OptionsDescription audit: clean transport rendering + secret-safe connection info

Directory.Packages.props

@@ -28,7 +28,7 @@
     <PackageVersion Include="Grpc.StatusProto" Version="2.76.0" />
     <PackageVersion Include="Grpc.Tools" Version="2.76.0" />
     <PackageVersion Include="HtmlTags" Version="9.0.0" />
-    <PackageVersion Include="JasperFx" Version="1.24.1" />
+    <PackageVersion Include="JasperFx" Version="1.26.0" />
     <PackageVersion Include="JasperFx.Events" Version="1.28.1" />
     <PackageVersion Include="JasperFx.RuntimeCompiler" Version="4.4.0" />
     <PackageVersion Include="JasperFx.SourceGeneration" Version="1.1.0" />

src/Http/Wolverine.Http/Transport/HttpEndpoint.cs

@@ -1,4 +1,5 @@
 using System.Text.Json;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Wolverine.Configuration;
 using Wolverine.Runtime;
@@ -21,6 +22,7 @@ public override ValueTask<IListener> BuildListenerAsync(IWolverineRuntime runtim
         return ValueTask.FromResult<IListener>(new NulloListener(Uri));
     }
 
+    [IgnoreDescription]
     public JsonSerializerOptions SerializerOptions { get; set; } = new JsonSerializerOptions
     {
         PropertyNamingPolicy = JsonNamingPolicy.CamelCase,

src/Transports/AWS/Wolverine.AmazonSns/Internal/AmazonSnsSubscription.cs

@@ -37,4 +37,10 @@ internal AmazonSnsSubscription(Subscription subscription)
         };
 
     public AmazonSnsSubscriptionAttributes Attributes { get; }
+
+    /// <summary>
+    /// Used by OptionsDescription (via [DescribeAsStringArray]) to render this
+    /// subscription as a single readable line.
+    /// </summary>
+    public override string ToString() => $"{Protocol}:{Endpoint}";
 }

src/Transports/AWS/Wolverine.AmazonSns/Internal/AmazonSnsTopic.cs

@@ -3,6 +3,7 @@
 using Amazon.SQS;
 using Amazon.SQS.Model;
 using JasperFx.Core;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Wolverine.Configuration;
 using Wolverine.Runtime;
@@ -59,7 +60,9 @@ internal ISnsEnvelopeMapper BuildMapper(IWolverineRuntime runtime)
     public string TopicName { get; }
     public string TopicArn { get; set; }
 
+    [ChildDescription]
     public CreateTopicRequest Configuration { get; }
+    [DescribeAsStringArray]
     public IList<AmazonSnsSubscription> TopicSubscriptions { get; set; } = new List<AmazonSnsSubscription>();
 
     public async ValueTask<bool> CheckAsync()

src/Transports/AWS/Wolverine.AmazonSns/Internal/AmazonSnsTransport.cs

@@ -2,6 +2,7 @@
 using Amazon.SimpleNotificationService;
 using Amazon.SQS;
 using JasperFx.Core;
+using JasperFx.Descriptors;
 using Wolverine.AmazonSqs.Internal;
 using Wolverine.Runtime;
 using Wolverine.Transports;
@@ -29,9 +30,12 @@ internal AmazonSnsTransport(IAmazonSimpleNotificationService snsClient, IAmazonS
 
     public override Uri ResourceUri => new(SnsConfig.ServiceURL);
 
+    [DescribeAsConfigurationState]
     public Func<IWolverineRuntime, AWSCredentials>? CredentialSource { get; set; }
+    [IgnoreDescription]
     public LightweightCache<string, AmazonSnsTopic> Topics { get; }
-
+
+    [ChildDescription]
     public AmazonSimpleNotificationServiceConfig SnsConfig { get; } = new();
     internal IAmazonSimpleNotificationService? SnsClient { get; private set; }
     internal IAmazonSQS? SqsClient { get; private set; }
@@ -131,6 +135,7 @@ private AmazonSQSClient buildSqsClient(IWolverineRuntime runtime)
     /// Override to customize the queue policy for permissions for an AWS SQS queue that subscribes to
     /// an SNS topic
     /// </summary>
+    [IgnoreDescription]
     public Func<SqsTopicDescription, string> QueuePolicyBuilder { get; set; } = description =>
     {
         var queuePolicy = $$"""

src/Transports/AWS/Wolverine.AmazonSns/Internal/CloudEventsSnsMapper.cs

@@ -12,6 +12,8 @@ public CloudEventsSnsMapper(CloudEventsMapper inner)
         _inner = inner;
     }
 
