@voxgig/sdkgen 4.32.1 → 4.33.0

package/project/.sdk/src/cmp/zig/Test_zig.ts

@@ -7,6 +7,7 @@ import { cmp, each, Folder, File, Content, entityCollection } from '@voxgig/sdkg
 
 import { TestEntity } from './TestEntity_zig'
 import { TestDirect } from './TestDirect_zig'
+import { TestClean } from './TestClean_zig'
 import { ReadmeExamplesTest } from './ReadmeExamplesTest_zig'
 
 
@@ -46,6 +47,10 @@ test "sdk_constructs_in_test_mode" {
       // Validate the documented zig quick-start examples run.
       ReadmeExamplesTest({ target })
     })
+
+    // The canary sweep, its own file: build.zig names every test file, and
+    // the generator's compile lane runs this one alone as `test-clean`.
+    TestClean({ target })
   })
 })
 

package/project/.sdk/src/cmp/zig/fragment/Build.fragment.zig

@@ -57,6 +57,7 @@ pub fn build(b: *std.Build) void {
     const test_files = [_][]const u8{
         "test/struct_corpus.zig",
         "test/generated_test.zig",
+        "test/clean_test.zig",
         "test/pipeline_test.zig",
         "test/feature_test.zig",
         "test/primary_utility_test.zig",
@@ -79,5 +80,23 @@ pub fn build(b: *std.Build) void {
         run_t.has_side_effects = true;
         test_step.dependOn(&run_t.step);
     }
+
+    // The canary sweep alone, as `zig build test-clean`: the generator's
+    // compile lane reads the `clean: swept ...` line it prints.
+    {
+        const clean_mod = b.createModule(.{
+            .root_source_file = b.path("test/clean_test.zig"),
+            .target = target,
+            .optimize = optimize,
+        });
+        clean_mod.addImport("voxgig-struct", struct_mod);
+        clean_mod.addImport("sdk", sdk_mod);
+        clean_mod.addImport("omni", omni_mod);
+        const clean_test = b.addTest(.{ .root_module = clean_mod });
+        const run_clean = b.addRunArtifact(clean_test);
+        run_clean.has_side_effects = true;
+        const clean_step = b.step("test-clean", "Run the canary sweep alone");
+        clean_step.dependOn(&run_clean.step);
+    }
     // #FeatureTestSteps
 }

package/project/.sdk/src/cmp/zig/fragment/Entity.fragment.zig

@@ -147,6 +147,13 @@ pub const EntyClass = struct {
         return self.doneResult(ctx);
     }
 
+    // A step's error ends the stream empty without reaching done, so the
+    // explain record is cleaned here.
+    fn streamFail(utility: *Utility, ctx: *Context) []Value {
+        utility.clean_explain(ctx);
+        return &.{};
+    }
+
     /// Streaming operation. Runs `action` through the full pipeline and
     /// returns a slice of the result items, so the `streaming` feature's
     /// incremental output is reachable from a generated entity (a normal op
@@ -198,23 +205,23 @@ pub const EntyClass = struct {
         // Run the same pipeline as run_op, firing the feature hooks (the
         // streaming feature attaches result.stream on PreResult).
         utility.feature_hook(ctx, "PrePoint");
-        const point = utility.make_point(ctx) catch return &.{};
+        const point = utility.make_point(ctx) catch return streamFail(utility, ctx);
         ctx.out_set("point", OutVal{ .val = point });
 
         utility.feature_hook(ctx, "PreSpec");
-        const spec = utility.make_spec(ctx) catch return &.{};
+        const spec = utility.make_spec(ctx) catch return streamFail(utility, ctx);
         ctx.out_set("spec", OutVal{ .spec = spec });
 
         utility.feature_hook(ctx, "PreRequest");
-        const resp = utility.make_request(ctx) catch return &.{};
+        const resp = utility.make_request(ctx) catch return streamFail(utility, ctx);
         ctx.out_set("request", OutVal{ .response = resp });
 
         utility.feature_hook(ctx, "PreResponse");
-        const resp2 = utility.make_response(ctx) catch return &.{};
+        const resp2 = utility.make_response(ctx) catch return streamFail(utility, ctx);
         ctx.out_set("response", OutVal{ .response = resp2 });
 
