@voxgig/sdkgen 4.32.1 → 4.34.0

package/project/.sdk/tm/clojure/test/sdk/test/pipeline.clj

@@ -269,34 +269,61 @@
                       (t/is-deep (vec (vs/getpath o "__derived__.featureorder")) ["cache" "retry"] "sorted")))))
 
       ;; ---- prepare-auth ----
-      (let [auth-ctx (fn [opts headers]
+      ;; The credential's container and name are this API's own, so the cases
+      ;; read them from a probe run. A nil probe means a public API. `basic`
+      ;; is false so an HTTP Basic SDK places the key as it is.
+      (let [auth-ctx (fn [opts spec]
                        (let [c (fake-client-opts opts)
                              ctx (core/make-context (vs/jm "client" c "utility" utility "opname" "load") nil)]
-                         (core/oset! ctx :spec (when headers (core/make-spec (vs/jm "headers" headers "step" "s"))))
-                         ctx))]
+                         (core/oset! ctx :spec spec)
+                         ctx))
+            auth (fn [prefix] (vs/jm "prefix" prefix "basic" false))
+            bags (fn [] (core/make-spec (vs/jm "headers" (vs/jm) "query" (vs/jm) "step" "s")))
+            bag (fn [spec where] (core/oget spec (if (= "query" where) :query :headers)))
+            ;; A cookie credential rides the header bag as `<scheme>=K`.
+            cookie-pair? (fn [v] (and (string? v) (some? (re-matches #"[^=;]+=K" v))))
+            probe (fn [opts]
+                    (let [spec (bags) ctx (auth-ctx opts spec)]
+                      ((core/uget ctx :prepare-auth) ctx)
+                      (some (fn [where]
+                              (when-let [name (first (vs/keysof (bag spec where)))]
+                                (let [value (mget (bag spec where) name)]
+                                  {:where where :name name :value value
+                                   :pair (if (and (= "headers" where) (= "cookie" name) (cookie-pair? value))
+                                           (subs value 0 (dec (count value))) "")})))
+                            ["headers" "query"])))
+            cred (probe (vs/jm "apikey" "K" "auth" (auth "Bearer")))
+            placed (fn [opts seed]
+                     (let [spec (bags)]
+                       (when (and cred seed)
+                         (.put ^java.util.Map (bag spec (:where cred)) (:name cred) (str (:pair cred) seed)))
+                       (let [ctx (auth-ctx opts spec)]
+                         ((core/uget ctx :prepare-auth) ctx)
+                         (when cred (mget (bag spec (:where cred)) (:name cred))))))]
         (chk "auth-guards-missing-spec"
-             (fn [] (let [ctx (auth-ctx (vs/jm "auth" (vs/jm "prefix" "") "apikey" "K") nil)]
+             (fn [] (let [ctx (auth-ctx (vs/jm "auth" (auth "") "apikey" "K") nil)]
                       (t/is-eq (:code (second ((core/uget ctx :prepare-auth) ctx))) "auth_no_spec" "no spec"))))
-        (chk "auth-apikey-with-prefix-space-joined"
-             (fn [] (let [ctx (auth-ctx (vs/jm "apikey" "K" "auth" (vs/jm "prefix" "Bearer")) (vs/jm))]
-                      ((core/uget ctx :prepare-auth) ctx)
-                      (t/is-eq (mget (core/oget (core/oget ctx :spec) :headers) "authorization") "Bearer K" "joined"))))
+        ;; Without this every case below could pass on the public-API path.
+        (chk "auth-probe-finds-the-credential"
+             (fn [] (t/is-eq (some? cred)
+                             (some? (probe (vs/jm "apikey" "K" "secret" "S"
+                                                  "auth" (vs/jm "prefix" "Bearer" "basic" true))))
+                             "probe")))
+        (chk "auth-apikey-placed-where-this-api-puts-it"
+             (fn [] (cond
+                      (nil? cred) (t/is-nil (placed (vs/jm "apikey" "K" "auth" (auth "Bearer")) nil) "public API")
+                      (not= "" (:pair cred)) (t/is-true (cookie-pair? (:value cred)) (str "cookie: " (:value cred)))
+                      ;; A query parameter has nowhere to put a scheme name.
+                      :else (t/is-eq (:value cred) (if (= "query" (:where cred)) "K" "Bearer K") "placed"))))
         (chk "auth-raw-apikey"
-             (fn [] (let [ctx (auth-ctx (vs/jm "apikey" "K" "auth" (vs/jm "prefix" "")) (vs/jm))]
-                      ((core/uget ctx :prepare-auth) ctx)
-                      (t/is-eq (mget (core/oget (core/oget ctx :spec) :headers) "authorization") "K" "raw"))))
+             (fn [] (t/is-eq (placed (vs/jm "apikey" "K" "auth" (auth "")) nil)
+                             (when cred (str (:pair cred) "K")) "raw")))
         (chk "auth-empty-apikey-drops"
-             (fn [] (let [ctx (auth-ctx (vs/jm "apikey" "" "auth" (vs/jm "prefix" "Bearer")) (vs/jm "authorization" "stale"))]
-                      ((core/uget ctx :prepare-auth) ctx)
-                      (t/is-nil (mget (core/oget (core/oget ctx :spec) :headers) "authorization") "dropped"))))
+             (fn [] (t/is-nil (placed (vs/jm "apikey" "" "auth" (auth "Bearer")) "stale") "dropped")))
         (chk "auth-public-api-drops"
-             (fn [] (let [ctx (auth-ctx (vs/jm "apikey" "K") (vs/jm "authorization" "stale"))]
-                      ((core/uget ctx :prepare-auth) ctx)
-                      (t/is-nil (mget (core/oget (core/oget ctx :spec) :headers) "authorization") "dropped"))))
+             (fn [] (t/is-nil (placed (vs/jm "apikey" "K") "stale") "dropped")))
         (chk "auth-missing-apikey-drops"
-             (fn [] (let [ctx (auth-ctx (vs/jm "auth" (vs/jm "prefix" "Bearer")) (vs/jm "authorization" "stale"))]
-                      ((core/uget ctx :prepare-auth) ctx)
-                      (t/is-nil (mget (core/oget (core/oget ctx :spec) :headers) "authorization") "dropped")))))
+             (fn [] (t/is-nil (placed (vs/jm "auth" (auth "Bearer")) "stale") "dropped"))))
 
