Enforce redaction for resolved pipeline summaries

internal/core/config/redaction.go

@@ -25,6 +25,10 @@ func (e EffectiveConfig) RedactedSummaryPayload() any {
 	}
 }
 
+func (e EffectiveConfig) RedactedResolvedPipelinePayload() pipeline.ResolvedPipeline {
+	return cloneResolvedPipeline(e.ResolvedPipeline)
+}
+
 func cloneResolvedPipeline(in pipeline.ResolvedPipeline) pipeline.ResolvedPipeline {
 	out := in
 	out.Input = redactBinding(cloneModuleBinding(in.Input))
@@ -116,26 +120,26 @@ func redactOptions(values map[string]any) map[string]any {
 			out[key] = "[REDACTED]"
 			continue
 		}
-		switch typed := value.(type) {
-		case map[string]any:
-			out[key] = redactOptions(typed)
-		case []any:
-			items := make([]any, len(typed))
-			for i, item := range typed {
-				if nested, ok := item.(map[string]any); ok {
-					items[i] = redactOptions(nested)
-				} else {
-					items[i] = item
-				}
-			}
-			out[key] = items
-		default:
-			out[key] = value
-		}
+		out[key] = redactOptionValue(value)
 	}
 	return out
 }
 
+func redactOptionValue(value any) any {
+	switch typed := value.(type) {
+	case map[string]any:
+		return redactOptions(typed)
+	case []any:
+		items := make([]any, len(typed))
+		for i, item := range typed {
+			items[i] = redactOptionValue(item)
+		}
+		return items
+	default:
+		return typed
+	}
+}
+
 func sensitiveConfigKey(key string) bool {
 	key = strings.ToLower(key)
 	return strings.Contains(key, "api_key") || strings.Contains(key, "apikey") || strings.Contains(key, "authorization") || strings.Contains(key, "bearer") || strings.Contains(key, "password") || strings.Contains(key, "secret") || strings.Contains(key, "token")