@voxgig/sdkgen 4.32.0 → 4.33.0

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/utility/ResultUtil.swift

@@ -118,14 +118,401 @@ func transformResponseUtil(_ ctx: Context) -> Value {
   return resdata
 }
 
+// MARK: - clean
+
+// Everything that leaves the pipeline passes through clean; inside it data
+// stays raw, so a hook can still read the header it must add to. See
+// docs/explanation/secret-redaction.md.
+
+// The derived clean block, MUTABLE after makeOptions since features register
+// values later. Carried as a native object under options.__derived__.clean,
+// which JSON.stringify prints as "<function>" rather than as the registry.
+// Nested in Utility, whose registry it is, so no entity type can collide
+// with it.
+extension Utility {
+  public final class CleanConfig {
+    public var active = true
+    public var keys: [String] = []
+    public var values: [String] = []
+    public var mask = "[redacted]"
+    public var hint = 0
+    public var min = 4
+    public init() {}
+  }
+}
+
+private let cleanMaxDepth = 32
+private let cleanCircular = "[circular]"
+
+// encodeURIComponent's unreserved set.
+private let cleanUnreserved = CharacterSet(
+  charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.!~*'()")
+
+private func cleanNormKey(_ key: String) -> String {
+  return key.lowercased()
+    .replacingOccurrences(of: "-", with: "")
+    .replacingOccurrences(of: "_", with: "")
+}
+
+private func cleanSplit(_ v: Value) -> [String] {
+  let text = v.asString ?? (isNil(v) ? "" : stringify(v))
+  return text.split(separator: ",", omittingEmptySubsequences: false)
+    .map { $0.trimmingCharacters(in: .whitespaces) }
+    .filter { $0 != "" }
+}
+
+func cleanSplitValues(_ v: Value) -> [String] {
+  if let l = v.asList {
+    return l.items.compactMap { $0.asString }
+  }
+  return cleanSplit(v)
+}
+
+private func cleanCount(_ v: Value, _ dflt: Int) -> Int {
+  var n: Double
+  switch v {
+  case .int(let i): n = Double(i)
+  case .double(let d): n = d
+  case .string(let s):
+    guard let d = Double(s.trimmingCharacters(in: .whitespaces)) else { return dflt }
+    n = d
+  default: return dflt
+  }
+  n = n.rounded(.down)
+  return n.isFinite && 0 <= n ? Int(n) : dflt
+}
+
+func makeCleanConfig(_ cleanopts: Value) -> Utility.CleanConfig {
+  let opts = cleanopts.asMap ?? VMap()
+  let cfg = Utility.CleanConfig()
+  cfg.active = gp(opts, "active") != .bool(false)
+  cfg.keys = cleanSplit(gp(opts, "keys")).map(cleanNormKey)
+  cfg.values = []
+  cfg.mask = gp(opts, "mask").asString ?? "[redacted]"
+  cfg.hint = cleanCount(gp(opts, "hint"), 0)
+  cfg.min = max(1, cleanCount(gp(opts, "min"), 4))
+  return cfg
+}
+
+// A context without options (makeError accepts a bare one) still masks by
+// the schema defaults.
+func cleanConfigOf(_ ctx: Context) -> Utility.CleanConfig {
+  if let cfg = gpath(ctx.options, "__derived__", "clean").asNative as? Utility.CleanConfig {
+    return cfg
+  }
+  return makeCleanConfig(gp(SdkSchema.optspec, "clean"))
+}
+
+// The encoded forms a value travels in.
+private func cleanForms(_ value: String) -> [String] {
+  var out = [value]
+  func add(_ s: String) {
+    if s != "" && !out.contains(s) { out.append(s) }
+  }
+  add(Data(value.utf8).base64EncodedString())
+  add(value.addingPercentEncoding(withAllowedCharacters: cleanUnreserved) ?? "")
+  add(String(JSON.quoted(value).dropFirst().dropLast()))
+  return out
+}
+
+func cleanAddUtil(_ ctx: Context, _ value: Value) {
+  let cfg = cleanConfigOf(ctx)
+  guard let s = value.asString, s.count >= cfg.min else { return }
+  var changed = false
+  for form in cleanForms(s) {
+    if form.count >= cfg.min && !cfg.values.contains(form) {
+      cfg.values.append(form)
+      changed = true
+    }
+  }
+  if changed {
+    cfg.values.sort { $0.count > $1.count }
+  }
+}
+
+// Every scalar under a sensitive name, at any depth and of any shape: a
+// credential mistyped as a map or a number is still a credential.
+func cleanAddSensitiveUtil(_ ctx: Context, _ val: Value) {
+  var seen: [ObjectIdentifier] = []
+  cleanAddSensitiveAt(ctx, val, false, 0, &seen)
+}
+
+private func cleanAddSensitiveAt(
+  _ ctx: Context, _ val: Value, _ under: Bool, _ depth: Int, _ seen: inout [ObjectIdentifier]
+) {
+  if cleanMaxDepth <= depth { return }
+  switch val {
+  case .string(let s):