       ;; ---- result helpers ----
       (chk "result-headers-non-hash-empty"

package/project/.sdk/tm/clojure/test/sdk/test_runner.clj

@@ -10,6 +10,7 @@
             [sdk.test.netsim :as netsim]
             [sdk.test.struct-corpus :as corpus]
             [sdk.test.omni-smoke :as omnismoke]
+            [sdk.test.clean :as clean]
             [sdk.gentest :as gentest]
             [clojure.java.io :as io]))
 
@@ -111,6 +112,9 @@
     (run-feature-suites rec)
     (netsim/run rec)
     (gentest/run rec)
+    ;; The canary sweep (generated: sdk/test/clean.clj) prints its own
+    ;; `clean: swept N surface(s), M leak(s)` line, which sdkgen's lane reads.
+    (clean/run rec)
     (let [fails (filter (complement :ok) @results)
           np (count (filter :ok @results))
           nf (count fails)]

package/project/.sdk/tm/cpp/core/types.hpp

@@ -14,6 +14,7 @@
 #include <functional>
 #include <map>
 #include <memory>
+#include <ostream>
 #include <stdexcept>
 #include <string>
 #include <vector>
@@ -80,17 +81,42 @@ public:
   std::string sdk = "ProjectName";
   std::string code;
   std::string msg;
+  // Reachable for a debugger, never printed: the context holds the live
+  // spec and options, and an error is what gets logged (ADR-003).
   Context* ctx = nullptr;
-  ResultPtr result_obj;
-  SpecPtr spec_obj;
+  int status = -1;
+  // Masked plain-data copies, never the live Result/Spec: masking them can
+  // never mask the pipeline's own request.
+  Value result = Value::undef();
+  Value spec = Value::undef();
 
   SdkError(const std::string& code_, const std::string& msg_, Context* ctx_)
       : std::runtime_error(msg_), code(code_), msg(msg_), ctx(ctx_) {}
 
   const char* what() const noexcept override { return msg.c_str(); }
   const std::string& getMessage() const { return msg; }
+  bool notFound() const { return 404 == status; }
+
+  // What makeError attached is already cleaned; the context is not part of
+  // the record.
+  Value toValue() const {
+    Value o = vmap();
+    map_put(o, "sdk", Value(sdk));
+    map_put(o, "code", Value(code));
+    map_put(o, "message", Value(msg));
+    map_put(o, "status", Value(status));
+    if (!result.is_undef()) map_put(o, "result", result);
+    if (!spec.is_undef()) map_put(o, "spec", spec);
+    return o;
+  }
+
+  std::string to_string() const { return sdk + "Error " + vs::jsonify(toValue(), 0); }
 };
 
