@voxgig/sdkgen 4.32.0 → 4.33.0

package/project/.sdk/tm/go/utility/make_error.go

@@ -1,6 +1,10 @@
 package utility
 
-import "GOMODULE/core"
+import (
+	"fmt"
+
+	"GOMODULE/core"
+)
 
 func makeErrorUtil(ctx *core.Context, err error) (any, error) {
 	if ctx == nil {
@@ -40,23 +44,29 @@ func makeErrorUtil(ctx *core.Context, err error) (any, error) {
 
 	spec := ctx.Spec
 
-	if ctx.Ctrl.Explain != nil {
-		ctx.Ctrl.Explain["err"] = map[string]any{
-			"message": msg,
-		}
-	}
-
+	// The context stays reachable on the error for a debugger; its result and
+	// spec are masked copies, so masking them never masks the pipeline's own.
 	sdkErr := &core.ProjectNameError{
 		IsProjectNameError: true,
-		Sdk:              "ProjectName",
-		Code:             "",
-		Msg:              msg,
-		Ctx:              ctx,
-		Result:           cleanUtil(ctx, result),
-		Spec:             cleanUtil(ctx, spec),
+		Sdk:                "ProjectName",
+		Code:               "",
+		Msg:                msg,
+		Ctx:                ctx,
+		Result:             cleanUtil(ctx, result),
+		Spec:               cleanUtil(ctx, spec),
 	}
 	if se, ok := err.(*core.ProjectNameError); ok {
-		sdkErr.Code = se.Code
+		sdkErr.Code = cleanUtil(ctx, se.Code).(string)
+	}
+
+	if ctx.Ctrl.Explain != nil {
+		ctx.Ctrl.Explain["err"] = map[string]any{
+			"message": msg,
+			"code":    sdkErr.Code,
+		}
+		// A failure before done() (makeSpec after prepareAuth, say) leaves the
+		// explain record raw otherwise; ts reaches done() on every such path.
+		cleanExplain(ctx)
 	}
 
 	ctx.Ctrl.Err = sdkErr
@@ -65,13 +75,38 @@ func makeErrorUtil(ctx *core.Context, err error) (any, error) {
 	// debug) close/record error paths that never reach PreDone (e.g. a PrePoint
 	// rbac short-circuit). Fires after ctx.Ctrl.Err is set so hooks can read the
 	// error; features guard against double-recording when PreDone already fired.
+	var out error = sdkErr
 	if ctx.Utility != nil && ctx.Utility.FeatureHook != nil {
-		ctx.Utility.FeatureHook(ctx, "PreUnexpected")
+		// A hook that panics here would leave raw, after the cleaning above:
+		// its error replaces the SDK error, cleaned, as ts's catch path does.
+		if herr := preUnexpected(ctx); herr != nil {
+			if cerr, ok := cleanUtil(ctx, herr).(error); ok {
+				herr = cerr
+			}
+			ctx.Ctrl.Err = herr
+			if ctx.Ctrl.Explain != nil {
+				ctx.Ctrl.Explain["unexpected"] = map[string]any{"message": herr.Error()}
+			}
+			out = herr
+		}
 	}
 
 	if ctx.Ctrl.Throw != nil && *ctx.Ctrl.Throw == false {
 		return result.Resdata, nil
 	}
 
-	return nil, sdkErr
+	return nil, out
+}
+
+func preUnexpected(ctx *core.Context) (herr error) {
+	defer func() {
+		if r := recover(); r != nil {
+			var ok bool
+			if herr, ok = r.(error); !ok {
+				herr = fmt.Errorf("%v", r)
+			}
+		}
+	}()
+	ctx.Utility.FeatureHook(ctx, "PreUnexpected")
+	return nil
 }

package/project/.sdk/tm/go/utility/make_options.go

@@ -67,6 +67,36 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 
 	opts := vs.Clone(options).(map[string]any)
 
