@voxgig/sdkgen 4.32.1 → 4.34.0

package/project/.sdk/tm/py/pkg/utility/make_error.py

@@ -46,20 +46,23 @@ def make_error_util(ctx, err):
 
     spec = ctx.spec
 
-    if ctx.ctrl.explain is not None:
-        ctx.ctrl.explain["err"] = {"message": msg}
+    sdk_err = ProjectNameError(
+        err.code if isinstance(err, ProjectNameError) else "", msg, ctx)
 
-    sdk_err = ProjectNameError("", msg, ctx)
+    # The context stays reachable for a debugger (a slot on the error), and
+    # the error itself is cleaned in place; result and spec are cleaned
+    # COPIES, so masking them cannot mask the pipeline's own objects.
+    ctx.utility.clean(ctx, sdk_err)
     sdk_err.result = ctx.utility.clean(ctx, result)
     sdk_err.spec = ctx.utility.clean(ctx, spec)
 
+    if ctx.ctrl.explain is not None:
+        ctx.ctrl.explain["err"] = {"message": msg}
+
     # Promote the HTTP status to the top level, so a consumer can branch on
     # `err.status` / `err.not_found` instead of reaching into `err.result`.
     sdk_err.status = -1 if result.status is None else result.status
 
-    if isinstance(err, ProjectNameError):
-        sdk_err.code = err.code
-
     ctx.ctrl.err = sdk_err
 
     # Fire PreUnexpected so observability features (metrics, telemetry, audit,

package/project/.sdk/tm/py/pkg/utility/make_options.py

@@ -3,6 +3,15 @@
 from __future__ import annotations
 from projectname_sdk.utility.voxgig_struct import voxgig_struct as vs
 from projectname_sdk.schema import OPTSPEC
+from projectname_sdk.utility.clean import (
+    clean_util, clean_add_util, clean_add_sensitive, make_clean_config, split_values)
+
+
+# A context carrying only the derived clean block, for the registry that
+# exists before the real options do.
+class _CleanCtx:
+    def __init__(self, cleancfg):
+        self.options = {"__derived__": {"clean": cleancfg}}
 
 
 
@@ -83,6 +92,24 @@ def make_options_util(ctx):
     if not isinstance(opts, dict):
         opts = {}
 
+    config = ctx.config or {}
+    cfgopts = {}
+    co = config.get("options") if isinstance(config, dict) else None
+    if isinstance(co, dict):
+        cfgopts = co
+
+    # The secret registry exists BEFORE validation, fed from the raw input,
+    # so the constructor's own rejection of a mistyped credential is clean
+    # too.
+    cfgclean = cfgopts.get("clean") if isinstance(cfgopts.get("clean"), dict) else {}
+    rawclean = opts.get("clean") if isinstance(opts.get("clean"), dict) else {}
+    cleancfg = make_clean_config(vs.merge([
+        {}, vs.clone(OPTSPEC.get("clean")), vs.clone(cfgclean), rawclean]))
+    cleanctx = _CleanCtx(cleancfg)
+    _clean_add_options(cleanctx, {k: v for k, v in opts.items() if k != "clean"})
+    for raw in split_values(cfgclean.get("values")) + split_values(rawclean.get("values")):
+        clean_add_util(cleanctx, raw)
+
     if authsuppressed:
         opts.pop("auth", None)
 
@@ -106,12 +133,6 @@ def make_options_util(ctx):
             featureorder.append(name)
         opts["feature"] = fmap
 
-    config = ctx.config or {}
-    cfgopts = {}
-    co = config.get("options") if isinstance(config, dict) else None
-    if isinstance(co, dict):
-        cfgopts = co
-
     # THE OPTION SPEC IS GENERATED, NOT WRITTEN HERE.
     #
     # `schema.OPTSPEC` is built from the model: `main.kit.optspec` for the
@@ -134,7 +155,12 @@ def make_options_util(ctx):
     # nested dicts as merge TARGETS — one instance's options (server, headers,
     # ...) would contaminate every instance constructed after it.
     merged = vs.merge([{}, vs.clone(cfgopts), opts])
-    validated = vs.validate(merged, optspec)
+    try:
+        validated = vs.validate(merged, optspec)
+    except Exception as err:
+        # The message quotes the offending value.
+        clean_util(cleanctx, err)
+        raise
     if not isinstance(validated, dict):
         validated = {}
     opts = validated
@@ -185,19 +211,6 @@ def make_options_util(ctx):
         else:
             opts["system"] = {"fetch": sys_fetch}
 
