Struct SecretArrayVec 

pub struct SecretArrayVec<T: SecureSanitize, const CAP: usize> { /* private fields */ }

Clear-on-drop wrapper around ArrayVec.

Live elements are sanitized and dropped before the complete resulting MaybeUninit<T> spare region is volatile-cleared. This covers inline bytes left by earlier push, pop, truncate, clear, reuse, or wrapping operations without raw-zeroing a live T.

Implementations

impl<T: SecureSanitize, const CAP: usize> SecretArrayVec<T, CAP>

pub const fn new() -> Self

Create an empty secret array vector.

pub fn from_arrayvec(inner: ArrayVec<T, CAP>) -> Self

Wrap an existing ArrayVec.

Historical bytes in the incoming vector’s current spare capacity are cleared immediately. Live elements remain unchanged.

pub fn len(&self) -> usize

Number of initialized elements.

pub const fn capacity(&self) -> usize

Maximum number of elements.

pub fn is_empty(&self) -> bool

Returns true when there are no initialized elements.

pub fn push(&mut self, value: T) -> Result<(), CapacityError<T>>

Push one sanitizable element.

If the vector is full, CapacityError returns the original element unchanged, matching arrayvec semantics. Callers remain responsible for sanitizing or securely reusing that rejected value. Use SecretArrayVec::push_or_sanitize when rejection must consume and clear the element instead.

pub fn push_or_sanitize( &mut self, value: T, ) -> Result<(), SanitizedCapacityError>

Push an element, consuming and sanitizing it if the vector is full.

The error intentionally carries no T, preventing callers from mistaking a sanitized value for the original secret.

pub fn pop(&mut self) -> Option<T>

Remove and return the last element.

The returned value remains secret-bearing and is the caller’s responsibility. The stale inline slot left by the move is volatile-cleared before this method returns.

pub fn truncate(&mut self, new_len: usize)

Shorten the vector to new_len.

Removed elements are sanitized before their destructors run. The complete spare region, including historical bytes from earlier operations, is then volatile-cleared.

pub fn as_slice(&self) -> &[T]

Borrow initialized elements.

pub fn as_mut_slice(&mut self) -> &mut [T]

Mutably borrow initialized elements.

pub fn with_secret<R>(&self, inspect: impl FnOnce(&[T]) -> R) -> R

Run a closure with read-only access to initialized elements.

pub fn with_secret_mut<R>(&mut self, edit: impl FnOnce(&mut [T]) -> R) -> R

Run a closure with mutable access to initialized elements.

pub fn clear_secret(&mut self)

Sanitize and drop all live elements, then clear all inline backing bytes.

pub fn into_cleared(self)

Consume after first sanitizing all live elements.

Trait Implementations

impl<T: SecureSanitize, const CAP: usize> Debug for SecretArrayVec<T, CAP>

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: SecureSanitize, const CAP: usize> Default for SecretArrayVec<T, CAP>

fn default() -> Self

Returns the “default value” for a type.

impl<T: SecureSanitize, const CAP: usize> Drop for SecretArrayVec<T, CAP>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl<T: SecureSanitize, const CAP: usize> SecureSanitize for SecretArrayVec<T, CAP>

fn secure_sanitize(&mut self)

Clear the sensitive bytes owned by this value.