+	config := ctx.Config
+	if config == nil {
+		config = map[string]any{}
+	}
+	cfgopts := map[string]any{}
+	if co, ok := config["options"]; ok && co != nil {
+		if cm, ok := co.(map[string]any); ok {
+			cfgopts = cm
+		}
+	}
+
+	// The secret registry exists BEFORE validation, fed from the raw input, so
+	// the constructor's own rejection of a mistyped credential is clean too.
+	cleanraw := map[string]any{}
+	for _, layer := range []any{core.OPTSPEC["clean"], cfgopts["clean"], opts["clean"]} {
+		for k, v := range core.ToMapAny(layer) {
+			cleanraw[k] = v
+		}
+	}
+	cleancfg := makeCleanConfig(cleanraw)
+	cleanctx := &core.Context{Options: map[string]any{
+		"__derived__": map[string]any{"clean": cleancfg},
+	}}
+	cleanAddOptions(cleanctx, cleanOmit(opts, "clean"))
+	for _, block := range []map[string]any{cfgopts, opts} {
+		for _, s := range cleanSplit(vs.GetPath(block, []any{"clean", "values"})) {
+			cleancfg.add(s)
+		}
+	}
+
 	var featureorder []any
 	if farr, ok := opts["feature"].([]any); ok {
 		fmap := map[string]any{}
@@ -91,17 +121,6 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 		opts["feature"] = fmap
 	}
 
-	config := ctx.Config
-	if config == nil {
-		config = map[string]any{}
-	}
-	cfgopts := map[string]any{}
-	if co, ok := config["options"]; ok && co != nil {
-		if cm, ok := co.(map[string]any); ok {
-			cfgopts = cm
-		}
-	}
-
 	optspec := core.OPTSPEC
 
 	// Preserve system.fetch before merge/validate.
@@ -169,24 +188,6 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 		}
 	}
 
-	// Derived clean config.
-	cleanKeys := "key,token,id"
-	if ck := vs.GetPath(opts, []any{"clean", "keys"}); ck != nil {
-		if cks, ok := ck.(string); ok {
-			cleanKeys = cks
-		}
-	}
-
-	parts := strings.Split(cleanKeys, ",")
-	var filtered []string
-	for _, p := range parts {
-		p = strings.TrimSpace(p)
-		if p != "" {
-			filtered = append(filtered, vs.EscRe(p))
-		}
-	}
-	keyre := strings.Join(filtered, "|")
-
 	// Resolve the feature add-order: an explicit array order (above) wins;
 	// otherwise order the map test-first, then the remaining names sorted, so
 	// the outcome is deterministic and `test` is always the base transport.
@@ -238,14 +239,54 @@ func makeOptionsUtil(ctx *core.Context) map[string]any {
 		}
 	}
 
-	derived := map[string]any{
-		"clean": map[string]any{},
-	}
-	if keyre != "" {
-		derived["clean"] = map[string]any{"keyre": keyre}
+	opts["__derived__"] = map[string]any{
+		"clean":        cleancfg,
+		"featureorder": featureorder,
 	}
-	derived["featureorder"] = featureorder
-	opts["__derived__"] = derived
+
+	// Again over the merged result: the config's own defaults can carry one.
+	cleanAddOptions(cleanctx, cleanOmit(opts, "clean", "__derived__"))
 
 	return opts
 }
+
+// A feature's name is not a field name: only the sensitive names inside its
+// settings count, so `secrets` does not make every setting a secret. Entity
+// blocks (per-entity settings, seeded records) hold no credential.
+func cleanAddOptions(ctx *core.Context, opts map[string]any) {
+	top := cleanOmit(opts, "feature", "entity")
+	if test, ok := top["test"]; ok {
+		top["test"] = cleanNoEntity(test)
+	}
+	cleanAddSensitive(ctx, top)
+	switch feature := opts["feature"].(type) {
+	case map[string]any:
+		for _, fopts := range feature {
+			cleanAddSensitive(ctx, cleanNoEntity(fopts))
+		}
+	case []any:
+		for _, entry := range feature {
+			cleanAddSensitive(ctx, cleanNoEntity(entry))
+		}
+	default:
+		cleanAddSensitive(ctx, feature)
+	}
+}
+
+func cleanNoEntity(block any) any {
+	if m, ok := block.(map[string]any); ok {
+		return cleanOmit(m, "entity")
+	}
+	return block
+}
+
+func cleanOmit(m map[string]any, keys ...string) map[string]any {
+	out := make(map[string]any, len(m))
+	for k, v := range m {
+		out[k] = v
+	}
+	for _, k := range keys {
+		delete(out, k)
+	}
+	return out
+}

package/project/.sdk/tm/go/utility/register.go

@@ -8,6 +8,8 @@ func init() {
 
 func registerAll(u *core.Utility) {
 	u.Clean = cleanUtil
+	u.CleanAdd = cleanAddUtil
+	u.CleanExplain = cleanExplain
 	u.Done = doneUtil
 	u.MakeError = makeErrorUtil
 	u.FeatureAdd = featureAddUtil
@@ -47,6 +49,16 @@ func overrideUtil(u *core.Utility, key string, val any) bool {
 			u.Clean = fn
 			return true
 		}
+	case "cleanAdd":
+		if fn, ok := val.(func(ctx *core.Context, val any)); ok {
+			u.CleanAdd = fn
+			return true
+		}
+	case "cleanExplain":
+		if fn, ok := val.(func(ctx *core.Context)); ok {
+			u.CleanExplain = fn
+			return true
+		}
 	case "done":
 		if fn, ok := val.(func(ctx *core.Context) (any, error)); ok {
 			u.Done = fn

package/project/.sdk/tm/java/core/Context.java

@@ -267,4 +267,33 @@ public class Context {
   public SdkError makeError(String code, String msg) {
     return new SdkError(code, msg, this);
   }
+
+  /** The raw record a serialiser reads; the live fields stay raw for the pipeline. */
+  public Map<String, Object> record() {
+    Map<String, Object> record = new LinkedHashMap<>();
+    record.put("id", this.id);
+    record.put("op", this.op);
+    record.put("spec", this.spec);
+    record.put("entity", this.entity);
+    record.put("result", this.result);
+    record.put("response", this.response);
+    record.put("meta", this.meta);
+    return record;
+  }
+
+  // The serialised context leaves the pipeline (a logger, an error dump), so
+  // it is cleaned.
+  public Map<String, Object> toMap() {
+    Map<String, Object> record = record();
+    if (this.utility == null || this.utility.clean == null) {
+      return record;
+    }
+    Map<String, Object> cleaned = Helpers.toMapAny(this.utility.clean.apply(this, record));
+    return cleaned == null ? record : cleaned;
+  }
+
+  @Override
+  public String toString() {
+    return "Context " + Struct.jsonify(toMap());
+  }
 }

package/project/.sdk/tm/java/core/SdkClient.java

@@ -290,13 +290,15 @@ public abstract class SdkClient {
 
     Map<String, Object> out = new LinkedHashMap<>();
 
+    // A raw request returns its failure rather than passing it through
+    // makeError, so it is cleaned here.
     Map<String, Object> fetchdef;
     try {
       fetchdef = this.prepare(fetchargs);
     }
     catch (RuntimeException err) {
       out.put("ok", false);
-      out.put("err", err);
+      out.put("err", utility.clean.apply(ctx, err));
       return out;
     }
 
@@ -308,7 +310,7 @@ public abstract class SdkClient {
     }
     catch (RuntimeException err) {
       out.put("ok", false);
-      out.put("err", err);
+      out.put("err", utility.clean.apply(ctx, err));
       return out;
     }
 

package/project/.sdk/tm/java/core/Utility.java

@@ -20,6 +20,11 @@ public class Utility {
     Object apply(Context ctx, Object val);
   }
 
+  @FunctionalInterface
+  public interface CleanAddFn {
+    void apply(Context ctx, Object value);
+  }
+
   @FunctionalInterface
   public interface MakeErrorFn {
     Object apply(Context ctx, RuntimeException err);
@@ -51,6 +56,7 @@ public class Utility {
   }
 
   public CleanFn clean;
+  public CleanAddFn cleanAdd;
   public CtxFn<Object> done;
   public MakeErrorFn makeError;
   public FeatureFn featureAdd;
@@ -94,6 +100,7 @@ public class Utility {
     Utility u = new Utility(true);
 
     u.clean = this.clean;
+    u.cleanAdd = this.cleanAdd;
     u.done = this.done;
     u.makeError = this.makeError;
     u.featureAdd = this.featureAdd;

package/project/.sdk/tm/java/feature/AuditFeature.java

@@ -7,6 +7,7 @@ import java.util.Map;
 import java.util.function.Consumer;
 
 import JAVAPACKAGE.core.Context;
+import JAVAPACKAGE.core.Helpers;
 import JAVAPACKAGE.core.SdkClient;
 
