@voxgig/sdkgen 4.32.1 → 4.34.0

package/project/.sdk/tm/clojure/src/sdk/core.clj

@@ -134,13 +134,19 @@
 ;; error map under ::sdk-error.
 ;; ---------------------------------------------------------------------------
 
+;; The context rides in the map's METADATA, not as a key: the error is data
+;; and `pr-str`/`ex-data` print every key, and the context holds the live
+;; spec and options. Reachable through `err-ctx` for a debugger, invisible to
+;; every printer.
 (defn make-error-obj
   ([code msg] (make-error-obj code msg nil))
   ([code msg ctx]
-   {:sdk-error true :sdk SDK-NAME :code (or code "") :msg (or msg "")
-    :ctx ctx :result nil :spec nil}))
+   (with-meta {:sdk-error true :sdk SDK-NAME :code (or code "") :msg (or msg "")
+               :result nil :spec nil}
+     {:ctx ctx})))
 
 (defn sdk-error? [x] (and (map? x) (true? (:sdk-error x))))
+(defn err-ctx [e] (when (sdk-error? e) (:ctx (meta e))))
 (defn err-msg [e]
   (cond
     (sdk-error? e) (:msg e)
@@ -332,6 +338,9 @@
         result (let [r (cprop "result")] (if (some? r) r (bget :result)))
         response (let [r (cprop "response")] (if (some? r) r (bget :response)))
         opname (or (cprop "opname") "")
+        ;; `:type` metadata routes print-method to the cleaned record (see
+        ;; ctx->data): a bare atom prints its whole value, spec and options
+        ;; included.
         ctx (atom {:id (str "C" (+ 10000000 (rand-int 89999999)))
                    :out (atom (vs/jm))
                    :client client :utility utility :ctrl ctrl :meta meta
@@ -340,7 +349,8 @@
                    :data (dmap "data") :reqdata (dmap "reqdata")
                    :match (dmap "match") :reqmatch (dmap "reqmatch")
                    :point point :spec spec :result result :response response
-                   :op nil})]
+                   :op nil}
+                  :meta {:type ::context})]
     (oset! ctx :op (resolve-op ctx opname))
     ctx))
 
@@ -430,7 +440,247 @@
 
 (def METHOD-MAP {"create" "POST" "update" "PUT" "load" "GET" "list" "GET" "remove" "DELETE" "patch" "PATCH"})
 
