Add redacted effective rendering

load.go

@@ -7,6 +7,7 @@ import (
 )
 
 // Definition contains reusable application rules for a configuration type.
+// Secret is a pure predicate that can add sensitivity to semantic paths.
 // Definitions should be treated as read-only after being shared.
 type Definition[T any] struct {
 	Defaults func() T
@@ -68,6 +69,7 @@ type Result[T any] struct {
 	diagnostics []Diagnostic
 	final       *document.Node
 	resolution  []resolutionSnapshot
+	secrets     map[string]bool
 }
 
 // Metadata returns detached effective presence, origin, and history records.
@@ -213,6 +215,7 @@ func Load[T any](source Source, supplied ...Options[T]) (*Result[T], error) {
 			return nil, accumulator.loadError()
 		}
 	}
+	secrets := classifySecretPaths(schema, options.Definition.Secret, metadata, final)
 	return &Result[T]{
 		Config:      configuration,
 		metadata:    metadata,
@@ -220,6 +223,7 @@ func Load[T any](source Source, supplied ...Options[T]) (*Result[T], error) {
 		diagnostics: canonicalDiagnostics(accumulator.diagnostics),
 		final:       document.Clone(final),
 		resolution:  cloneResolutionSnapshots(resolutionSnapshots),
+		secrets:     secrets,
 	}, nil
 }
 
@@ -233,9 +237,6 @@ func selectOptions[T any](source Source, supplied []Options[T]) (Options[T], []D
 	}
 	var diagnostics []Diagnostic
 	definition := options.Definition
-	if definition.Secret != nil {
-		diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsUnavailable, "dynamic secret classification is not available in this release boundary"))
-	}
 	if !validProfileName(options.Profile) {
 		diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, "profile name must contain only ASCII letters, digits, underscore, or hyphen"))
 	}