fix(publish): redact inline registry credentials

crates/aube/src/commands/publish.rs

@@ -472,9 +472,10 @@ async fn publish_one(
             });
         }
         return Err(miette!(
-            "{}: {name}@{version} is already on {registry_url}\n\
+            "{}: {name}@{version} is already on {}\n\
              help: pass --force to republish (the registry must allow it; npm's public registry does not)",
-            aube_util::cmd("publish")
+            aube_util::cmd("publish"),
+            aube_util::url::redact_url(&registry_url),
         ));
     }
 
@@ -740,7 +741,12 @@ async fn exchange_npm_oidc_token(
         .send()
         .await
         .into_diagnostic()
-        .wrap_err_with(|| format!("failed to exchange npm OIDC token at {endpoint}"))?;
+        .wrap_err_with(|| {
+            format!(
+                "failed to exchange npm OIDC token at {}",
+                aube_util::url::redact_url(&endpoint)
+            )
+        })?;
     if !resp.status().is_success() {
         tracing::debug!(
             status = %resp.status(),
@@ -928,12 +934,7 @@ fn emit_outcome(outcome: &PublishOutcome, as_json: bool) -> miette::Result<()> {
 fn emit_outcome_line(outcome: &PublishOutcome) {
     match outcome.status {
         PublishStatus::DryRun => {
-            println!(
-                "+ {}@{} (dry run, would PUT to {})",
-                outcome.name,
-                outcome.version,
-                put_url(&outcome.registry_url, &outcome.name)
-            );
+            println!("{}", dry_run_outcome_line(outcome));
             if let Some(archive) = &outcome.archive {
                 for f in &archive.files {
                     println!("  {f}");
@@ -952,6 +953,15 @@ fn emit_outcome_line(outcome: &PublishOutcome) {
     }
 }
 
+fn dry_run_outcome_line(outcome: &PublishOutcome) -> String {
+    format!(
+        "+ {}@{} (dry run, would PUT to {})",
+        outcome.name,
+        outcome.version,
+        aube_util::url::redact_url(&put_url(&outcome.registry_url, &outcome.name))
+    )
+}
+
 fn emit_json_outcomes(outcomes: &[PublishOutcome]) -> miette::Result<()> {
     let out = serde_json::to_string_pretty(&publish_outcomes_json(outcomes)).into_diagnostic()?;
     println!("{out}");
@@ -1610,4 +1620,20 @@ mod tests {
             "//registry.npmjs.org/"
         );
     }
+
+    #[test]
+    fn publish_target_display_redacts_inline_registry_credentials() {
+        let outcome = PublishOutcome {
+            name: "@scope/pkg".to_string(),
+            version: "1.0.0".to_string(),
+            registry_url: "https://user:secret@registry.example/".to_string(),
+            archive: None,
+            status: PublishStatus::DryRun,
+        };
+
+        assert_eq!(
+            dry_run_outcome_line(&outcome),
+            "+ @scope/pkg@1.0.0 (dry run, would PUT to https://***@registry.example/@scope%2Fpkg)"
+        );
+    }
 }