@voxgig/sdkgen 4.32.1 → 4.33.0

package/project/.sdk/tm/rust/utility/done.rs

@@ -7,18 +7,7 @@ use crate::utility::voxgigstruct as vs;
 use crate::utility::voxgigstruct::Value;
 
 pub fn done_util(ctx: &Rc<Context>) -> Result<Value, ProjectNameError> {
-    {
-        let ctrl = ctx.ctrl.borrow().clone();
-        let mut c = ctrl.borrow_mut();
-        if c.has_explain() {
-            let explain = crate::utility::clean::clean_util(ctx, &c.explain);
-            if let Value::Map(_) = getp(&explain, "result") {
-                let rm = to_map(&getp(&explain, "result"));
-                vs::del_prop(rm, &Value::str("err"));
-            }
-            c.explain = explain;
-        }
-    }
+    clean_explain_util(ctx);
 
     let result = ctx.result.borrow().clone();
     if let Some(res) = result {
@@ -29,3 +18,24 @@ pub fn done_util(ctx: &Rc<Context>) -> Result<Value, ProjectNameError> {
 
     crate::utility::make_error::make_error_util(ctx, None)
 }
+
+/// Clean the explain record in place. It is the caller's own map (Control
+/// copies the Rc), so its entries are replaced by the cleaned copy's; with
+/// clean off the cleaned record is that map, already current.
+pub fn clean_explain_util(ctx: &Rc<Context>) {
+    let ctrl = ctx.ctrl.borrow().clone();
+    let explain = ctrl.borrow().explain.clone();
+    let Value::Map(orig) = &explain else {
+        return;
+    };
+    if let Value::Map(cleaned) = crate::utility::clean::clean_util(ctx, &explain) {
+        if !Rc::ptr_eq(orig, &cleaned) {
+            let entries = cleaned.borrow().clone();
+            *orig.borrow_mut() = entries;
+        }
+    }
+    // explain.result is a to_value snapshot, never the live result.
+    if let Value::Map(_) = getp(&explain, "result") {
+        vs::del_prop(to_map(&getp(&explain, "result")), &Value::str("err"));
+    }
+}

package/project/.sdk/tm/rust/utility/make_error.rs

@@ -46,6 +46,8 @@ pub fn make_error_util(
         None => Value::Noval,
     };
 
+    crate::utility::done::clean_explain_util(ctx);
+
     let ctrl = ctx.ctrl.borrow().clone();
     {
         let c = ctrl.borrow();
@@ -59,7 +61,8 @@ pub fn make_error_util(
     }
 
     let mut sdk_err = ProjectNameError::new("", &msg);
-    sdk_err.code = err.code.clone();
+    // A hook's own error supplies the code as well as the message.
+    sdk_err.code = crate::utility::clean::clean_str(ctx, &err.code);
     sdk_err.result = crate::utility::clean::clean_util(ctx, &result.borrow().to_value());
     sdk_err.spec = crate::utility::clean::clean_util(ctx, &spec_val);
 

package/project/.sdk/tm/rust/utility/make_options.rs

@@ -2,6 +2,7 @@ use std::rc::Rc;
 
 use crate::core::context::Context;
 use crate::core::helpers::{get_str, getp, getpath, ja, jo, setp, to_map};
+use crate::utility::clean;
 use crate::utility::voxgigstruct as vs;
 use crate::utility::voxgigstruct::Value;
 
@@ -58,6 +59,26 @@ pub fn make_options_util(ctx: &Rc<Context>) -> Value {
 
     let optspec = crate::core::schema::optspec();
 