+    public override string ToString() => "Cloud Events";
+
     public string BuildMessageBody(Envelope envelope)
     {
         return _inner.WriteToString(envelope);

src/Transports/AWS/Wolverine.AmazonSns/Internal/MassTransitMapper.cs

@@ -16,6 +16,8 @@ public MassTransitMapper(IMassTransitInteropEndpoint endpoint)
         _serializer = new MassTransitJsonSerializer(endpoint);
     }
 
+    public override string ToString() => "MassTransit Interop";
+
     public MassTransitJsonSerializer Serializer => _serializer;
 
     public string BuildMessageBody(Envelope envelope)

src/Transports/AWS/Wolverine.AmazonSns/Internal/NServiceBusEnvelopeMapper.cs

@@ -22,6 +22,8 @@ public NServiceBusEnvelopeMapper(string replyName, Endpoint endpoint)
         _endpoint = endpoint;
     }
 
+    public override string ToString() => "NServiceBus Interop";
+
     public IEnumerable<KeyValuePair<string, MessageAttributeValue>> ToAttributes(Envelope envelope)
     {
         yield return new ("NServiceBus.ConversationId",

src/Transports/AWS/Wolverine.AmazonSns/RawJsonSnsEnvelopeMapper.cs

@@ -16,6 +16,8 @@ public RawJsonSnsEnvelopeMapper(Type defaultMessageType, JsonSerializerOptions s
         _serializerOptions = serializerOptions;
     }
 
+    public override string ToString() => "Raw JSON";
+
     public string BuildMessageBody(Envelope envelope)
     {
         return JsonSerializer.Serialize(

src/Transports/AWS/Wolverine.AmazonSqs/Internal/AmazonSqsQueue.cs

@@ -2,6 +2,7 @@
 using Amazon.SQS.Model;
 using JasperFx.Core;
 using JasperFx.Core.Reflection;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Wolverine.Configuration;
 using Wolverine.Runtime;
@@ -84,6 +85,7 @@ public int VisibilityTimeout
     /// <summary>
     ///     Additional configuration for how an SQS queue should be created
     /// </summary>
+    [ChildDescription]
     public CreateQueueRequest Configuration { get; }
 
     /// <summary>

src/Transports/AWS/Wolverine.AmazonSqs/Internal/AmazonSqsTransport.cs

@@ -2,6 +2,7 @@
 using Amazon.SQS;
 using Amazon.SQS.Model;
 using JasperFx.Core;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Spectre.Console;
 using Wolverine.Configuration;
@@ -41,10 +42,13 @@ internal AmazonSqsTransport(IAmazonSQS client) : this()
         Client = client;
     }
 
+    [DescribeAsConfigurationState]
     public Func<IWolverineRuntime, AWSCredentials>? CredentialSource { get; set; }
 
+    [IgnoreDescription]
     public LightweightCache<string, AmazonSqsQueue> Queues { get; }
 
+    [ChildDescription]
     public AmazonSQSConfig Config { get; } = new();
 
     internal IAmazonSQS? Client { get; private set; }

src/Transports/AWS/Wolverine.AmazonSqs/Internal/CloudEventsSqsMapper.cs

@@ -13,6 +13,8 @@ public CloudEventsSqsMapper(CloudEventsMapper inner)
         _inner = inner;
     }
 
+    public override string ToString() => "Cloud Events";
+
     public string BuildMessageBody(Envelope envelope)
     {
         return _inner.WriteToString(envelope);

src/Transports/AWS/Wolverine.AmazonSqs/Internal/MassTransitMapper.cs

@@ -18,6 +18,8 @@ public MassTransitMapper(IMassTransitInteropEndpoint endpoint)
         _serializer = new MassTransitJsonSerializer(endpoint);
     }
 
