@voxgig/sdkgen 4.32.1 → 4.33.0

package/project/.sdk/tm/scala/sdktest/SdkTestMain.scala

@@ -471,7 +471,7 @@ object SdkTestMain {
       val h = fhMake(null, fhF(f, om("max" -> I(1), "onEntry" -> oe)))
       h.op(fhOp("load").withHeaders(om("authorization" -> "Bearer secret"))); h.op(fhOp("list"))
       eqI("debug.ring", 1, f.entries.size()); eqI("debug.onEntry", 2, seen.size())
-      eq("debug.redacted", "<redacted>", Helpers.toMapAny(seen.get(0).get("headers")).get("authorization")) }
+      eq("debug.redacted", "[redacted]", Helpers.toMapAny(seen.get(0).get("headers")).get("authorization")) }
     { val f = new DebugFeature()
       val h = fhMake(null, fhF(new NetsimFeature(), om("failTimes" -> I(1), "failStatus" -> I(500))), fhF(f, null))
       h.op(fhOp("load")); eqI("debug.fail.n", 1, f.entries.size()); eq("debug.fail.ok", B(false), f.entries.get(0).get("ok")) }
@@ -479,7 +479,7 @@ object SdkTestMain {
       val h = fhMake(null, fhF(f, om("now" -> f0(clk.nowFn), "redact" -> jl("x-secret"))))
       h.op(fhOp("load").withHeaders(om("x-secret" -> "hide", "x-ok" -> "show")))
       val dh = Helpers.toMapAny(f.entries.get(0).get("headers"))
-      eq("debug.redact.secret", "<redacted>", dh.get("x-secret")); eq("debug.redact.ok", "show", dh.get("x-ok")) }
+      eq("debug.redact.secret", "[redacted]", dh.get("x-secret")); eq("debug.redact.ok", "show", dh.get("x-ok")) }
     { val f = new DebugFeature()
       val h = fhMake(null, fhF(f, om("active" -> B(false))))
       h.op(fhOp("load")); eqI("debug.inactive", 0, f.entries.size()) }

package/project/.sdk/tm/scala/utility/Make.scala

@@ -33,6 +33,7 @@ object MakeError {
     val spec = ctx.spec
 
     if (ctx.ctrl.explain != null) {
+      Clean.cleanExplain(ctx)
       val errRecord = new LinkedHashMap[String, Object]()
       errRecord.put("message", msg)
       ctx.ctrl.explain.put("err", errRecord)
@@ -44,6 +45,7 @@ object MakeError {
     val sdkErr = new SdkError(code, msg, ctx)
     sdkErr.result = Clean.clean(ctx, result)
     sdkErr.spec = Clean.clean(ctx, spec)
+    sdkErr.status = result.status
 
     ctx.ctrl.err = sdkErr
 
@@ -266,6 +268,29 @@ object MakeOptions {
     // null check, which cannot distinguish them.
     val authSuppressed = options.containsKey("auth") && null == options.get("auth")
 
+    var config = ctx.config
+    if (config == null) config = new LinkedHashMap[String, Object]()
+    var cfgopts = Helpers.toMapAny(config.get("options"))
+    if (cfgopts == null) cfgopts = new LinkedHashMap[String, Object]()
+
+    // The secret registry exists BEFORE validation, fed from the raw input, so
+    // the constructor's own rejection of a mistyped credential is clean too.
+    // An absent layer is left out: merge lets a null replace everything before it.
+    val cleanlist = new ArrayList[Object]()
+    cleanlist.add(new LinkedHashMap[String, Object]())
+    for (layer <- List(Schema.optspec.get("clean"), cfgopts.get("clean"), options.get("clean"))
+        if layer != null) {
+      cleanlist.add(Struct.clone(layer))
+    }
+    val cleancfg = Clean.makeCleanConfig(Struct.merge(cleanlist))
+    addSensitiveOptions(cleancfg, options, "clean")
+    for (block <- List(cfgopts.get("clean"), options.get("clean"))) {
+      val bm = Helpers.toMapAny(block)
+      for (raw <- Clean.splitvalues(if (bm == null) null else bm.get("values"))) {
+        Clean.registerValue(cleancfg, raw)
+      }
+    }
+
     var opts = Struct.clone(options).asInstanceOf[JMap[String, Object]]
 
     if (authSuppressed) opts.remove("auth")
@@ -298,11 +323,6 @@ object MakeOptions {
       case _ =>
     }
 
