Publish redacted ConfigKit effective configuration

internal/core/config/redaction.go

@@ -4,6 +4,7 @@ import (
 	"reflect"
 	"strings"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
 )
 
@@ -188,3 +189,21 @@ func sensitiveConfigKey(key string) bool {
 	key = strings.ToLower(key)
 	return strings.Contains(key, "api_key") || strings.Contains(key, "apikey") || strings.Contains(key, "authorization") || strings.Contains(key, "bearer") || strings.Contains(key, "password") || strings.Contains(key, "secret") || strings.Contains(key, "token")
 }
+
+// sensitiveDocumentPath applies the existing option-key classification to the
+// fully typed ConfigKit document. Dynamic option maps can be nested below any
+// producer or validator, so every key after an options container participates.
+func sensitiveDocumentPath(path configkit.Path) bool {
+	segments := strings.Split(strings.TrimPrefix(path.String(), "/"), "/")
+	withinOptions := false
+	for _, segment := range segments {
+		segment = strings.ReplaceAll(strings.ReplaceAll(segment, "~1", "/"), "~0", "~")
+		if withinOptions && sensitiveConfigKey(segment) {
+			return true
+		}
+		if segment == "options" {
+			withinOptions = true
+		}
+	}
+	return false
+}