         utility.feature_hook(ctx, "PreResult");
-        const result = utility.make_result(ctx) catch return &.{};
+        const result = utility.make_result(ctx) catch return streamFail(utility, ctx);
         ctx.out_set("result", OutVal{ .result = result });
 
         utility.feature_hook(ctx, "PreDone");
@@ -223,6 +230,8 @@ pub const EntyClass = struct {
         // fall back to the materialised items so stream always yields.
         if (ctx.result) |res| {
             if (res.stream) |sf| {
+                // done() does not run on this path, so its record is cleaned here.
+                utility.clean_explain(ctx);
                 return sf.call(sf.ctx);
             }
         }

package/project/.sdk/src/cmp/zig/fragment/Main.fragment.zig

@@ -265,7 +265,7 @@ pub const ProjectNameSDK = struct {
         const fetched = self.sdkUtility.fetch(ctx, url, fetchdef) catch {
             return h.jo(&.{
                 .{ "ok", h.vbool(false) },
-                .{ "err", h.vstr(if (ctx.pending_err) |e| e.msg else "fetch failed") },
+                .{ "err", h.vstr(if (ctx.pending_err) |e| self.sdkUtility.clean_str(ctx, e.msg) else "fetch failed") },
             });
         };
 

package/project/.sdk/tm/c/core/context.c

@@ -22,6 +22,31 @@ PNError* context_make_error(Context* ctx, const char* code, const char* msg) {
 
 Utility* context_util(Context* ctx) { return ctx->utility; }
 
+voxgig_value* context_to_value(Context* ctx) {
+  if (!ctx) return voxgig_new_undef();
+  voxgig_value* response = voxgig_new_undef();
+  if (ctx->response) {
+    response = cmap(3,
+      "status", v_num((double)ctx->response->status),
+      "statusText", v_str(ctx->response->status_text),
+      "headers", ctx->response->headers ? v_share(ctx->response->headers) : voxgig_new_undef());
+  }
+  voxgig_value* record = cmap(6,
+    "id", v_str(ctx->id),
+    "op", cmap(2,
+      "entity", v_str(ctx->op ? ctx->op->entity : ""),
+      "name", v_str(ctx->op ? ctx->op->name : "")),
+    "spec", ctx->spec ? spec_to_value(ctx->spec) : voxgig_new_undef(),
+    "result", ctx->result ? result_to_value(ctx->result) : voxgig_new_undef(),
+    "response", response,
+    "meta", ctx->meta ? v_share(ctx->meta) : voxgig_new_undef());
+  return clean_util(ctx, record);
+}
+
+char* context_str(Context* ctx) {
+  return voxgig_jsonify(context_to_value(ctx), NULL);
+}
+
 void ctx_out_set_point_val(Context* ctx, voxgig_value* v) {
   ctx->out_point_kind = OUT_VAL;
   ctx->out_point_val = v;

package/project/.sdk/tm/c/core/error.c

@@ -22,3 +22,19 @@ PNError* pn_error_new(const char* code, const char* msg) {
   e->spec = NULL;
   return e;
 }
+
+// What make_error attached is already cleaned; the error carries no
+// context.
+voxgig_value* pn_error_to_value(PNError* e) {
+  if (!e) return voxgig_new_undef();
+  return cmap(5,
+    "sdk", v_str(e->sdk),
+    "code", v_str(e->code),
+    "message", v_str(e->msg),
+    "result", e->result ? v_share(e->result) : voxgig_new_undef(),
+    "spec", e->spec ? v_share(e->spec) : voxgig_new_undef());
+}
+
+char* pn_error_str(PNError* e) {
+  return voxgig_jsonify(pn_error_to_value(e), NULL);
+}

package/project/.sdk/tm/c/core/sdk.h

@@ -55,6 +55,10 @@ typedef struct PNError {
 } PNError;
 
 PNError* pn_error_new(const char* code, const char* msg);
+// The error as a record and as its default print: the message and the
+// cleaned snapshots, nothing the pipeline holds live. Malloc'd string.
+voxgig_value* pn_error_to_value(PNError* e);
+char* pn_error_str(PNError* e);
 