+    if under { cleanAddUtil(ctx, .string(s)) }
+  case .int(let i):
+    if under { cleanAddUtil(ctx, .string(String(i))) }
+  case .double(let d):
+    if under { cleanAddUtil(ctx, .string(cleanNumberText(d))) }
+  case .list(let l):
+    if seen.contains(ObjectIdentifier(l)) { return }
+    seen.append(ObjectIdentifier(l))
+    for item in l.items {
+      cleanAddSensitiveAt(ctx, item, under, depth + 1, &seen)
+    }
+  case .map(let m):
+    if seen.contains(ObjectIdentifier(m)) { return }
+    seen.append(ObjectIdentifier(m))
+    for (k, item) in m.entries {
+      cleanAddSensitiveAt(ctx, item, under || cleanKeyUtil(ctx, k), depth + 1, &seen)
+    }
+  default:
+    return
+  }
+}
+
+// A number's decimal text as JavaScript's String() writes it, for whole values.
+private func cleanNumberText(_ d: Double) -> String {
+  if d.rounded() == d && abs(d) < 9.0e15 {
+    return String(Int64(d))
+  }
+  return String(d)
+}
+
+private func cleanMaskValue(_ cfg: Utility.CleanConfig, _ value: String) -> String {
+  if 0 < cfg.hint && value.count > 2 * cfg.hint {
+    return cfg.mask + String(value.suffix(cfg.hint))
+  }
+  return cfg.mask
+}
+
+private func cleanString(_ cfg: Utility.CleanConfig, _ text: String) -> String {
+  var out = text
+  for value in cfg.values where out.contains(value) {
+    out = out.replacingOccurrences(of: value, with: cleanMaskValue(cfg, value))
+  }
+  return out
+}
+
+private func cleanSensitiveKey(_ cfg: Utility.CleanConfig, _ key: String?) -> Bool {
+  guard let key = key else { return false }
+  let nk = cleanNormKey(key)
+  return cfg.keys.contains { nk.contains($0) }
+}
+
+// A masked plain-data copy: closures dropped, cycles cut, and nothing shared
+// with the live value, whose spec must stay raw. A typed pipeline product
+// carried as a native (a Spec, a Result, a feature record) reads through its
+// stored properties, the way `dump` would; the context reads through its
+// own record so its client, options and config never enter.
+private func cleanSnapshot(
+  _ cfg: Utility.CleanConfig, _ val: Value, _ key: String?, _ depth: Int,
+  _ seen: inout [ObjectIdentifier]
+) -> Value {
+  switch val {
+  case .noval, .null, .sentinel:
+    return val
+  case .string(let s):
+    return .string(cleanSensitiveKey(cfg, key) ? cleanMaskValue(cfg, s) : cleanString(cfg, s))
+  case .function:
+    return .noval
+  case .bool, .int, .double:
+    return cleanSensitiveKey(cfg, key) ? .string(cfg.mask) : val
+  case .native(let ref):
+    if cleanMaxDepth <= depth || seen.contains(ObjectIdentifier(ref)) {
+      return .string(cleanCircular)
+    }
+    if cleanSensitiveKey(cfg, key) {
+      return .string(cfg.mask)
+    }
+    seen.append(ObjectIdentifier(ref))
+    defer { seen.removeLast() }
+    return cleanNative(cfg, ref.value, key, depth, &seen)
+  case .list(let l):
+    if cleanMaxDepth <= depth || seen.contains(ObjectIdentifier(l)) {
+      return .string(cleanCircular)
+    }
+    if cleanSensitiveKey(cfg, key) {
+      return .string(cfg.mask)
+    }
+    seen.append(ObjectIdentifier(l))
+    defer { seen.removeLast() }
+    let out = VList()
+    for item in l.items {
+      out.items.append(cleanSnapshot(cfg, item, nil, depth + 1, &seen))
+    }
+    return .list(out)
+  case .map(let m):
+    if cleanMaxDepth <= depth || seen.contains(ObjectIdentifier(m)) {
+      return .string(cleanCircular)
+    }
+    if cleanSensitiveKey(cfg, key) {
+      return .string(cfg.mask)
+    }
+    seen.append(ObjectIdentifier(m))
+    defer { seen.removeLast() }
+    let out = VMap()
+    for (k, item) in m.entries {
+      let v = cleanSnapshot(cfg, item, k, depth + 1, &seen)
+      if !v.isNoval { out.entries[cleanName(cfg, out, k)] = v }
+    }
+    return .map(out)
+  }
+}
+
+// A registered value used as a property name is masked like any other
+// string; names that mask alike take a counter, so none is lost.
+private func cleanName(_ cfg: Utility.CleanConfig, _ out: VMap, _ key: String) -> String {
+  let name = cleanString(cfg, key)
+  if name == key || out.entries[name] == nil {
+    return name
+  }
+  var i = 1
+  while out.entries[name + "#" + String(i)] != nil { i += 1 }
+  return name + "#" + String(i)
+}
+
+private func cleanErrorRecord(
+  _ cfg: Utility.CleanConfig, _ err: Error, _ depth: Int, _ seen: inout [ObjectIdentifier]
+) -> Value {
