@kitsy/cnos 1.6.0 → 1.7.0

package/dist/internal.d.cts

@@ -1,5 +1,5 @@
-import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, n as VaultAuthConfig, o as SecretVaultProvider, i as NamespaceName, p as SecretReference, g as CnosRuntime, q as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './plugin-CKrBlWGI.cjs';
-export { r as ValidationIssue, s as WorkspaceFile } from './plugin-CKrBlWGI.cjs';
+import { j as DerivedValue, P as ParsedDerivation, N as NormalizedManifest, n as LoadManifestOptions, o as LoadedManifest, b as LogicalKey, p as NamespaceDefinition, q as VaultDefinition, r as VaultAuthConfig, s as SecretVaultProvider, t as ResolvedRoot, m as NamespaceName, u as RootResolution, v as SecretReference, g as CnosRuntime, w as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './core-BJ8xewez.cjs';
+export { l as RuntimeProvider, x as ValidationIssue, y as WorkspaceFile } from './core-BJ8xewez.cjs';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -11,6 +11,13 @@ declare class CnosAuthenticationError extends CnosError {
     constructor(message: string);
 }
 
+declare function isDerivedValue(value: unknown): value is DerivedValue;
+declare function parseDerivation(value: DerivedValue): ParsedDerivation;
+
+declare function validateDerivedTargetNamespace(manifest: NormalizedManifest, namespace: string): void;
+declare function validateParsedDerivation(manifest: NormalizedManifest, parsed: ParsedDerivation): void;
+declare function normalizeDerivedValue(templateOrExpr: string, expr?: boolean): DerivedValue;
+
 declare function readKeychain(entry: string): Promise<string | undefined>;
 declare function writeKeychain(entry: string, value: string): Promise<void>;
 
@@ -28,14 +35,60 @@ declare function clearAllVaultSessionKeys(processEnv?: Record<string, string | u
 
 declare function createSecretVaultProvider(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
 
+interface ParsedGitUri {
+    uri: string;
+    cloneUrl: string;
+    ref: string;
+    subpath: string;
+    transport: 'https' | 'ssh' | 'file' | 'custom';
+}
+declare function parseGitUri(uri: string): ParsedGitUri;
+
+interface RemoteRootCacheMetadata {
+    uri: string;
+    cloneUrl: string;
+    ref: string;
+    subpath: string;
+    resolvedCommit: string;
+    cachedAt: string;
+    isImmutable: boolean;
+}
+declare function readRemoteRootCacheMetadata(metaPath: string): Promise<RemoteRootCacheMetadata | undefined>;
+declare function writeRemoteRootCacheMetadata(metaPath: string, metadata: RemoteRootCacheMetadata): Promise<void>;
+
+type RemoteRootCacheMode = 'runtime' | 'build' | 'dev';
+declare function isImmutableGitRef(ref: string): boolean;
+
+declare function resolveRootUri(rootUri: string, cnosrcDir: string, options?: {
+    processEnv?: Record<string, string | undefined>;
+    cacheMode?: RemoteRootCacheMode;
+    cacheTtlSeconds?: number;
+    forceRefresh?: boolean;
+}): Promise<ResolvedRoot>;
+
+interface RemoteRootCachePaths {
+    cacheRoot: string;
+    cacheDir: string;
+    repoDir: string;
+    metaPath: string;
+}
+declare function resolveCnosCacheRoot(processEnv?: Record<string, string | undefined>): string;
+declare function createRemoteRootCacheKey(uri: string): string;
+declare function resolveRemoteRootCachePaths(uri: string, processEnv?: Record<string, string | undefined>): RemoteRootCachePaths;
+
 declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
 