-(defn u-clean [_ctx val] val)
+;; ---------------------------------------------------------------------------
+;; clean. Everything that leaves the pipeline passes through it; inside, data
+;; stays raw so a hook can still read the header it must add to. See
+;; docs/explanation/secret-redaction.md.
+;; ---------------------------------------------------------------------------
+
+(def ^:private CLEAN-MAXDEPTH 32)
+(def ^:private CLEAN-CIRCULAR "[circular]")
+(def ^:private DROP (Object.))
+
+(defn- keyname [k] (cond (nil? k) "" (keyword? k) (name k) :else (str k)))
+
+(defn- normkey [k] (str/replace (str/lower-case (keyname k)) #"[-_]" ""))
+
+(defn- splitkeys [keys]
+  (->> (str/split (str (or keys "")) #"\s*,\s*") (map normkey) (remove empty?) vec))
+
+(defn splitvalues [values]
+  (if (or (vs/islist values) (sequential? values))
+    (filterv string? (vec values))
+    (->> (str/split (str (or values "")) #"\s*,\s*") (remove empty?) vec)))
+
+(defn- count-opt [v dflt]
+  (let [n (try (long (Math/floor (Double/parseDouble (str v)))) (catch Exception _ nil))]
+    (if (and n (<= 0 n)) n dflt)))
+
+;; The derived clean block: a struct map so it lives in options.__derived__
+;; and its `values` list stays MUTABLE after make-options - features register
+;; what they resolve later.
+(defn make-clean-config [cleanopts]
+  (let [o (fn [k] (mget cleanopts k))
+        keys (vs/jt)]
+    (doseq [k (splitkeys (o "keys"))] (.add ^java.util.List keys k))
+    (vs/jm "active" (not= false (o "active"))
+           "keys" keys
+           "values" (vs/jt)
+           "mask" (let [m (o "mask")] (if (string? m) m "[redacted]"))
+           "hint" (count-opt (o "hint") 0)
+           "min" (max 1 (count-opt (o "min") 4)))))
+
+;; A context without options (make-error accepts a bare one) still masks by
+;; the schema defaults.
+(defn- clean-config [ctx]
+  (let [options (when (instance? clojure.lang.IDeref ctx) (oget ctx :options))
+        derived (when (vs/ismap options) (vs/getpath options "__derived__.clean"))]
+    (if (vs/ismap derived) derived (make-clean-config (vs/getprop @optspec-parsed "clean")))))
+
+;; The encoded forms a value travels in.
+(defn- clean-forms [^String value]
+  (let [out (java.util.ArrayList.)
+        add (fn [s] (when (and (string? s) (not= "" s) (not (.contains out s))) (.add out s)))]
+    (add value)
+    (try (add (.encodeToString (java.util.Base64/getEncoder) (.getBytes value "UTF-8"))) (catch Throwable _ nil))
+    (try (add (vs/escurl value)) (catch Throwable _ nil))
+    (try (let [j (vs/jsonify value)] (add (subs j 1 (dec (count j))))) (catch Throwable _ nil))
+    (vec out)))
+
+(defn u-clean-add [ctx value]
+  (let [cfg (clean-config ctx)
+        minlen (long (or (mget cfg "min") 4))
+        values (mget cfg "values")]
+    (when (and (string? value) (>= (count value) minlen) (instance? java.util.List values))
+      (let [changed (atom false)]
+        (doseq [form (clean-forms value)]
+          (when (and (>= (count form) minlen) (not (.contains ^java.util.List values form)))
+            (.add ^java.util.List values form)
+            (reset! changed true)))
+        ;; Longest first, so a value is never masked by a substring of itself.
+        (when @changed
+          (let [sorted (sort-by (fn [^String s] (- (count s))) (vec values))]
+            (.clear ^java.util.List values)
+            (doseq [s sorted] (.add ^java.util.List values s))))))
+    nil))
+
+(defn- mask-value [cfg ^String value]
+  (let [hint (long (or (mget cfg "hint") 0))
+        mask (str (mget cfg "mask"))]
+    (if (and (pos? hint) (> (count value) (* 2 hint)))
+      (str mask (subs value (- (count value) hint)))
+      mask)))
+
+(defn- clean-string [cfg ^String text]