+  let out = VMap()
+  out.entries["message"] = .string(cleanString(cfg, errMessage(err)))
+  if let se = err as? ProjectNameError {
+    out.entries["sdk"] = .string(se.sdk)
+    out.entries["code"] = .string(cleanString(cfg, se.code))
+    out.entries["status"] = .int(Int64(se.status))
+    out.entries["result"] = cleanSnapshot(cfg, se.resultVal, "result", depth + 1, &seen)
+    out.entries["spec"] = cleanSnapshot(cfg, se.specVal, "spec", depth + 1, &seen)
+  }
+  return .map(out)
+}
+
+// A native the loose model carries. The pipeline's own products are read
+// through their stored properties; anything else (a closure, a foreign
+// object) is dropped, as a function is.
+private func cleanNative(
+  _ cfg: Utility.CleanConfig, _ any: Any, _ key: String?, _ depth: Int,
+  _ seen: inout [ObjectIdentifier]
+) -> Value {
+  if let v = any as? Value {
+    return cleanSnapshot(cfg, v, key, depth, &seen)
+  }
+  if let m = any as? VMap {
+    return cleanSnapshot(cfg, .map(m), key, depth, &seen)
+  }
+  if let l = any as? VList {
+    return cleanSnapshot(cfg, .list(l), key, depth, &seen)
+  }
+  if let s = any as? String {
+    return cleanSnapshot(cfg, .string(s), key, depth, &seen)
+  }
+  if let b = any as? Bool {
+    return cleanSnapshot(cfg, .bool(b), key, depth, &seen)
+  }
+  if let i = any as? Int {
+    return cleanSnapshot(cfg, .int(Int64(i)), key, depth, &seen)
+  }
+  if let i = any as? Int64 {
+    return cleanSnapshot(cfg, .int(i), key, depth, &seen)
+  }
+  if let d = any as? Double {
+    return cleanSnapshot(cfg, .double(d), key, depth, &seen)
+  }
+  if let err = any as? Error {
+    return cleanErrorRecord(cfg, err, depth, &seen)
+  }
+  if let ctx = any as? Context {
+    return cleanSnapshot(cfg, .map(ctx.rawRecord()), key, depth, &seen)
+  }
+  if let ent = any as? Entity {
+    return .string(ent.getName())
+  }
+  if any is ProjectNameSDK {
+    return .noval
+  }
+
+  let mirror = Mirror(reflecting: any)
+  if mirror.displayStyle == .optional {
+    guard let inner = mirror.children.first?.value else { return .null }
+    return cleanNative(cfg, inner, key, depth, &seen)
+  }
+  if mirror.displayStyle == .collection || mirror.displayStyle == .set {
+    let out = VList()
+    for child in mirror.children {
+      let v = cleanNative(cfg, child.value, nil, depth + 1, &seen)
+      out.items.append(v)
+    }
+    return .list(out)
+  }
+  if mirror.displayStyle == .dictionary {
+    // Sorted, so colliding masked names number the same way every run.
+    var pairs: [(String, Any)] = []
+    for child in mirror.children {
+      let pair = Mirror(reflecting: child.value).children.map { $0.value }
+      guard 2 == pair.count else { continue }
+      pairs.append((String(describing: pair[0]), pair[1]))
+    }
+    let out = VMap()
+    for (k, item) in pairs.sorted(by: { $0.0 < $1.0 }) {
+      let v = cleanNative(cfg, item, k, depth + 1, &seen)
+      if !v.isNoval { out.entries[cleanName(cfg, out, k)] = v }
+    }
+    return .map(out)
+  }
+  if mirror.displayStyle == .class || mirror.displayStyle == .struct {
+    let out = VMap()
+    for child in mirror.children {
+      guard let label = child.label else { continue }
+      let v = cleanNative(cfg, child.value, label, depth + 1, &seen)
+      if !v.isNoval { out.entries[label] = v }
+    }
+    return .map(out)
+  }
+  return .noval
+}
+
+// The SDK's own error is cleaned in place, since it is about to be thrown.
 func cleanUtil(_ ctx: Context, _ val: Value) -> Value {
-  return val
+  let cfg = cleanConfigOf(ctx)
+
+  if !cfg.active {
+    return val
+  }
+
+  if let s = val.asString {
+    return .string(cleanString(cfg, s))
+  }
+
+  if let err = val.asNative as? ProjectNameError {
+    var seen: [ObjectIdentifier] = []
+    err.message = cleanString(cfg, err.message)
+    err.code = cleanString(cfg, err.code)
+    if !isNil(err.resultVal) {
+      err.resultVal = cleanSnapshot(cfg, err.resultVal, "result", 1, &seen)
+    }
+    if !isNil(err.specVal) {
+      err.specVal = cleanSnapshot(cfg, err.specVal, "spec", 1, &seen)
+    }
+    return val
+  }
+
+  if val.asNative is Error {
+    return val
+  }
+
+  var seen: [ObjectIdentifier] = []
+  return cleanSnapshot(cfg, val, nil, 0, &seen)
+}
+
+func cleanKeyUtil(_ ctx: Context, _ key: String) -> Bool {
+  return cleanSensitiveKey(cleanConfigOf(ctx), key)
 }
 
