jt))))))
+           "PreRequest"
+           (fn [ctx]
+             (when (active? fa)
+               (let [spec (core/oget ctx :spec)
+                     op (core/oget ctx :op)
+                     url (when spec (if (= "" (str (core/oget spec :url))) (core/oget spec :path) (core/oget spec :url)))
+                     method (when spec (core/oget spec :method))
+                     headers (when spec (core/oget spec :headers))
+                     entry (vs/jm "op" (str (if op (core/op-entity op) "_") "." (if op (core/op-name op) "_"))
+                                  "method" method "url" url "headers" (redact headers) "start" (now-ms fa)
+                                  "status" nil "ok" nil "durationMs" nil "error" nil)]
+                 (swap! fa update :entries assoc ctx entry))))
+           "PreResponse"
+           (fn [ctx]
+             (when (active? fa)
+               (let [entry (get (:entries @fa) ctx) response (core/oget ctx :response)]
+                 (when (and entry response)
+                   (.put ^java.util.Map entry "status" (core/oget response :status))
+                   (when (and (or (nil? (mget entry "url")) (= "" (str (mget entry "url")))) (core/oget ctx :spec))
+                     (.put ^java.util.Map entry "url" (core/oget (core/oget ctx :spec) :url)))))))
+           "PreDone" (fn [ctx] (when (active? fa) (finish ctx true)))
+           "PreUnexpected"
+           (fn [ctx]
+             (when (active? fa)
+               (let [entry (get (:entries @fa) ctx) ctrl (core/oget ctx :ctrl)]
+                 (when (and entry ctrl (core/oget ctrl :err))
+                   (.put ^java.util.Map entry "error" (core/err-msg (core/oget ctrl :err)))))
+               (finish ctx false))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; audit
+;; ---------------------------------------------------------------------------
+
+(defn audit-feature []
+  (let [fa (new-feature "audit" false "0.0.1")
+        actor (fn [ctx]
+                (let [ctrl (core/oget ctx :ctrl)]
+                  (if (and ctrl (some? (core/oget ctrl :actor))) (core/oget ctrl :actor)
+                      (opt fa "actor" "anonymous"))))
+        emit (fn [ctx outcome]
+               (when-not (contains? (:seen @fa) ctx)
+                 (swap! fa update :seen conj ctx)
+                 (swap! fa update :seq inc)
+                 (let [op (core/oget ctx :op)
+                       result (core/oget ctx :result)
+                       record (vs/jm "seq" (:seq @fa) "ts" (now-ms fa) "actor" (actor ctx)
+                                     "entity" (if op (core/op-entity op) "_") "op" (if op (core/op-name op) "_")
+                                     "outcome" outcome "status" (when result (core/oget result :status))
+                                     "correlationId" (core/oget ctx :id))
+                       track (track-ensure! fa "_audit" (vs/jm "records" (vs/jt)))
+                       recs (mget track "records")
+                       max (opt fa "max" 1000)]
+                   (.add ^java.util.List recs record)
+                   (while (> (.size ^java.util.List recs) max) (.remove ^java.util.List recs 0))
+                   (let [sink (opt fa "sink")] (when (fn? sink) (try (sink record) (catch Throwable _ nil)))))))]
+    (swap! fa assoc :seq 0 :seen #{})
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options) :seq 0 :seen #{})
+                    (when (active? fa)
+                      (when (nil? (track-get fa "_audit")) (track-set! fa "_audit" (vs/jm "records" (vs/jt))))))
+           "PreDone" (fn [ctx]
+                       (when (active? fa)
+                         (let [result (core/oget ctx :result)
+                               ok (and (some? result) (= true (core/oget result :ok)) (nil? (core/oget result :err)))]
+                           (emit ctx (if ok "ok" "error")))))
+           "PreUnexpected" (fn [ctx] (when (active? fa) (emit ctx "error"))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; clienttrack
+;; ---------------------------------------------------------------------------
+
+(defn clienttrack-feature []
+  (let [fa (new-feature "clienttrack" false "0.0.1")
+        client-name (fn [] (str (opt fa "clientName" "ProjectName-SDK") "/" (opt fa "clientVersion" "0.0.1")))
+        gen-id (fn [kind]
+                 (let [idgen (opt fa "idgen")]
+                   (if (fn? idgen) (idgen kind)
+                       (let [h (fn [] (Long/toHexString (long (rand-int 0x10000000))))
+                             s (str (subs kind 0 1) "-" (h) (h) (h))]
+                         (subs s 0 (min 20 (count s)))))))
+        setk (fn [headers name value]
+               (let [lower (str/lower-case name)]
+                 (when-not (some (fn [k] (= (str/lower-case (str k)) lower)) (or (vs/keysof headers) []))
+                   (.put ^java.util.Map headers name value))))]
+    (swap! fa assoc :session "" :requests 0)
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options) :requests 0))
+           "PostConstruct"
+           (fn [_ctx]
+             (when (active? fa)
+               (swap! fa assoc :session (or (opt fa "sessionId") (gen-id "session")))
+               (track-set! fa "_clienttrack" (vs/jm "session" (:session @fa) "requests" 0 "clientName" (client-name)))))
+           "PreRequest"
+           (fn [ctx]
+             (when (active? fa)
+               (let [spec (core/oget ctx :spec)]
+                 (when spec
+                   (when (nil? (core/oget spec :headers)) (core/oset! spec :headers (vs/jm)))
+                   (when (= "" (:session @fa)) (swap! fa assoc :session (or (opt fa "sessionId") (gen-id "session"))))
+                   (let [h (or (opt fa "headers") (vs/jm))
+                         headers (core/oget spec :headers)]
+                     (swap! fa update :requests inc)
+                     (let [request-id (gen-id "request")]
+                       (setk headers (or (mget h "agent") "User-Agent") (client-name))
+                       (setk headers (or (mget h "client") "X-Client-Id") (:session @fa))
+                       (.put ^java.util.Map headers (or (mget h "request") "X-Request-Id") request-id)
+                       (let [track (track-ensure! fa "_clienttrack"
+                                                  (vs/jm "session" (:session @fa) "requests" 0 "clientName" (client-name)))]
+                         (.put ^java.util.Map track "requests" (:requests @fa))
+                         (.put ^java.util.Map track "lastRequestId" request-id)))))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; rbac — PrePoint short-circuit (gotcha #2).