+  (reduce (fn [^String out ^String value]
+            (if (.contains out value) (str/replace out value (mask-value cfg value)) out))
+          text
+          (vec (or (mget cfg "values") []))))
+
+(defn- sensitive-key? [cfg key]
+  (if (or (nil? key) (number? key))
+    false
+    (let [^String nk (normkey key)]
+      (boolean (some (fn [^String k] (.contains nk k)) (vec (or (mget cfg "keys") [])))))))
+
+(defn- number-text [n]
+  (if (and (float? n) (== (double n) (Math/floor (double n))) (< (Math/abs (double n)) 9.0E15))
+    (str (long n))
+    (str n)))
+
+;; Every scalar under a sensitive name, at any depth and of any shape: a
+;; credential mistyped as a map or a number is still a credential, and the
+;; validation error that rejects it quotes it.
+(defn u-clean-add-sensitive
+  ([ctx val] (u-clean-add-sensitive ctx (clean-config ctx) val false 0 []))
+  ([ctx cfg val under depth seen]
+   (cond
+     (or (nil? val) (<= CLEAN-MAXDEPTH depth)) nil
+     (string? val) (when under (u-clean-add ctx val))
+     (number? val) (when under (u-clean-add ctx (number-text val)))
+     (some #(identical? % val) seen) nil
+     (instance? java.util.Map val)
+     (let [seen (conj seen val)]
+       (doseq [^java.util.Map$Entry e (vec (.entrySet ^java.util.Map val))]
+         (u-clean-add-sensitive ctx cfg (.getValue e)
+                                (or under (sensitive-key? cfg (.getKey e))) (inc depth) seen)))
+     (or (instance? java.util.Collection val) (sequential? val))
+     (let [seen (conj seen val)]
+       (doseq [v (seq val)]
+         (u-clean-add-sensitive ctx cfg v under (inc depth) seen)))
+     :else nil)))
+
+(defn- entity-instance? [v]
+  (and (map? v) (instance? clojure.lang.IAtom (:_data v)) (fn? (:get-name v))))
+
+;; A registered value used as a property name is masked like any other
+;; string; names that mask alike take a counter, so none is lost.
+(defn- clean-name [cfg has? k]
+  (let [key (keyname k)
+        n (clean-string cfg key)]
+    (if (or (= n key) (not (has? n)))
+      n
+      (loop [i 1]
+        (let [c (str n "#" i)]
+          (if (has? c) (recur (inc i)) c))))))
+
+;; A masked plain-data COPY (string-keyed struct nodes): an entity serialises
+;; as its record, an atom-object as its map, functions are dropped, cycles
+;; cut, and nothing is shared with the live value, whose spec must stay raw.
+(defn- clean-snapshot [cfg val key depth seen]
+  (cond
+    (nil? val) nil
+    (string? val) (if (sensitive-key? cfg key) (mask-value cfg val) (clean-string cfg val))
+    (fn? val) DROP
+    (or (number? val) (boolean? val) (keyword? val) (symbol? val) (char? val))
+    (if (sensitive-key? cfg key) (mget cfg "mask") val)
+    (or (<= CLEAN-MAXDEPTH depth) (some #(identical? % val) seen)) CLEAN-CIRCULAR
+    (sensitive-key? cfg key) (mget cfg "mask")
+    :else
+    (let [seen (conj seen val)]
+      (cond
+        (entity-instance? val) (clean-snapshot cfg (deref (:_data val)) key (inc depth) seen)
+        (instance? clojure.lang.IAtom val) (clean-snapshot cfg (deref val) key (inc depth) seen)
+        (instance? Throwable val)
+        (let [out (vs/jm "message" (clean-string cfg (str (.getMessage ^Throwable val))))]
+          (when (instance? clojure.lang.IExceptionInfo val)
+            (let [d (clean-snapshot cfg (ex-data val) "data" (inc depth) seen)]
+              (when-not (identical? DROP d) (.put ^java.util.Map out "data" d))))
+          out)
+        (instance? java.util.Map val)
+        (let [out (vs/jm)]
+          (doseq [^java.util.Map$Entry e (.entrySet ^java.util.Map val)]
+            (let [k (.getKey e)
+                  v (clean-snapshot cfg (.getValue e) k (inc depth) seen)]
+              (when-not (identical? DROP v)
+                (.put ^java.util.Map out
+                      (clean-name cfg #(.containsKey ^java.util.Map out %) k) v))))
+          out)
+        (or (instance? java.util.Collection val) (sequential? val))
+        (let [out (vs/jt)]
+          (doseq [[i v] (map-indexed vector (seq val))]
+            (let [c (clean-snapshot cfg v i (inc depth) seen)]
+              (.add ^java.util.List out (if (identical? DROP c) nil c))))
+          out)
+        :else (clean-string cfg (str val))))))
+
+;; An error map is immutable, so "in place" is a cleaned copy carrying the
+;; same metadata (the context stays reachable through err-ctx).
+(defn- clean-error [cfg err]
+  (with-meta
+    (reduce (fn [out [k v]]
+              (let [c (clean-snapshot cfg v k 1 [])
+                    n (clean-name cfg #(contains? out %) k)]
+                (assoc out (if (= n (keyname k)) k n) (if (identical? DROP c) nil c))))
+            {} err)
+    (meta err)))
+
+(defn u-clean [ctx val]
+  (let [cfg (clean-config ctx)]
+    (cond
+      (= false (mget cfg "active")) val
+      (string? val) (clean-string cfg val)
+      (sdk-error? val) (clean-error cfg val)
+      :else (let [out (clean-snapshot cfg val nil 0 [])] (if (identical? DROP out) nil out)))))
+
+;; A Throwable is immutable, so one that never passed through make-error (a
+;; hook's, a fetcher's) leaves as a cleaned copy with the original's trace.
+;; One carrying the SDK error keeps it, cleaned, under the same key.
+(defn clean-throwable [ctx ^Throwable t]
+  (let [cfg (clean-config ctx)]
+    (if (= false (mget cfg "active"))
+      t
+      (let [sdkerr (ex->sdk t)
+            out (if (sdk-error? sdkerr)
+                  (let [e (clean-error cfg sdkerr)]
+                    (ex-info (err-msg e) {::sdk-error e}))
+                  (let [data (when (instance? clojure.lang.IExceptionInfo t)
+                               (clean-snapshot cfg (ex-data t) nil 0 []))]
+                    (ex-info (clean-string cfg (str (.getMessage t)))
+                             (if (instance? java.util.Map data) (into {} data) {}))))]
+        (.setStackTrace ^Throwable out (.getStackTrace t))
+        out))))
+
+;; The error as string-keyed data: jsonify reads a java.util.Map's keys as
+;; strings, so a keyword-keyed map would serialise as nulls.
+(defn err->data [e]
+  (when (sdk-error? e)
+    (u-clean (err-ctx e) (into {} (map (fn [[k v]] [(keyname k) v]) e)))))
+
+;; The serialised context leaves the pipeline (a logger, an error dump), so
+;; it is the cleaned record; the live fields stay raw for the pipeline's use.
+(defn ctx->data [ctx]
+  (let [m (deref ctx)
+        u (:utility m)
+        clean (or (when (instance? clojure.lang.IDeref u) (:clean (deref u))) u-clean)
+        entity (:entity m)]
+    (clean ctx (vs/jm "id" (:id m) "op" (:op m) "spec" (:spec m)
+                      "entity" (when (map? entity) (entity-get-name entity))
+                      "result" (:result m) "response" (:response m) "meta" (:meta m)))))
+
+(defmethod print-method ::context [ctx ^java.io.Writer w]
+  (.write w (str "#sdk/context " (vs/jsonify (ctx->data ctx) (vs/jm "indent" 0)))))
+
+;; The explain map is the CALLER's, so it is cleaned in place: what they hold
+;; after the call is the cleaned record. With clean off its result is the live
+;; result atom, which the prune leaves alone.
+(defn clean-explain! [ctx]
+  (when-let [ex (oget (oget ctx :ctrl) :explain)]
+    (let [cleaned (ucall ctx :clean ex)]
+      (when (and (vs/ismap ex) (vs/ismap cleaned) (not (identical? cleaned ex)))
+        (.clear ^java.util.Map ex)
+        (.putAll ^java.util.Map ex ^java.util.Map cleaned))
+      (let [er (mget ex "result")] (when (vs/ismap er) (vs/delprop er "err"))))))
 