+inline std::ostream& operator<<(std::ostream& os, const SdkError& err) {
+  return os << err.to_string();
+}
+
 // ---- Control ----------------------------------------------------------
 
 class Control {
@@ -461,15 +487,28 @@ public:
 
   SdkErrorPtr makeError(const std::string& code, const std::string& msg);
 
+  // The raw record, for the pipeline's own use.
+  Value toValue() const;
+
+  // The serialised context leaves the pipeline (a logger, an error dump), so
+  // it is cleaned; the live fields stay raw.
+  std::string to_string() const;
+
 private:
   OperationPtr resolveOp(const std::string& opname);
 };
 
+inline std::ostream& operator<<(std::ostream& os, const Context& ctx) {
+  return os << ctx.to_string();
+}
+
 // ---- Utility (swappable pipeline function bundle) ---------------------
 
 class Utility {
 public:
   std::function<Value(CtxPtr, const Value&)> clean;
+  std::function<void(CtxPtr, const Value&)> cleanAdd;
+  std::function<void(CtxPtr)> cleanExplain;
   std::function<Value(CtxPtr)> done;
   std::function<Value(CtxPtr, SdkErrorPtr)> makeError;
   std::function<void(CtxPtr, FeaturePtr)> featureAdd;
@@ -512,6 +551,8 @@ public:
   UtilityPtr copy() const {
     auto u = std::shared_ptr<Utility>(new Utility(NoRegister{}));
     u->clean = clean;
+    u->cleanAdd = cleanAdd;
+    u->cleanExplain = cleanExplain;
     u->done = done;
     u->makeError = makeError;
     u->featureAdd = featureAdd;
@@ -569,6 +610,9 @@ public:
   UtilityPtr getUtility();
   CtxPtr getRootCtx() { return rootctx; }
 
+  // The options hold the credential; the printed client names itself only.
+  std::string to_string() const { return "ProjectNameSDK{mode=" + mode + "}"; }
+
   Value prepare(const Value& fetchargs);
   Value direct(const Value& fetchargs);
   Value graphql(const std::string& query, const Value& variables = Value::undef(),
@@ -584,6 +628,10 @@ public:
   static Value testOptions(const Value& testopts, const Value& sdkopts);
 };
 
+inline std::ostream& operator<<(std::ostream& os, const SdkClient& client) {
+  return os << client.to_string();
+}
+
 // ---- SdkEntity contract -----------------------------------------------
 
 class SdkEntity;
@@ -782,6 +830,40 @@ inline SdkErrorPtr Context::makeError(const std::string& code, const std::string
   return std::make_shared<SdkError>(code, msg, this);
 }
 
+inline Value Context::toValue() const {
+  Value o = vmap();
+  map_put(o, "id", Value(id));
+  if (op) {
+    map_put(o, "op", vmap({{"entity", Value(op->entity)}, {"name", Value(op->name)},
+                           {"input", Value(op->input)}}));
+  }
+  if (spec) map_put(o, "spec", spec->toValue());
+  if (entity) map_put(o, "entity", Value(entity->getName()));
+  if (result) map_put(o, "result", result->toValue());
+  if (response) {
+    Value r = vmap();
+    map_put(r, "status", Value(response->status));
+    map_put(r, "statusText", Value(response->statusText));
+    if (response->headers.is_map()) map_put(r, "headers", response->headers);
+    if (!response->body.is_undef()) map_put(r, "body", response->body);
+    if (response->err) map_put(r, "err", vmap({{"message", Value(response->err->msg)}}));
+    map_put(o, "response", r);
+  }
+  if (meta.is_map()) map_put(o, "meta", meta);
+  return o;
+}
+
+inline std::string Context::to_string() const {
+  Value record = toValue();
+  if (utility && utility->clean) {
+    // clean takes the context by shared pointer; the record is what it reads
+    // the configuration from, so a non-owning alias is enough here.
+    CtxPtr self(const_cast<Context*>(this), [](Context*) {});
+    record = utility->clean(self, record);
+  }
+  return "Context " + vs::jsonify(record, 0);
+}
+
 // ---- SdkClient ----
 inline SdkClient::SdkClient(const Value& options_) {
   utility = std::make_shared<Utility>();
@@ -1012,7 +1094,7 @@ inline Value SdkClient::rawRequest(const Value& fetchargs_) {
     fetched = u->fetcher(ctx, url.is_string() ? url.as_string() : "", fetchdef);
   } catch (const SdkErrorPtr& err) {
     map_put(out, "ok", Value(false));
-    map_put(out, "err", vmap({{"message", Value(err->msg)}}));
+    map_put(out, "err", vmap({{"message", u->clean(ctx, Value(err->msg))}}));
     return out;
   }
 