+    // The secret registry exists BEFORE validation, fed from the raw input.
+    // Its block is Rc-shared: what is registered into `cleanopts` here is
+    // what `opts.__derived__.clean` carries out below.
+    let cleancfg = clean::make_clean_config(&vs::merge(
+        &ja(vec![
+            Value::empty_map(),
+            vs::clone(&getp(&optspec, "clean")),
+            clean_block(&cfgopts),
+            clean_block(&opts),
+        ]),
+        None,
+    ));
+    let cleanopts = jo(vec![("__derived__", jo(vec![("clean", cleancfg.clone())]))]);
+    clean::clean_add_sensitive_opts(&cleanopts, &without(&opts, &["clean"]));
+    for src in [&cfgopts, &opts] {
+        for value in clean::splitvalues(&getpath(&["clean", "values"], src)) {
+            clean::clean_add_opts(&cleanopts, &value);
+        }
+    }
+
     // Preserve system.fetch before merge/validate (validation strips it).
     let sys_fetch = getpath(&["system", "fetch"], &opts);
 
@@ -145,19 +166,6 @@ pub fn make_options_util(ctx: &Rc<Context>) -> Value {
         }
     }
 
-    let clean_keys = match getpath(&["clean", "keys"], &opts) {
-        Value::Str(s) => s,
-        _ => "key,token,id".to_string(),
-    };
-
-    let filtered: Vec<String> = clean_keys
-        .split(',')
-        .map(|p| p.trim())
-        .filter(|p| !p.is_empty())
-        .map(|p| vs::esc_re(&Value::str(p)))
-        .collect();
-    let keyre = filtered.join("|");
-
     // Resolve the feature add-order: an explicit List order (above) wins;
     // otherwise order the map test-first, then the remaining names sorted, so
     // the outcome is deterministic and `test` is always the base transport.
@@ -188,20 +196,66 @@ pub fn make_options_util(ctx: &Rc<Context>) -> Value {
     let order_list =
         Value::list(feature_order.into_iter().map(|n| Value::str(n)).collect());
 
-    let derived_clean = if keyre.is_empty() {
-        Value::empty_map()
-    } else {
-        jo(vec![("keyre", Value::str(keyre))])
-    };
     setp(
         &opts,
         "__derived__",
-        jo(vec![("clean", derived_clean), ("featureorder", order_list)]),
+        jo(vec![("clean", cleancfg), ("featureorder", order_list)]),
     );
 
+    // Again over the merged result: the config's own defaults can carry one.
+    clean::clean_add_sensitive_opts(&opts, &without(&opts, &["clean", "__derived__"]));
+
     opts
 }
 
+// A copy of the clean block, or an empty one: merge lets a missing value
+// replace everything merged before it, schema defaults included.
+fn clean_block(opts: &Value) -> Value {
+    match getp(opts, "clean") {
+        Value::Map(_) => vs::clone(&getp(opts, "clean")),
+        _ => Value::empty_map(),
+    }
+}
+
+// The options to scan for secrets. The feature map is keyed by feature
+// names, not field names, so it is scanned as a list: `secrets` must not
+// make every setting of that feature a secret. Entity blocks hold entity
+// settings and seeded records, never a credential, so none is scanned.
+fn without(val: &Value, keys: &[&str]) -> Value {
+    let out = Value::empty_map();
+    if let Value::Map(m) = val {
+        for (k, v) in m.borrow().iter() {
+            if "entity" == k.as_str() || keys.contains(&k.as_str()) {
+                continue;
+            }
+            let v = match (k.as_str(), v) {
+                ("feature", Value::Map(fm)) => {
+                    Value::list(fm.borrow().iter().map(|(_, fv)| noentity(fv)).collect())
+                }
+                ("test", _) => noentity(v),
+                _ => v.clone(),
+            };
+            setp(&out, k, v);
+        }
+    }
+    out
+}
+
+fn noentity(val: &Value) -> Value {
+    match val {
+        Value::Map(m) => {
+            let out = Value::empty_map();
+            for (k, v) in m.borrow().iter() {
+                if "entity" != k.as_str() {
+                    setp(&out, k, v.clone());
+                }
+            }
+            out
+        }
+        _ => val.clone(),
+    }
+}
+
 /// Read a string option (helper shared by prepare utilities).
 pub fn opt_str(options: &Value, key: &str) -> String {
     get_str(options, key).unwrap_or_default()