 ;; The API definition is authoritative: a POST-only or PATCH-based API
 ;; exposes `update` as POST or PATCH, not the PUT the op name implies.
@@ -978,16 +1228,22 @@
           :else
           (do
             (oset! spec :step "response")
-            (ucall ctx :result-basic)
-            (ucall ctx :result-headers)
-            (ucall ctx :result-body)
-            ;; GraphQL reports failures as a top-level `errors` array under
-            ;; HTTP 200, so result-basic's status check never sees them. Lift
-            ;; them here, before the response transform tries to unwrap data
-            ;; that is not there.
-            (ucall ctx :graphql-errors)
-            (ucall ctx :transform-response)
-            (when (nil? (oget result :err)) (oset! result :ok true))
+            ;; A body reader that throws (a non-JSON body) fails the result,
+            ;; as in ts; it must not escape the pipeline with the raw spec
+            ;; still on the explain record.
+            (try
+              (ucall ctx :result-basic)
+              (ucall ctx :result-headers)
+              (ucall ctx :result-body)
+              ;; GraphQL reports failures as a top-level `errors` array under
+              ;; HTTP 200, so result-basic's status check never sees them. Lift
+              ;; them here, before the response transform tries to unwrap data
+              ;; that is not there.
+              (ucall ctx :graphql-errors)
+              (ucall ctx :transform-response)
+              (when (nil? (oget result :err)) (oset! result :ok true))
+              (catch Throwable e
+                (oset! result :err e)))
             (when-let [ex (oget (oget ctx :ctrl) :explain)] (.put ^java.util.Map ex "result" result))
             [response nil])))))
 
