Detach callback values before publishing configuration

This commit is contained in:
2026-09-06 19:05:28 -05:00
parent 9c94f2b70a
commit f7ca150a7f
5 changed files with 91 additions and 7 deletions

View File

@@ -34,7 +34,10 @@ root `T` must satisfy the application schema contract below. With no options it
starts from the Go zero value. A `Definition[T].Defaults` factory, when supplied,
runs exactly once after successful source parsing, schema construction, optional
schema-version checking, and selected-profile loading. Its result is detached before
input is applied.
input is applied. Resolver-provided mutable values are detached before secret lookup
and validation, and a final detached copy prevents equal-valued aliases introduced
by validators from escaping into the returned configuration. The publication copy
preserves already validated secret state without rereading the environment.
The current lifecycle is: