@voxgig/sdkgen 4.34.0 → 4.34.1

package/project/.sdk/tm/csharp/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ Voxgig
+Copyright (c) $$const.year$$ PROJECTPUBLISHER
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/csharp/core/Context.cs

@@ -226,7 +226,7 @@ public class Context
         var opcfg = StructUtils.GetPath(Config,
             StructUtils.Jt("entity", entname, "op", opname));
 
-        var input = (opname == "update" || opname == "create") ? "data" : "match";
+        var input = (opname == "update" || opname == "create" || opname == "patch") ? "data" : "match";
 
         List<object?>? points = null;
         if (opcfg is Dictionary<string, object?> ocm)

package/project/.sdk/tm/csharp/core/Helpers.cs

@@ -17,6 +17,23 @@ public static class Helpers
             $"operation '{opname}' not supported by entity '{entityname}'");
     }
 
+    // Whether a comma-separated allow option names the item: whole names, any case.
+    public static bool Allowed(object? names, string? item)
+    {
+        if (names is not string list || string.IsNullOrEmpty(item))
+        {
+            return false;
+        }
+        foreach (var name in list.Split(','))
+        {
+            if (string.Equals(name.Trim(), item, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+
     public static Dictionary<string, object?>? ToMapAny(object? v)
     {
         return v as Dictionary<string, object?>;

package/project/.sdk/tm/csharp/core/Response.cs

@@ -1,5 +1,7 @@
 // ProjectName SDK - transport response wrapper.
 
+using System.Text.RegularExpressions;
+
 using Voxgig.Struct;
 
 namespace ProjectNameSdk;
@@ -13,6 +15,11 @@ public class Response
     public object? Body;
     public Exception? Err;
 
+    // Set by a transport that could not read a non-blank body as JSON.
+    public bool Unreadable;
+
+    private const int PreviewLength = 160;
+
     public Response(Dictionary<string, object?>? resmap)
     {
         resmap ??= new Dictionary<string, object?>();
@@ -41,5 +48,73 @@ public class Response
         {
             Err = er;
         }
+
+        Unreadable = StructUtils.GetProp(resmap, "unreadable") is true;
+    }
+
+    // A body that is not JSON. An HTTP failure keeps its own error, with the
+    // response described; otherwise the code tells a wrong content type from
+    // malformed JSON.
+    public static Exception UnreadableBody(Context ctx, int status, object? headers,
+        object? text, object? sent, Exception? failed)
+    {
+        var type = HeaderValue(headers, "content-type");
+        var agent = Clean(ctx, HeaderValue(sent, "user-agent"));
+        var detail = "HTTP " + status + ", content-type " + (type == "" ? "none" : type) +
+            ", user-agent " + (agent == "" ? "transport default" : agent) +
+            (text == null ? "" : ", body: " + Preview(ctx, text));
+
+        if (failed is ProjectNameError sdkErr)
+        {
+            sdkErr.SetMessage(sdkErr.Message + " (" + detail + ")");
+            return sdkErr;
+        }
+        if (failed != null)
+        {
+            return new Exception(failed.Message + " (" + detail + ")", failed);
+        }
+
+        return type == "" || type.Contains("json", StringComparison.OrdinalIgnoreCase)
+            ? ctx.MakeError("response_json_invalid", "response: body is not valid JSON (" + detail + ")")
+            : ctx.MakeError("response_content_type",
+                "response: expected JSON, got " + type + " (" + detail + ")");
+    }
+
+    private static string HeaderValue(object? headers, string name)
+    {
+        if (headers is IDictionary<string, object?> map)
+        {
+            foreach (var kv in map)
+            {
+                if (string.Equals(kv.Key, name, StringComparison.OrdinalIgnoreCase))
+                {
+                    return kv.Value?.ToString() ?? "";
+                }
+            }
+        }
+        return "";
+    }
+
+    private static string Clean(Context ctx, string s)
+    {
+        return ctx.Utility?.Clean(ctx, s)?.ToString() ?? s;
+    }
+
+    // Cleaned whole: a secret the bound would split could leave its prefix.
+    private static string Preview(Context ctx, object text)
+    {
+        var flat = Clean(ctx, Regex.Replace(text.ToString() ?? "", @"\s+", " ").Trim());
+        var count = 0;
+        var end = 0;
+        foreach (var rune in flat.EnumerateRunes())
+        {
+            if (count == PreviewLength)
+            {
+                return flat.Substring(0, end) + "...";
+            }
+            count++;
+            end += rune.Utf16SequenceLength;
+        }
+        return flat;
     }
 }