 // ===========================================================================
 // Value helpers (mirrors core/helpers.rs). All return owned (unreleased)
@@ -407,6 +411,11 @@ struct Context {
 Context* context_new(CtxSpec spec, Context* basectx);
 PNError* context_make_error(Context* ctx, const char* code, const char* msg);
 Utility* context_util(Context* ctx);
+// The context as a record, CLEANED: it leaves the pipeline (a logger, an
+// error dump), while the live fields stay raw for the pipeline's own use.
+// context_str is its JSON, malloc'd.
+voxgig_value* context_to_value(Context* ctx);
+char* context_str(Context* ctx);
 
 // ctx.out helpers.
 void ctx_out_set_point_val(Context* ctx, voxgig_value* v);
@@ -478,7 +487,20 @@ void** feature_plugins(const char* name, size_t* n);
 
 voxgig_value* clean_util(Context* ctx, voxgig_value* val);
 char* clean_str(Context* ctx, const char* val); // returns malloc'd
+// Register a secret value the SDK will mask from now on, through a context
+// or straight against the options map a feature holds.
+void clean_add_util(Context* ctx, const char* value);
+void clean_add_opts(voxgig_value* options, const char* value);
+bool clean_key_util(Context* ctx, const char* key);
+voxgig_value* clean_opts(voxgig_value* options, voxgig_value* val);
+voxgig_value* clean_make_config(voxgig_value* cleanopts);
+voxgig_value* clean_split_values(voxgig_value* values);
+void clean_add_sensitive_opts(voxgig_value* options, voxgig_value* val);
+void clean_add_sensitive_util(Context* ctx, voxgig_value* val);
+void clean_error_util(Context* ctx, PNError* err);
+char* clean_base64(const char* in); // returns malloc'd
 voxgig_value* done_util(Context* ctx, PNError** err);
+void clean_explain_util(Context* ctx);
 voxgig_value* make_error_util(Context* ctx, PNError* err, PNError** out);
 void feature_add_util(Context* ctx, Feature* f);
 void feature_hook_util(Context* ctx, const char* name);

package/project/.sdk/tm/c/feature/audit.c

@@ -66,6 +66,8 @@ static void audit_emit(AuditFeature* af, Context* ctx, const char* outcome) {
     setp(record, "status", v_num((double)ctx->result->status));
   }
 
+  record = clean_util(ctx, record);
+
   voxgig_list_push(voxgig_as_list(af->records), voxgig_retain(record));
   int64_t max = fopt_int(af->options, "max", 1000);
   while (voxgig_list_len(voxgig_as_list(af->records)) > (size_t)max) {

package/project/.sdk/tm/c/feature/cost.c

@@ -415,6 +415,7 @@ static void cost_commit(CostTrack* t, voxgig_value* options, Context* ctx,
       cmap(8, "seq", v_num((double)t->seq), "entity", v_str(entity), "op", v_str(opname),
            "actor", v_str(actor), "amount", v_num(amount), "currency", v_str(t->currency),
            "source", v_str(source), "attempts", v_num((double)attempts));
+  record = clean_util(ctx, record);
   t->last = record;
 
   voxgig_value* sink = getp(options, "sink");

package/project/.sdk/tm/c/feature/debug.c

@@ -13,17 +13,6 @@
 
 #define DEBUG_ENTRY_KEY "debug_entry"
 
-static const char* DEBUG_DEFAULT_REDACT[] = {
-  "authorization",
-  "cookie",
-  "set-cookie",
-  "api-key",
-  "apikey",
-  "x-api-key",
-  "idempotency-key",
-};
-#define DEBUG_DEFAULT_REDACT_LEN (sizeof(DEBUG_DEFAULT_REDACT) / sizeof(DEBUG_DEFAULT_REDACT[0]))
-
 typedef struct {
   Feature base;
   char* name;
@@ -35,47 +24,43 @@ typedef struct {
   voxgig_value* entries; // List of Value
 } DebugFeature;
 