@@ -1138,6 +1220,9 @@ inline Value EntityBase::runOp(CtxPtr ctx, const std::function<void()>& postDone
   } catch (const SdkErrorPtr& err) {
     if (ctx->ctrl->err && err == ctx->ctrl->err) throw;
     return u->makeError(ctx, err);
+  } catch (const std::exception& e) {
+    // An exception a hook threw never passed through makeError.
+    return u->makeError(ctx, ctx->makeError("unexpected", e.what()));
   }
 }
 
@@ -1197,6 +1282,8 @@ inline std::vector<Value> EntityBase::stream(const std::string& action,
     // back to the materialised items so stream always yields.
     ResultPtr res = ctx->result;
     if (res && res->stream) {
+      // done() does not run on this path, so its record is cleaned here.
+      u->cleanExplain(ctx);
       return res->stream();
     }
 
@@ -1212,6 +1299,9 @@ inline std::vector<Value> EntityBase::stream(const std::string& action,
     if (ctx->ctrl->err && err == ctx->ctrl->err) throw;
     u->makeError(ctx, err);
     return std::vector<Value>();
+  } catch (const std::exception& e) {
+    u->makeError(ctx, ctx->makeError("unexpected", e.what()));
+    return std::vector<Value>();
   }
 }
 

package/project/.sdk/tm/cpp/feature/audit.hpp

@@ -87,6 +87,7 @@ private:
     if (ctx->result) {
       map_put(record, "status", Value(ctx->result->status));
     }
+    record = ctx->utility->clean(ctx, record);
 
     records.as_list()->push_back(record);
     int max = fopt::foptInt(options, "max", 1000);

package/project/.sdk/tm/cpp/feature/cost.hpp

@@ -223,6 +223,7 @@ private:
     map_put(record, "currency", Value(currency));
     map_put(record, "source", Value(source));
     map_put(record, "attempts", Value(p.attempts));
+    record = ctx->utility->clean(ctx, record);
     last = record;
 
     Value sink = getp(options, "sink");

package/project/.sdk/tm/cpp/feature/debug.hpp

@@ -1,10 +1,11 @@
 // ProjectName SDK — debug feature (mirrors java feature/DebugFeature.java).
 // Request/response capture for debugging. Records a bounded ring buffer of
 // per-operation traces — method, URL, redacted headers, response status and
-// timing — on the feature's entries. Sensitive header values (matching
-// `redact`) are masked. An optional `onEntry` callback receives each finished
-// entry. `max` caps the buffer (default 100). The per-context entry marker
-// (java ctx.out) is kept here keyed by ctx.id.
+// timing — on the feature's entries. The SDK's own clean rules apply to the
+// whole entry; the `redact` option ADDS header names on top of them. An
+// optional `onEntry` callback receives each finished entry. `max` caps the
+// buffer (default 100). The per-context entry marker (java ctx.out) is kept
+// here keyed by ctx.id.
 
 #ifndef SDK_FEATURE_DEBUG_HPP
 #define SDK_FEATURE_DEBUG_HPP
@@ -56,7 +57,7 @@ public:
       } else {
         map_put(entry, "url", Value(ctx->spec->path));
       }
-      map_put(entry, "headers", redact(ctx->spec->headers));
+      map_put(entry, "headers", redact(ctx, ctx->spec->headers));
     }
     pending[ctx->id] = entry;
   }
@@ -110,6 +111,11 @@ private:
       map_put(entry, "status", Value(ctx->result->status));
     }
 
+    // The whole entry leaves through the buffer and the callback: the url
+    // and the error message can carry a query credential the header mask
+    // above never saw.
+    entry = ctx->utility->clean(ctx, entry);
+
     entries.as_list()->push_back(entry);
     int max = fopt::foptInt(options, "max", 100);
     while ((int) entries.as_list()->size() > max) {
@@ -123,14 +129,16 @@ private:
     }
   }
 