package/project/.sdk/tm/scala/Makefile

@@ -15,11 +15,13 @@ build:
 #
 # Main classes are NAMED here rather than globbed, so a per-feature suite has
 # to be listed. SecretsTestMain drives the feature through the `extend` seam
-# and so runs in every scala SDK, model-activated or not.
+# and so runs in every scala SDK, model-activated or not. SdkCleanTestMain is
+# the canary sweep: no credential leaves the SDK in any form.
 test:
 	scala-cli run . --main-class OmniSmoke
 	scala-cli run . --main-class SdkTestMain
 	scala-cli run . --main-class SdkEntityTestMain
+	scala-cli run . --main-class SdkCleanTestMain
 	scala-cli run . --main-class SecretsTestMain
 	scala-cli run . --main-class Runner -- ../.sdk/test/test.json
 	scala-cli run . --main-class PrimaryCorpusMain -- ../.sdk/test/test.json

package/project/.sdk/tm/scala/core/Context.scala

@@ -158,4 +158,20 @@ class Context(ctxmap: JMap[String, Object], basectx: Context) {
   }
 
   def makeError(code: String, msg: String): SdkError = new SdkError(code, msg, this)
+
+  // The serialised context leaves the pipeline (a logger, an error dump), so
+  // it is cleaned; the live fields stay raw for the pipeline's own use.
+  def toMap(): Object = {
+    val record = new LinkedHashMap[String, Object]()
+    record.put("id", id)
+    record.put("op", op)
+    record.put("spec", spec)
+    record.put("entity", entity)
+    record.put("result", result)
+    record.put("response", response)
+    record.put("meta", meta)
+    if (utility == null || utility.clean == null) record else utility.clean(this, record)
+  }
+
+  override def toString: String = "Context " + Struct.jsonify(toMap())
 }

package/project/.sdk/tm/scala/core/SdkClient.scala

@@ -2,6 +2,7 @@ package SCALAPACKAGE.core
 
 import java.util.{ArrayList, LinkedHashMap, List => JList, Map => JMap}
 import java.util.function.Supplier
+import scala.util.control.NonFatal
 import SCALAPACKAGE.utility.struct.Struct
 
 // Shared client runtime for the ProjectName SDK. The generated
@@ -76,6 +77,9 @@ abstract class SdkClient(options0: JMap[String, Object]) {
     this.utility.featureHook(this.rootctx, "PostConstruct")
   }
 
+  // The options hold the credential; a printed client shows only its name.
+  override def toString: String = this.getClass.getSimpleName + "(mode=" + this.mode + ")"
+
   def optionsMap(): JMap[String, Object] = Struct.clone(this.options) match {
     case m: JMap[_, _] => m.asInstanceOf[JMap[String, Object]]
     case _ => new LinkedHashMap[String, Object]()
@@ -241,15 +245,15 @@ abstract class SdkClient(options0: JMap[String, Object]) {
 
     val fetchdef =
       try this.prepare(fetchargs)
-      catch { case err: RuntimeException =>
-        out.put("ok", java.lang.Boolean.FALSE); out.put("err", err); return out
+      catch { case NonFatal(err) =>
+        out.put("ok", java.lang.Boolean.FALSE); out.put("err", cleanErr(ctx, err)); return out
       }
 
     val url = fetchdef.get("url")
     val fetched =
       try utility.fetcher(ctx, url match { case s: String => s; case _ => "" }, fetchdef)
-      catch { case err: RuntimeException =>
-        out.put("ok", java.lang.Boolean.FALSE); out.put("err", err); return out
+      catch { case NonFatal(err) =>
+        out.put("ok", java.lang.Boolean.FALSE); out.put("err", cleanErr(ctx, err)); return out
       }
 
     if (fetched == null) {
@@ -292,6 +296,12 @@ abstract class SdkClient(options0: JMap[String, Object]) {
         out
     }
   }
+
+  // A raw request returns its error rather than passing it through makeError.
+  private def cleanErr(ctx: Context, err: Throwable): Object = this.utility.clean(ctx, err) match {
+    case t: Throwable => t
+    case _ => err
+  }
 }
 