 // Audit trail. Emits a structured record for every operation — who (actor),
@@ -100,6 +101,11 @@ public class AuditFeature extends BaseFeature {
       record.put("status", ctx.result.status);
     }
 
+    if (ctx.utility != null && ctx.utility.clean != null) {
+      Map<String, Object> cleaned = Helpers.toMapAny(ctx.utility.clean.apply(ctx, record));
+      record = cleaned == null ? record : cleaned;
+    }
+
     this.records.add(record);
     int max = FeatureOptions.foptInt(this.options, "max", 1000);
     while (this.records.size() > max) {

package/project/.sdk/tm/java/feature/CostFeature.java

@@ -7,6 +7,7 @@ import java.util.Map;
 import java.util.function.Consumer;
 
 import JAVAPACKAGE.core.Context;
+import JAVAPACKAGE.core.Helpers;
 import JAVAPACKAGE.core.SdkClient;
 import JAVAPACKAGE.core.Utility;
 import JAVAPACKAGE.utility.struct.Struct;
@@ -299,6 +300,10 @@ public class CostFeature extends BaseFeature {
     record.put("currency", this.currency);
     record.put("source", source);
     record.put("attempts", pending.attempts);
+    if (ctx.utility != null && ctx.utility.clean != null) {
+      Map<String, Object> cleaned = Helpers.toMapAny(ctx.utility.clean.apply(ctx, record));
+      record = cleaned == null ? record : cleaned;
+    }
     this.last = record;
 
     if (this.options.get("sink") instanceof Consumer) {

package/project/.sdk/tm/java/feature/DebugFeature.java

@@ -12,10 +12,10 @@ import JAVAPACKAGE.core.SdkClient;
 
 // Request/response capture for debugging. Records a bounded ring buffer of
 // per-operation traces — method, URL, redacted headers, response status and
-// timing — on the feature's entries. Sensitive header values (matching
-// `redact`, default authorization/cookie/api-key style names) are masked.
-// An optional `onEntry` callback receives each finished entry (e.g. to
-// stream to a console). `max` caps the buffer (default 100).
+// timing — on the feature's entries. The SDK's own clean rules apply to the
+// whole entry; header names in `redact` are masked on top of them. An
+// optional `onEntry` callback receives each finished entry (e.g. to stream
+// to a console). `max` caps the buffer (default 100).
 @SuppressWarnings({"unchecked"})
 public class DebugFeature extends BaseFeature {
 
@@ -27,10 +27,6 @@ public class DebugFeature extends BaseFeature {
 
   private static final String DEBUG_ENTRY_KEY = "debug_entry";
 
-  private static final List<String> DEFAULT_REDACT = List.of(
-      "authorization", "cookie", "set-cookie", "api-key", "apikey",
-      "x-api-key", "idempotency-key");
-
   public DebugFeature() {
     super("debug", "0.0.1", true);
   }
@@ -66,7 +62,7 @@ public class DebugFeature extends BaseFeature {
       else {
         entry.put("url", ctx.spec.path);
       }
-      entry.put("headers", redact(ctx.spec.headers));
+      entry.put("headers", redact(ctx, ctx.spec.headers));
     }
     ctx.out.put(DEBUG_ENTRY_KEY, entry);
   }
@@ -123,6 +119,11 @@ public class DebugFeature extends BaseFeature {
       entry.put("status", ctx.result.status);
     }
 
+    // The whole entry leaves through the buffer and the callback: the url
+    // and the error message can carry a query credential the header mask
+    // above never saw.
+    entry = clean(ctx, entry);
+
     this.entries.add(entry);
     int max = FeatureOptions.foptInt(this.options, "max", 100);
     while (this.entries.size() > max) {
@@ -134,30 +135,40 @@ public class DebugFeature extends BaseFeature {
     }
   }
 