+    public override string ToString() => "MassTransit Interop";
+
     public MassTransitJsonSerializer Serializer => _serializer;
 
     public string BuildMessageBody(Envelope envelope)

src/Transports/AWS/Wolverine.AmazonSqs/RawJsonSqsEnvelopeMapper.cs

@@ -16,6 +16,8 @@ public RawJsonSqsEnvelopeMapper(Type defaultMessageType, JsonSerializerOptions s
         _serializerOptions = serializerOptions;
     }
 
+    public override string ToString() => "Raw JSON";
+
     public string BuildMessageBody(Envelope envelope)
     {
         return JsonSerializer.Serialize(

src/Transports/Azure/Wolverine.AzureServiceBus/AzureServiceBusTransport.cs

@@ -3,6 +3,7 @@
 using Azure.Messaging.ServiceBus;
 using Azure.Messaging.ServiceBus.Administration;
 using JasperFx.Core;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Wolverine.AzureServiceBus.Internal;
 using Wolverine.Configuration;
@@ -84,23 +85,49 @@ public override string SanitizeIdentifier(string identifier)
     /// </summary>
     public bool SystemQueuesEnabled { get; set; } = true;
 
+    [IgnoreDescription]
     public LightweightCache<string, AzureServiceBusQueue> Queues { get; }
+    [IgnoreDescription]
     public LightweightCache<string, AzureServiceBusTopic> Topics { get; }
 
+    // Contains shared access key / password — raw value hidden to avoid
+    // leaking secrets in diagnostic views. Surfaced via ConnectionSummary below.
+    [IgnoreDescription]
     public string? ConnectionString { get; set; }
 
     /// <summary>
     /// Optional separate connection string for the ServiceBusAdministrationClient.
     /// When set, the management client uses this instead of ConnectionString.
     /// Useful for the Azure Service Bus Emulator which exposes management on a different port.
     /// </summary>
+    [IgnoreDescription]
     public string? ManagementConnectionString { get; set; }
 
+    /// <summary>
+    /// The configured connection string with the <c>SharedAccessKey</c> value
+    /// masked. Safe to render in diagnostic output.
+    /// </summary>
+    public string? ConnectionSummary => ConnectionString == null
+        ? null
+        : ConnectionStringRedactor.Redact(ConnectionString, "SharedAccessKey");
+
+    /// <summary>
+    /// The configured management connection string with the <c>SharedAccessKey</c>
+    /// value masked. Safe to render in diagnostic output.
+    /// </summary>
+    public string? ManagementConnectionSummary => ManagementConnectionString == null
+        ? null
+        : ConnectionStringRedactor.Redact(ManagementConnectionString, "SharedAccessKey");
+
     public string? FullyQualifiedNamespace { get; set; }
+    [IgnoreDescription]
     public TokenCredential? TokenCredential { get; set; }
+    [IgnoreDescription]
     public AzureNamedKeyCredential? NamedKeyCredential { get; set; }
+    [IgnoreDescription]
     public AzureSasCredential? SasCredential { get; set; }
 
+    [ChildDescription]
     public ServiceBusClientOptions ClientOptions { get; } = new()
     {
         TransportType = ServiceBusTransportType.AmqpTcp

src/Transports/Azure/Wolverine.AzureServiceBus/Internal/AzureServiceBusEndpoint.cs

@@ -1,5 +1,6 @@
 using Azure.Messaging.ServiceBus;
 using JasperFx.Core;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Wolverine.Configuration;
 using Wolverine.Runtime;
@@ -31,6 +32,7 @@ public AzureServiceBusEndpoint(AzureServiceBusTransport parent, Uri uri, Endpoin
         Parent = parent;
     }
 
+    [IgnoreDescription]
     public AzureServiceBusTransport Parent { get; }
 
     /// <summary>

src/Transports/Azure/Wolverine.AzureServiceBus/Internal/AzureServiceBusQueue.cs

@@ -4,6 +4,7 @@
 using Azure.Messaging.ServiceBus.Administration;
 using JasperFx.Core;
 using JasperFx.Core.Reflection;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json;
 using Wolverine.Configuration;
@@ -36,6 +37,7 @@ public AzureServiceBusQueue(AzureServiceBusTransport parent, string queueName,
         };
     }
 