-  Value redact(const Value& headers) {
+  // The core clean rules apply (clean.keys, every registered value); the
+  // feature's own `redact` list ADDS header names on top of them.
+  Value redact(CtxPtr ctx, const Value& headers) {
     Value out = vmap();
     if (!headers.is_map()) return out;
 
-    std::vector<std::string> patterns = fopt::foptStrList(options, "redact");
-    if (!fopt::foptList(options, "redact").is_list()) {
-      patterns = {"authorization", "cookie", "set-cookie", "api-key",
-                  "apikey", "x-api-key", "idempotency-key"};
+    std::vector<std::string> patterns;
+    for (std::string p : fopt::foptStrList(options, "redact")) {
+      for (auto& c : p) c = static_cast<char>(std::tolower((unsigned char)c));
+      patterns.push_back(p);
     }
     for (const auto& kv : *headers.as_map()) {
       std::string lk = kv.first;
@@ -143,12 +151,12 @@ private:
         }
       }
       if (masked) {
-        map_put(out, kv.first, Value("<redacted>"));
+        map_put(out, kv.first, Value("[redacted]"));
       } else {
         map_put(out, kv.first, kv.second);
       }
     }
-    return out;
+    return ctx->utility->clean(ctx, out);
   }
 };
 

package/project/.sdk/tm/cpp/feature/log.hpp

@@ -1,9 +1,10 @@
 // ProjectName SDK — log feature (mirrors java feature/LogFeature.java).
 // Hook logging. The java donor uses java.util.logging; the C++ target has no
 // such facility, so this emits the same "hook=… op=… spec=…" lines to
-// std::cerr, gated by a level threshold. Active by default (like the java
-// donor: the constructor sets active=true and init only overrides it when
-// options.active is an explicit boolean).
+// std::cerr, gated by a level threshold, unless the `logger` option names a
+// callable, which then receives [level, record] for every line instead.
+// Active by default (like the java donor: the constructor sets active=true
+// and init only overrides it when options.active is an explicit boolean).
 
 #ifndef SDK_FEATURE_LOG_HPP
 #define SDK_FEATURE_LOG_HPP
@@ -36,6 +37,7 @@ public:
 
     if (active) {
       hasLogger = true;
+      logger = getp(options, "logger");
       Value lvl = getp(options, "level");
       if (lvl.is_string()) {
         std::string s = lvl.as_string();
@@ -62,15 +64,16 @@ public:
   void preResult(CtxPtr ctx) override { loghook("PreResult", ctx, ""); }
 
 private:
+  Value logger = Value::undef();
+
+  // A log line leaves the pipeline, so it carries the cleaned record: the
+  // spec after auth holds the credential, and a logger serialises whatever
+  // it is handed.
   void loghook(const std::string& hook, CtxPtr ctx, std::string level) {
     if (!hasLogger) return;
 
     if (level.empty()) level = "info";
 
-    std::string msg = "hook=" + hook;
-    if (ctx->op) msg += " op=" + ctx->op->name;
-    if (ctx->spec) msg += " spec=" + ctx->spec->method + " " + ctx->spec->path;
-
     // The per-call level (always "info" here) is emitted iff it clears the
     // configured threshold (mirrors Logger.info() vs Logger.setLevel()).
     int callLevel = 800;
@@ -79,9 +82,28 @@ private:
     else if (level == "warn") { callLevel = 900; tag = "WARNING"; }
     else if (level == "error") { callLevel = 1000; tag = "SEVERE"; }
 
-    if (callLevel >= levelThreshold) {
-      std::cerr << "ProjectNameSDK.log " << tag << ": " << msg << "\n";
+    if (callLevel < levelThreshold) return;
+
+    Value record = vmap();
+    map_put(record, "hook", Value(hook));
+    if (ctx->op) map_put(record, "op", Value(ctx->op->name));
+    if (ctx->spec) map_put(record, "spec", ctx->spec->toValue());
+    map_put(record, "ctx", ctx->toValue());
+    record = ctx->utility->clean(ctx, record);
+
+    if (logger.is_injector()) {
+      vs::Injection inj(Value::undef(), Value::undef());
+      logger.as_injector()(inj, vlist({Value(level), record}), std::string(""), Value::undef());
+      return;
+    }
+
+    std::string msg = "hook=" + hook;
+    if (ctx->op) msg += " op=" + ctx->op->name;
+    if (ctx->spec) {
+      Value spec = getp(record, "spec");
+      msg += " spec=" + as_str(getp(spec, "method")) + " " + as_str(getp(spec, "path"));
     }
+    std::cerr << "ProjectNameSDK.log " << tag << ": " << msg << "\n";
   }
 };
 