-  private Map<String, Object> redact(Map<String, Object> headers) {
+  // The core clean rules apply (clean.keys, every registered value); the
+  // feature's own `redact` list ADDS header names on top of them.
+  private Map<String, Object> redact(Context ctx, Map<String, Object> headers) {
     Map<String, Object> out = new LinkedHashMap<>();
     if (headers == null) {
       return out;
     }
     List<String> patterns = FeatureOptions.foptStrList(this.options, "redact");
     if (patterns == null) {
-      patterns = DEFAULT_REDACT;
+      patterns = List.of();
     }
     for (Map.Entry<String, Object> h : headers.entrySet()) {
       boolean masked = false;
       for (String p : patterns) {
-        if (h.getKey().toLowerCase().equals(p)) {
+        if (h.getKey().toLowerCase().equals(p.toLowerCase())) {
           masked = true;
           break;
         }
       }
       if (masked) {
-        out.put(h.getKey(), "<redacted>");
+        out.put(h.getKey(), "[redacted]");
       }
       else {
         out.put(h.getKey(), h.getValue());
       }
     }
-    return out;
+    return clean(ctx, out);
+  }
+
+  private static Map<String, Object> clean(Context ctx, Map<String, Object> record) {
+    if (ctx.utility == null || ctx.utility.clean == null) {
+      return record;
+    }
+    Map<String, Object> out = Helpers.toMapAny(ctx.utility.clean.apply(ctx, record));
+    return out == null ? record : out;
   }
 }

package/project/.sdk/tm/java/feature/LogFeature.java

@@ -125,18 +125,25 @@ public class LogFeature extends BaseFeature {
       msg.append(" spec=").append(ctx.spec.method).append(" ").append(ctx.spec.path);
     }
 
+    // A log line leaves the pipeline, so it is cleaned like every other
+    // emission, even though it carries no header or url today.
+    String line = msg.toString();
+    if (ctx.utility != null && ctx.utility.clean != null) {
+      line = String.valueOf(ctx.utility.clean.apply(ctx, line));
+    }
+
     switch (level) {
       case "debug":
-        this.logger.fine(msg.toString());
+        this.logger.fine(line);
         break;
       case "warn":
-        this.logger.warning(msg.toString());
+        this.logger.warning(line);
         break;
       case "error":
-        this.logger.severe(msg.toString());
+        this.logger.severe(line);
         break;
       default:
-        this.logger.info(msg.toString());
+        this.logger.info(line);
         break;
     }
   }

package/project/.sdk/tm/java/feature/ProxyFeature.java

@@ -1,5 +1,9 @@
 package JAVAPACKAGE.feature;
 
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -25,7 +29,12 @@ public class ProxyFeature extends BaseFeature {
   private Map<String, Object> options;
   private List<String> noProxy = new ArrayList<>();
 
-  // Activity tracking (mirrors the ts client._proxy record).
+  // The proxy the transport is told to route through, raw: it may carry
+  // credentials as userinfo.
+  private String target = "";
+
+  // Activity tracking (mirrors the ts client._proxy record). `url` is the
+  // cleaned form of the target, since the record is what a caller prints.
   public int routed = 0;
   public String url = "";
 
@@ -46,12 +55,12 @@ public class ProxyFeature extends BaseFeature {
       return;
     }
 
-    this.url = FeatureOptions.foptStr(this.options, "url", "");
+    this.target = FeatureOptions.foptStr(this.options, "url", "");
     List<String> noProxyRaw = FeatureOptions.foptStrList(this.options, "noProxy");
 
     if (FeatureOptions.foptBool(this.options, "fromEnv", false)) {
-      if ("".equals(this.url)) {
-        this.url = firstEnv("HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy");
+      if ("".equals(this.target)) {
+        this.target = firstEnv("HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy");
       }
       if (noProxyRaw == null) {
         String np = firstEnv("NO_PROXY", "no_proxy");
@@ -71,6 +80,32 @@ public class ProxyFeature extends BaseFeature {
       }
     }
 
+    // A proxy URL may carry credentials as userinfo, from the option or the
+    // environment, and neither is under a sensitive key name.
+    if (!"".equals(this.target) && ctx.utility != null && ctx.utility.cleanAdd != null) {
+      try {
+        String userinfo = new URI(this.target).getRawUserInfo();
+        if (userinfo != null) {
+          int colon = userinfo.indexOf(':');
+          String[] parts = colon < 0
+              ? new String[] {userinfo}
+              : new String[] {userinfo.substring(0, colon), userinfo.substring(colon + 1)};
+          for (String part : parts) {
+            if (!"".equals(part)) {
+              ctx.utility.cleanAdd.apply(ctx, part);
+              ctx.utility.cleanAdd.apply(ctx, URLDecoder.decode(part, StandardCharsets.UTF_8));
+            }
+          }
+        }
+      }
+      catch (URISyntaxException | RuntimeException e) {
+        // An unparseable target routes nothing (see route), so there is
+        // nothing to register.
+      }
+    }
+    this.url = ctx.utility != null && ctx.utility.clean != null
+        ? String.valueOf(ctx.utility.clean.apply(ctx, this.target)) : this.target;
+
     final Utility.FetcherFn inner = ctx.utility.fetcher;
 