-    var config = ctx.config
-    if (config == null) config = new LinkedHashMap[String, Object]()
-    var cfgopts = Helpers.toMapAny(config.get("options"))
-    if (cfgopts == null) cfgopts = new LinkedHashMap[String, Object]()
-
     // THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
     //
     // Built from the model: `main.kit.optspec` for the standard options, plus
@@ -330,9 +350,17 @@ object MakeOptions {
     mergeList.add(opts)
     val merged = Struct.merge(mergeList)
 
+    // Errors are collected, not thrown, so a mistyped option is not rejected.
     val vopts = new LinkedHashMap[String, Object]()
     vopts.put("errs", new ArrayList[Object]())
-    val validated = Struct.validate(merged, optspec, vopts)
+    val validated =
+      try Struct.validate(merged, optspec, vopts)
+      catch {
+        // A rejection quotes the value it rejected.
+        case err: RuntimeException =>
+          val text = if (err.getMessage == null) String.valueOf(err) else err.getMessage
+          throw new SdkError("options_invalid", Clean.cleanWith(cleancfg, text).asInstanceOf[String], ctx)
+      }
     opts = validated.asInstanceOf[JMap[String, Object]]
 
     // Restore the suppression the optspec default would otherwise erase.
@@ -345,17 +373,6 @@ object MakeOptions {
       else { val sm = new LinkedHashMap[String, Object](); sm.put("fetch", sysFetch); opts.put("system", sm) }
     }
 
-    // Derived clean config.
-    var cleanKeys = "key,token,id"
-    Struct.getpath(opts, java.util.List.of("clean", "keys")) match { case s: String => cleanKeys = s; case _ => }
-
-    val filtered = new ArrayList[String]()
-    for (p0 <- cleanKeys.split(",")) {
-      val p = p0.trim
-      if ("" != p) filtered.add(Struct.escre(p))
-    }
-    val keyre = String.join("|", filtered)
-
     // Resolve the feature add-order: an explicit list order (above) wins;
     // otherwise order the map test-first, then the remaining names sorted, so
     // the outcome is deterministic and `test` is always the base transport.
@@ -374,14 +391,40 @@ object MakeOptions {
     }
 
     val derived = new LinkedHashMap[String, Object]()
-    val derivedClean = new LinkedHashMap[String, Object]()
-    if ("" != keyre) derivedClean.put("keyre", keyre)
-    derived.put("clean", derivedClean)
+    derived.put("clean", cleancfg)
     derived.put("featureorder", featureorder)
     opts.put("__derived__", derived)
 
+    // Again over the merged result: the config's own defaults can carry one.
+    addSensitiveOptions(cleancfg, opts, "clean", "__derived__")
+
     opts
   }
+
+  // A feature's name is not a field name: a feature called `secrets` does not
+  // make every one of its options a secret. Entity blocks (entity settings,
+  // seeded records) hold no credential.
+  private def addSensitiveOptions(cfg: CleanConfig, m: JMap[String, Object], keys: String*): Unit = {
+    val top = omit(m, (keys :+ "feature" :+ "entity")*)
+    if (top.containsKey("test")) top.put("test", noEntity(top.get("test")))
+    Clean.addSensitiveWith(cfg, top)
+    m.get("feature") match {
+      case fm: JMap[_, _] => fm.values().forEach(v => Clean.addSensitiveWith(cfg, noEntity(v.asInstanceOf[Object])))
+      case fl: JList[_] => fl.forEach(v => Clean.addSensitiveWith(cfg, noEntity(v.asInstanceOf[Object])))
+      case other => Clean.addSensitiveWith(cfg, other)
+    }
+  }
+
+  private def noEntity(block: Object): Object = block match {
+    case bm: JMap[_, _] => omit(bm.asInstanceOf[JMap[String, Object]], "entity")
+    case other => other
+  }
+
+  private def omit(m: JMap[String, Object], keys: String*): JMap[String, Object] = {
+    val out = new LinkedHashMap[String, Object](m)
+    keys.foreach(k => out.remove(k))
+    out
+  }
 }
 
 object MakeFetchDef {

package/project/.sdk/tm/scala/utility/Misc.scala

@@ -1,6 +1,8 @@
 package SCALAPACKAGE.utility
 
-import java.util.{Map => JMap}
+import java.io.{PrintWriter, StringWriter}
+import java.nio.charset.StandardCharsets
+import java.util.{ArrayList, Base64, IdentityHashMap, LinkedHashMap, List => JList, Map => JMap}
 import SCALAPACKAGE.core._
 import SCALAPACKAGE.utility.struct.Struct
 
