@voxgig/sdkgen 4.34.0 → 4.34.2

package/project/.sdk/tm/rb/utility/prepare_query.rb

@@ -1,5 +1,6 @@
 # ProjectName SDK utility: prepare_query
 require_relative 'struct/voxgig_struct'
+require_relative 'param'
 module ProjectNameUtilities
   PrepareQuery = ->(ctx) {
     point = ctx.point
@@ -17,12 +18,15 @@ module ProjectNameUtilities
           params << name if name.is_a?(String)
         end
       end
-      # A header parameter travels in the headers, which prepare_headers fills.
-      hl = VoxgigStruct.getpath(point, "args.header")
-      if hl.is_a?(Array)
+      # A header or cookie parameter travels in the headers, which prepare_headers
+      # fills, unless a query parameter shares its name: then both are sent.
+      ql = VoxgigStruct.getpath(point, "args.query")
+      declared = ql.is_a?(Array) ? ql.map { |qd| VoxgigStruct.getprop(qd, "name") } : []
+      [VoxgigStruct.getpath(point, "args.header"), VoxgigStruct.getpath(point, "args.cookie")].each do |hl|
+        next unless hl.is_a?(Array)
         hl.each do |hd|
           name = VoxgigStruct.getprop(hd, "name")
-          params << name if name.is_a?(String)
+          params << name if name.is_a?(String) && !declared.include?(name)
         end
       end
     end
@@ -47,6 +51,10 @@ module ProjectNameUtilities
         out[wire.fetch(key, key)] = val if val && key.is_a?(String) && key != "$action" && !params.include?(key)
       end
     end
+    # A create or update passes its query arguments in its data.
+    ProjectNameUtilities.call_args(ctx, "query").each do |name, orig, val|
+      out[orig] = val if !val.nil? && !params.include?(name)
+    end
     out
   }
 end

package/project/.sdk/tm/rb/utility/result_body.rb

@@ -6,6 +6,51 @@ module ProjectNameUtilities
     if result && response && response.json_func && response.body
       result.body = response.json_func.call
     end
+    if result && response && response.unreadable
+      sent = ctx.spec ? ctx.spec.headers : nil
+      result.err = UnreadableBody.call(ctx, result.status, result.headers, response.body,
+                                       sent, result.err)
+    end
     result
   }
+
+  BODY_PREVIEW_LENGTH = 160
+
+  # A body that is not JSON. An HTTP failure keeps its own error, with the
+  # response described; otherwise the code tells a wrong content type from
+  # malformed JSON.
+  UnreadableBody = ->(ctx, status, headers, text, sent, failed) {
+    ctype = BodyHeader.call(headers, "content-type")
+    agent = ctx.utility.clean.call(ctx, BodyHeader.call(sent, "user-agent")).to_s
+    agent = "transport default" if agent.empty?
+    detail = "HTTP #{status}, content-type #{ctype.empty? ? 'none' : ctype}, user-agent #{agent}"
+    detail += ", body: " + BodyPreview.call(ctx, text) unless text.nil?
+
+    if failed
+      return "#{failed} (#{detail})" if failed.is_a?(String)
+      message = "#{failed.message} (#{detail})"
+      return RuntimeError.new(message) unless failed.is_a?(ProjectNameError)
+      failed.msg = message
+      return failed
+    end
+
+    if ctype.empty? || ctype.downcase.include?("json")
+      ctx.make_error("response_json_invalid", "response: body is not valid JSON (#{detail})")
+    else
+      ctx.make_error("response_content_type", "response: expected JSON, got #{ctype} (#{detail})")
+    end
+  }
+
+  BodyHeader = ->(headers, name) {
+    return "" unless headers.is_a?(Hash)
+    pair = headers.find { |key, _| key.to_s.downcase == name }
+    pair ? pair[1].to_s : ""
+  }
+
+  # Cleaned whole: a secret the bound would split could leave its prefix.
+  BodyPreview = ->(ctx, text) {
+    raw = text.to_s.dup.force_encoding(Encoding::UTF_8).scrub("?")
+    flat = ctx.utility.clean.call(ctx, raw.gsub(/\s+/, " ").strip).to_s
+    flat.length > BODY_PREVIEW_LENGTH ? flat[0, BODY_PREVIEW_LENGTH] + "..." : flat
+  }
 end