+    [ChildDescription]
     public CreateQueueOptions Options { get; }
 
     public string QueueName { get; }

src/Transports/Azure/Wolverine.AzureServiceBus/Internal/AzureServiceBusSubscription.cs

@@ -4,6 +4,7 @@
 using Azure.Messaging.ServiceBus.Administration;
 using JasperFx.Core;
 using JasperFx.Core.Reflection;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json;
 using Wolverine.Configuration;
@@ -41,12 +42,16 @@ public AzureServiceBusSubscription(AzureServiceBusTransport parent, AzureService
         RuleOptions = new CreateRuleOptions();
     }
 
+    [ChildDescription]
     public CreateSubscriptionOptions Options { get; }
 
+    [ChildDescription]
     public CreateRuleOptions RuleOptions { get; }
 
     public string SubscriptionName { get; }
 
+    // No attribute needed — AzureServiceBusTopic.ToString() returns TopicName,
+    // so this property renders as the topic name string (per audit decision).
     public AzureServiceBusTopic Topic { get; }
 
     public override ValueTask<IListener> BuildListenerAsync(IWolverineRuntime runtime, IReceiver receiver)

src/Transports/Azure/Wolverine.AzureServiceBus/Internal/AzureServiceBusTopic.cs

@@ -3,6 +3,7 @@
 using Azure.Messaging.ServiceBus.Administration;
 using JasperFx.Core;
 using JasperFx.Core.Reflection;
+using JasperFx.Descriptors;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json;
 using Wolverine.Configuration;
@@ -33,6 +34,12 @@ public AzureServiceBusTopic(AzureServiceBusTransport parent, string topicName) :
 
     public string TopicName { get; }
 
+    /// <summary>
+    /// Used by OptionsDescription to render references to this topic (for example
+    /// from <see cref="AzureServiceBusSubscription.Topic"/>) as just the topic name.
+    /// </summary>
+    public override string ToString() => TopicName;
+
     public override ValueTask<IListener> BuildListenerAsync(IWolverineRuntime runtime, IReceiver receiver)
     {
         throw new NotSupportedException();
@@ -60,6 +67,7 @@ public override ValueTask TeardownAsync(ILogger logger)
         return new ValueTask(Parent.WithManagementClientAsync(client => client.DeleteTopicAsync(TopicName)));
     }
 
+    [ChildDescription]
     public CreateTopicOptions Options { get; }
 
     public override ValueTask SetupAsync(ILogger logger)

src/Transports/Kafka/Wolverine.Kafka/Internals/KafkaTransport.cs

@@ -1,5 +1,6 @@
 using Confluent.Kafka;
 using JasperFx.Core;
+using JasperFx.Descriptors;
 using Wolverine.Configuration;
 using Wolverine.Runtime;
 using Wolverine.Runtime.Routing;
@@ -16,17 +17,24 @@ public enum KafkaUsage
 
 public class KafkaTransport : BrokerTransport<KafkaTopic>
 {
+    [IgnoreDescription]
     public Cache<string, KafkaTopic> Topics { get; }
 
     internal List<KafkaTopicGroup> TopicGroups { get; } = new();
 
+    [ChildDescription]
     public ProducerConfig ProducerConfig { get; } = new();
+    [IgnoreDescription]
     public Action<ProducerBuilder<string, byte[]>> ConfigureProducerBuilders { get; internal set; } = _ => {};
 
+    [ChildDescription]
     public ConsumerConfig ConsumerConfig { get; } = new();
+    [IgnoreDescription]
     public Action<ConsumerBuilder<string, byte[]>> ConfigureConsumerBuilders { get; internal set; } = _ => {};
 
+    [ChildDescription]
     public AdminClientConfig AdminClientConfig { get; } = new();
+    [IgnoreDescription]
     public Action<AdminClientBuilder> ConfigureAdminClientBuilders { get; internal set; } = _ => {};
 
     public KafkaTransport() : this("kafka")