@@ -9,16 +11,367 @@ object MakeContext {
     new Context(ctxmap, basectx)
 }
 
+// The derived clean block: built by makeOptions from the raw input, grown by
+// cleanAdd for as long as the client lives (features register later).
+final class CleanConfig(
+  val active: Boolean,
+  val keys: List[String],
+  val values: ArrayList[String],
+  val mask: String,
+  val hint: Int,
+  val min: Int,
+) {
+  // The options map this sits in can itself be printed; the registry never is.
+  override def toString: String = "CleanConfig(active=" + active + ")"
+}
+
+// Everything that leaves the pipeline passes through clean; inside it data
+// stays raw, so a hook can still read the header it must add to. See
+// docs/explanation/secret-redaction.md.
 object Clean {
-  def clean(ctx: Context, v: Object): Object = v
+  private val MAXDEPTH = 32
+  private val CIRCULAR = "[circular]"
+  private val DROP = new Object()
+  private val SPLIT_RE = "\\s*,\\s*"
+
+  private def normkey(key: Object): String =
+    String.valueOf(key).toLowerCase.replace("-", "").replace("_", "")
+
+  private def splitkeys(keys: Object): List[String] =
+    (if (keys == null) "" else String.valueOf(keys)).split(SPLIT_RE).toList
+      .map(k => normkey(k)).filter(k => "" != k)
+
+  def splitvalues(values: Object): List[String] = values match {
+    case null => Nil
+    case l: JList[_] => l.asInstanceOf[JList[Object]].toArray.toList.collect { case s: String => s }
+    case v => String.valueOf(v).split(SPLIT_RE).toList.filter(s => "" != s)
+  }
+
+  private def count(v: Object, dflt: Int): Int = {
+    val n: Double = v match {
+      case n: java.lang.Number => n.doubleValue()
+      case s: String =>
+        try s.trim.toDouble
+        catch { case _: NumberFormatException => return dflt }
+      case _ => return dflt
+    }
+    if (n.isNaN || n.isInfinite || n < 0) dflt else Math.floor(n).toInt
+  }
+
+  def makeCleanConfig(cleanopts: Object): CleanConfig = {
+    val opts = Helpers.toMapAny(cleanopts)
+    def get(k: String): Object = if (opts == null) null else opts.get(k)
+    new CleanConfig(
+      java.lang.Boolean.FALSE != get("active"),
+      splitkeys(get("keys")),
+      new ArrayList[String](),
+      get("mask") match { case s: String => s; case _ => "[redacted]" },
+      count(get("hint"), 0),
+      Math.max(1, count(get("min"), 4)),
+    )
+  }
+
+  // A context without options (makeError accepts a bare one) still masks by
+  // the schema defaults.
+  private def cleanConfig(ctx: Context): CleanConfig = {
+    if (ctx != null && ctx.options != null) {
+      val derived = Helpers.toMapAny(ctx.options.get("__derived__"))
+      if (derived != null) derived.get("clean") match {
+        case c: CleanConfig => return c
+        case _ =>
+      }
+    }
+    makeCleanConfig(Schema.optspec.get("clean"))
+  }
+
+  // encodeURIComponent, byte for byte: URLEncoder differs on space and `~!'()*`.
+  private def percentEncode(value: String): String = {
+    val out = new StringBuilder()
+    for (b <- value.getBytes(StandardCharsets.UTF_8)) {
+      val c = b & 0xff
+      val ch = c.toChar
+      if ((ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') || (ch >= '0' && ch <= '9') ||
+          "-_.!~*'()".indexOf(ch) >= 0) out.append(ch)
+      else out.append('%').append(String.format("%02X", java.lang.Integer.valueOf(c)))
+    }
+    out.toString
