eric/ConfigKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Preserve secret tags in dynamic configuration values

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-06 19:03:00 -05:00
parent f42ecc70c3
commit e0f9541f5f
7 changed files with 325 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/config.md
View File

@@ -113,7 +113,9 @@ selected profile, then synthetic CLI records in supplied order.
### Secret classification and effective rendering
Secret classification combines `configkit:"secret"` field tags with the optional
pure `Definition.Secret(Path) bool` predicate. A tagged or predicate-classified
pure `Definition.Secret(Path) bool` predicate. Tags on concrete structs inside
supported dynamic values are retained in typed projections, including superseded
defaults and pre-resolution values. A tagged or predicate-classified
container makes all descendants sensitive. ConfigKit evaluates final and historical
paths, so replacing or deleting a definition does not erase its classification. The
predicate can add sensitivity but cannot declassify a tagged path.