package/project/.sdk/tm/rb/utility/transform_request.rb

@@ -1,6 +1,7 @@
 # ProjectName SDK utility: transform_request
 require_relative 'struct/voxgig_struct'
 require_relative '../core/helpers'
+require_relative 'param'
 module ProjectNameUtilities
   # `$action` selects the point (see MakePoint); it is never an API field, so
   # the body is a copy without it. The caller's hash is left untouched.
@@ -8,12 +9,21 @@ module ProjectNameUtilities
     omit_keys(reqdata, ["$action"])
   end
 
-  # A header argument travels as a header, which PrepareHeaders sends, so the
-  # body is built from the request data without it.
-  def self.header_arg_names(point)
-    hl = point ? VoxgigStruct.getpath(point, "args.header") : nil
-    return [] unless hl.is_a?(Array)
-    hl.map { |hd| VoxgigStruct.getprop(hd, "name") }.select { |n| n.is_a?(String) && !n.empty? }
+  # A header, cookie or query argument travels where PrepareHeaders or
+  # PrepareQuery sends it, so the body is built from the request data without
+  # it, unless the point marks it as a field the body keeps.
+  def self.routed_arg_names(ctx)
+    (call_args(ctx, "header") + call_args(ctx, "cookie") + call_args(ctx, "query")).map(&:first)
+      .reject { |name| field_arg?(ctx, name) }
+  end
+
+  def self.field_arg?(ctx, name)
+    ["header", "cookie", "query"].any? do |kind|
+      defs = ctx.point ? VoxgigStruct.getpath(ctx.point, "args.#{kind}") : nil
+      defs.is_a?(Array) && defs.any? do |ad|
+        VoxgigStruct.getprop(ad, "name") == name && true == VoxgigStruct.getprop(ad, "field")
+      end
+    end
   end
 
   def self.omit_keys(reqdata, names)
@@ -25,7 +35,7 @@ module ProjectNameUtilities
     spec = ctx.spec
     point = ctx.point
     spec.step = "reqform" if spec
-    data = ProjectNameUtilities.omit_keys(ctx.reqdata, ProjectNameUtilities.header_arg_names(point))
+    data = ProjectNameUtilities.omit_keys(ctx.reqdata, ProjectNameUtilities.routed_arg_names(ctx))
     transform = ProjectNameHelpers.to_map(VoxgigStruct.getprop(point, "transform"))
     return ProjectNameUtilities.strip_action(data) unless transform
     reqform = VoxgigStruct.getprop(transform, "req")

package/project/.sdk/tm/rust/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) $$const.year$$ Voxgig
+Copyright (c) $$const.year$$ PROJECTPUBLISHER
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/project/.sdk/tm/rust/core/context.rs

@@ -251,7 +251,7 @@ impl Context {
 
         let opcfg = getpath(&["entity", &entname, "op", opname], &self.config.borrow());
 
-        let input = if opname == "update" || opname == "create" {
+        let input = if opname == "update" || opname == "create" || opname == "patch" {
             "data"
         } else {
             "match"

package/project/.sdk/tm/rust/core/helpers.rs

@@ -30,6 +30,16 @@ pub fn getp(val: &Value, key: &str) -> Value {
     vs::get_prop(val, &Value::str(key), Value::Noval)
 }
 