-// True when lowercase(key) == pat (pat compared as-is, mirroring rust
-// `k.to_lowercase() == *p`).
+// Case-insensitive equality.
 static bool eq_lower(const char* key, const char* pat) {
   size_t i = 0;
   for (; key[i] != '\0' && pat[i] != '\0'; i++) {
-    if ((char)tolower((unsigned char)key[i]) != pat[i]) return false;
+    if (tolower((unsigned char)key[i]) != tolower((unsigned char)pat[i])) return false;
   }
   return key[i] == '\0' && pat[i] == '\0';
 }
 
-// patterns = fopt_str_list(options,"redact") or DEBUG_DEFAULT_REDACT.
+// The feature's own `redact` list; the core clean rules apply beside it.
 static bool is_redacted(DebugFeature* df, const char* key) {
   voxgig_value* rl = getp(df->options, "redact");
-  if (voxgig_is_list(rl)) {
-    voxgig_list* l = voxgig_as_list(rl);
-    for (size_t i = 0; i < l->len; i++) {
-      voxgig_value* pv = l->items[i];
-      if (voxgig_is_string(pv) && eq_lower(key, voxgig_as_string(pv))) return true;
-    }
-    return false;
-  }
-  for (size_t i = 0; i < DEBUG_DEFAULT_REDACT_LEN; i++) {
-    if (eq_lower(key, DEBUG_DEFAULT_REDACT[i])) return true;
+  if (!voxgig_is_list(rl)) return false;
+  voxgig_list* l = voxgig_as_list(rl);
+  for (size_t i = 0; i < l->len; i++) {
+    voxgig_value* pv = l->items[i];
+    if (voxgig_is_string(pv) && eq_lower(key, voxgig_as_string(pv))) return true;
   }
   return false;
 }
 
-static voxgig_value* debug_redact(DebugFeature* df, voxgig_value* headers) {
+// The core clean rules apply (clean.keys, every registered value); the
+// feature's own `redact` list ADDS header names on top of them.
+static voxgig_value* debug_redact(DebugFeature* df, Context* ctx, voxgig_value* headers) {
   voxgig_value* out = v_map();
   if (voxgig_is_map(headers)) {
     voxgig_map* m = voxgig_as_map(headers);
     for (size_t i = 0; i < m->len; i++) {
       const char* k = m->entries[i].key;
       if (is_redacted(df, k)) {
-        setp(out, k, v_str("<redacted>"));
+        setp(out, k, v_str("[redacted]"));
       } else {
         setp(out, k, m->entries[i].value); // v.clone(): setp retains
       }
     }
   }
-  return out;
+  return clean_util(ctx, out);
 }
 
 static char* dot_join(const char* a, const char* b) {
@@ -112,6 +97,11 @@ static void debug_finish(DebugFeature* df, Context* ctx, bool ok) {
     }
   }
 
+  // The whole entry leaves through the buffer and the callback: the url and
+  // the error message can carry a query credential the header mask above
+  // never saw.
+  entry = clean_util(ctx, entry);
+
   voxgig_list_push(voxgig_as_list(df->entries), voxgig_retain(entry));
   int64_t max = fopt_int(df->options, "max", 100);
   while (voxgig_list_len(voxgig_as_list(df->entries)) > (size_t)max) {
@@ -144,7 +134,7 @@ static void debug_pre_request(DebugFeature* df, Context* ctx) {
     } else {
       setp(entry, "url", v_str(s->path ? s->path : ""));
     }
-    setp(entry, "headers", debug_redact(df, s->headers));
+    setp(entry, "headers", debug_redact(df, ctx, s->headers));
   }
   ctx_out_extra_set(ctx, DEBUG_ENTRY_KEY, entry);
 }

package/project/.sdk/tm/c/feature/log.c

@@ -40,10 +40,29 @@ static void loghook(LogFeature* lf, const char* hook, Context* ctx) {
   if (level_num("info") < lf->level) return;
 
