Module registry 

Process-global registry of resolved secret values + a redaction scrubber.

Interpolation resolves secrets on raw config strings, so by the time the config is a typed structure a secret value is an ordinary String. Rather than tag fields, we track the resolved values and scrub any occurrence from output the CLI emits (the RedactingWriter).

Structs

RedactingMakeWriterobservability

MakeWriter that produces a RedactingWriter over stderr, for the tracing fmt subscriber. Only needed when the observability feature wires a subscriber (the sole place the CLI formats tracing output).

RedactingWriter

An io::Write adapter that runs redact over every chunk before forwarding it to the inner writer. Wrapping the tracing subscriber’s writer in this scrubs secret values out of all CLI log/diagnostic output at the I/O boundary, regardless of which field carried the value.

Functions

redact

Replace every registered secret value in input with ***.

register

Register a resolved secret value so it is scrubbed from future output.