+  }
+
+  // The encoded forms a value travels in.
+  private def forms(value: String): List[String] = {
+    val out = new ArrayList[String]()
+    out.add(value)
+    def add(s: String): Unit = if ("" != s && !out.contains(s)) out.add(s)
+    try add(Base64.getEncoder.encodeToString(value.getBytes(StandardCharsets.UTF_8)))
+    catch { case _: RuntimeException => }
+    try add(percentEncode(value))
+    catch { case _: RuntimeException => }
+    try {
+      val j = Struct.jsonify(value)
+      if (j.length >= 2) add(j.substring(1, j.length - 1))
+    }
+    catch { case _: RuntimeException => }
+    out.toArray(new Array[String](0)).toList
+  }
+
+  private[utility] def registerValue(cfg: CleanConfig, value: Object): Unit = value match {
+    case s: String if s.length >= cfg.min =>
+      cfg.synchronized {
+        var changed = false
+        for (form <- forms(s)) {
+          if (form.length >= cfg.min && !cfg.values.contains(form)) {
+            cfg.values.add(form)
+            changed = true
+          }
+        }
+        if (changed) cfg.values.sort(new java.util.Comparator[String] {
+          def compare(a: String, b: String): Int = Integer.compare(b.length, a.length)
+        })
+      }
+    case _ =>
+  }
+
+  def cleanAdd(ctx: Context, value: Object): Unit = registerValue(cleanConfig(ctx), value)
+
+  private def maskValue(cfg: CleanConfig, value: String): String =
+    if (0 < cfg.hint && value.length > 2 * cfg.hint) cfg.mask + value.substring(value.length - cfg.hint)
+    else cfg.mask
+
+  private def cleanString(cfg: CleanConfig, text: String): String = {
+    val values = cfg.synchronized { new ArrayList[String](cfg.values) }
+    var out = text
+    val it = values.iterator()
+    while (it.hasNext) {
+      val v = it.next()
+      if (out.contains(v)) out = out.replace(v, maskValue(cfg, v))
+    }
+    out
+  }
+
+  private def sensitiveKey(cfg: CleanConfig, key: Object): Boolean = {
+    if (key == null || key.isInstanceOf[java.lang.Number]) return false
+    val nk = normkey(key)
+    cfg.keys.exists(k => nk.contains(k))
+  }
+
+  private def isfunc(v: Object): Boolean = {
+    val cls = v.getClass
+    cls.isSynthetic || cls.getInterfaces.exists { i =>
+      i.getName.startsWith("java.util.function.") || i.getName.startsWith("scala.Function")
+    }
+  }
+
+  private def stackOf(err: Throwable): String = {
+    val sw = new StringWriter()
+    err.printStackTrace(new PrintWriter(sw))
+    sw.toString
+  }
+
+  // The SDK's own objects have no serialisation hook, so this is the record
+  // each one leaves as. The context stays raw on the error and is not here.
+  private def record(v: Object): JMap[String, Object] = {
+    val out = new LinkedHashMap[String, Object]()
+    v match {
+      case e: Throwable =>
+        out.put("message", if (e.getMessage == null) "" else e.getMessage)
+        out.put("stack", stackOf(e))
+        e match {
+          case se: SdkError =>
+            out.put("sdk", se.sdk)
+            out.put("code", se.code)
+            out.put("status", java.lang.Integer.valueOf(se.status))
+            out.put("result", se.result)
+            out.put("spec", se.spec)
+          case _ =>
+        }
+      case s: Spec =>
+        out.put("method", s.method)
+        out.put("base", s.base)
+        out.put("prefix", s.prefix)
+        out.put("suffix", s.suffix)