 object SdkClient {

package/project/.sdk/tm/scala/core/SdkError.scala

@@ -1,5 +1,8 @@
 package SCALAPACKAGE.core
 
+import java.util.{LinkedHashMap, Map => JMap}
+import SCALAPACKAGE.utility.struct.Struct
+
 // ProjectName SDK error. Carries the SDK error code, the operation context,
 // and cleaned copies of the result and spec at failure time.
 class SdkError(code0: String, msg0: String, ctx0: Context) extends RuntimeException(msg0) {
@@ -7,9 +10,34 @@ class SdkError(code0: String, msg0: String, ctx0: Context) extends RuntimeExcept
   val sdk: String = "ProjectName"
   var code: String = if (code0 == null) "" else code0
   var msg: String = msg0
+
+  // The HTTP status when there was a response, -1 otherwise.
+  var status: Int = -1
+
+  // Reachable for a debugger, out of every serialisation: the context holds
+  // the live spec and options, and an error is what gets logged.
   @transient var ctx: Context = ctx0
   @transient var result: Object = null
   @transient var spec: Object = null
 
+  def notFound: Boolean = 404 == this.status
+
   override def getMessage: String = this.msg
+
+  // What makeError attached is already cleaned; the context is not part of
+  // the record.
+  def toMap(): JMap[String, Object] = {
+    val out = new LinkedHashMap[String, Object]()
+    out.put("sdk", this.sdk)
+    out.put("code", this.code)
+    out.put("message", this.msg)
+    out.put("status", java.lang.Integer.valueOf(this.status))
+    out.put("result", this.result)
+    out.put("spec", this.spec)
+    out
+  }
+
+  def toJson(): String = Struct.jsonify(this.toMap())
+
+  override def toString: String = "ProjectNameError " + this.toJson()
 }

package/project/.sdk/tm/scala/core/Types.scala

@@ -15,6 +15,9 @@ type FetcherFn = (Context, String, JMap[String, Object]) => Object
 // clean(ctx, val) -> val
 type CleanFn = (Context, Object) => Object
 
+// cleanAdd(ctx, value): registers a secret the SDK handles
+type CleanAddFn = (Context, Object) => Unit
+
 // makeError(ctx, err) -> value (throws, or returns fallback)
 type MakeErrorFn = (Context, RuntimeException) => Object
 

package/project/.sdk/tm/scala/core/Utility.scala

@@ -8,6 +8,7 @@ import java.util.{LinkedHashMap, Map => JMap}
 class Utility private (noregister: Boolean) {
 
   var clean: CleanFn = null
+  var cleanAdd: CleanAddFn = null
   var done: CtxFn[Object] = null
   var makeError: MakeErrorFn = null
   var featureAdd: FeatureFn = null
@@ -53,6 +54,7 @@ class Utility private (noregister: Boolean) {
   def copy(): Utility = {
     val u = new Utility(true)
     u.clean = this.clean
+    u.cleanAdd = this.cleanAdd
     u.done = this.done
     u.makeError = this.makeError
     u.featureAdd = this.featureAdd

package/project/.sdk/tm/scala/feature/AuditFeature.scala

@@ -1,7 +1,7 @@
 package SCALAPACKAGE.feature
 
 import java.util.{ArrayList, LinkedHashMap, List => JList, Map => JMap}
-import SCALAPACKAGE.core.{Context, SdkClient}
+import SCALAPACKAGE.core.{Context, Helpers, SdkClient}
 
 // Audit trail. Emits a structured record for every operation — who (actor),
 // what (entity + op), the outcome, and a correlation id — suitable for
@@ -74,17 +74,23 @@ class AuditFeature extends BaseFeature("audit", "0.0.1", true) {
       opname = ctx.op.name
     }
 