-    # Derived clean config.
-    clean_keys = "key,token,id"
-    ck = vs.getpath(opts, "clean.keys")
-    if isinstance(ck, str):
-        clean_keys = ck
-
-    parts = []
-    for part in clean_keys.split(","):
-        trimmed = part.strip()
-        if trimmed != "":
-            parts.append(vs.escre(trimmed))
-    keyre = "|".join(parts)
-
     # Resolve the feature add-order: an explicit list order (above) wins;
     # otherwise order the map test-first, then the remaining names sorted, so
     # the outcome is deterministic and `test` is always the base transport.
@@ -219,10 +232,36 @@ def make_options_util(ctx):
             at = featureorder.index("test") + 1 if "test" in featureorder else 0
             featureorder.insert(at, "station")
 
-    derived = {"clean": {}}
-    if keyre != "":
-        derived["clean"] = {"keyre": keyre}
-    derived["featureorder"] = featureorder
-    opts["__derived__"] = derived
+    # The clean block stays MUTABLE: features register what they resolve
+    # after construction.
+    opts["__derived__"] = {
+        "clean": cleancfg,
+        "featureorder": featureorder,
+    }
+
+    # Again over the merged result: the config's own defaults can carry one.
+    _clean_add_options(cleanctx, {
+        k: v for k, v in opts.items() if k not in ("clean", "__derived__")})
 
     return opts
+
+
+# A feature's name is not a field name: only the sensitive names inside its
+# settings count, so `secrets` does not make every setting a secret. Entity
+# blocks (per-entity settings, seeded records) hold no credential.
+def _clean_add_options(cleanctx, opts):
+    top = {k: v for k, v in opts.items() if k not in ("feature", "entity")}
+    if "test" in top:
+        top["test"] = _no_entity(top["test"])
+    clean_add_sensitive(cleanctx, top)
+    feature = opts.get("feature")
+    blocks = feature.values() if isinstance(feature, dict) else (
+        feature if isinstance(feature, list) else [feature])
+    for fopts in blocks:
+        clean_add_sensitive(cleanctx, _no_entity(fopts))
+
+
+def _no_entity(block):
+    if isinstance(block, dict):
+        return {k: v for k, v in block.items() if k != "entity"}
+    return block

package/project/.sdk/tm/py/pkg/utility/make_response.py

@@ -26,19 +26,25 @@ def make_response_util(ctx):
 
     spec.step = "response"
 
-    utility.result_basic(ctx)
-    utility.result_headers(ctx)
-    utility.result_body(ctx)
-
-    # GraphQL reports failures as a top-level `errors` array under HTTP
-    # 200, so result_basic's status check never sees them. Lift them here,
-    # before the response transform tries to unwrap data that is not there.
-    utility.graphql_errors(ctx)
-
-    utility.transform_response(ctx)
-
-    if result.err is None:
-        result.ok = True
+    # A body that is not what it claims (a `json` thunk that raises) is a
+    # failed result, not a raw exception out of the pipeline - as in ts.
+    try:
+        utility.result_basic(ctx)
+        utility.result_headers(ctx)
+        utility.result_body(ctx)
+
+        # GraphQL reports failures as a top-level `errors` array under HTTP
+        # 200, so result_basic's status check never sees them. Lift them
+        # here, before the response transform tries to unwrap data that is
+        # not there.
+        utility.graphql_errors(ctx)
+
+        utility.transform_response(ctx)
+
+        if result.err is None:
+            result.ok = True
+    except Exception as err:
+        result.err = err
 