+// Whether a comma-separated allow option names the item: whole names, any case.
+pub fn allowed(names: &Value, item: &str) -> bool {
+    match names {
+        Value::Str(list) if !item.is_empty() => list
+            .split(',')
+            .any(|name| name.trim().eq_ignore_ascii_case(item)),
+        _ => false,
+    }
+}
+
 pub fn getpath(path: &[&str], store: &Value) -> Value {
     let p = Value::list(path.iter().map(|s| Value::str(*s)).collect());
     vs::get_path(store, &p, None)

package/project/.sdk/tm/rust/core/response.rs

@@ -1,7 +1,13 @@
 
+use std::rc::Rc;
+
+use crate::core::context::Context;
 use crate::core::error::ProjectNameError;
 use crate::core::helpers::{get_str, getp, to_int};
-use crate::utility::voxgigstruct::Value;
+use crate::utility::clean::clean_str;
+use crate::utility::voxgigstruct::{stringify, Value};
+
+const PREVIEW_LENGTH: usize = 160;
 
 pub struct Response {
     pub status: i64,
@@ -10,6 +16,8 @@ pub struct Response {
     pub json: Value,
     pub body: Value,
     pub err: Option<ProjectNameError>,
+    // Set by a transport that could not read a non-blank body as JSON.
+    pub unreadable: bool,
 }
 
 impl Response {
@@ -23,6 +31,7 @@ impl Response {
         let headers = getp(resmap, "headers");
         let json = getp(resmap, "json");
         let body = getp(resmap, "body");
+        let unreadable = getp(resmap, "unreadable") == Value::Bool(true);
 
         Response {
             status,
@@ -31,6 +40,76 @@ impl Response {
             json,
             body,
             err: None,
+            unreadable,
+        }
+    }
+}
+
+/// A body that is not JSON. An HTTP failure keeps its own error, with the
+/// response described; otherwise the code tells a wrong content type from
+/// malformed JSON.
+pub fn unreadable_body(
+    ctx: &Rc<Context>,
+    status: i64,
+    headers: &Value,
+    text: &Value,
+    sent: &Value,
+    failed: Option<ProjectNameError>,
+) -> ProjectNameError {
+    let ctype = header_value(headers, "content-type");
+    let agent = clean_str(ctx, &header_value(sent, "user-agent"));
+    let detail = format!(
+        "HTTP {}, content-type {}, user-agent {}{}",
+        status,
+        if ctype.is_empty() { "none" } else { &ctype },
+        if agent.is_empty() { "transport default" } else { &agent },
+        match text {
+            Value::Noval | Value::Null => String::new(),
+            t => format!(", body: {}", preview(ctx, t)),
         }
+    );
+
+    if let Some(mut err) = failed {
+        err.msg = format!("{} ({})", err.msg, detail);
+        return err;
+    }
+
+    if ctype.is_empty() || ctype.to_lowercase().contains("json") {
+        ctx.make_error(
+            "response_json_invalid",
+            &format!("response: body is not valid JSON ({})", detail),
+        )
+    } else {
+        ctx.make_error(
+            "response_content_type",
+            &format!("response: expected JSON, got {} ({})", ctype, detail),
+        )
+    }
+}
+
+fn header_value(headers: &Value, name: &str) -> String {
+    if let Value::Map(m) = headers {
+        for (k, v) in m.borrow().iter() {
+            if k.eq_ignore_ascii_case(name) {
+                return text_of(v);
+            }
+        }
+    }
+    String::new()
+}
+
+fn text_of(v: &Value) -> String {
+    match v {
+        Value::Str(s) => s.clone(),
+        other => stringify(other, None, false),
+    }
+}
+
+// Cleaned whole: a secret the bound would split could leave its prefix.
+fn preview(ctx: &Rc<Context>, text: &Value) -> String {
+    let flat = clean_str(ctx, &text_of(text).split_whitespace().collect::<Vec<_>>().join(" "));
+    match flat.char_indices().nth(PREVIEW_LENGTH) {
+        Some((end, _)) => format!("{}...", &flat[..end]),
+        None => flat,
     }
 }