package/project/.sdk/tm/csharp/core/Spec.cs

@@ -17,6 +17,9 @@ public class Spec
     public object? Body;
     public string Url = "";
     public string Path = "";
+    // The query parameters PrepareAuth placed: the credential, which the
+    // request sends and the entity's match leaves out.
+    public List<string> AuthQuery = new();
 
     public Spec(Dictionary<string, object?>? specmap)
     {

package/project/.sdk/tm/csharp/feature/TestFeature.cs

@@ -58,6 +58,16 @@ public class TestFeature : BaseFeature
             {
                 if (data == null || ctx2.Point == null) { return data; }
                 var tm = StructUtils.GetProp(ctx2.Point, "transform");
+                var key = ItemEnvelopeKey(StructUtils.GetProp(tm, "res"));
+                if (key != null && data is System.Collections.IList items)
+                {
+                    var wrapped = new List<object?>();
+                    foreach (var item in items)
+                    {
+                        wrapped.Add(new Dictionary<string, object?> { [key] = item });
+                    }
+                    return wrapped;
+                }
                 if (StructUtils.GetProp(tm, "res") is not string spec) { return data; }
                 // Rebuild whatever nesting the transform unwraps. Multi-segment on purpose:
                 // GraphQL ops unwrap `body.data.<field>`, not just one envelope property.
@@ -160,7 +170,7 @@ public class TestFeature : BaseFeature
                 var outval = StructUtils.Clone(found);
                 return Respond(200, outval, null);
             }
-            else if (op.Name == "update")
+            else if (op.Name == "update" || op.Name == "patch")
             {
                 // Match the existing entity by id only (or its alias).
                 // Reqdata also contains the new field values, which would
@@ -198,7 +208,7 @@ public class TestFeature : BaseFeature
                 }
                 if (ent is Dictionary<string, object?> && ctx2.Reqdata != null)
                 {
-                    StructUtils.Merge(new List<object?> { ent, ctx2.Reqdata });
+                    StructUtils.Merge(new List<object?> { ent, Record(ctx2.Reqdata) });
                 }
                 StructUtils.DelProp(ent, "$KEY");
                 var outval = StructUtils.Clone(ent);
@@ -226,7 +236,7 @@ public class TestFeature : BaseFeature
                     Random.Shared.Next(0x10000), Random.Shared.Next(0x10000),
                     Random.Shared.Next(0x10000), Random.Shared.Next(0x10000));
 
-                var ent = StructUtils.Clone(ctx2.Reqdata);
+                var ent = StructUtils.Clone(Record(ctx2.Reqdata));
                 if (ent is Dictionary<string, object?> entm)
                 {
                     entm["id"] = id;
@@ -328,6 +338,34 @@ public class TestFeature : BaseFeature
         };
     }
 
+    // The record the mock keeps: the request data without `$body`, which only the
+    // wire carries.
+    private static Dictionary<string, object?>? Record(Dictionary<string, object?>? reqdata)
+    {
+        if (reqdata == null)
+        {
+            return null;
+        }
+        var rec = new Dictionary<string, object?>(reqdata);
+        rec.Remove("$body");
+        return rec;
+    }
+
+    // The key a list's response transform
+    // ["`$EACH`", "body", {"`$MERGE`": "`.<key>`"}] reads each item's record under.
+    private static string? ItemEnvelopeKey(object? restf)
+    {
+        if (restf is not System.Collections.IList spec || spec.Count != 3 ||
+            !"`$EACH`".Equals(spec[0]) || !"body".Equals(spec[1]) ||
+            spec[2] is not System.Collections.IDictionary child ||
+            child["`$MERGE`"] is not string merge)
+        {
+            return null;
+        }
+        var m = System.Text.RegularExpressions.Regex.Match(merge, "^`\\.([^.`$]+)`$");
+        return m.Success ? m.Groups[1].Value : null;
+    }
+
     private static object BuildArgs(Context ctx, Operation op, Dictionary<string, object?>? args)
     {
         var opname = op.Name;

package/project/.sdk/tm/csharp/feature/TimeoutFeature.cs

@@ -49,16 +49,44 @@ public class TimeoutFeature : BaseFeature
             return inner(ctx, url, fetchdef);
         }
 