package/project/.sdk/tm/cpp/feature/proxy.hpp

@@ -8,6 +8,7 @@
 #ifndef SDK_FEATURE_PROXY_HPP
 #define SDK_FEATURE_PROXY_HPP
 
+#include <cctype>
 #include <cstdlib>
 #include <initializer_list>
 #include <regex>
@@ -26,7 +27,9 @@ public:
   Value options = Value::undef();
   std::vector<std::string> noProxy;
 
-  // Activity tracking (mirrors the ts client._proxy record).
+  // Activity tracking (mirrors the ts client._proxy record). `url` is the
+  // CLEANED target: the raw one, userinfo included, stays in target_ for
+  // routing.
   int routed = 0;
   std::string url = "";
 
@@ -38,13 +41,13 @@ public:
     active = fopt::foptBool(options, "active", false);
     if (!active) return;
 
-    url = fopt::foptStr(options, "url", "");
+    target_ = fopt::foptStr(options, "url", "");
     bool hasNoProxy = fopt::foptList(options, "noProxy").is_list();
     std::vector<std::string> noProxyRaw = fopt::foptStrList(options, "noProxy");
 
     if (fopt::foptBool(options, "fromEnv", false)) {
-      if (url.empty()) {
-        url = firstEnv({"HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"});
+      if (target_.empty()) {
+        target_ = firstEnv({"HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"});
       }
       if (!hasNoProxy) {
         std::string np = firstEnv({"NO_PROXY", "no_proxy"});
@@ -63,6 +66,15 @@ public:
       }
     }
 
+    // A proxy URL may carry credentials as userinfo, from the option or the
+    // environment, and neither is under a sensitive key name.
+    for (const auto& part : userinfo(target_)) {
+      ctx->utility->cleanAdd(ctx, Value(part));
+      ctx->utility->cleanAdd(ctx, Value(percentDecode(part)));
+    }
+    Value shown = ctx->utility->clean(ctx, Value(target_));
+    url = shown.is_string() ? shown.as_string() : "";
+
     auto inner = ctx->utility->fetcher;
     ctx->utility->fetcher = [this, inner](CtxPtr ctx2, const std::string& u,
                                           const Value& fetchdef) -> Value {
@@ -71,8 +83,10 @@ public:
   }
 
 private:
+  std::string target_ = "";
+
   Value route(const std::string& u, const Value& fetchdef) {
-    if (url.empty() || bypass(u)) {
+    if (target_.empty() || bypass(u)) {
       return fetchdef;
     }
 
@@ -81,12 +95,44 @@ private:
     if (fetchdef.is_map()) {
       for (const auto& kv : *fetchdef.as_map()) map_put(out, kv.first, kv.second);
     }
-    map_put(out, "proxy", Value(url));
+    map_put(out, "proxy", Value(target_));
 
     routed++;
     return out;
   }
 
+  // The username and password of `scheme://user:pass@host...`, raw.
+  static std::vector<std::string> userinfo(const std::string& u) {
+    std::vector<std::string> out;
+    size_t scheme = u.find("://");
+    size_t start = std::string::npos == scheme ? 0 : scheme + 3;
+    size_t end = u.find_first_of("/?#", start);
+    std::string authority = u.substr(start, std::string::npos == end ? std::string::npos : end - start);
+    size_t at = authority.rfind('@');
+    if (std::string::npos == at) return out;
+    std::string info = authority.substr(0, at);
+    size_t colon = info.find(':');
+    std::string user = std::string::npos == colon ? info : info.substr(0, colon);
+    std::string pass = std::string::npos == colon ? "" : info.substr(colon + 1);
+    if (!user.empty()) out.push_back(user);
+    if (!pass.empty()) out.push_back(pass);
+    return out;
+  }
+
+  static std::string percentDecode(const std::string& s) {
+    std::string out;
+    for (size_t i = 0; i < s.size(); i++) {
+      if ('%' == s[i] && i + 2 < s.size() && std::isxdigit((unsigned char)s[i + 1]) &&
+          std::isxdigit((unsigned char)s[i + 2])) {
+        out.push_back(static_cast<char>(std::stoi(s.substr(i + 1, 2), nullptr, 16)));
+        i += 2;
+      } else {
+        out.push_back(s[i]);
+      }
+    }
+    return out;
+  }
+
   bool bypass(const std::string& u) {
     if (noProxy.empty()) return false;
     std::string host = u;