package/project/.sdk/tm/rust/core/spec.rs

@@ -16,6 +16,9 @@ pub struct Spec {
     pub body: Value,
     pub url: String,
     pub path: String,
+    /// The query parameters prepare_auth placed: the credential, which the
+    /// request sends and the entity's match leaves out.
+    pub authquery: Vec<String>,
 }
 
 impl Spec {
@@ -34,6 +37,7 @@ impl Spec {
             body: Value::Noval,
             url: String::new(),
             path: String::new(),
+            authquery: Vec::new(),
         };
 
         if !matches!(specmap, Value::Map(_)) {

package/project/.sdk/tm/rust/core/types.rs

@@ -83,6 +83,7 @@ pub trait ProjectNameEntity: Entity + Sized {
     fn list(self: &Rc<Self>, reqmatch: Value, ctrl: Value) -> Result<Vec<Rc<Self>>, ProjectNameError>;
     fn create(self: &Rc<Self>, reqdata: Value, ctrl: Value) -> Result<Rc<Self>, ProjectNameError>;
     fn update(self: &Rc<Self>, reqdata: Value, ctrl: Value) -> Result<Rc<Self>, ProjectNameError>;
+    fn patch(self: &Rc<Self>, reqdata: Value, ctrl: Value) -> Result<Rc<Self>, ProjectNameError>;
     fn remove(self: &Rc<Self>, reqmatch: Value, ctrl: Value) -> Result<Rc<Self>, ProjectNameError>;
 }
 

package/project/.sdk/tm/rust/feature/test.rs

@@ -28,11 +28,34 @@ impl TestFeature {
     }
 }
 
+/// The key a list's response transform
+/// ["`$EACH`", "body", {"`$MERGE`": "`.<key>`"}] reads each item's record under.
+fn item_envelope_key(restf: &Value) -> Option<String> {
+    let spec = restf.as_list()?.borrow();
+    if spec.len() != 3 || spec[0].as_str() != Some("`$EACH`") || spec[1].as_str() != Some("body") {
+        return None;
+    }
+    let merge = vs::get_prop(&spec[2], &Value::str("`$MERGE`"), Value::Noval);
+    let key = merge.as_str()?.strip_prefix("`.")?.strip_suffix('`')?;
+    if key.is_empty() || key.contains(|c: char| c == '.' || c == '`' || c == '$') {
+        return None;
+    }
+    Some(key.to_string())
+}
+
 fn envelope(ctx: &Rc<Context>, data: Value) -> Value {
     if data.is_noval() || data.is_null() {
         return data;
     }
     let restf = crate::core::helpers::getpath(&["transform", "res"], &ctx.point.borrow());
+    if let (Some(key), Value::List(items)) = (item_envelope_key(&restf), &data) {
+        let wrapped: Vec<Value> = items
+            .borrow()
+            .iter()
+            .map(|item| jo(vec![(key.as_str(), item.clone())]))
+            .collect();
+        return Value::list(wrapped);
+    }
     if let Value::Str(spec) = restf {
         // Rebuild whatever nesting the transform unwraps: a GraphQL op unwraps
         // `body.data.<field>`, not just one envelope property.
@@ -238,7 +261,7 @@ fn test_fetch(
             Ok(respond(ctx, 200, vs::clone(&found), vec![]))
         }
 
-        "update" => {
+        "update" | "patch" => {
             let reqdata = ctx.reqdata.borrow().clone();
             let update_match = Value::empty_map();
             if let Value::Map(_) = reqdata {
@@ -269,7 +292,10 @@ fn test_fetch(
                 ));
             }
             if let (Value::Map(_), Value::Map(_)) = (&ent, &reqdata) {
-                vs::merge(&Value::list(vec![ent.clone(), reqdata.clone()]), None);
+                // `$body` travels on the wire alone; the record is the rest.
+                let rec = vs::clone(&reqdata);
+                vs::del_prop(rec.clone(), &Value::str("$body"));
+                vs::merge(&Value::list(vec![ent.clone(), rec]), None);
             }
             vs::del_prop(ent.clone(), &Value::str("$KEY"));
             Ok(respond(ctx, 200, vs::clone(&ent), vec![]))
@@ -304,6 +330,7 @@ fn test_fetch(
 