-        var task = Task.Run(() => inner(ctx, url, fetchdef));
+        // The deadline runs from here, not from the wait below: a caller paused
+        // between the two would otherwise find a late response complete and
+        // take it. The worker notes when it finished, so a response or a
+        // failure after the deadline is a timeout however late the caller looks.
+        var now = FoptNow(_options);
+        var start = now();
+        long arrived = long.MaxValue;
+        var task = Task.Run(() =>
+        {
+            try
+            {
+                return inner(ctx, url, fetchdef);
+            }
+            finally
+            {
+                Interlocked.Exchange(ref arrived, now());
+            }
+        });
 
-        if (task == Task.WhenAny(task, Task.Delay(ms)).GetAwaiter().GetResult())
+        var remaining = Math.Max(0L, ms - (now() - start));
+        if (task == Task.WhenAny(task, Task.Delay(TimeSpan.FromMilliseconds(remaining)))
+            .GetAwaiter().GetResult())
         {
+            if (ms < Interlocked.Read(ref arrived) - start)
+            {
+                throw TimedOut(ctx, ms);
+            }
             // Unwraps any inner exception.
             return task.GetAwaiter().GetResult();
         }
 
+        throw TimedOut(ctx, ms);
+    }
+
+    private Exception TimedOut(Context ctx, int ms)
+    {
         Track(ms);
-        throw ctx.MakeError("timeout", $"Request exceeded timeout of {ms}ms");
+        return ctx.MakeError("timeout", $"Request exceeded timeout of {ms}ms");
     }
 
     private void Track(int ms)

package/project/.sdk/tm/csharp/feature/ValidateFeature.cs

@@ -207,6 +207,8 @@ public class ValidateFeature : BaseFeature
         // custom-action call would be rejected for the one key that made it
         // reachable.
         outmap.Remove("$action");
+        // Nor is `$body`, the raw request body.
+        outmap.Remove("$body");
 
         return outmap;
     }

package/project/.sdk/tm/csharp/test/FeatureHarness.cs

@@ -111,7 +111,7 @@ internal class FhHarness
         return op switch
         {
             "create" => "POST",
-            "update" => "PATCH",
+            "update" or "patch" => "PATCH",
             "remove" => "DELETE",
             _ => "GET",
         };

package/project/.sdk/tm/csharp/test/FeatureTest.cs

@@ -342,6 +342,41 @@ public class FeatureTimeoutTest
         Assert.Equal(1, f.Count);
     }
 
+    // The deadline runs from the request's start, not from the wait: a response
+    // that arrives after it is a timeout even when the caller only looks once it
+    // is complete. The clock stands at the start for the caller and 300 ms
+    // later for the worker.
+    [Fact]
+    public void LateResponseTimesOutHoweverLateTheCallerLooks()
+    {
+        if (Fh.SkipWithout("timeout")) return;
+        var f = new TimeoutFeature();
+        var h = Fh.Make(null, (f, new Dictionary<string, object?> { ["ms"] = 20, ["now"] = WorkerClock(300L) }));
+        var res = h.Op(new FhOpSpec { Op = "load" });
+        Assert.Equal("timeout", Fh.ErrCode(res.Err));
+        Assert.Equal(1, f.Count);
+    }
+
+    // A transport failure after the deadline is a timeout too, not the failure.
+    [Fact]
+    public void LateFailureTimesOut()
+    {
+        if (Fh.SkipWithout("timeout")) return;
+        var f = new TimeoutFeature();
+        var h = Fh.Make((ctx, url, fetchdef) => throw new InvalidOperationException("socket closed"),
+            (f, new Dictionary<string, object?> { ["ms"] = 20, ["now"] = WorkerClock(300L) }));
+        var res = h.Op(new FhOpSpec { Op = "load" });
+        Assert.Equal("timeout", Fh.ErrCode(res.Err));
+        Assert.Equal(1, f.Count);
+    }
+
+    // A clock standing at 0 for the calling thread and at later for any other.
+    private static Func<long> WorkerClock(long later)
+    {
+        var caller = Thread.CurrentThread.ManagedThreadId;
+        return () => Thread.CurrentThread.ManagedThreadId == caller ? 0L : later;
+    }
+
     [Fact]
     public void FastRequestPasses()
     {

package/project/.sdk/tm/csharp/test/PipelineTest.cs

@@ -41,6 +41,34 @@ public class PipelineTest
         return utility.MakeContext(ctxmap, client.GetRootCtx());
     }
 