 func doneUtil(_ ctx: Context) throws -> Value {
-  if let explain = ctx.ctrl.explain,
-    let rm = explain.entries["result"]?.asMap {
-    rm.entries.removeValue(forKey: "err")
+  if let explain = ctx.ctrl.explain {
+    // Refilled in place: the caller holds this very map (the Context took it
+    // out of the ctrl map), so a replacement would leave them reading the
+    // raw one.
+    if let cleaned = cleanUtil(ctx, .map(explain)).asMap, cleaned !== explain {
+      explain.entries = cleaned.entries
+    }
+    if let rm = explain.entries["result"]?.asMap {
+      rm.entries.removeValue(forKey: "err")
+    }
   }
 
   if let result = ctx.result, result.ok {

package/project/.sdk/tm/swift/Tests/ProjectNameSDKTests/FeatureTest.swift

@@ -757,7 +757,7 @@ final class FeatureDebugTest: XCTestCase {
     XCTAssertEqual(f.entries.count, 1)
     XCTAssertEqual(seen.count, 2)
     let headers = seen[0].entries["headers"]?.asMap
-    XCTAssertEqual(headers?.entries["authorization"], .string("<redacted>"))
+    XCTAssertEqual(headers?.entries["authorization"], .string("[redacted]"))
   }
 
   func testCapturesFailures() {
@@ -777,7 +777,7 @@ final class FeatureDebugTest: XCTestCase {
     let h = Fh.make(nil, (f, vm(("now", .nat(clock.now)), ("redact", .list([.string("x-secret")])))))
     _ = h.op(FhOpSpec(op: "load", headers: vm(("x-secret", .string("hide")), ("x-ok", .string("show")))))
     let headers = f.entries[0].entries["headers"]?.asMap
-    XCTAssertEqual(headers?.entries["x-secret"], .string("<redacted>"))
+    XCTAssertEqual(headers?.entries["x-secret"], .string("[redacted]"))
     XCTAssertEqual(headers?.entries["x-ok"], .string("show"))
   }
 

package/project/.sdk/tm/ts/src/Context.ts

@@ -121,8 +121,10 @@ class Context {
   }
 
 
+  // The serialised context leaves the pipeline (a logger, an error dump), so
+  // it is cleaned; the live fields stay raw for the pipeline's own use.
   toJSON() {
-    return {
+    const record = {
       id: this.id,
       op: this.op,
       spec: this.spec,
@@ -131,6 +133,8 @@ class Context {
       response: this.response,
       meta: this.meta,
     }
+    const clean = (this as any).utility?.clean
+    return 'function' === typeof clean ? clean(this, record) : record
   }
 