             let ent = vs::clone(&ctx.reqdata.borrow().clone());
             if let Value::Map(_) = &ent {
+                vs::del_prop(ent.clone(), &Value::str("$body"));
                 setp(&ent, "id", id.clone());
                 if let Value::Str(id_str) = &id {
                     setp(&entmap, id_str, ent.clone());

package/project/.sdk/tm/rust/feature/validate.rs

@@ -64,6 +64,8 @@ impl ValidateFeature {
 
         if let Some(m) = out.as_map() {
             m.borrow_mut().shift_remove("$action");
+            // Nor is `$body`, the raw request body.
+            m.borrow_mut().shift_remove("$body");
         }
 
         out

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -186,6 +186,113 @@ pub struct EntityTestSetup {
     pub now: i64,
 }
 
+// A live check that did not pass, as main.kit.test.live.strict decides:
+// strict panics; lenient prints the reason and the caller returns, which
+// is as near a skip as a Rust test comes.
+pub fn live_miss(strict: bool, reason: &str) {
+    if strict {
+        panic!("{}", reason);
+    }
+    eprintln!("skip: {}", reason);
+}
+
+// A live response that succeeded: no error, ok, and a 2xx status.
+pub fn live_ok(result: &Value) -> bool {
+    let err = getp(result, "err");
+    (err.is_noval() || err.is_null())
+        && getp(result, "ok") == Value::Bool(true)
+        && (200..300).contains(&to_int(&getp(result, "status")))
+}
+
+// An account holding no record for the test to read skips either way.
+pub fn live_empty(reason: &str) {
+    eprintln!("skip: {}", reason);
+}
+
+// A live list response's records: the body, or the first list an envelope
+// holds.
+pub fn live_list(data: &Value) -> Option<Value> {
+    if let Value::List(_) = data {
+        return Some(data.clone());
+    }
+    if let Value::Map(_) = data {
+        for key in vs::keysof_vec(data) {
+            let value = getp(data, &key);
+            if let Value::List(_) = value {
+                return Some(value);
+            }
+        }
+    }
+    None
+}
+
+// A live response for a message: the SDK's error, or else its status and
+// content type, never its body.
+pub fn live_describe(result: &Value) -> String {
+    let err = getp(result, "err");
+    if !err.is_noval() && !err.is_null() {
+        return vs::stringify(&err, None, false);
+    }
+    let mut out = format!("HTTP {}", vs::stringify(&getp(result, "status"), None, false));
+    let headers = getp(result, "headers");
+    for key in vs::keysof_vec(&headers) {
+        if key.eq_ignore_ascii_case("content-type") {
+            let ctype = vs::stringify(&getp(&headers, &key), None, false);
+            out.push(' ');
+            out.push_str(ctype.split(';').next().unwrap_or("").trim());
+        }
+    }
+    out
+}
+
+// The record a create-less flow reads live: the first its list returns, put
+// where the flow reads the fixture's existing records. False once the test
+// is settled and has to return.
+pub fn live_existing(
+    data: &Value,
+    strict: bool,
+    name: &str,
+    list: impl FnOnce() -> Result<Value, ProjectNameError>,
+) -> bool {
+    let found = match list() {
+        Ok(found) => found,
+        Err(err) => {
+            live_miss(strict, &format!("Live list discovery failed: {}", err));
+            return false;
+        }
+    };
+    if !matches!(found, Value::List(_)) {
+        live_miss(strict, "Live list discovery returned no list");
+        return false;
+    }
+    let first = vs::get_elem(&found, &Value::Num(0.0), Value::Noval);
+    if first.is_noval() {
+        live_empty(&format!("The account has no {} record to load", name));
+        return false;
+    }
+    let mut existing = getp(data, "existing");
+    if !matches!(existing, Value::Map(_)) {
+        existing = Value::empty_map();
+        setp(data, "existing", existing.clone());
+    }
+    setp(&existing, name, jo(vec![("live01", first)]));
+    true
+}
+
+// In a lenient live run a panicking check is reported and the test returns,
+// observing the live API rather than failing on it.
+pub fn live_observe(err: Box<dyn std::any::Any + Send>, live: bool, strict: bool) {
+    if strict || !live {
+        std::panic::resume_unwind(err);
+    }
+    let reason = err
+        .downcast_ref::<String>()
+        .cloned()
+        .or_else(|| err.downcast_ref::<&str>().map(|s| s.to_string()))
+        .unwrap_or_default();
+    eprintln!("skip: live run, main.kit.test.live.strict is false: {}", reason);
+}
+
 /// Extract data maps from a list result (rust list results already carry
 /// plain data maps).
 pub fn entity_list_to_data(list: &Value) -> Value {
@@ -531,7 +638,7 @@ pub struct FhOpResult {
 pub fn fh_default_method(op: &str) -> &'static str {
     match op {
         "create" => "POST",
-        "update" => "PATCH",
+        "update" | "patch" => "PATCH",
         "remove" => "DELETE",
         _ => "GET",
     }

