Module observability 

Observability - opt-in, local-first structured event logging and secret-safe protocol redaction.

Feedback 03 “Observability” contract: no invasive telemetry by default. This module is disabled by default: EventLog::from_env returns a no-op log unless AUTH_CLOUDFLARE_OBSERVABILITY=1. When enabled, events are appended as one JSON object per line (JSONL) to a local file - never shipped anywhere, never read back by this crate.

Privacy invariants (binding)

• The standard event log never stores prompt content or full tool output. Event carries only request metadata (model id, counts, latency, cost estimate, trace id) - no user text, no secrets.
• redact is the shared scrubber for any text that might reach a developer log: it removes Authorization headers, Bearer tokens, cfut_/cfwt_ token prefixes, cookie values, and ENV_VAR=value-style substrings.
• debug_protocol_enabled gates an explicit developer-only mode (AUTH_CLOUDFLARE_DEBUG_PROTOCOL=1). That mode only enables sanitized protocol traces - every trace must still pass through redact so Authorization, Bearer tokens, cookies, env-var values, known token prefixes, and private file contents never reach the log.

Structs

Event

One structured observability event, serialized as a single snake_case JSON line.

EventLog

Local JSONL event log. Disabled (no-op) unless explicitly enabled.

Constants

DEBUG_PROTOCOL_ENV

Enables sanitized protocol traces when set to the exact value "1".

EVENT_LOG_ENV

Overrides the event-log file path when set.

OBSERVABILITY_ENV

Enables the local event log when set to the exact value "1".

Functions

debug_protocol_enabled

True when AUTH_CLOUDFLARE_DEBUG_PROTOCOL is exactly "1" - the developer-only gate for sanitized protocol traces. Any other value (including "true", "0", or unset) is false.

redact

Scrub secret-bearing text for a developer log or protocol trace.