Add typed environment secret references

projection.go

@@ -222,6 +222,12 @@ func (o *valueOperation) project(value reflect.Value, descriptor *typeDescriptor
 			node.Text = time.Duration(value.Int()).String()
 		}
 		return node, issue
+	case descriptorSecret:
+		node, issue := o.node(document.String, path, depth)
+		if issue == nil {
+			node.Text = value.Interface().(Secret).EnvName()
+		}
+		return node, issue
 	case descriptorText:
 		text, issue := marshalCanonicalText(value, path)
 		if issue != nil {
@@ -336,6 +342,13 @@ func (o *valueOperation) clone(value reflect.Value, descriptor *typeDescriptor,
 		result := reflect.New(value.Type()).Elem()
 		result.Set(cloned)
 		return result, nil
+	case descriptorSecret:
+		result := reflect.New(value.Type()).Elem()
+		reference := value.Interface().(Secret)
+		if reference.specified {
+			result.Set(reflect.ValueOf(SecretEnv(reference.EnvName())))
+		}
+		return result, nil
 	case descriptorText:
 		text, issue := marshalCanonicalText(value, path)
 		if issue != nil {
@@ -360,14 +373,39 @@ func (o *valueOperation) clone(value reflect.Value, descriptor *typeDescriptor,
 }
 
 func (o *valueOperation) dynamicDescriptor(current reflect.Type, path Path) (*typeDescriptor, *projectionIssue) {
+	if current == secretType {
+		return nil, &projectionIssue{code: CodeSchemaDynamicType, path: path.clone(), message: "dynamic configuration values cannot establish secret-reference semantics"}
+	}
 	builder := schemaBuilder{cache: o.schema.types, building: make(map[reflect.Type]bool)}
 	descriptor, issue := builder.describe(current, path)
 	if issue != nil {
 		return nil, &projectionIssue{code: CodeSchemaDynamicType, path: path.clone(), message: "dynamic configuration value has an unsupported type"}
 	}
+	if descriptorContainsSecret(descriptor, make(map[*typeDescriptor]bool)) {
+		return nil, &projectionIssue{code: CodeSchemaDynamicType, path: path.clone(), message: "dynamic configuration values cannot establish secret-reference semantics"}
+	}
 	return descriptor, nil
 }
 
+func descriptorContainsSecret(descriptor *typeDescriptor, visited map[*typeDescriptor]bool) bool {
+	if descriptor == nil || visited[descriptor] {
+		return false
+	}
+	if descriptor.kind == descriptorSecret {
+		return true
+	}
+	visited[descriptor] = true
+	if descriptorContainsSecret(descriptor.element, visited) {
+		return true
+	}
+	for _, member := range descriptor.members {
+		if descriptorContainsSecret(member.descriptor, visited) {
+			return true
+		}
+	}
+	return false
+}
+
 func (o *valueOperation) node(kind document.Kind, path Path, depth int) (*document.Node, *projectionIssue) {
 	if issue := o.checkDepth(path, depth); issue != nil {
 		return nil, issue