   toString() {

package/project/.sdk/tm/ts/src/Response.ts

@@ -14,13 +14,26 @@ class Response {
     this.status = getprop(resmap, 'status', -1)
     this.statusText = getprop(resmap, 'statusText', '')
     this.headers = getprop(resmap, 'headers')
-    this.json = resmap.json ? resmap.json.bind(resmap) : async () => undefined
+    this.json = readJson(resmap)
     this.body = getprop(resmap, 'body')
     this.err = getprop(resmap, 'err')
   }
 }
 
 
+// An empty body, such as the one an accepted delete answers with, is no
+// body: parsing it as JSON would throw after the call has succeeded.
+function readJson(resmap: Record<string, any>): Function {
+  if ('function' === typeof resmap.text) {
+    return async () => {
+      const text = await resmap.text()
+      return '' === text.trim() ? undefined : JSON.parse(text)
+    }
+  }
+  return resmap.json ? resmap.json.bind(resmap) : async () => undefined
+}
+
+
 export {
   Response,
 }

package/project/.sdk/tm/ts/src/feature/audit/AuditFeature.ts

@@ -50,7 +50,7 @@ class AuditFeature extends BaseFeature {
     }
     this._seen.add(ctx)
     this._seq++
-    const record = {
+    const record = ctx.utility.clean(ctx, {
       seq: this._seq,
       ts: this._now(),
       actor: (ctx.ctrl && ctx.ctrl.actor) || this._options.actor || 'anonymous',
@@ -59,7 +59,7 @@ class AuditFeature extends BaseFeature {
       outcome,
       status: ctx.result && ctx.result.status,
       correlationId: ctx.id,
-    }
+    })
 
     const client: any = this._client
     const recs = client._audit.records

package/project/.sdk/tm/ts/src/feature/cost/CostFeature.ts

@@ -208,7 +208,7 @@ class CostFeature extends BaseFeature {
     this._bump(cost.actors, actor, amount)
 
     this._seq++
-    const record = {
+    const record = ctx.utility.clean(ctx, {
       seq: this._seq,
       entity,
       op: opname,
@@ -217,7 +217,7 @@ class CostFeature extends BaseFeature {
       currency: cost.currency,
       source,
       attempts: pending.attempts,
-    }
+    })
     cost.last = record
 
     const sink = this._options.sink

package/project/.sdk/tm/ts/src/feature/debug/DebugFeature.ts

@@ -34,7 +34,7 @@ class DebugFeature extends BaseFeature {
       op: ((ctx.op && ctx.op.entity) || '_') + '.' + ((ctx.op && ctx.op.name) || '_'),
       method: spec.method,
       url: spec.url || spec.path,
-      headers: this._redact(spec.headers),
+      headers: this._redact(ctx, spec.headers),
       start: this._now(),
       status: undefined as any,
       ok: undefined as any,
@@ -73,7 +73,7 @@ class DebugFeature extends BaseFeature {
 
 
   _finish(this: any, ctx: any, ok: boolean) {
-    const entry = this._entries.get(ctx)
+    let entry = this._entries.get(ctx)
     if (null == entry) {
       return
     }
@@ -84,6 +84,11 @@ class DebugFeature extends BaseFeature {
       entry.status = ctx.result.status
     }
 
+    // The whole entry leaves through the buffer and the callback: the url
+    // and the error message can carry a query credential the header mask
+    // above never saw.
+    entry = ctx.utility.clean(ctx, entry)
+
     const client: any = this._client
     const buf = client._debug.entries
     buf.push(entry)
@@ -99,17 +104,18 @@ class DebugFeature extends BaseFeature {
   }
 
 
-  _redact(this: any, headers: any): any {
+  // The core clean rules apply (clean.keys, every registered value); the
+  // feature's own `redact` list ADDS header names on top of them.
+  _redact(this: any, ctx: any, headers: any): any {
     if (null == headers) {
       return {}
     }
-    const patterns = this._options.redact ||
-      ['authorization', 'cookie', 'set-cookie', 'api-key', 'apikey', 'x-api-key', 'idempotency-key']
+    const patterns = (this._options.redact || []).map((n: any) => String(n).toLowerCase())
     const out: any = {}
     for (const k of Object.keys(headers)) {
-      out[k] = patterns.indexOf(k.toLowerCase()) >= 0 ? '<redacted>' : headers[k]
+      out[k] = patterns.indexOf(k.toLowerCase()) >= 0 ? '[redacted]' : headers[k]
     }
-    return out
+    return ctx.utility.clean(ctx, out)
   }
 