     if ctx.ctrl.explain is not None:
         ctx.ctrl.explain["result"] = result

package/project/.sdk/tm/py/pkg/utility/register.py

@@ -2,8 +2,8 @@
 
 from projectname_sdk.core.utility_type import ProjectNameUtility
 
-from projectname_sdk.utility.clean import clean_util
-from projectname_sdk.utility.done import done_util
+from projectname_sdk.utility.clean import clean_util, clean_add_util
+from projectname_sdk.utility.done import done_util, clean_explain_util
 from projectname_sdk.utility.make_error import make_error_util
 from projectname_sdk.utility.feature_add import feature_add_util
 from projectname_sdk.utility.feature_hook import feature_hook_util
@@ -36,6 +36,8 @@ from projectname_sdk.utility.transform_response import transform_response_util
 
 def register_all(u):
     u.clean = clean_util
+    u.clean_add = clean_add_util
+    u.clean_explain = clean_explain_util
     u.done = done_util
     u.make_error = make_error_util
     u.feature_add = feature_add_util

package/project/.sdk/tm/py/test/feature_harness.py

@@ -20,6 +20,7 @@ from projectname_sdk.core.control import ProjectNameControl
 from projectname_sdk.core.error import ProjectNameError
 from projectname_sdk.core.result import ProjectNameResult
 from projectname_sdk.core.spec import ProjectNameSpec
+from projectname_sdk.utility.clean import clean_util, clean_add_util
 
 
 # True when this SDK was generated with the named feature.
@@ -115,6 +116,9 @@ def build_url(spec):
 class _Utility:
     def __init__(self, fetcher):
         self.fetcher = fetcher
+        # The real ones: every feature record leaves through clean.
+        self.clean = clean_util
+        self.clean_add = clean_add_util
 
         def param(ctx, name):
             params = ctx.spec.params if ctx.spec is not None else {}

package/project/.sdk/tm/py/test/test_feature.py

@@ -572,7 +572,7 @@ class TestDebugFeature:
         entries = h.client._debug["entries"]
         assert len(entries) == 1  # ring buffer capped at max
         assert len(seen) == 2
-        assert seen[0]["headers"]["authorization"] == "<redacted>"
+        assert seen[0]["headers"]["authorization"] == "[redacted]"
 
     # Drives netsim as the simulated network: runnable only when this
     # SDK was generated with it (the harness skips absent features).
@@ -593,7 +593,7 @@ class TestDebugFeature:
                                       "redact": ["x-secret"]}}])
         h.op(op="load", headers={"x-secret": "hide", "x-ok": "show"})
         entry = h.client._debug["entries"][0]
-        assert entry["headers"]["x-secret"] == "<redacted>"
+        assert entry["headers"]["x-secret"] == "[redacted]"
         assert entry["headers"]["x-ok"] == "show"
         assert entry["durationMs"] == 0
 

package/project/.sdk/tm/py/test/test_primary_utility.py

@@ -186,6 +186,7 @@ class TestPrimaryUtility:
         utility = client._utility
 
         assert utility.clean is not None
+        assert utility.clean_add is not None
         assert utility.done is not None
         assert utility.make_error is not None
         assert utility.feature_add is not None

package/project/.sdk/tm/rb/core/context.rb

@@ -109,4 +109,32 @@ class ProjectNameContext
   def make_error(code, msg)
     ProjectNameError.new(code, msg, self)
   end
+
+  # The serialised context leaves the pipeline (a logger, an error dump), so
+  # it is cleaned; the live fields stay raw for the pipeline's own use.
+  def to_h
+    record = {
+      "id" => @id,
+      "op" => @op,
+      "spec" => @spec,
+      "entity" => @entity,
+      "result" => @result,
+      "response" => @response,
+      "meta" => @meta,
+    }
+    clean = @utility.respond_to?(:clean) ? @utility.clean : nil
+    clean.respond_to?(:call) ? clean.call(self, record) : record
+  end
+
+  def to_json(*args)
+    to_h.to_json(*args)
+  end
+
+  def to_s
+    "Context " + VoxgigStruct.jsonify(to_h)
+  end
+
+  def inspect
+    to_s
+  end
 end

package/project/.sdk/tm/rb/core/error.rb

@@ -1,5 +1,7 @@
 # ProjectName SDK error
 
+require 'json'
+
 class ProjectNameError < StandardError
   attr_accessor :is_sdk_error, :sdk, :code, :msg, :ctx, :result, :spec, :status
 