package/project/.sdk/tm/rust/utility/clean.rs

@@ -22,7 +22,6 @@ struct CleanConfig {
     values: Vec<String>,
     mask: String,
     hint: usize,
-    min: usize,
 }
 
 fn normkey(key: &str) -> String {
@@ -126,7 +125,6 @@ fn read_config(block: &Value) -> CleanConfig {
             _ => DEFAULT_MASK.to_string(),
         },
         hint: count(&getp(block, "hint"), 0),
-        min: count(&getp(block, "min"), 4).max(1),
     }
 }
 

package/project/.sdk/tm/rust/utility/fetcher.rs

@@ -54,7 +54,8 @@ fn default_http_fetch(fullurl: &str, fetchdef: &Value) -> Result<Value, ProjectN
     let mut req = agent.request(&method, fullurl);
 
     let mut has_ua = false;
-    if let Value::Map(m) = getp(fetchdef, "headers") {
+    let sent_headers = getp(fetchdef, "headers");
+    if let Value::Map(m) = &sent_headers {
         for (k, v) in m.borrow().iter() {
             if let Value::Str(sv) = v {
                 if k.eq_ignore_ascii_case("user-agent") {
@@ -65,16 +66,20 @@ fn default_http_fetch(fullurl: &str, fetchdef: &Value) -> Result<Value, ProjectN
         }
     }
     // Default User-Agent — some CDNs block library defaults. Use a
-    // Mozilla-shaped UA unless the caller already set one.
+    // Mozilla-shaped UA unless the caller already set one, and record it with
+    // the headers the request sent.
     if !has_ua {
-        req = req.set("User-Agent", "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)");
+        let agent = "Mozilla/5.0 (compatible; ProjectNameSDK/1.0)";
+        req = req.set("User-Agent", agent);
+        if let Value::Map(_) = &sent_headers {
+            setp(&sent_headers, "user-agent", Value::str(agent));
+        }
     }
 
-    let body = get_str(fetchdef, "body").filter(|b| !b.is_empty());
-
-    let sent = match body {
-        Some(b) => req.send_string(&b),
-        None => req.call(),
+    let body = getp(fetchdef, "body");
+    let sent = match crate::utility::media::body_bytes(&body) {
+        Some(bytes) if !bytes.is_empty() => req.send_bytes(&bytes),
+        _ => req.call(),
     };
 
     // ureq reports non-2xx as Err(Status) — unwrap those back into normal
@@ -101,11 +106,13 @@ fn default_http_fetch(fullurl: &str, fetchdef: &Value) -> Result<Value, ProjectN
         .into_string()
         .map_err(|e| ProjectNameError::new("fetch_body", &format!("{}", e)))?;
 
