Struct Vault 

pub struct Vault { /* private fields */ }

Maps a redaction sentinel to the original plaintext it stands in for, and allocates a stable per-type counter so two distinct values of the same type stay distinct ([REDACTED_EMAIL_1_<suffix>] vs [REDACTED_EMAIL_2_<suffix>]).

Implementations

impl Vault

pub fn new() -> Self

Build a vault with a freshly-minted per-request random nonce, derived from the thread RNG so two concurrent requests never share a sentinel namespace.

pub fn deterministic(key: &[u8]) -> Self

Build a deterministic vault keyed by caller-owned secret key: every sentinel suffix is HMAC(key, value)[:n], so the same value under the same key redacts byte-identically across independent vaults. The key is copied into the vault and zeroized on drop.

pub fn with_strategy(strategy: NonceStrategy) -> Self

Build a vault under an explicit NonceStrategy — the general entry point behind Self::new (Random) and Self::deterministic.

pub fn with_nonce(nonce: String) -> Self

Build a vault with an explicit nonce. Test-only escape hatch so a test can assert against a fixed sentinel; production always mints a random one via Self::new.

pub fn nonce(&self) -> Option<&str>

The request’s random nonce, or None in deterministic mode (where the suffix is per-value, not per-request). For audit and tests only.

pub fn is_empty(&self) -> bool

Whether the vault holds any redaction. An empty vault is the byte-identical-passthrough signal on the response path.

pub fn len(&self) -> usize

Number of distinct values interned.

pub fn intern(&mut self, ty: &str, original: &str, restorable: bool) -> String

Intern original under entity type ty, returning its sentinel. The same original value seen twice in one request returns the same sentinel; a new value allocates the next per-type counter.

restorable marks the sentinel for the restore pass: true for a RoundTrip input redaction (the caller’s own PII, echoed back), false for a OneWay redaction (a secret, or model-emitted PII masked on output). Restorability is sticky-true: if a value is interned restorable once, a later OneWay intern of the same value (the model echoing the caller’s literal input) keeps it restorable, because it is still the caller’s value.

pub fn is_restorable(&self, placeholder: &str) -> bool

Whether placeholder was interned as restorable (a RoundTrip input redaction). The restore pass consults this so it never rehydrates a OneWay sentinel — a secret, or model-emitted PII masked on output — even when that sentinel shares an entity type with a restored input value.

pub fn original_for(&self, placeholder: &str) -> Option<&str>

Look up the original for a sentinel (exact match). The detokenize half of the round-trip; the proptest pins intern then original_for as an identity.

pub fn entries(&self) -> impl Iterator<Item = (&str, &str)>

Iterate (sentinel, original) pairs for the restore pass.

pub fn interned_counts(&self) -> impl Iterator<Item = (&str, u32)>

Iterate (entity_type, count) for every type interned so far, where the count is the number of distinct values redacted under that type. The keys are entity type labels (EMAIL, AWS_ACCESS_KEY…), never values — so a metrics consumer can diff this snapshot across a scanner run to attribute redactions per type without ever touching plaintext.

pub fn note_restored(&mut self, ty: &str, n: u32)

Record that n sentinels of entity type ty were restored against this vault. The restore pass calls this so a metrics consumer can read the restored tally; it stores counts and the type label only.

pub fn restored_counts(&self) -> impl Iterator<Item = (&str, u32)>

Iterate (entity_type, count) of restores recorded via Vault::note_restored. Type labels and counts only.

Trait Implementations

impl Debug for Vault

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Reports only counts and mode — never the originals, nonce, or key, which are the host-side secret this type exists to hold.

impl Default for Vault

fn default() -> Self

Mints a fresh random nonce, same as Self::new — there is no suffix-less vault, so default() is never a footgun.

impl Drop for Vault

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.