+    // A typed collection is a list or a map to a cookie argument, as it is to
+    // the rest of the SDK: a List<string> repeats the name, a
+    // Dictionary<string, string> sends its keys.
+    [Fact]
+    public void PrepareHeadersCookieTypedCollections()
+    {
+        var (client, utility) = PlClient(null);
+        var ctx = PlCtx(client, utility, null);
+        ctx.Point = new Dictionary<string, object?>
+        {
+            ["args"] = new Dictionary<string, object?>
+            {
+                ["cookie"] = new List<object?>
+                {
+                    new Dictionary<string, object?> { ["name"] = "theme", ["orig"] = "theme", ["kind"] = "cookie" },
+                    new Dictionary<string, object?> { ["name"] = "prefs", ["orig"] = "prefs", ["kind"] = "cookie" },
+                },
+            },
+        };
+        ctx.Reqmatch = new Dictionary<string, object?>
+        {
+            ["theme"] = new List<string> { "dark", "x y" },
+            ["prefs"] = new Dictionary<string, string> { ["size"] = "2", ["lang"] = "en gb" },
+        };
+        var headers = utility.PrepareHeaders(ctx);
+        Assert.Equal("theme=dark; theme=x%20y; lang=en%20gb; size=2", headers["cookie"]);
+    }
+
     private static string ErrCode(Action act)
     {
         try

package/project/.sdk/tm/csharp/test/Runner.cs

@@ -483,6 +483,125 @@ public static class TestRunner
         return new ProjectNameError(code, msg, null);
     }
 
+    // A live check that did not pass, as main.kit.test.live.strict decides:
+    // strict fails the test; lenient prints the reason and the caller
+    // returns, as xunit 2 has no runtime skip.
+    public static void LiveMiss(bool strict, string reason)
+    {
+        Assert.False(strict, reason);
+        Console.WriteLine("skip: " + reason);
+    }
+
+    // An account holding no record for the test to read skips either way.
+    public static void LiveEmpty(string reason)
+    {
+        Console.WriteLine("skip: " + reason);
+    }
+
+    // A live response that succeeded: no error, ok, and a 2xx status.
+    public static bool LiveOk(Dictionary<string, object?> result)
+    {
+        var status = ProjectNameSdk.Helpers.ToInt(result.TryGetValue("status", out var s) ? s : null);
+        return (!result.TryGetValue("err", out var err) || err == null)
+            && Equals(result.TryGetValue("ok", out var ok) ? ok : null, true)
+            && status >= 200 && status < 300;
+    }
+
+    // A live list response's records: the body, or the first list an
+    // envelope holds.
+    public static List<object?>? LiveList(object? data)
+    {
+        if (data is List<object?> list)
+        {
+            return list;
+        }
+        if (data is Dictionary<string, object?> map)
+        {
+            var keys = new List<string>(map.Keys);
+            keys.Sort(StringComparer.Ordinal);
+            foreach (var key in keys)
+            {
+                if (map[key] is List<object?> found)
+                {
+                    return found;
+                }
+            }
+        }
+        return null;
+    }
+
+    // A live response for a message: the SDK's error, or else its status and
+    // content type, never its body.
+    public static string LiveDescribe(Dictionary<string, object?> result)
+    {
+        if (result.TryGetValue("err", out var err) && err != null)
+        {
+            return err is Exception e ? e.Message : (err.ToString() ?? "");
+        }
+        var output = "HTTP " + (result.TryGetValue("status", out var status) ? status : null);
+        if (result.TryGetValue("headers", out var headers) &&
+            headers is Dictionary<string, object?> hmap)
+        {
+            foreach (var entry in hmap)
+            {
+                if (string.Equals(entry.Key, "content-type", StringComparison.OrdinalIgnoreCase)
+                    && entry.Value != null)
+                {
+                    output += " " + (entry.Value.ToString() ?? "").Split(';')[0].Trim();
+                }
+            }
+        }
+        return output;
+    }
+
+    // The record a create-less flow reads live: the first its list returns,
+    // put where the flow reads the fixture's existing records. False once
+    // the test is settled and has to return.
+    public static bool LiveExisting(Dictionary<string, object?> data, bool strict, string name,
+        Func<object?> list)
+    {
+        object? found;
+        try
+        {
+            found = list();
+        }
+        catch (Exception e)
+        {
+            LiveMiss(strict, "Live list discovery failed: " + e.Message);
+            return false;
+        }
+        if (found is not List<object?> items)
+        {
+            LiveMiss(strict, "Live list discovery returned no list");
+            return false;
+        }
+        if (items.Count == 0)
+        {
+            LiveEmpty("The account has no " + name + " record to load");
+            return false;
+        }
+        var record = items[0] is IEntity ent ? ent.Data() : items[0];
+        if (!(data.TryGetValue("existing", out var existing) &&
+            existing is Dictionary<string, object?> emap))
+        {
+            emap = new Dictionary<string, object?>();
+            data["existing"] = emap;
+        }
+        emap[name] = new Dictionary<string, object?> { ["live01"] = record };
+        return true;
+    }
+
+    // In a lenient live run a failing check is reported and the test
+    // returns, observing the live API rather than failing on it.
+    public static void LiveObserve(Exception err, bool live, bool strict)
+    {
+        if (strict || !live)
+        {
+            System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(err).Throw();
+        }
+        Console.WriteLine("skip: live run, main.kit.test.live.strict is false: " + err.Message);
+    }
+
     // EntityListToData extracts data maps from a list of entity objects.
     public static List<object?> EntityListToData(List<object?> list)
     {