   const char* opname = ctx->op->name;
+
+  // A log line leaves the pipeline, so it carries the cleaned record: the
+  // spec after auth holds the credential, and a logger serialises whatever
+  // it is handed.
+  voxgig_value* record = clean_util(ctx, cmap(4,
+    "hook", v_str(hook),
+    "op", cmap(2, "entity", v_str(ctx->op->entity), "name", v_str(opname)),
+    "spec", ctx->spec ? spec_to_value(ctx->spec) : voxgig_new_undef(),
+    "ctx", context_to_value(ctx)));
+
+  voxgig_value* logger = getp(lf->options, "logger");
+  if (voxgig_is_func(logger)) {
+    call_vfn(logger, record);
+    return;
+  }
+
   char specinfo[256];
   specinfo[0] = '\0';
-  if (ctx->spec) {
-    snprintf(specinfo, sizeof(specinfo), "%s %s", ctx->spec->method, ctx->spec->path);
+  voxgig_value* spec = getp(record, "spec");
+  if (voxgig_is_map(spec)) {
+    const char* method = get_str(spec, "method");
+    const char* path = get_str(spec, "path");
+    snprintf(specinfo, sizeof(specinfo), "%s %s", method ? method : "", path ? path : "");
   }
   fprintf(stderr, "name=log hook=%s op=%s spec=%s\n", hook, opname, specinfo);
 }

package/project/.sdk/tm/c/feature/proxy.c

@@ -15,11 +15,59 @@
 typedef struct {
   // Activity tracking (mirrors the ts client._proxy record).
   int64_t routed;
-  char* url; // "" when none
+  char* url;     // as it may be shown: userinfo masked; "" when none
+  char* raw_url; // as it is used, kept off the tracking record
   char** no_proxy;
   size_t no_proxy_len;
 } ProxyTrack;
 
+static char* percent_decode(const char* s) {
+  size_t n = strlen(s);
+  char* out = (char*)malloc(n + 1);
+  size_t o = 0;
+  for (size_t i = 0; i < n; i++) {
+    if ('%' == s[i] && i + 2 < n && isxdigit((unsigned char)s[i + 1]) &&
+        isxdigit((unsigned char)s[i + 2])) {
+      char hex[3] = { s[i + 1], s[i + 2], '\0' };
+      out[o++] = (char)strtol(hex, NULL, 16);
+      i += 2;
+    } else {
+      out[o++] = s[i];
+    }
+  }
+  out[o] = '\0';
+  return out;
+}
+
+// A proxy URL may carry credentials as userinfo, from the option or the
+// environment, and neither is under a sensitive key name.
+static void register_userinfo(Context* ctx, const char* url) {
+  const char* rest = url;
+  const char* p = strstr(url, "://");
+  if (p) rest = p + 3;
+  const char* slash = strchr(rest, '/');
+  size_t alen = slash ? (size_t)(slash - rest) : strlen(rest);
+  const char* at = NULL;
+  for (size_t i = 0; i < alen; i++) {
+    if ('@' == rest[i]) at = rest + i;
+  }
+  if (!at) return;
+  char* userinfo = (char*)malloc((size_t)(at - rest) + 1);
+  memcpy(userinfo, rest, (size_t)(at - rest));
+  userinfo[at - rest] = '\0';
+  char* colon = strchr(userinfo, ':');
+  if (colon) *colon = '\0';
+  const char* parts[2] = { userinfo, colon ? colon + 1 : NULL };
+  for (int i = 0; i < 2; i++) {
+    if (!parts[i] || parts[i][0] == '\0') continue;
+    clean_add_util(ctx, parts[i]);
+    char* decoded = percent_decode(parts[i]);
+    clean_add_util(ctx, decoded);
+    free(decoded);
+  }
+  free(userinfo);
+}
+
 typedef struct {
   Feature base;
   char* name;
@@ -117,7 +165,7 @@ static bool bypass(char** no_proxy, size_t n, const char* url) {
 // Annotate fetchdef with the proxy address, unless there is no proxy or the
 // host is bypassed. Returns fetchdef unchanged in those cases.
 static voxgig_value* route(ProxyTrack* track, const char* url, voxgig_value* fetchdef) {
-  const char* proxy_url = track->url;
+  const char* proxy_url = track->raw_url;
   if (proxy_url == NULL || proxy_url[0] == '\0' || bypass(track->no_proxy, track->no_proxy_len, url)) {
     return fetchdef;
   }
@@ -204,7 +252,10 @@ static void proxy_init(Feature* f, Context* ctx, voxgig_value* options) {
   }
   free(raw);
 