@@ -9,6 +11,9 @@ class ProjectNameError < StandardError
     @sdk = "ProjectName"
     @code = code
     @msg = msg
+    # Reachable for a debugger, absent from every serialiser below: the
+    # context holds the live spec and options, and an error is what gets
+    # logged.
     @ctx = ctx
     @result = nil
     @spec = nil
@@ -26,4 +31,29 @@ class ProjectNameError < StandardError
   def to_s
     @msg
   end
+
+  def inspect
+    "#<#{self.class.name} #{@code.inspect} #{@status}: #{@msg}>"
+  end
+
+  # What make_error attached is already cleaned; the context is not part of
+  # the record.
+  def to_h
+    {
+      "sdk" => @sdk,
+      "code" => @code,
+      "message" => @msg,
+      "status" => @status,
+      "result" => @result,
+      "spec" => @spec,
+    }
+  end
+
+  def as_json(*)
+    to_h
+  end
+
+  def to_json(*args)
+    to_h.to_json(*args)
+  end
 end

package/project/.sdk/tm/rb/core/utility_type.rb

@@ -1,7 +1,7 @@
 # ProjectName SDK utility type
 
 class ProjectNameUtility
-  attr_accessor :clean, :done, :make_error, :feature_add, :feature_hook,
+  attr_accessor :clean, :clean_add, :clean_explain, :done, :make_error, :feature_add, :feature_hook,
                 :feature_init, :fetcher, :make_fetch_def, :make_context,
                 :make_options, :make_request, :make_response, :make_result,
                 :make_point, :make_spec, :make_url, :param, :prepare_auth,

package/project/.sdk/tm/rb/feature/audit_feature.rb

@@ -58,7 +58,7 @@ class ProjectNameAuditFeature < ProjectNameBaseFeature
     @seen[ctx] = true
     @seq += 1
 
-    record = {
+    record = ctx.utility.clean.call(ctx, {
       "seq" => @seq,
       "ts" => _now,
       "actor" => _actor(ctx),
@@ -67,7 +67,7 @@ class ProjectNameAuditFeature < ProjectNameBaseFeature
       "outcome" => outcome,
       "status" => ctx.result ? ctx.result.status : nil,
       "correlationId" => ctx.id,
-    }
+    })
 
     track = @client.instance_variable_get(:@_audit)
     if track.nil?

package/project/.sdk/tm/rb/feature/cost_feature.rb

@@ -237,7 +237,7 @@ class ProjectNameCostFeature < ProjectNameBaseFeature
     _bump(cost["actors"], actor, amount)
 
     @seq += 1
-    record = {
+    record = ctx.utility.clean.call(ctx, {
       "seq" => @seq,
       "entity" => entity,
       "op" => opname,
@@ -246,7 +246,7 @@ class ProjectNameCostFeature < ProjectNameBaseFeature
       "currency" => cost["currency"],
       "source" => source,
       "attempts" => entry["attempts"],
-    }
+    })
     cost["last"] = record
 
     sink = @options["sink"]

package/project/.sdk/tm/rb/feature/debug_feature.rb

@@ -2,8 +2,9 @@
 #
 # Request/response capture for debugging. Records a bounded ring buffer of
 # per-operation traces - method, URL, redacted headers, response status and
-# timing. Sensitive header values (matching "redact", default
-# authorization/cookie/api-key style names) are masked. An optional
+# timing. The SDK's own clean rules (clean.keys and every registered secret
+# value) apply to the whole entry, and the "redact" option ADDS header names
+# on top of them. An optional
 # "on_entry" callback receives each finished entry (e.g. to stream to a
 # console). "max" caps the buffer (default 100). The clock is injectable
 # ("now", ms) for deterministic tests.
@@ -11,11 +12,6 @@
 require_relative 'base_feature'
 
 class ProjectNameDebugFeature < ProjectNameBaseFeature
-  REDACT_DEFAULT = [
-    "authorization", "cookie", "set-cookie", "api-key", "apikey",
-    "x-api-key", "idempotency-key",
-  ].freeze
-
   def initialize
     super
     @version = "0.0.1"
@@ -55,7 +51,7 @@ class ProjectNameDebugFeature < ProjectNameBaseFeature
       "op" => "#{ctx.op ? ctx.op.entity : '_'}.#{ctx.op ? ctx.op.name : '_'}",
       "method" => method,
       "url" => url,
-      "headers" => _redact(headers),
+      "headers" => _redact(ctx, headers),
       "start" => _now,
       "status" => nil,
       "ok" => nil,
@@ -101,6 +97,11 @@ class ProjectNameDebugFeature < ProjectNameBaseFeature
       entry["status"] = ctx.result.status
     end
 