package/project/.sdk/tm/csharp/test/feature/secrets/SecretsFeatureTest.cs

@@ -1391,8 +1391,9 @@ public class SecretsFeatureTest
                 ["feature"] = ExchangeOpts(null),
             });
 
+            var results = new Dictionary<string, object?>[4];
             Parallel.For(0, 4, i =>
-                client.Direct(new Dictionary<string, object?> { ["path"] = "/p" + i }));
+                results[i] = client.Direct(new Dictionary<string, object?> { ["path"] = "/p" + i }));
 
             // REPORTS WHAT WENT OUT, not just how many. This assertion failed
             // once in CI and passed on re-run, and the count alone could not
@@ -1400,10 +1401,14 @@ public class SecretsFeatureTest
             // purchases (the coalescing missed) or none (the exchange never
             // ran). By the time anyone looked, the re-run had replaced the
             // job log and the number was gone. Report() exists for exactly
-            // this, and the sibling assertions already use it.
+            // this, and the sibling assertions already use it. The results
+            // ride along because Direct returns its error: a purchase that
+            // never ran leaves nothing on the wire, and only they say why.
             Assert.True(1 == w.Token().Count,
                 "four operations at once must open exactly ONE token request, saw " +
-                w.Token().Count + " — calls: " + w.Report());
+                w.Token().Count + " — calls: " + w.Report() + " — results: " +
+                string.Join(", ", Array.ConvertAll(results,
+                    r => "ok=" + r["ok"] + " err=" + ErrMessage(r))));
         }
         finally
         {

package/project/.sdk/tm/csharp/utility/Fetcher.cs

@@ -72,9 +72,20 @@ public static partial class SdkUtility
 
         using var req = new HttpRequestMessage(new HttpMethod(method), fullurl);
 
-        if (fetchdef.TryGetValue("body", out var braw) && braw is string body && body != "")
+        if (fetchdef.TryGetValue("body", out var braw))
         {
-            req.Content = new StringContent(body, Encoding.UTF8, "application/json");
+            if (braw is string body && body != "")
+            {
+                req.Content = new StringContent(body, Encoding.UTF8, "application/json");
+            }
+            else if (braw is byte[] bytes)
+            {
+                req.Content = new ByteArrayContent(bytes);
+            }
+            else if (braw is Stream stream)
+            {
+                req.Content = new StreamContent(stream);
+            }
         }
 