+        out.put("path", s.path)
+        out.put("url", s.url)
+        out.put("params", s.params)
+        out.put("query", s.query)
+        out.put("headers", s.headers)
+        out.put("body", s.body)
+        out.put("step", s.step)
+      case r: Result =>
+        out.put("ok", java.lang.Boolean.valueOf(r.ok))
+        out.put("status", java.lang.Integer.valueOf(r.status))
+        out.put("statusText", r.statusText)
+        out.put("headers", r.headers)
+        out.put("body", r.body)
+        out.put("resdata", r.resdata)
+        out.put("resmatch", r.resmatch)
+        out.put("err", r.err)
+        out.put("paging", r.paging)
+      case r: Response =>
+        out.put("status", java.lang.Integer.valueOf(r.status))
+        out.put("statusText", r.statusText)
+        out.put("headers", r.headers)
+        out.put("body", r.body)
+        out.put("err", r.err)
+      case o: Operation =>
+        out.put("entity", o.entity)
+        out.put("name", o.name)
+        out.put("input", o.input)
+      case c: Context =>
+        out.put("id", c.id)
+        out.put("op", c.op)
+        out.put("spec", c.spec)
+        out.put("entity", c.entity)
+        out.put("result", c.result)
+        out.put("response", c.response)
+        out.put("meta", c.meta)
+      case e: Entity =>
+        out.put("name", e.getName())
+        out.put("data", try e.data() catch { case _: RuntimeException => null })
+      case _ =>
+    }
+    out
+  }
+
+  // A masked plain-data copy: functions dropped, cycles cut, and nothing
+  // shared with the live value, whose spec must stay raw.
+  private def snapshot(cfg: CleanConfig, v: Object, key: Object, depth: Int,
+      seen: IdentityHashMap[Object, Object]): Object = {
+    if (v == null || (v eq Struct.UNDEF)) return v
+
+    v match {
+      case s: String => return if (sensitiveKey(cfg, key)) maskValue(cfg, s) else cleanString(cfg, s)
+      case _ =>
+    }
+
+    if (isfunc(v)) return DROP
+
+    v match {
+      case _: java.lang.Number | _: java.lang.Boolean | _: java.lang.Character =>
+        return if (sensitiveKey(cfg, key)) cfg.mask else v
+      case _ =>
+    }
+
+    if (MAXDEPTH <= depth || seen.containsKey(v)) return CIRCULAR
+
+    if (sensitiveKey(cfg, key)) return cfg.mask
+
+    seen.put(v, v)
+    try {
+      v match {
+        case l: JList[_] =>
+          val out = new ArrayList[Object]()
+          var i = 0
+          val it = l.asInstanceOf[JList[Object]].iterator()
+          while (it.hasNext) {
+            val s = snapshot(cfg, it.next(), java.lang.Integer.valueOf(i), depth + 1, seen)
+            if (s ne DROP) out.add(s)
+            i += 1
+          }
+          out
+        case m: JMap[_, _] => plain(cfg, m, depth, seen)
+        case _: Throwable | _: Spec | _: Result | _: Response | _: Operation | _: Context | _: Entity =>
+          plain(cfg, record(v), depth, seen)
+        case _ => cleanString(cfg, v.toString)
+      }
+    }
+    finally seen.remove(v)
+  }
+
+  private def plain(cfg: CleanConfig, m: JMap[_, _], depth: Int,
+      seen: IdentityHashMap[Object, Object]): JMap[String, Object] = {
+    val out = new LinkedHashMap[String, Object]()
+    val it = m.asInstanceOf[JMap[Object, Object]].entrySet().iterator()
+    while (it.hasNext) {
+      val e = it.next()
+      val s = snapshot(cfg, e.getValue, e.getKey, depth + 1, seen)