+    # The whole entry leaves through the buffer and the callback: the url
+    # and the error message can carry a query credential the header mask
+    # above never saw.
+    entry = ctx.utility.clean.call(ctx, entry)
+
     track = @client.instance_variable_get(:@_debug)
     if track.nil?
       track = { "entries" => [] }
@@ -120,14 +121,16 @@ class ProjectNameDebugFeature < ProjectNameBaseFeature
     end
   end
 
-  def _redact(headers)
+  # The core clean rules apply (clean.keys, every registered value); the
+  # feature's own `redact` list ADDS header names on top of them.
+  def _redact(ctx, headers)
     return {} if headers.nil?
-    patterns = @options["redact"] || REDACT_DEFAULT
+    patterns = (@options["redact"] || []).map { |n| n.to_s.downcase }
     out = {}
     headers.each do |k, v|
-      out[k] = patterns.include?(k.to_s.downcase) ? "<redacted>" : v
+      out[k] = patterns.include?(k.to_s.downcase) ? "[redacted]" : v
     end
-    out
+    ctx.utility.clean.call(ctx, out)
   end
 
   def _now

package/project/.sdk/tm/rb/feature/log_feature.rb

@@ -27,10 +27,12 @@ class ProjectNameLogFeature < ProjectNameBaseFeature
     end
   end
 
+  # A log line leaves the pipeline, so it is cleaned before the logger sees
+  # it, as every emitted record is.
   def _loghook(hook, ctx, level = "info")
     return unless @logger
     opname = ctx.op ? ctx.op.name : ""
-    msg = "hook=#{hook} op=#{opname}"
+    msg = ctx.utility.clean.call(ctx, "hook=#{hook} op=#{opname}")
     if @logger.respond_to?(:puts)
       @logger.puts("[#{level.upcase}] #{msg}")
     end

package/project/.sdk/tm/rb/feature/proxy_feature.rb

@@ -9,6 +9,8 @@
 # fetchdef["proxy"] for the transport to honour. Hosts matching "noProxy"
 # (exact or suffix) bypass the proxy.
 
+require 'uri'
+
 require_relative 'base_feature'
 
 class ProjectNameProxyFeature < ProjectNameBaseFeature
@@ -22,6 +24,7 @@ class ProjectNameProxyFeature < ProjectNameBaseFeature
     @options = {}
     @url = nil
     @no_proxy = []
+    @ctx = nil
   end
 
   def init(ctx, options)
@@ -43,6 +46,26 @@ class ProjectNameProxyFeature < ProjectNameBaseFeature
     @no_proxy = (no_proxy.is_a?(String) ? no_proxy.split(/\s*,\s*/) : (no_proxy || []))
       .reject { |s| s.nil? || s == "" }
 
+    # A proxy URL may carry credentials as userinfo, from the option or the
+    # environment, and neither is under a sensitive key name.
+    @ctx = ctx
+    if @url.is_a?(String)
+      begin
+        parsed = URI.parse(@url)
+        [parsed.user, parsed.password].each do |part|
+          next if part.nil? || part.empty?
+          ctx.utility.clean_add.call(ctx, part)
+          begin
+            ctx.utility.clean_add.call(ctx, URI.decode_www_form_component(part))
+          rescue StandardError
+            nil
+          end
+        end
+      rescue StandardError
+        nil
+      end
+    end
+
     feature = self
     utility = ctx.utility
     inner = utility.fetcher
@@ -85,7 +108,8 @@ class ProjectNameProxyFeature < ProjectNameBaseFeature
   def _track(url)
     track = @client.instance_variable_get(:@_proxy)
     if track.nil?
-      track = { "routed" => 0, "url" => @url }
+      ctx = @ctx
+      track = { "routed" => 0, "url" => ctx.nil? ? @url : ctx.utility.clean.call(ctx, @url) }
       @client.instance_variable_set(:@_proxy, track)
     end
     track["routed"] += 1

package/project/.sdk/tm/rb/feature/secrets_feature.rb

@@ -86,6 +86,9 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
     @lastset = nil
     @resolved = false
 
