Enhance configuration data handling with new reference resolution functions, dummy secret support, and update module version to 1.1.0

Readme.md

@@ -64,6 +64,9 @@ This block shows all currently supported parameter properties.
             # Metadata for later reporting/output tooling. The resolver does not mask values yet.
             Sensitive = $false
 
+            # Prevents child templates from changing this parameter definition during merge.
+            Sealed = $false
+
             # Emits a warning when the parameter is present.
             Deprecated = @{
                 Message = @{
@@ -89,6 +92,7 @@ Notes:
 - `Type`, `Required`, `AllowedValues`, `MinLength`, `MaxLength`, `MinValue`, `MaxValue`, and `Pattern` are validated by the resolver.
 - `AllowedValues` validates scalar values directly and array values item by item.
 - `Sensitive` is currently metadata only.
+- `Sealed = $true` on a parameter seals the whole parameter definition during merge. Child templates cannot change any property of that parameter.
 - `Deprecated.Message` can be a string or a localized hashtable.
 - Optional string parameters can allow empty values with a pattern like `'^$|^[A-Za-z][A-Za-z0-9_-]*$'`.
 
@@ -139,7 +143,11 @@ $resolved = Resolve-DSCConfigurationData -ConfigurationData $merged -ProviderSet
 }
 ```
 
-Use `-SkipSecrets` when you only want structural validation/resolution without loading provider secrets.
+Use `-SkipSecrets` when you only want structural validation/resolution without loading provider secrets. Secret references are replaced with typed dummy values, so references such as `reference(..., 'UserName')` keep working in tests and previews.
+
+```powershell
+$preview = Resolve-DSCConfigurationData -ConfigurationData $merged -SkipSecrets
+```
 
 SecretManagement is the only built-in secret resolver provider. KeePass, SecretStore, Azure Key Vault, and other backends should be registered as SecretManagement vaults.
 
@@ -207,6 +215,30 @@ $resolved = Resolve-DSCConfigurationData `
     -ProviderSettingsPath 'C:\DSC\Contoso\ProviderSettings.SecretManagement.psd1'
 ```
 
+## Sealed Template Blocks
+
+`Sealed = $true` can also be placed on any hashtable block in the configuration data. During merge, child templates cannot add or overwrite anything at that node or below it.
+
+```powershell
+Resources = @{
+    NonNodeData = @{
+        Services = @{
+            SharePoint = @{
+                Farm = @{
+                    ManagedAccounts = @{
+                        Sealed = $true
+
+                        FarmAccount = "[parameters('FarmCredential')]"
+                    }
+                }
+            }
+        }
+    }
+}
+```
+
+The `Sealed` marker is kept during merge so later merge steps can enforce it. `Resolve-DSCConfigurationData` removes the marker from the final resolved data so DSC resource loops do not see it as a normal configuration item.
+
 Inspect the configured provider and registered vault:
 
 ```powershell
@@ -382,12 +414,16 @@ ConfigDbName    : SharePoint_corp_TST_Farm_Config
 ```powershell
 "[parameters('DatabasePrefix')]"
 "[variables('ServiceDbPrefix')]"
+"[reference('Resources.NonNodeData.Services.SharePoint.Farm.ManagedAccounts.FarmAccount')]"
+"[reference('Resources.NonNodeData.Services.SharePoint.Farm.ManagedAccounts.FarmAccount', 'UserName')]"
 ```
 
 `parameters(name)` returns the effective parameter value. `Value` is used before `DefaultValue`.
 
 `variables(name)` resolves another variable. Variables may reference other variables.
 
+`reference(path)` resolves another value from the configuration data by path. `reference(path, property)` resolves the value and then returns a property from it, such as `UserName` from a `PSCredential`.
+
 ### String Composition
 
 ```powershell
@@ -590,6 +626,8 @@ ConfigDbName    : SharePoint_corp_TST_Farm_Config
 
 - `parameters(name)`
 - `variables(name)`
+- `reference(path)`
+- `reference(path, property)`
 - `concat(value1, value2, ...)`
 - `format(formatString, value1, value2, ...)`
 - `coalesce(value1, value2, ...)`