@@ -1028,11 +1284,13 @@
           msg (ucall ctx :clean msg0)
           spec (oget ctx :spec)]
       (oset! result :err nil)
+      (clean-explain! ctx)
       (when-let [ex (oget (oget ctx :ctrl) :explain)] (.put ^java.util.Map ex "err" (vs/jm "message" msg)))
-      (let [sdk-err (assoc (make-error-obj "" msg ctx)
+      ;; Cleaned COPIES of the result and spec, never the live objects.
+      (let [code (when (sdk-error? err) (ucall ctx :clean (:code err)))
+            sdk-err (assoc (make-error-obj code msg ctx)
                            :result (ucall ctx :clean result)
-                           :spec (ucall ctx :clean spec)
-                           :code (if (sdk-error? err) (:code err) ""))]
+                           :spec (ucall ctx :clean spec))]
         (oset! (oget ctx :ctrl) :err sdk-err)
         ;; Fire PreUnexpected so observability features (metrics, telemetry,
         ;; audit, debug) close/record error paths that never reach PreDone
@@ -1046,15 +1304,11 @@
           (sdk-throw sdk-err))))))
 
 (defn u-done [ctx]
-  (let [ctrl (oget ctx :ctrl)]
-    (when-let [ex (oget ctrl :explain)]
-      (let [cleaned (ucall ctx :clean ex)]
-        (oset! ctrl :explain cleaned)
-        (let [er (mget cleaned "result")] (when (vs/ismap er) (vs/delprop er "err")))))
-    (let [result (oget ctx :result)]
-      (if (and result (oget result :ok))
-        (oget result :resdata)
-        (ucall ctx :make-error nil)))))
+  (clean-explain! ctx)
+  (let [result (oget ctx :result)]
+    (if (and result (oget result :ok))
+      (oget result :resdata)
+      (ucall ctx :make-error nil))))
 
 ;; Public camelCase option key -> the kebab-case keyword naming a utility
 ;; member, or nil when the key is not a public name.
@@ -1073,6 +1327,19 @@
                             (fn [[_ c]]
                               (clojure.core/str "-" (str/lower-case c))))))))
 
+;; A feature's name is not a field name: only the sensitive names inside its
+;; settings count, so `secrets` does not make every setting a secret. Entity
+;; blocks hold entity settings and seeded records, never a credential.
+(defn- clean-add-options [ctx opts]
+  (let [noent #(omit-keys % ["entity"])
+        top (dissoc (into {} opts) "feature" "entity")
+        feature (vs/getprop opts "feature")]
+    (u-clean-add-sensitive ctx (cond-> top (contains? top "test") (update "test" noent)))
+    (doseq [fopts (cond (vs/ismap feature) (map #(vs/getprop feature %) (vs/keysof feature))
+                        (vs/islist feature) (vec feature)
+                        :else [feature])]
+      (u-clean-add-sensitive ctx (noent fopts)))))
+
 (defn u-make-options [ctx]
   (let [options (or (oget ctx :options) (vs/jm))
         custom-utils (vs/getprop options "utility")]
@@ -1137,9 +1404,28 @@
           ;; one of twenty hand-maintained copies of a schema nothing
           ;; cross-checked — so add it to the model instead.
           optspec @optspec-parsed
+          ;; The secret registry exists BEFORE validation, fed from the raw
+          ;; input, so the constructor's own rejection of a mistyped
+          ;; credential is clean too. A shallow merge over the schema
+          ;; defaults: the clean block is flat.
+          cleancfg (make-clean-config
+                    (let [out (vs/jm)]
+                      (doseq [src [(vs/getprop optspec "clean") (vs/getprop cfgopts "clean")
+                                   (vs/getprop opts0 "clean")]]
+                        (when (vs/ismap src)
+                          (doseq [k (vs/keysof src)] (.put ^java.util.Map out k (vs/getprop src k)))))
+                      out))
+          cleanctx (atom {:options (vs/jm "__derived__" (vs/jm "clean" cleancfg))})
+          _ (clean-add-options cleanctx (omit-keys opts0 ["clean"]))
+          _ (doseq [raw (concat (splitvalues (vs/getpath cfgopts "clean.values"))
+                                (splitvalues (vs/getpath opts0 "clean.values")))]
+              (u-clean-add cleanctx raw))
           sys-fetch (vs/getpath opts0 "system.fetch")
-          merged (vs/merge (vs/jt (vs/jm) cfgopts opts0))
-          validated (vs/validate merged optspec)
+          ;; Cloned: merge writes through the nested maps of what it reads.
+          merged (vs/merge (vs/jt (vs/jm) (vs/clone cfgopts) opts0))
+          validated (try (vs/validate merged optspec)
+                         (catch RuntimeException e
+                           (throw (RuntimeException. ^String (u-clean cleanctx (str (.getMessage e)))))))
           opts (if (vs/ismap validated) validated (vs/jm))
           ;; Restore the suppression the optspec default would otherwise erase.
           _ (when auth-suppressed (.put ^java.util.Map opts "auth" nil))
@@ -1179,10 +1465,7 @@
       (when sys-fetch
         (when (not (vs/ismap (vs/getprop opts "system"))) (.put ^java.util.Map opts "system" (vs/jm)))
         (.put ^java.util.Map (vs/getprop opts "system") "fetch" sys-fetch))
-      (let [clean-keys (let [k (vs/getpath opts "clean.keys")] (if (string? k) k "key,token,id"))
-            parts (->> (str/split clean-keys #",") (map str/trim) (remove empty?) (map vs/escre))
-            keyre (str/join "|" parts)
-            ;; Resolve the feature add-order: an explicit array order (above)
+      (let [;; Resolve the feature add-order: an explicit array order (above)
             ;; wins; otherwise order the map test-first, then the remaining
             ;; names sorted, so the outcome is deterministic and `test` is
             ;; always the base transport.
@@ -1195,9 +1478,10 @@
                 (when (some #(= % "test") names) (.add ^java.util.List order "test"))
                 (doseq [n names] (when (not= n "test") (.add ^java.util.List order n)))
                 order))
-            derived (vs/jm "clean" (if (empty? keyre) (vs/jm) (vs/jm "keyre" keyre))
-                           "featureorder" feature-order)]
+            derived (vs/jm "clean" cleancfg "featureorder" feature-order)]
         (.put ^java.util.Map opts "__derived__" derived)
+        ;; Again over the merged result: the config's own defaults can carry one.
+        (clean-add-options (atom {:options opts}) (omit-keys opts ["clean" "__derived__"]))
         opts))))
 