+    # The root context, for registering what this feature resolves.
+    @ctx = nil
+
     @statelock = Mutex.new
     @resolvelock = Mutex.new
     @buylock = Mutex.new
@@ -94,6 +97,7 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
   # Sync by feature contract: build the chain, never look anything up here.
   def init(ctx, options)
     @client = ctx.client
+    @ctx = ctx
     @options = options.is_a?(Hash) ? options : {}
     @liveopts = ctx.options.is_a?(Hash) ? ctx.options : {}
     @active = @options["active"] == true
@@ -140,6 +144,7 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
       specs = []
 
       if explicit.is_a?(String) && !explicit.empty?
+        _register(explicit)
         specs << {
           "kind" => "memory",
           "name" => "options",
@@ -256,6 +261,15 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
 
   private
 
+  # Every value this feature resolves or buys is a secret the SDK handles,
+  # and none arrives under an option key the intake registration saw.
+  def _register(value)
+    ctx = @ctx
+    return if ctx.nil? || ctx.utility.nil? || !ctx.utility.respond_to?(:clean_add)
+    add = ctx.utility.clean_add
+    add.call(ctx, value) if add.respond_to?(:call)
+  end
+
   # Resolve once, answering whether a credential came out of it. That
   # boolean is the whole of what resolve needs to tell a cacheable HIT from
   # a miss it must not keep.
@@ -266,6 +280,7 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
     # "a store could not answer" - only the miss falls through.
     found = @sekreto.try(@secretname)
     found = nil unless found.is_a?(String)
+    _register(found)
 
     if @exchange.nil?
       # An UNCACHED miss after an earlier hit is a revocation: the chain
@@ -469,6 +484,8 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
         "secrets: token exchange returned no '#{x['response']}' field from #{url}"
     end
 
+    _register(token)
+
     token
   end
 

package/project/.sdk/tm/rb/feature/telemetry_feature.rb

@@ -86,16 +86,18 @@ class ProjectNameTelemetryFeature < ProjectNameBaseFeature
     span["durationMs"] = [0, span["end"] - span["start"]].max
     span["ok"] = ok
 
+    out = ctx.utility.clean.call(ctx, span)
+
     t = _telemetry
     unless t.nil?
       t["active"] -= 1
-      t["spans"] << span
+      t["spans"] << out
     end
 
     exporter = @options["exporter"]
     if exporter.is_a?(Proc)
       begin
-        exporter.call(span)
+        exporter.call(out)
       rescue StandardError
       end
     end

package/project/.sdk/tm/rb/test/feature_test.rb

@@ -763,7 +763,9 @@ class FeatureTest < Minitest::Test
     entries = h.track(:@_debug)["entries"]
     assert_equal 1, entries.length # ring buffer capped at max
     assert_equal 2, seen.length
-    assert_equal "<redacted>", seen[0]["headers"]["authorization"]
+    # Masked by the SDK's own clean rule (authorization is a clean.keys
+    # name), which the feature's redact list now sits on top of.
+    assert_equal "[redacted]", seen[0]["headers"]["authorization"]
   end
 
   def test_debug_captures_failures
@@ -784,7 +786,7 @@ class FeatureTest < Minitest::Test
     h = harness([fspec("debug", "now" => -> { 7 }, "redact" => ["x-secret"])])
     h.op(headers: { "x-secret" => "hide", "x-ok" => "show" })
     entry = h.track(:@_debug)["entries"][0]
-    assert_equal "<redacted>", entry["headers"]["x-secret"]
+    assert_equal "[redacted]", entry["headers"]["x-secret"]
     assert_equal "show", entry["headers"]["x-ok"]
   end