+;; ---------------------------------------------------------------------------
+
+(defn rbac-feature []
+  (let [fa (new-feature "rbac" false "0.0.1")
+        required (fn [ctx]
+                   (let [rules (or (opt fa "rules") (vs/jm))
+                         entity (cond (and (core/oget ctx :entity) (core/entity-get-name (core/oget ctx :entity)))
+                                      (core/entity-get-name (core/oget ctx :entity))
+                                      (core/oget ctx :op) (core/op-entity (core/oget ctx :op))
+                                      :else "")
+                         opname (if (core/oget ctx :op) (core/op-name (core/oget ctx :op)) "")]
+                     (cond
+                       (some? (mget rules (str entity "." opname))) (mget rules (str entity "." opname))
+                       (some? (mget rules opname)) (mget rules opname)
+                       (some? (mget rules "*")) (mget rules "*")
+                       :else nil)))
+        track! (fn [ctx req allowed]
+                 (let [t (track-ensure! fa "_rbac" (vs/jm "allowed" 0 "denied" 0 "last" nil))]
+                   (.put ^java.util.Map t (if allowed "allowed" "denied") (inc (long (mget t (if allowed "allowed" "denied")))))
+                   (.put ^java.util.Map t "last" (vs/jm "required" req "allowed" allowed
+                                                        "op" (when (core/oget ctx :op) (core/op-name (core/oget ctx :op)))))))
+        reject (fn [ctx req]
+                 (track! ctx req false)
+                 (let [op (core/oget ctx :op)
+                       opname (if (and op (seq (core/op-name op))) (core/op-name op) "?")
+                       err (core/ctx-error ctx "rbac_denied" (str "Permission \"" req "\" required for operation \"" opname "\""))]
+                   ;; Short-circuit endpoint resolution; make_point surfaces this
+                   ;; error before any network use.
+                   (core/out-set! ctx "point" err)
+                   err))]
+    (swap! fa assoc :granted {})
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (swap! fa assoc :client (core/oget ctx :client)
+                           :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options))
+                    (let [perms (opt fa "permissions")]
+                      (swap! fa assoc :granted (if (vs/islist perms) (into {} (map (fn [p] [p true]) (vec perms))) {}))))
+           "PrePoint"
+           (fn [ctx]
+             (when (active? fa)
+               (let [req (required ctx)]
+                 (cond
+                   (nil? req) (when (= true (opt fa "deny")) (reject ctx "<default-deny>"))
+                   (or (get (:granted @fa) "*") (get (:granted @fa) req)) (do (track! ctx req true) nil)
+                   :else (reject ctx req))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; netsim — seeded LCG + exact error codes (gotcha #6).