 ;; ---------------------------------------------------------------------------
@@ -1258,7 +1542,7 @@
 ;; ---------------------------------------------------------------------------
 
 (defn base-utility-map []
-  {:clean u-clean :done u-done :make-error u-make-error
+  {:clean u-clean :clean-add u-clean-add :done u-done :make-error u-make-error
    :feature-add feature-add :feature-hook feature-hook :feature-init feature-init
    :fetcher u-fetcher :make-fetch-def u-make-fetch-def :make-context (fn [cm bc] (make-context cm bc))
    :make-options u-make-options :make-request u-make-request :make-response u-make-response

package/project/.sdk/tm/clojure/src/sdk/features.clj

@@ -69,11 +69,24 @@
 
 (defn log-feature []
   (let [fa (new-feature "log" true "0.0.1")
+        ;; A log line leaves the pipeline, so it carries the cleaned record:
+        ;; the spec after auth holds the credential, and a logger serialises
+        ;; whatever it is handed. `logger` is a fn of the record, a map with
+        ;; an "info" fn, or anything else for the stderr default.
         loghook (fn [ctx hook]
-                  (when (:logger @fa)
-                    (let [opname (if (core/oget ctx :op) (core/op-name (core/oget ctx :op)) "")]
-                      (binding [*out* *err*]
-                        (println (str "[INFO] hook=" hook " op=" opname))))))]
+                  (when-let [logger (:logger @fa)]
+                    (let [opname (if (core/oget ctx :op) (core/op-name (core/oget ctx :op)) "")
+                          record (core/ucall ctx :clean
+                                             (vs/jm "hook" hook "op" opname
+                                                    "spec" (core/oget ctx :spec)
+                                                    "ctx" (core/ctx->data ctx)))]
+                      (cond
+                        (fn? logger) (logger record)
+                        (and (vs/ismap logger) (fn? (mget logger "info"))) ((mget logger "info") record)
+                        :else
+                        (binding [*out* *err*]
+                          (println (str "[INFO] hook=" hook " op=" opname " "
+                                        (vs/jsonify record (vs/jm "indent" 0)))))))))]
     (swap! fa assoc
            "init" (fn [ctx options]
                     (swap! fa assoc :client (core/oget ctx :client) :options options
@@ -779,10 +792,13 @@
                     (bump-bucket! (mget rec "ops") (str entity "." opname) amount)
                     (bump-bucket! (mget rec "actors") (str actor) amount)
                     (swap! fa update :seq (fnil inc 0))
-                    (.put ^java.util.Map rec "last"
-                          (vs/jm "seq" (:seq @fa) "entity" entity "op" opname "actor" (str actor)
-                                 "amount" amount "currency" (mget rec "currency")
-                                 "source" source "attempts" (mget p "attempts")))))
+                    (let [last (core/ucall ctx :clean
+                                           (vs/jm "seq" (:seq @fa) "entity" entity "op" opname "actor" (str actor)
+                                                  "amount" amount "currency" (mget rec "currency")
+                                                  "source" source "attempts" (mget p "attempts")))]
+                      (.put ^java.util.Map rec "last" last)
+                      (let [sink (opt fa "sink")]
+                        (when (fn? sink) (try (sink last) (catch Throwable _ nil)))))))
         finish! (fn [ctx done]
                   (when (active? fa)
                     (let [id (core/oget ctx :id) p (get (:pending @fa) id)]
@@ -910,9 +926,22 @@
                           (let [made (agent (:url @fa) url)]
                             (.put ^java.util.Map out "dispatcher" made)
                             (.put ^java.util.Map out "agent" made))))
-                      (let [t (track-ensure! fa "_proxy" (vs/jm "routed" 0 "url" (:url @fa)))]
+                      (let [t (track-ensure! fa "_proxy" (vs/jm "routed" 0 "url" (:clean-url @fa)))]
                         (.put ^java.util.Map t "routed" (inc (long (mget t "routed")))))
-                      out)))]
+                      out)))
+        ;; A proxy URL may carry credentials as userinfo, from the option or
+        ;; the environment, and neither is under a sensitive key name.
+        register-userinfo! (fn [ctx url]
+                             (when (string? url)
+                               (try
+                                 (let [ui (.getRawUserInfo (java.net.URI. ^String url))]
+                                   (when (and ui (seq ui))
+                                     (doseq [part (str/split ui #":" 2)]
+                                       (when (seq part)
+                                         (core/ucall ctx :clean-add part)
+                                         (try (core/ucall ctx :clean-add (java.net.URLDecoder/decode ^String part "UTF-8"))
+                                              (catch Throwable _ nil))))))
+                                 (catch Throwable _ nil))))]
     (swap! fa assoc
            "init" (fn [ctx options]
                     (swap! fa assoc :client (core/oget ctx :client)
@@ -928,7 +957,9 @@
                                                 (vs/islist no-proxy1) (vec no-proxy1)
                                                 :else [])
                                           (remove (fn [s] (or (nil? s) (= s "")))))]
-                        (swap! fa assoc :url url :no-proxy (vec no-proxy)))
+                        (register-userinfo! ctx url)
+                        (swap! fa assoc :url url :no-proxy (vec no-proxy)
+                               :clean-url (if (string? url) (core/ucall ctx :clean url) url)))
                       (wrap-fetcher! ctx (fn [fctx url fd inner] (inner fctx url (route url fd)))))))
     fa))
 