     ctx.utility.fetcher = (ctx2, u, fetchdef) ->
@@ -78,12 +113,12 @@ public class ProxyFeature extends BaseFeature {
   }
 
   private Map<String, Object> route(String u, Map<String, Object> fetchdef) {
-    if ("".equals(this.url) || bypass(u)) {
+    if ("".equals(this.target) || bypass(u)) {
       return fetchdef;
     }
 
     Map<String, Object> out = new LinkedHashMap<>(fetchdef);
-    out.put("proxy", this.url);
+    out.put("proxy", this.target);
 
     this.routed++;
     return out;

package/project/.sdk/tm/java/feature/SecretsFeature.java

@@ -88,6 +88,10 @@ public class SecretsFeature extends BaseFeature {
   private boolean cache = true;
   private Sekreto sek;
 
+  // The context init was given: the registry every resolved value is added
+  // to lives on its options.
+  private Context rootctx;
+
   // Exchange state: null config when off; the refresh credential the chain
   // resolved; the single in-flight purchase.
   private SecretsExchange exchange;
@@ -145,6 +149,7 @@ public class SecretsFeature extends BaseFeature {
   @Override
   public void init(Context ctx, Map<String, Object> options) {
     this.client = ctx.client;
+    this.rootctx = ctx;
     this.liveopts = ctx.options == null ? new LinkedHashMap<>() : ctx.options;
     this.active = true;
 
@@ -194,6 +199,7 @@ public class SecretsFeature extends BaseFeature {
     List<Object> specs = new ArrayList<>();
 
     if (!"".equals(explicit)) {
+      register(explicit);
       String key = null;
       try {
         key = Sekreto.envkey(this.secretname, null);
@@ -393,6 +399,7 @@ public class SecretsFeature extends BaseFeature {
     // tryget: null is a MISS (the chain had nothing), an exception is an
     // ERROR and propagates to the gate above.
     String found = this.sek.tryget(this.secretname);
+    register(found);
 
     if (this.exchange == null) {
       synchronized (this.lock) {
@@ -570,6 +577,7 @@ public class SecretsFeature extends BaseFeature {
     // required server variable, for the same reason.
     if (!"live".equals(this.client.mode)) {
       String token = "test-" + this.exchange.response;
+      register(token);
       synchronized (this.lock) {
         this.cred = token;
       }
@@ -602,6 +610,7 @@ public class SecretsFeature extends BaseFeature {
     RuntimeException err = null;
     try {
       token = buyonce();
+      register(token);
     }
     catch (RuntimeException e) {
       err = e;
@@ -625,6 +634,15 @@ public class SecretsFeature extends BaseFeature {
     return token;
   }
 
+  // Every value this feature resolves or buys is a secret the SDK handles,
+  // and none arrives under an option key the intake registration saw.
+  private void register(String value) {
+    Context ctx = this.rootctx;
+    if (value != null && ctx != null && ctx.utility != null && ctx.utility.cleanAdd != null) {
+      ctx.utility.cleanAdd.apply(ctx, value);
+    }
+  }
+
   private String buyonce() {
     SecretsExchange x = this.exchange;
 

package/project/.sdk/tm/java/feature/TelemetryFeature.java

@@ -122,11 +122,17 @@ public class TelemetryFeature extends BaseFeature {
     span.put("durationMs", dur);
     span.put("ok", ok);
 
+    Map<String, Object> out = span;
+    if (ctx.utility != null && ctx.utility.clean != null) {
+      Map<String, Object> cleaned = Helpers.toMapAny(ctx.utility.clean.apply(ctx, span));
+      out = cleaned == null ? span : cleaned;
+    }
+
     this.activeSpans--;
-    this.spans.add(span);
+    this.spans.add(out);
 
     if (this.options.get("exporter") instanceof Consumer) {
-      ((Consumer<Map<String, Object>>) this.options.get("exporter")).accept(span);
+      ((Consumer<Map<String, Object>>) this.options.get("exporter")).accept(out);
     }
   }