Optionalredacted: string | null = nullDisplay text for a partially redacted string, or null for a
whole-value secret.
StaticREDACTEDThe real, fully unmasked value underneath.
the redacted display text, never the real value
the redacted display text
StaticrevealUnwraps value if it is a Secret, returning anything else unchanged
-- handy for code that accepts either.
Wraps a secret value (CASC.md §4.3's
*key-prefixed keys) in the resultloadFile/loadStringreturn, so it never leaks by accident:String(secret), template literals,JSON.stringify, andutil.inspect/console.logall render the redacted text regardless of the wrapped value. Reach the real value deliberately viareveal()(or thevalueproperty) -- redaction is only ever a display-time concern, never a barrier to the application's own deliberate use of the value.Mirrors
Cooper.Secret. One JS-specific hardening on top:valueis a non-enumerable property, so object spread,Object.keys,structuredClone, and logging libraries that walk enumerable keys don't copy the real value out either.Partial redaction
A secret embedded inside a larger interpolated string (
"postgres://user:%{database.password}@host") redacts only the embedded portion -- the result displays as"postgres://user:[~~REDACTED~~]@host", each secret at its own position.redactedcarries that precomputed display text;null(an ordinary whole-value secret) falls back to the blanket[~~REDACTED~~]marker. Either wayvalue/reveal()give back the real, fully unmasked value.