         var hasUA = false;
@@ -102,11 +113,16 @@ public static partial class SdkUtility
             }
         }
         // Default User-Agent - some CDNs block requests without one. Use a
-        // Mozilla-shaped UA unless the caller already set one.
+        // Mozilla-shaped UA unless the caller already set one, and record it
+        // with the headers the request sent.
         if (!hasUA)
         {
-            req.Headers.TryAddWithoutValidation("User-Agent",
-                "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)");
+            var agent = "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)";
+            req.Headers.TryAddWithoutValidation("User-Agent", agent);
+            if (hraw is Dictionary<string, object?> sent)
+            {
+                sent["user-agent"] = agent;
+            }
         }
 
         using var resp = ClientFor(fetchdef).Send(req, HttpCompletionOption.ResponseContentRead);
@@ -122,7 +138,8 @@ public static partial class SdkUtility
         }
 
         object? jsonBody = null;
-        if (bodyText.Length > 0)
+        var unreadable = false;
+        if (!string.IsNullOrWhiteSpace(bodyText))
         {
             try
             {
@@ -131,7 +148,7 @@ public static partial class SdkUtility
             }
             catch (JsonException)
             {
-                jsonBody = null;
+                unreadable = true;
             }
         }
 
@@ -144,6 +161,7 @@ public static partial class SdkUtility
             ["headers"] = resheaders,
             ["json"] = (Func<object?>)(() => jsonBody),
             ["body"] = bodyText,
+            ["unreadable"] = unreadable,
         };
     }
 

package/project/.sdk/tm/csharp/utility/MakeFetchDef.cs

@@ -1,7 +1,5 @@
 // ProjectName SDK utility: makeFetchDef.
 
-using Voxgig.Struct;
-
 namespace ProjectNameSdk.Util;
 
 public static partial class SdkUtility
@@ -28,9 +26,7 @@ public static partial class SdkUtility
 
         if (spec.Body != null)
         {
-            fetchdef["body"] = spec.Body is Dictionary<string, object?>
-                ? StructUtils.Jsonify(spec.Body)
-                : spec.Body;
+            fetchdef["body"] = RequestBody(ctx.Point, spec.Body);
         }
 
         return fetchdef;

package/project/.sdk/tm/csharp/utility/MakeOptions.cs

@@ -366,14 +366,15 @@ public static partial class SdkUtility
 
     // A feature's name is not a field name: a feature called `secrets` does
     // not make every one of its options a secret. Entity blocks (entity
-    // settings, seeded records) hold no credential.
+    // settings, seeded records) hold no credential, and nor do rbac's rules,
+    // keyed by entity and operation names.
     private static void CleanAddOptions(Context cleanctx, Dictionary<string, object?> opts,
         params string[] omit)
     {
         var top = CleanOmit(opts, omit.Append("feature").Append("entity").ToArray());
         if (top.ContainsKey("test"))
         {
-            top["test"] = CleanNoEntity(top["test"]);
+            top["test"] = CleanPlain(top["test"], null);
         }
         CleanAddSensitive(cleanctx, top);
         var feature = opts.GetValueOrDefault("feature");
@@ -381,14 +382,15 @@ public static partial class SdkUtility
         {
             foreach (DictionaryEntry kv in fmap)
             {
-                CleanAddSensitive(cleanctx, CleanNoEntity(kv.Value));
+                CleanAddSensitive(cleanctx, CleanPlain(kv.Value, Convert.ToString(kv.Key)));
             }
         }
         else if (feature is IList flist)
         {
             foreach (var entry in flist)
             {
-                CleanAddSensitive(cleanctx, CleanNoEntity(entry));
+                var name = entry is IDictionary e && e.Contains("name") ? e["name"] as string : null;
+                CleanAddSensitive(cleanctx, CleanPlain(entry, name));
             }
         }
         else
@@ -397,7 +399,7 @@ public static partial class SdkUtility
         }
     }
 
-    private static object? CleanNoEntity(object? block)
+    private static object? CleanPlain(object? block, string? name)
     {
         if (block is not IDictionary dict)
         {
@@ -407,7 +409,7 @@ public static partial class SdkUtility
         foreach (DictionaryEntry kv in dict)
         {
             var key = Convert.ToString(kv.Key) ?? "";
-            if (key != "entity")
+            if (key != "entity" && !("rbac" == name && key == "rules"))
             {
                 out_[key] = kv.Value;
             }