 

package/project/.sdk/tm/ts/src/feature/log/LogFeature.ts

@@ -37,9 +37,9 @@ class LogFeature extends BaseFeature {
         let level = this._options.level || 'info'
 
         logger = Pino({ name: 'log', level }, pretty)
-
-        this._logger = logger
       }
+
+      this._logger = logger
     }
   }
 
@@ -85,15 +85,19 @@ class LogFeature extends BaseFeature {
     this._loghook('PreResult', ctx)
   }
 
+  // A log line leaves the pipeline, so it carries the cleaned record: the
+  // spec after auth holds the credential, and a logger serialises whatever
+  // it is handed.
   _loghook(this: any, hook: any, ctx: any, level: any) {
     level = level || 'info'
     if (this._logger) {
-      this._logger[level]({
+      const clean = ctx.utility.clean
+      this._logger[level](clean(ctx, {
         hook,
         op: ctx.op,
         spec: ctx.spec,
-        ctx
-      })
+        ctx: 'function' === typeof ctx.toJSON ? ctx.toJSON() : ctx,
+      }))
     }
   }
 }

package/project/.sdk/tm/ts/src/feature/proxy/ProxyFeature.ts

@@ -14,6 +14,7 @@ class ProxyFeature extends BaseFeature {
   _options: any = {}
   _url?: string
   _noProxy: string[] = []
+  _ctx?: Context
 
 
   init(ctx: Context, options: FeatureOptions): void | Promise<any> {
@@ -37,6 +38,22 @@ class ProxyFeature extends BaseFeature {
     this._noProxy = ('string' === typeof noProxy ? noProxy.split(/\s*,\s*/) : (noProxy || []))
       .filter((s: string) => null != s && '' !== s)
 
+    // A proxy URL may carry credentials as userinfo, from the option or the
+    // environment, and neither is under a sensitive key name.
+    this._ctx = ctx
+    if ('string' === typeof this._url) {
+      try {
+        const parsed = new URL(this._url)
+        for (const part of [parsed.username, parsed.password]) {
+          if ('' !== part) {
+            ctx.utility.cleanAdd(ctx, part)
+            try { ctx.utility.cleanAdd(ctx, decodeURIComponent(part)) } catch (_e) { }
+          }
+        }
+      }
+      catch (_e) { }
+    }
+
     const self = this
     const utility = ctx.utility
     const inner = utility.fetcher
@@ -92,7 +109,8 @@ class ProxyFeature extends BaseFeature {
   _track(this: any, url: string) {
     const client: any = this._client
     if (null == client._proxy) {
-      client._proxy = { routed: 0, url: this._url }
+      const ctx = this._ctx
+      client._proxy = { routed: 0, url: null == ctx ? this._url : ctx.utility.clean(ctx, this._url) }
     }
     client._proxy.routed++
   }

package/project/.sdk/tm/ts/src/feature/secrets/SecretsFeature.ts

@@ -50,6 +50,7 @@ class SecretsFeature extends BaseFeature {
       (null == xopts ? undefined : xopts.refresh)
 
     if ('string' === typeof explicit && '' !== explicit) {
+      this._register(explicit)
       providers.push({
         kind: 'memory',
         name: 'options',
@@ -88,6 +89,14 @@ class SecretsFeature extends BaseFeature {
   }
 
 
+  _register(value: any): void {
+    const ctx = this._client._rootctx
+    if (null != ctx && null != ctx.utility && 'function' === typeof ctx.utility.cleanAdd) {
+      ctx.utility.cleanAdd(ctx, value)
+    }
+  }
+
+
   PreSpec(_ctx: Context) {
     return this.resolve()
   }
@@ -123,6 +132,7 @@ class SecretsFeature extends BaseFeature {
     }
 
     const found = await this._sekreto.try(this._secretname)
+    this._register(found)
 
     if (null == this._exchange) {
       if (undefined !== found) {
@@ -225,6 +235,8 @@ class SecretsFeature extends BaseFeature {
         "secrets: token exchange returned no '" + x.response + "' field from " + url)
     }
 
+    this._register(token)
+
     return token
   }