-    val record = new LinkedHashMap[String, Object]()
-    record.put("seq", java.lang.Integer.valueOf(this.seq))
-    record.put("ts", java.lang.Long.valueOf(FeatureOptions.foptNow(this.options).getAsLong()))
-    record.put("actor", actor)
-    record.put("entity", entity)
-    record.put("op", opname)
-    record.put("outcome", outcome)
-    record.put("correlationId", ctx.id)
+    val raw = new LinkedHashMap[String, Object]()
+    raw.put("seq", java.lang.Integer.valueOf(this.seq))
+    raw.put("ts", java.lang.Long.valueOf(FeatureOptions.foptNow(this.options).getAsLong()))
+    raw.put("actor", actor)
+    raw.put("entity", entity)
+    raw.put("op", opname)
+    raw.put("outcome", outcome)
+    raw.put("correlationId", ctx.id)
     if (ctx.result != null) {
-      record.put("status", java.lang.Integer.valueOf(ctx.result.status))
+      raw.put("status", java.lang.Integer.valueOf(ctx.result.status))
     }
+    val record =
+      if (ctx.utility == null || ctx.utility.clean == null) raw
+      else {
+        val out = Helpers.toMapAny(ctx.utility.clean(ctx, raw))
+        if (out == null) raw else out
+      }
 
     this.records.add(record)
     val max = FeatureOptions.foptInt(this.options, "max", 1000)

package/project/.sdk/tm/scala/feature/CostFeature.scala

@@ -266,15 +266,20 @@ class CostFeature extends BaseFeature("cost", "0.0.1", true) {
     bump(this.ops, entity + "." + opname, amount)
     bump(this.actors, actor, amount)
 
+    // The record leaves through `last` and the sink, so its text is cleaned.
+    def cs(s: String): String =
+      if (ctx.utility == null || ctx.utility.clean == null) s
+      else String.valueOf(ctx.utility.clean(ctx, s))
+
     this.seq += 1
     val record = new CostRecord()
     record.seq = this.seq
-    record.entity = entity
-    record.op = opname
-    record.actor = actor
+    record.entity = cs(entity)
+    record.op = cs(opname)
+    record.actor = cs(actor)
     record.amount = amount
-    record.currency = this.currency
-    record.source = source
+    record.currency = cs(this.currency)
+    record.source = cs(source)
     record.attempts = pending.attempts
     this.last = record
 

package/project/.sdk/tm/scala/feature/DebugFeature.scala

@@ -19,10 +19,6 @@ class DebugFeature extends BaseFeature("debug", "0.0.1", true) {
 
   private val DEBUG_ENTRY_KEY = "debug_entry"
 
-  private val DEFAULT_REDACT: JList[String] = java.util.List.of(
-    "authorization", "cookie", "set-cookie", "api-key", "apikey",
-    "x-api-key", "idempotency-key")
-
   override def init(ctx: Context, options: JMap[String, Object]): Unit = {
     this.client = ctx.client
     this.options = options
@@ -51,7 +47,7 @@ class DebugFeature extends BaseFeature("debug", "0.0.1", true) {
       } else {
         entry.put("url", ctx.spec.path)
       }
-      entry.put("headers", redact(ctx.spec.headers))
+      entry.put("headers", redact(ctx, ctx.spec.headers))
     }
     ctx.out.put(DEBUG_ENTRY_KEY, entry)
   }
@@ -88,7 +84,7 @@ class DebugFeature extends BaseFeature("debug", "0.0.1", true) {
 
   private def finish(ctx: Context, ok: Boolean): Unit = {
     // Finish once per operation: the marker in ctx.out is consumed here.
-    val entry = Helpers.toMapAny(ctx.out.get(DEBUG_ENTRY_KEY))
+    var entry = Helpers.toMapAny(ctx.out.get(DEBUG_ENTRY_KEY))
     if (entry == null) {
       return
     }
@@ -105,6 +101,11 @@ class DebugFeature extends BaseFeature("debug", "0.0.1", true) {
       entry.put("status", java.lang.Integer.valueOf(ctx.result.status))
     }
 
