Add typed environment secret references

load.go

@@ -1,6 +1,7 @@
 package configkit
 
 import (
+	"os"
 	"reflect"
 
 	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
@@ -100,6 +101,10 @@ func (r *Result[T]) Diagnostics() []Diagnostic {
 // imports, and one selected profile. It accepts at most one Options value and
 // returns no result when any error is reported.
 func Load[T any](source Source, supplied ...Options[T]) (*Result[T], error) {
+	return loadWithSecretLookup(source, os.LookupEnv, supplied...)
+}
+
+func loadWithSecretLookup[T any](source Source, lookup secretLookup, supplied ...Options[T]) (*Result[T], error) {
 	accumulator := diagnosticAccumulator{}
 	options, diagnostics := selectOptions(source, supplied)
 	if len(diagnostics) != 0 {
@@ -208,8 +213,13 @@ func Load[T any](source Source, supplied ...Options[T]) (*Result[T], error) {
 		resolutionSnapshots = resolved.snapshots
 		applyResolutionMetadata(&metadata, resolved)
 	}
+	secretResolution := resolveSecretReferences(reflect.ValueOf(&configuration).Elem(), schema, inputDocument, lookup)
+	accumulator.add(secretResolution.diagnostics...)
+	if hasErrors(secretResolution.diagnostics) {
+		return nil, accumulator.loadError()
+	}
 	if options.Definition.Validate != nil {
-		validationDiagnostics := runValidation(&configuration, options.Definition.Validate, schema, final, inputDocument)
+		validationDiagnostics := runValidation(&configuration, options.Definition.Validate, schema, final, inputDocument, secretResolution.lookups)
 		accumulator.add(validationDiagnostics...)
 		if hasErrors(validationDiagnostics) {
 			return nil, accumulator.loadError()