+      if (s ne DROP) out.put(cleanName(cfg, out, String.valueOf(e.getKey)), s)
+    }
+    out
+  }
+
+  // A registered value used as a map key is masked like any other string;
+  // keys that mask alike take a counter, so none is lost.
+  private def cleanName(cfg: CleanConfig, out: JMap[String, Object], key: String): String = {
+    val name = cleanString(cfg, key)
+    if (name == key || !out.containsKey(name)) return name
+    var i = 1
+    while (out.containsKey(name + "#" + i)) i += 1
+    name + "#" + i
+  }
+
+  private[utility] def cleanWith(cfg: CleanConfig, value: Object): Object = {
+    if (!cfg.active) return value
+
+    value match {
+      case s: String => return cleanString(cfg, s)
+      case err: SdkError =>
+        // Cleaned in place, since it is about to be thrown.
+        err.msg = cleanString(cfg, err.msg)
+        err.code = cleanString(cfg, err.code)
+        err.result = snapshot(cfg, err.result, "result", 1, new IdentityHashMap[Object, Object]())
+        err.spec = snapshot(cfg, err.spec, "spec", 1, new IdentityHashMap[Object, Object]())
+        return err
+      // A throwable's message is fixed, so a foreign one leaves as a cleaned
+      // copy of the SDK's own error, without the raw one as its cause.
+      case t: Throwable =>
+        return new SdkError("", cleanString(cfg, if (t.getMessage == null) String.valueOf(t) else t.getMessage), null)
+      case _ =>
+    }
+
+    val out = snapshot(cfg, value, null, 0, new IdentityHashMap[Object, Object]())
+    if (out eq DROP) null else out
+  }
+
+  def clean(ctx: Context, v: Object): Object = cleanWith(cleanConfig(ctx), v)
+
+  def cleanKey(ctx: Context, key: Object): Boolean = sensitiveKey(cleanConfig(ctx), key)
+
+  // Every scalar under a sensitive name, at any depth and of any shape: a
+  // credential mistyped as a map or a number is still a credential, and a
+  // message about it can quote it.
+  private[utility] def addSensitiveWith(cfg: CleanConfig, v: Object): Unit =
+    addSensitive(cfg, v, false, 0, new IdentityHashMap[Object, Object]())
+
+  private def addSensitive(cfg: CleanConfig, v: Object, under: Boolean, depth: Int,
+      seen: IdentityHashMap[Object, Object]): Unit = {
+    if (v == null || MAXDEPTH <= depth) return
+    v match {
+      case s: String => if (under) registerValue(cfg, s)
+      case n: java.lang.Number => if (under) registerValue(cfg, Struct.stringify(n))
+      case _ if seen.containsKey(v) =>
+      case m: JMap[_, _] =>
+        seen.put(v, v)
+        val it = m.asInstanceOf[JMap[Object, Object]].entrySet().iterator()
+        while (it.hasNext) {
+          val e = it.next()
+          addSensitive(cfg, e.getValue, under || sensitiveKey(cfg, e.getKey), depth + 1, seen)
+        }
+      case l: JList[_] =>
+        seen.put(v, v)
+        val it = l.asInstanceOf[JList[Object]].iterator()
+        while (it.hasNext) addSensitive(cfg, it.next(), under, depth + 1, seen)
+      case _ =>
+    }
+  }
+
+  // The caller holds the explain map, so the cleaned copy is written back
+  // into it rather than swapped for it.
+  private[utility] def cleanExplain(ctx: Context): Unit = {
+    val explain = ctx.ctrl.explain
+    if (explain == null) return
+    val cleaned = Helpers.toMapAny(clean(ctx, explain))
+    if (cleaned != null && (cleaned ne explain)) {
+      explain.clear()
+      explain.putAll(cleaned)
+    }
+  }
 }
 