+    // The whole entry leaves through the buffer and the callback: the url
+    // and the error message can carry a query credential the header mask
+    // above never saw.
+    entry = cleaned(ctx, entry)
+
     this.entries.add(entry)
     val max = FeatureOptions.foptInt(this.options, "max", 100)
     while (this.entries.size() > max) {
@@ -118,32 +119,34 @@ class DebugFeature extends BaseFeature("debug", "0.0.1", true) {
     }
   }
 
-  private def redact(headers: JMap[String, Object]): JMap[String, Object] = {
+  private def cleaned(ctx: Context, m: JMap[String, Object]): JMap[String, Object] = {
+    if (ctx.utility == null || ctx.utility.clean == null) return m
+    val out = Helpers.toMapAny(ctx.utility.clean(ctx, m))
+    if (out == null) m else out
+  }
+
+  // The core clean rules apply (clean.keys, every registered value); the
+  // feature's own `redact` list ADDS header names on top of them.
+  private def redact(ctx: Context, headers: JMap[String, Object]): JMap[String, Object] = {
     val out = new LinkedHashMap[String, Object]()
     if (headers == null) {
       return out
     }
-    var patterns = FeatureOptions.foptStrList(this.options, "redact")
-    if (patterns == null) {
-      patterns = DEFAULT_REDACT
+    val patterns = new ArrayList[String]()
+    val listed = FeatureOptions.foptStrList(this.options, "redact")
+    if (listed != null) {
+      val pit = listed.iterator()
+      while (pit.hasNext) patterns.add(pit.next().toLowerCase())
     }
     val it = headers.entrySet().iterator()
     while (it.hasNext) {
       val h = it.next()
-      var masked = false
-      val pit = patterns.iterator()
-      while (!masked && pit.hasNext) {
-        val p = pit.next()
-        if (h.getKey.toLowerCase().equals(p)) {
-          masked = true
-        }
-      }
-      if (masked) {
-        out.put(h.getKey, "<redacted>")
+      if (patterns.contains(h.getKey.toLowerCase())) {
+        out.put(h.getKey, "[redacted]")
       } else {
         out.put(h.getKey, h.getValue)
       }
     }
-    out
+    cleaned(ctx, out)
   }
 }

package/project/.sdk/tm/scala/feature/LogFeature.scala

@@ -54,11 +54,16 @@ class LogFeature extends BaseFeature("log", "0.0.1", true) {
     if (ctx.op != null) msg.append(" op=").append(ctx.op.name)
     if (ctx.spec != null) msg.append(" spec=").append(ctx.spec.method).append(" ").append(ctx.spec.path)
 
+    // A log line leaves the pipeline, so it carries the cleaned text.
+    val line =
+      if (ctx.utility == null || ctx.utility.clean == null) msg.toString
+      else String.valueOf(ctx.utility.clean(ctx, msg.toString))
+
     level match {
-      case "debug" => this.logger.fine(msg.toString)
-      case "warn" => this.logger.warning(msg.toString)
-      case "error" => this.logger.severe(msg.toString)
-      case _ => this.logger.info(msg.toString)
+      case "debug" => this.logger.fine(line)
+      case "warn" => this.logger.warning(line)
+      case "error" => this.logger.severe(line)
+      case _ => this.logger.info(line)
     }
   }
 }

package/project/.sdk/tm/scala/feature/ProxyFeature.scala

@@ -1,6 +1,7 @@
 package SCALAPACKAGE.feature
 
 import java.util.{ArrayList, LinkedHashMap, List => JList, Map => JMap}
+import java.net.URI
 import java.util.regex.{Matcher, Pattern}
 import SCALAPACKAGE.core.{Context, FetcherFn, SdkClient}
 
@@ -21,6 +22,8 @@ class ProxyFeature extends BaseFeature("proxy", "0.0.1", true) {
   var routed: Int = 0
   var url: String = ""
 
+  private var target: String = ""
+
   private val HOST_RE: Pattern =
     Pattern.compile("^[a-z]+://([^/:]+)", Pattern.CASE_INSENSITIVE)
 
@@ -59,18 +62,36 @@ class ProxyFeature extends BaseFeature("proxy", "0.0.1", true) {
       }
     }
 
