Expose captured configuration inspection and redacted reports

internal/configuration/inspection.go

@@ -0,0 +1,45 @@
+package configuration
+
+import (
+	"io"
+	"strings"
+
+	"gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+// Inspection is the read-only subset of the retained ConfigKit result used by
+// the facade. It does not expose typed configuration or resource contexts.
+type Inspection interface {
+	Metadata() configkit.Metadata
+	Sources() []configkit.SourceInfo
+	Diagnostics() []configkit.Diagnostic
+	Explain(configkit.Path) (configkit.Explanation, bool)
+	WriteEffective(io.Writer) error
+	WriteExplanation(io.Writer, configkit.Path) error
+}
+
+// Inspection returns only the retained result's inspection operations.
+func (state *loaded) Inspection() Inspection {
+	if state == nil {
+		return nil
+	}
+	return state.result
+}
+
+func secretProviderPath(path configkit.Path) bool {
+	pointer := path.String()
+	if pointer == "" {
+		return false
+	}
+	parts := strings.Split(strings.TrimPrefix(pointer, "/"), "/")
+	if len(parts) < 4 || (parts[0] != "backends" && parts[0] != "profiles") || parts[2] != "extra_params" {
+		return false
+	}
+	key := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(parts[len(parts)-1], "~1", "/"), "~0", "~"))
+	switch key {
+	case "api_key", "apikey", "authorization", "credential", "credentials", "password", "secret", "token", "access_token":
+		return true
+	default:
+		return false
+	}
+}

internal/configuration/load.go

@@ -119,6 +119,7 @@ func load(main configkit.Input, underlays []configkit.Underlay) (*loaded, error)
 	result, err := configkit.LoadLayered(main, configkit.LayeredOptions[document]{
 		Underlays: underlays,
 		Definition: configkit.Definition[document]{
+			Secret: secretProviderPath,
 			Resolve: func(config *document, resolution *configkit.Resolution) error {
 				captureFields(config.Backends, "backends", backendFields, resolution, state.backends)
 				captureFields(config.Profiles, "profiles", profileFields, resolution, state.profiles)

internal/engine/engine.go

@@ -81,7 +81,8 @@ func (o *Options) SetSchemaFile(path string) error {
 
 // Engine forwards domain operations to the single assembled use-case runner.
 type Engine struct {
-	runner *usecase.Runner
+	runner     *usecase.Runner
+	inspection configuration.Inspection
 }
 
 // New assembles an engine from facade-selected configuration and collaborators.
@@ -131,7 +132,18 @@ func New(cfg Config, options Options) (*Engine, error) {
 		reader = artifact.NewCompositeReader()
 	}
 
-	return &Engine{runner: usecase.NewRunnerWithRepairer(snapshot, snapshot, snapshot, reader, prompt.NewCompiledRenderer(snapshot), client, validator, usecase.NewDefaultOutputRepairer(client), manager, defaultRetries)}, nil
+	return &Engine{
+		runner:     usecase.NewRunnerWithRepairer(snapshot, snapshot, snapshot, reader, prompt.NewCompiledRenderer(snapshot), client, validator, usecase.NewDefaultOutputRepairer(client), manager, defaultRetries),
+		inspection: snapshot.Inspection(),
+	}, nil
+}
+
+// InspectConfiguration returns read-only operations over the captured result.
+func (e *Engine) InspectConfiguration() configuration.Inspection {
+	if e == nil {
+		return nil
+	}
+	return e.inspection
 }
 
 func validateSourceFS(fsys fs.FS, root string) error {