package/project/.sdk/tm/cpp/feature/secrets.hpp

@@ -264,6 +264,7 @@ public:
     std::vector<sekreto::ProviderSpec> specs;
 
     if (!explicitcred.empty()) {
+      registerSecret(explicitcred);
       try {
         std::string key = sekreto::envkey(secretname_, "");
         sekreto::ProviderSpec seat;
@@ -426,6 +427,15 @@ private:
     if (initerr_.empty()) initerr_ = msg;
   }
 
+  // Every value this feature resolves or buys is a secret the SDK handles,
+  // and none arrives under an option key the intake registration saw.
+  void registerSecret(const std::string& value) {
+    CtxPtr ctx = nullptr == client ? nullptr : client->rootctx;
+    if (ctx && ctx->utility && ctx->utility->cleanAdd) {
+      ctx->utility->cleanAdd(ctx, Value(value));
+    }
+  }
+
   // ---- options map -> sekreto ------------------------------------------------
 
   // An SDK Value as the plugin value model sekreto::specof reads. `values`
@@ -524,6 +534,7 @@ private:
     // required server variable, for the same reason.
     if (nullptr == client || "live" != client->mode) {
       cred_ = "test-" + x.response;
+      registerSecret(cred_);
       track_.buys++;
       return "";
     }
@@ -599,6 +610,7 @@ private:
     }
 
     cred_ = token.as_string();
+    registerSecret(cred_);
     track_.buys++;
     return "";
   }
@@ -630,6 +642,7 @@ private:
       return e.what();
     }
     track_.resolves++;
+    if (found.has_value()) registerSecret(found.value());
 
     if (!exchange_) {
       // A hit is the credential. An UNCACHED miss after an earlier hit is a

package/project/.sdk/tm/cpp/feature/telemetry.hpp

@@ -106,13 +106,15 @@ private:
     map_put(span, "durationMs", Value(dur));
     map_put(span, "ok", Value(ok));
 
+    Value out = ctx->utility->clean(ctx, span);
+
     activeSpans--;
-    spans.as_list()->push_back(span);
+    spans.as_list()->push_back(out);
 
     Value exporter = getp(options, "exporter");
     if (exporter.is_injector()) {
       vs::Injection inj(Value::undef(), Value::undef());
-      exporter.as_injector()(inj, vlist({span}), std::string(""), Value::undef());
+      exporter.as_injector()(inj, vlist({out}), std::string(""), Value::undef());
     }
   }
 

package/project/.sdk/tm/cpp/test/feature_test.cpp

@@ -563,7 +563,7 @@ static void debug_redactsAndHonoursOnEntryMax() {
   ASSERT_EQ((int)f->entries.as_list()->size(), 1, "expected ring buffer capped at 1");
   ASSERT_EQ((int)seen.as_list()->size(), 2, "expected onEntry for both ops");
   Value headers = getp((*seen.as_list())[0], "headers");
-  ASSERT_EQ_VAL(getp(headers, "authorization"), Value("<redacted>"), "expected redacted authorization");
+  ASSERT_EQ_VAL(getp(headers, "authorization"), Value("[redacted]"), "expected redacted authorization");
 }
 
 static void debug_capturesFailures() {
@@ -584,7 +584,7 @@ static void debug_injectedClockAndCustomRedact() {
   auto h = fhMake(nullptr, {FF(f, fhMap({{"now", clock.nowFn()}, {"redact", vlist({Value("x-secret")})}}))});
   h->op(fhOp("load").setHeaders(fhMap({{"x-secret", Value("hide")}, {"x-ok", Value("show")}})));
   Value headers = getp((*f->entries.as_list())[0], "headers");
-  ASSERT_EQ_VAL(getp(headers, "x-secret"), Value("<redacted>"), "expected x-secret redacted");
+  ASSERT_EQ_VAL(getp(headers, "x-secret"), Value("[redacted]"), "expected x-secret redacted");
   ASSERT_EQ_VAL(getp(headers, "x-ok"), Value("show"), "expected x-ok kept");
 }