Module registry 

Process-global registry of resolved secret values + a redaction scrubber.

Interpolation resolves secrets on raw config strings, so by the time the config is a typed structure a secret value is an ordinary String. Rather than tag fields, we track the resolved values and scrub any occurrence from output the CLI emits (the RedactingWriter).

Structs

RedactingMakeWriterobservability

MakeWriter that produces a RedactingWriter over stderr, for the tracing fmt subscriber. Only needed when the observability feature wires a subscriber (the sole place the CLI formats tracing output).

RedactingWriter

An io::Write adapter that runs redact over every chunk before forwarding it to the inner writer. Wrapping the tracing subscriber’s writer in this scrubs secret values out of all CLI log/diagnostic output at the I/O boundary, regardless of which field carried the value.

Functions

redact

Replace every registered secret value in input with ***.

redact_with

Replace every registered secret value in input with a caller-supplied token. token(secret) receives the raw secret and returns its replacement; it is called only for secrets actually present in input. Used by the config-snapshot writer (#374) to swap secrets for stable <secret:sha256:…> tokens instead of ***, so a rotation surfaces as a changed hash without ever persisting the secret. Same longest-first ordering as redact.

register

Register a resolved secret value so it is scrubbed from future output.