+    // A proxy URL may carry credentials as userinfo, from the option or the
+    // environment, and neither is under a sensitive key name. The transport
+    // is handed the raw target; the activity record shows the cleaned one.
+    this.target = this.url
+    if (!"".equals(this.url) && ctx.utility != null) {
+      try {
+        val parsed = new URI(this.url)
+        for (info <- List(parsed.getRawUserInfo, parsed.getUserInfo)) {
+          if (info != null && !"".equals(info)) {
+            for (part <- info.split(":", 2)) {
+              if (!"".equals(part)) ctx.utility.cleanAdd(ctx, part)
+            }
+          }
+        }
+      } catch { case _: RuntimeException => }
+      this.url = String.valueOf(ctx.utility.clean(ctx, this.url))
+    }
+
     val inner: FetcherFn = ctx.utility.fetcher
 
     ctx.utility.fetcher = (ctx2, u, fetchdef) => inner(ctx2, u, route(u, fetchdef))
   }
 
   private def route(u: String, fetchdef: JMap[String, Object]): JMap[String, Object] = {
-    if ("".equals(this.url) || bypass(u)) {
+    if ("".equals(this.target) || bypass(u)) {
       return fetchdef
     }
 
     val out = new LinkedHashMap[String, Object](fetchdef)
-    out.put("proxy", this.url)
+    out.put("proxy", this.target)
 
     this.routed += 1
     out

package/project/.sdk/tm/scala/feature/SecretsFeature.scala

@@ -64,6 +64,16 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
 
   private var client: SdkClient = null
 
+  // Every value this feature resolves or buys is a secret the SDK handles,
+  // and none arrives under an option key the intake registration saw.
+  private def register(value: Object): Unit = {
+    if (this.client == null) return
+    val ctx = this.client.getRootCtx()
+    if (ctx != null && ctx.utility != null && ctx.utility.cleanAdd != null) {
+      ctx.utility.cleanAdd(ctx, value)
+    }
+  }
+
   // The LIVE options map (root ctx options). READ ONLY: this feature never
   // writes it - see the class note.
   private var liveopts: JMap[String, Object] = null
@@ -171,6 +181,7 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
     val entries = ListBuffer.empty[Any]
 
     if ("" != explicit) {
+      register(explicit)
       try
         entries += ProviderSpec(
           kind = "memory",
@@ -291,6 +302,7 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
     // tryget returns None for a MISS and RAISES for an ERROR. That is the
     // whole miss-vs-error rule, and it is sekreto's, not this feature's.
     val found = this.sek.tryget(this.secretname)
+    register(found.orNull)
 
     if (!this.xactive) {
       // An UNCACHED miss after an earlier hit is a revocation: the chain now
@@ -439,6 +451,7 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
     // required server variable, for the same reason.
     if ("live" != this.client.mode) {
       this.cred = "test-" + this.xresponse
+      register(this.cred)
       return this.cred
     }
 
@@ -503,6 +516,7 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
           "' field from " + url)
     }
 
+    register(token)
     this.cred = token
     token
   }

package/project/.sdk/tm/scala/feature/TelemetryFeature.scala

@@ -101,12 +101,19 @@ class TelemetryFeature extends BaseFeature("telemetry", "0.0.1", true) {
     span.put("durationMs", java.lang.Long.valueOf(dur))
     span.put("ok", java.lang.Boolean.valueOf(ok))
 
+    val out =
+      if (ctx.utility == null || ctx.utility.clean == null) span
+      else {
+        val c = Helpers.toMapAny(ctx.utility.clean(ctx, span))
+        if (c == null) span else c
+      }
+
     this.activeSpans -= 1
-    this.spans.add(span)
+    this.spans.add(out)
 
     this.options.get("exporter") match {
       case c: java.util.function.Consumer[_] =>
-        c.asInstanceOf[java.util.function.Consumer[JMap[String, Object]]].accept(span)
+        c.asInstanceOf[java.util.function.Consumer[JMap[String, Object]]].accept(out)
       case _ =>
     }
   }