@@ -954,11 +985,12 @@
                     (.put ^java.util.Map span "end" (now-ms fa))
                     (.put ^java.util.Map span "durationMs" (max 0 (- (mget span "end") (mget span "start"))))
                     (.put ^java.util.Map span "ok" ok)
-                    (when-let [t (telem)]
-                      (.put ^java.util.Map t "active" (dec (long (mget t "active"))))
-                      (.add ^java.util.List (mget t "spans") span))
-                    (let [exporter (opt fa "exporter")]
-                      (when (fn? exporter) (try (exporter span) (catch Throwable _ nil)))))))]
+                    (let [out (core/ucall ctx :clean span)]
+                      (when-let [t (telem)]
+                        (.put ^java.util.Map t "active" (dec (long (mget t "active"))))
+                        (.add ^java.util.List (mget t "spans") out))
+                      (let [exporter (opt fa "exporter")]
+                        (when (fn? exporter) (try (exporter out) (catch Throwable _ nil))))))))]
     (swap! fa assoc :spans {} :seq 0)
     (swap! fa assoc
            "init" (fn [ctx options]
@@ -1043,19 +1075,18 @@
 ;; debug
 ;; ---------------------------------------------------------------------------
 
-(def REDACT-DEFAULT ["authorization" "cookie" "set-cookie" "api-key" "apikey" "x-api-key" "idempotency-key"])
-
 (defn debug-feature []
   (let [fa (new-feature "debug" false "0.0.1")
-        redact (fn [headers]
+        ;; The core clean rules apply (clean.keys, every registered value);
+        ;; the feature's own `redact` list ADDS header names on top of them.
+        redact (fn [ctx headers]
                  (if (nil? headers) (vs/jm)
-                     (let [patterns (or (opt fa "redact") REDACT-DEFAULT)
-                           pset (into #{} (map str (vec patterns)))
+                     (let [pset (into #{} (map (fn [p] (str/lower-case (str p))) (vec (or (opt fa "redact") []))))
                            out (vs/jm)]
                        (doseq [item (or (vs/items headers) [])]
                          (let [k (vs/getprop item 0) v (vs/getprop item 1)]
-                           (.put ^java.util.Map out k (if (contains? pset (str/lower-case (str k))) "<redacted>" v))))
-                       out)))
+                           (.put ^java.util.Map out k (if (contains? pset (str/lower-case (str k))) "[redacted]" v))))
+                       (core/ucall ctx :clean out))))
         finish (fn [ctx ok]
                  (let [entry (get (:entries @fa) ctx)]
                    (when entry
@@ -1065,12 +1096,18 @@
                        (.put ^java.util.Map entry "durationMs" (max 0 (- (now-ms fa) (mget entry "start"))))
                        (when (and (nil? (mget entry "status")) result)
                          (.put ^java.util.Map entry "status" (core/oget result :status)))
-                       (let [track (track-ensure! fa "_debug" (vs/jm "entries" (vs/jt)))
+                       ;; The whole entry leaves through the buffer and the
+                       ;; callback: the url and the error message can carry a
+                       ;; query credential the header mask above never saw.
+                       (let [entry (core/ucall ctx :clean entry)
+                             track (track-ensure! fa "_debug" (vs/jm "entries" (vs/jt)))
                              buf (mget track "entries")
                              max (opt fa "max" 100)]
                          (.add ^java.util.List buf entry)
                          (while (> (.size ^java.util.List buf) max) (.remove ^java.util.List buf 0))
-                         (let [on-entry (opt fa "on_entry")]
+                         ;; `onEntry` is the option spec's spelling; the
+                         ;; older `on_entry` is kept for callers that used it.
+                         (let [on-entry (or (opt fa "onEntry") (opt fa "on_entry"))]
                            (when (fn? on-entry) (try (on-entry entry) (catch Throwable _ nil)))))))))]
     (swap! fa assoc :entries {})
     (swap! fa assoc
@@ -1088,7 +1125,7 @@
                      method (when spec (core/oget spec :method))
                      headers (when spec (core/oget spec :headers))
                      entry (vs/jm "op" (str (if op (core/op-entity op) "_") "." (if op (core/op-name op) "_"))
-                                  "method" method "url" url "headers" (redact headers) "start" (now-ms fa)
+                                  "method" method "url" url "headers" (redact ctx headers) "start" (now-ms fa)
                                   "status" nil "ok" nil "durationMs" nil "error" nil)]
                  (swap! fa update :entries assoc ctx entry))))
            "PreResponse"
@@ -1125,10 +1162,11 @@
                  (swap! fa update :seq inc)
                  (let [op (core/oget ctx :op)
                        result (core/oget ctx :result)
-                       record (vs/jm "seq" (:seq @fa) "ts" (now-ms fa) "actor" (actor ctx)
-                                     "entity" (if op (core/op-entity op) "_") "op" (if op (core/op-name op) "_")
-                                     "outcome" outcome "status" (when result (core/oget result :status))
-                                     "correlationId" (core/oget ctx :id))
+                       record (core/ucall ctx :clean
+                                          (vs/jm "seq" (:seq @fa) "ts" (now-ms fa) "actor" (actor ctx)
+                                                 "entity" (if op (core/op-entity op) "_") "op" (if op (core/op-name op) "_")
+                                                 "outcome" outcome "status" (when result (core/oget result :status))
+                                                 "correlationId" (core/oget ctx :id)))
                        track (track-ensure! fa "_audit" (vs/jm "records" (vs/jt)))
                        recs (mget track "records")
                        max (opt fa "max" 1000)]

package/project/.sdk/tm/clojure/test/sdk/test/feature.clj

@@ -435,7 +435,9 @@
                     (let [entries (mget (h-track h "_debug") "entries")]
                       (t/is-eq (vs/size entries) 1 "capped")
                       (t/is-eq (count @seen) 2 "2 seen")
-                      (t/is-eq (mget (mget (nth @seen 0) "headers") "authorization") "<redacted>" "redacted")))))
+                      ;; Masked by the core clean rule (clean.keys), not a
+                      ;; feature list of its own.
+                      (t/is-eq (mget (mget (nth @seen 0) "headers") "authorization") "[redacted]" "redacted")))))
     (check "debug-captures-failures" "debug"
            (fn [] (when (feature-present? "netsim")
                     (let [h (make-harness [(fspec "netsim" "failTimes" 1 "failStatus" 500) (fspec "debug")])]
@@ -447,7 +449,7 @@
            (fn [] (let [h (make-harness [(fspec "debug" "now" (fn [] 7) "redact" (vs/jt "x-secret"))])]
                     (h-op h :headers (vs/jm "x-secret" "hide" "x-ok" "show"))
                     (let [entry (vs/getelem (mget (h-track h "_debug") "entries") 0)]
-                      (t/is-eq (mget (mget entry "headers") "x-secret") "<redacted>" "redacted")
+                      (t/is-eq (mget (mget entry "headers") "x-secret") "[redacted]" "redacted")
                       (t/is-eq (mget (mget entry "headers") "x-ok") "show" "shown")))))
 
     ;; ---- audit ----