-    let json_body = if body_txt.is_empty() {
-        Value::Noval
+    let parsed = if body_txt.trim().is_empty() {
+        Ok(Value::Noval)
     } else {
-        crate::utility::jsonparse::json_parse(&body_txt).unwrap_or(Value::Noval)
+        crate::utility::jsonparse::json_parse(&body_txt)
     };
+    let unreadable = parsed.is_err();
+    let json_body = parsed.unwrap_or(Value::Noval);
 
     Ok(jo(vec![
         ("status", Value::Num(status as f64)),
@@ -113,6 +120,7 @@ fn default_http_fetch(fullurl: &str, fetchdef: &Value) -> Result<Value, ProjectN
         ("headers", headers),
         ("json", json_thunk(json_body)),
         ("body", Value::str(body_txt)),
+        ("unreadable", Value::Bool(unreadable)),
     ]))
 }
 

package/project/.sdk/tm/rust/utility/make_fetch_def.rs

@@ -29,9 +29,20 @@ pub fn make_fetch_def_util(ctx: &Rc<Context>) -> Result<Value, ProjectNameError>
     setp(&fetchdef, "method", Value::str(spec.borrow().method.clone()));
     setp(&fetchdef, "headers", spec.borrow().headers.clone());
 
+    // A list is a raw body's bytes. A map, any other list, and a scalar on a
+    // point that declares a JSON body are JSON.
     let body = spec.borrow().body.clone();
     if !body.is_noval() {
-        if let Value::Map(_) = body {
+        let point = ctx.point.borrow();
+        let encode = match body {
+            Value::Map(_) => true,
+            Value::List(_) => !crate::utility::media::is_raw_request(&point),
+            Value::Bool(_) | Value::Num(_) | Value::Str(_) => {
+                crate::utility::media::is_json_request(&point)
+            }
+            _ => false,
+        };
+        if encode {
             setp(&fetchdef, "body", Value::str(vs::jsonify(&body, None)));
         } else {
             setp(&fetchdef, "body", body);

package/project/.sdk/tm/rust/utility/make_options.rs

@@ -220,7 +220,8 @@ fn clean_block(opts: &Value) -> Value {
 // The options to scan for secrets. The feature map is keyed by feature
 // names, not field names, so it is scanned as a list: `secrets` must not
 // make every setting of that feature a secret. Entity blocks hold entity
-// settings and seeded records, never a credential, so none is scanned.
+// settings and seeded records, never a credential, so none is scanned, and
+// nor are rbac's rules, keyed by entity and operation names.
 fn without(val: &Value, keys: &[&str]) -> Value {
     let out = Value::empty_map();
     if let Value::Map(m) = val {
@@ -230,9 +231,9 @@ fn without(val: &Value, keys: &[&str]) -> Value {
             }
             let v = match (k.as_str(), v) {
                 ("feature", Value::Map(fm)) => {
-                    Value::list(fm.borrow().iter().map(|(_, fv)| noentity(fv)).collect())
+                    Value::list(fm.borrow().iter().map(|(fk, fv)| plain(fv, fk)).collect())
                 }
-                ("test", _) => noentity(v),
+                ("test", _) => plain(v, ""),
                 _ => v.clone(),
             };
             setp(&out, k, v);
@@ -241,12 +242,12 @@ fn without(val: &Value, keys: &[&str]) -> Value {
     out
 }
 
-fn noentity(val: &Value) -> Value {
+fn plain(val: &Value, name: &str) -> Value {
     match val {
         Value::Map(m) => {
             let out = Value::empty_map();
             for (k, v) in m.borrow().iter() {
-                if "entity" != k.as_str() {
+                if "entity" != k.as_str() && !("rbac" == name && "rules" == k.as_str()) {
                     setp(&out, k, v.clone());
                 }
             }