A teammate defines an output that exposes a database connection string containing a generated password. When they run `terraform apply`, the full connection string is printed in plain text at the end of the run, and it also appears in CI logs. They want the value to remain retrievable programmatically (for example via `terraform output -json` or by other configurations) but not be displayed in normal CLI output. What should they add to the output block?