-  pf->track->url = url;
+  register_userinfo(ctx, url);
+
+  pf->track->url = clean_str(ctx, url);
+  pf->track->raw_url = url;
   pf->track->no_proxy = final_np;
   pf->track->no_proxy_len = final_len;
 
@@ -243,6 +294,7 @@ Feature* feature_proxy_new(void) {
   pf->track = (ProxyTrack*)calloc(1, sizeof(ProxyTrack));
   pf->track->routed = 0;
   pf->track->url = strdup("");
+  pf->track->raw_url = strdup("");
   pf->track->no_proxy = NULL;
   pf->track->no_proxy_len = 0;
   return (Feature*)pf;

package/project/.sdk/tm/c/feature/secrets.c

@@ -316,9 +316,14 @@ static void secrets_reauth(SecretsFeature* f, voxgig_value* fetchdef) {
   }
 }
 
+// Every value this feature resolves or buys is a secret the SDK handles,
+// and none arrives under an option key the intake registration saw. The
+// live options map is the client's own, so the registry it carries is the
+// one every context reads.
 static void secrets_setcred(SecretsFeature* f, const char* value) {
   free(f->cred);
   f->cred = strdup(NULL == value ? "" : value);
+  if ('\0' != f->cred[0]) clean_add_opts(f->liveopts, f->cred);
 }
 
 // ---- the exchange -----------------------------------------------------------
@@ -466,6 +471,7 @@ static const char* secrets_resolve(SecretsFeature* f, Context* ctx) {
   // say whether it does.
   free(f->refresh);
   f->refresh = strdup(found ? found : "");
+  if ('\0' != f->refresh[0]) clean_add_opts(f->liveopts, f->refresh);
 
   if ('\0' == f->cred[0]) {
     // A starting access token supplied as the OPTION: read from the frozen
@@ -650,6 +656,7 @@ static void secrets_init(Feature* fb, Context* ctx, voxgig_value* options) {
   } else {
     explicit = get_str(xopts, "refresh");
   }
+  if (NULL != explicit && '\0' != explicit[0]) clean_add_opts(f->liveopts, explicit);
 
   size_t cap = 4;
   size_t count = 0;

package/project/.sdk/tm/c/feature/telemetry.c

@@ -78,6 +78,8 @@ static void telemetry_close(TelemetryFeature* tf, Context* ctx, bool ok) {
   setp(span, "durationMs", v_num((double)dur));
   setp(span, "ok", v_bool(ok));
 
+  span = clean_util(ctx, span);
+
   tf->active_spans -= 1;
   voxgig_list_push(voxgig_as_list(tf->spans), voxgig_retain(span));
 

package/project/.sdk/tm/c/tests/feature_test.c

@@ -748,7 +748,7 @@ static void test_debug_redacts_and_honours_onentry_max(void) {
   CHECK_INT_EQ(fh_track_int(f, "entries"), 1, "debug: ring buffer capped at 1");
   CHECK_INT_EQ((int)voxgig_list_len(voxgig_as_list(seen)), 2, "debug: onEntry for both ops");
   voxgig_value* headers = getp(voxgig_getelem(seen, v_int(0), v_undef()), "headers");
-  CHECK_STR_EQ(get_str(headers, "authorization"), "<redacted>", "debug: redacted authorization");
+  CHECK_STR_EQ(get_str(headers, "authorization"), "[redacted]", "debug: redacted authorization");
 }
 
 static void test_debug_captures_failures(void) {
@@ -780,7 +780,7 @@ static void test_debug_injected_clock_and_custom_redact(void) {
   o.headers = cmap(2, "x-secret", v_str("hide"), "x-ok", v_str("show"));
   fh_op(&h, o);
   voxgig_value* headers = getp(voxgig_getelem(seen, v_int(0), v_undef()), "headers");
-  CHECK_STR_EQ(get_str(headers, "x-secret"), "<redacted>", "debug custom redact: x-secret");
+  CHECK_STR_EQ(get_str(headers, "x-secret"), "[redacted]", "debug custom redact: x-secret");
   CHECK_STR_EQ(get_str(headers, "x-ok"), "show", "debug custom redact: x-ok kept");
 }