 object Done {
   def done(ctx: Context): Object = {
     if (ctx.ctrl.explain != null) {
-      ctx.ctrl.explain = Clean.clean(ctx, ctx.ctrl.explain).asInstanceOf[JMap[String, Object]]
-      val explainResult = ctx.ctrl.explain.get("result")
-      val rm = Helpers.toMapAny(explainResult)
+      Clean.cleanExplain(ctx)
+      val rm = Helpers.toMapAny(ctx.ctrl.explain.get("result"))
       if (rm != null) rm.remove("err")
     }
 

package/project/.sdk/tm/scala/utility/Register.scala

@@ -6,6 +6,7 @@ import SCALAPACKAGE.core.Utility
 object Register {
   def registerAll(u: Utility): Unit = {
     u.clean = (ctx, v) => Clean.clean(ctx, v)
+    u.cleanAdd = (ctx, v) => Clean.cleanAdd(ctx, v)
     u.done = (ctx) => Done.done(ctx)
     u.makeError = (ctx, err) => MakeError.makeError(ctx, err)
     u.featureAdd = (ctx, f) => FeatureAdd.featureAdd(ctx, f)

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/core/Context.swift

@@ -158,4 +158,33 @@ public final class Context {
   public func makeError(_ code: String, _ msg: String) -> ProjectNameError {
     return ProjectNameError(code, msg, self)
   }
+
+  // The record form: what the context says about the operation, never its
+  // client, options or config.
+  func rawRecord() -> VMap {
+    let record = VMap()
+    record.entries["id"] = .string(id)
+    record.entries["op"] = op == nil ? .noval : .nat(op!)
+    record.entries["spec"] = spec == nil ? .noval : .nat(spec!)
+    record.entries["entity"] = entity == nil ? .noval : .string(entity!.getName())
+    record.entries["result"] = result == nil ? .noval : .nat(result!)
+    record.entries["response"] = response == nil ? .noval : .nat(response!)
+    record.entries["meta"] = .map(meta)
+    return record
+  }
+
+  // The serialised context leaves the pipeline (a logger, an error dump), so
+  // it is cleaned; the live fields stay raw for the pipeline's own use.
+  public func record() -> VMap {
+    let record = rawRecord()
+    guard let clean = utility?.clean else { return record }
+    return clean(self, .map(record)).asMap ?? record
+  }
+}
+
+// Every default print of a context is the cleaned record, `dump` included.
+extension Context: CustomStringConvertible, CustomDebugStringConvertible, CustomReflectable {
+  public var description: String { "Context " + jsonify(.map(record()), indent: 0) }
+  public var debugDescription: String { description }
+  public var customMirror: Mirror { Mirror(self, children: ["record": jsonify(.map(record()), indent: 0)]) }
 }

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/core/Utility.swift

@@ -6,6 +6,7 @@ import Foundation
 
 public final class Utility {
   public var clean: ((Context, Value) -> Value)!
+  public var cleanAdd: ((Context, Value) -> Void)!
   public var done: ((Context) throws -> Value)!
   public var makeError: ((Context, Error?) throws -> Value)!
   public var featureAdd: ((Context, BaseFeature) -> Void)!
@@ -49,6 +50,7 @@ public final class Utility {
   public static func copy(_ src: Utility) -> Utility {
     let u = Utility(noregister: true)
     u.clean = src.clean
+    u.cleanAdd = src.cleanAdd
     u.done = src.done
     u.makeError = src.makeError
     u.featureAdd = src.featureAdd

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/AuditFeature.swift

@@ -74,17 +74,18 @@ public final class AuditFeature: BaseFeature {
     let entity = ctx.op?.entity ?? "_"
     let opname = ctx.op?.name ?? "_"
 
-    let record = VMap()
-    record.entries["seq"] = .int(Int64(seq))
-    record.entries["ts"] = .int(foptNow(options)())
-    record.entries["actor"] = .string(actor)
-    record.entries["entity"] = .string(entity)
-    record.entries["op"] = .string(opname)
-    record.entries["outcome"] = .string(outcome)
-    record.entries["correlationId"] = .string(ctx.id)
+    let raw = VMap()
+    raw.entries["seq"] = .int(Int64(seq))
+    raw.entries["ts"] = .int(foptNow(options)())
+    raw.entries["actor"] = .string(actor)
+    raw.entries["entity"] = .string(entity)
+    raw.entries["op"] = .string(opname)
+    raw.entries["outcome"] = .string(outcome)
+    raw.entries["correlationId"] = .string(ctx.id)
     if let result = ctx.result {
-      record.entries["status"] = .int(Int64(result.status))
+      raw.entries["status"] = .int(Int64(result.status))
     }
+    let record = fclean(ctx, raw)
 
     records.append(record)
     let max = foptInt(options, "max", 1000)

package/project/.sdk/tm/swift/Sources/ProjectNameSDK/feature/CostFeature.swift

@@ -303,14 +303,16 @@ public final class CostFeature: BaseFeature {
     bump(&actors, actor, amount)
 
     seq += 1
+    // A typed record, so its strings are cleaned one by one rather than the
+    // record as a whole.
     let record = CostRecord()
     record.seq = seq
-    record.entity = entity
-    record.op = opname
-    record.actor = actor
+    record.entity = fcleanStr(ctx, entity)
+    record.op = fcleanStr(ctx, opname)
+    record.actor = fcleanStr(ctx, actor)
     record.amount = amount
-    record.currency = currency
-    record.source = source
+    record.currency = fcleanStr(ctx, currency)
+    record.source = fcleanStr(ctx, source)
     record.attempts = pending.attempts
     last = record