+;; ---------------------------------------------------------------------------
+
+(defn netsim-feature []
+  (let [fa (new-feature "netsim" false "0.0.1")
+        lcg-rand (fn []
+                   (swap! fa update :seed (fn [s] (bit-and (+ (* (long s) 1103515245) 12345) 0x7fffffff)))
+                   (/ (double (:seed @fa)) 0x7fffffff))
+        pick-latency (fn []
+                       (let [l (opt fa "latency")]
+                         (cond (nil? l) 0
+                               (number? l) (if (< l 0) 0 l)
+                               :else (let [mn (long (or (mget l "min") 0))
+                                           mx (if (nil? (mget l "max")) mn (long (mget l "max")))]
+                                       (if (<= mx mn) mn (+ mn (long (Math/floor (* (lcg-rand) (- mx mn))))))))))
+        do-sleep (fn [ms] (sleep-ms fa ms))
+        respond (fn [status data extra]
+                  (let [out (vs/jm "status" status "statusText" "OK" "json" (fn [] data) "body" "not-used" "headers" (vs/jm))]
+                    (when (vs/ismap extra)
+                      (doseq [item (or (vs/items extra) [])]
+                        (let [k (vs/getprop item 0) v (vs/getprop item 1)]
+                          (if (and (= k "headers") (vs/ismap v))
+                            (let [headers (vs/jm)]
+                              (doseq [hitem (or (vs/items v) [])]
+                                (.put ^java.util.Map headers (str/lower-case (str (vs/getprop hitem 0))) (vs/getprop hitem 1)))
+                              (.put ^java.util.Map out "headers" headers))
+                            (.put ^java.util.Map out k v)))))
+                    out))
+        track! (fn [ctx applied]
+                 (let [t (track-ensure! fa "_netsim" (vs/jm "calls" 0 "applied" (vs/jt)))]
+                   (.put ^java.util.Map t "calls" (inc (long (mget t "calls"))))
+                   (.add ^java.util.List (mget t "applied") applied)
+                   (when-let [ex (core/oget (core/oget ctx :ctrl) :explain)] (.put ^java.util.Map ex "netsim" t))))
+        simulate
+        (fn [ctx url fetchdef inner]
+          (swap! fa update :calls inc)
+          (let [call (:calls @fa) applied (vs/jm)]
+            (cond
+              (= true (opt fa "offline"))
+              (do (do-sleep (pick-latency)) (.put ^java.util.Map applied "offline" true) (track! ctx applied)
+                  [nil (core/ctx-error ctx "netsim_offline" (str "Simulated network offline (URL was: \"" url "\")"))])
+              (<= call (long (opt fa "errorTimes" 0)))
+              (do (do-sleep (pick-latency)) (.put ^java.util.Map applied "error" true) (track! ctx applied)
+                  [nil (core/ctx-error ctx "netsim_conn" (str "Simulated connection error (call " call ")"))])
+              (<= call (long (opt fa "rateLimitTimes" 0)))
+              (do (do-sleep (pick-latency)) (.put ^java.util.Map applied "rateLimited" true) (track! ctx applied)
+                  [(respond 429 nil (vs/jm "statusText" "Too Many Requests"
+                                           "headers" (vs/jm "retry-after" (str (opt fa "retryAfter" 0))))) nil])
+              :else
+              (let [fail-status (opt fa "failStatus" 503)
+                    fail-by-count (<= call (long (opt fa "failTimes" 0)))
+                    fail-every (long (opt fa "failEvery" 0))
+                    fail-by-every (and (> fail-every 0) (zero? (mod call fail-every)))
+                    fail-rate (let [r (opt fa "failRate")] (if (number? r) r 0))
+                    fail-by-rate (and (> fail-rate 0) (< (lcg-rand) fail-rate))]
+                (if (or fail-by-count fail-by-every fail-by-rate)
+                  (do (do-sleep (pick-latency)) (.put ^java.util.Map applied "failStatus" fail-status) (track! ctx applied)
+                      [(respond fail-status nil (vs/jm "statusText" "Simulated Failure")) nil])
+                  (let [latency (pick-latency)]
+                    (.put ^java.util.Map applied "latency" latency) (track! ctx applied)
+                    (do-sleep latency)
+                    (inner ctx url fetchdef)))))))]
+    (swap! fa assoc :calls 0 :seed 1)
+    (swap! fa assoc
+           "init" (fn [ctx options]
+                    (let [seed0 (long (or (mget options "seed") 0))]
+                      (swap! fa assoc :client (core/oget ctx :client)
+                             :options (if (vs/ismap options) options (vs/jm)) :active (opts-active? options)
+                             :seed (if (= 0 seed0) 1 seed0) :calls 0))
+                    (when (active? fa)
+                      (wrap-fetcher! ctx (fn [fctx url fd inner] (simulate fctx url fd inner))))))
+    fa))
+
+;; ---------------------------------------------------------------------------
+;; Factory
+;; ---------------------------------------------------------------------------
+
+(defn make-feature [name]
+  (case name
+    "base" (base-feature)
+    "log" (log-feature)
+    "test" (test-feature)
+    "retry" (retry-feature)
+    "timeout" (timeout-feature)
+    "ratelimit" (ratelimit-feature)
+    "cache" (cache-feature)
+    "idempotency" (idempotency-feature)
+    "paging" (paging-feature)
+    "streaming" (streaming-feature)
+    "proxy" (proxy-feature)
+    "telemetry" (telemetry-feature)
+    "metrics" (metrics-feature)
+    "debug" (debug-feature)
+    "audit" (audit-feature)
+    "clienttrack" (clienttrack-feature)
+    "rbac" (rbac-feature)
+    "netsim" (netsim-feature)
+    (base-feature)))