 declare function resolveManifestRoot(options?: {
     root?: string;
     cwd?: string;
+    processEnv?: Record<string, string | undefined>;
+    cacheMode?: 'runtime' | 'build' | 'dev';
+    cacheTtlSeconds?: number;
+    forceRefresh?: boolean;
 }): Promise<{
     manifestRoot: string;
     consumerRoot: string;
+    rootResolution: RootResolution;
     anchorPath?: string;
     workspace?: string;
 }>;
@@ -193,4 +246,4 @@ interface WatchTargetSet {
 }
 declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CNOS_PROJECTION_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, deserializeServerProjection, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readServerProjectionFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, serializeServerProjection, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };
+export { CNOS_GRAPH_ENV_VAR, CNOS_PROJECTION_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, DerivedValue, ParsedDerivation, type RemoteRootCacheMetadata, type ResolvedVaultDefinition, RootResolution, SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createRemoteRootCacheKey, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, deserializeServerProjection, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isDerivedValue, isImmutableGitRef, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, normalizeDerivedValue, parseDerivation, parseGitUri, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRemoteRootCacheMetadata, readRuntimeGraphFromEnv, readServerProjectionFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCnosCacheRoot, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveRemoteRootCachePaths, resolveRootUri, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, serializeServerProjection, stringifyYaml, validateDerivedTargetNamespace, validateParsedDerivation, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeRemoteRootCacheMetadata, writeVaultSessionKey };

package/dist/internal.d.ts

@@ -1,5 +1,5 @@
-import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, n as VaultAuthConfig, o as SecretVaultProvider, i as NamespaceName, p as SecretReference, g as CnosRuntime, q as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './plugin-CKrBlWGI.js';
-export { r as ValidationIssue, s as WorkspaceFile } from './plugin-CKrBlWGI.js';
+import { j as DerivedValue, P as ParsedDerivation, N as NormalizedManifest, n as LoadManifestOptions, o as LoadedManifest, b as LogicalKey, p as NamespaceDefinition, q as VaultDefinition, r as VaultAuthConfig, s as SecretVaultProvider, t as ResolvedRoot, m as NamespaceName, u as RootResolution, v as SecretReference, g as CnosRuntime, w as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './core-BJ8xewez.js';
+export { l as RuntimeProvider, x as ValidationIssue, y as WorkspaceFile } from './core-BJ8xewez.js';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -11,6 +11,13 @@ declare class CnosAuthenticationError extends CnosError {
     constructor(message: string);
 }
 
+declare function isDerivedValue(value: unknown): value is DerivedValue;
+declare function parseDerivation(value: DerivedValue): ParsedDerivation;
+
+declare function validateDerivedTargetNamespace(manifest: NormalizedManifest, namespace: string): void;
+declare function validateParsedDerivation(manifest: NormalizedManifest, parsed: ParsedDerivation): void;
+declare function normalizeDerivedValue(templateOrExpr: string, expr?: boolean): DerivedValue;
+
 declare function readKeychain(entry: string): Promise<string | undefined>;
 declare function writeKeychain(entry: string, value: string): Promise<void>;
 
@@ -28,14 +35,60 @@ declare function clearAllVaultSessionKeys(processEnv?: Record<string, string | u
 
 declare function createSecretVaultProvider(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
 
+interface ParsedGitUri {
+    uri: string;
+    cloneUrl: string;
+    ref: string;
+    subpath: string;
+    transport: 'https' | 'ssh' | 'file' | 'custom';
+}
+declare function parseGitUri(uri: string): ParsedGitUri;
+
+interface RemoteRootCacheMetadata {
+    uri: string;
+    cloneUrl: string;
+    ref: string;
+    subpath: string;
+    resolvedCommit: string;
+    cachedAt: string;
+    isImmutable: boolean;
+}
+declare function readRemoteRootCacheMetadata(metaPath: string): Promise<RemoteRootCacheMetadata | undefined>;
+declare function writeRemoteRootCacheMetadata(metaPath: string, metadata: RemoteRootCacheMetadata): Promise<void>;
+
+type RemoteRootCacheMode = 'runtime' | 'build' | 'dev';
+declare function isImmutableGitRef(ref: string): boolean;
+
+declare function resolveRootUri(rootUri: string, cnosrcDir: string, options?: {
+    processEnv?: Record<string, string | undefined>;
+    cacheMode?: RemoteRootCacheMode;
+    cacheTtlSeconds?: number;
+    forceRefresh?: boolean;
+}): Promise<ResolvedRoot>;
+
+interface RemoteRootCachePaths {
+    cacheRoot: string;
+    cacheDir: string;
+    repoDir: string;
+    metaPath: string;
+}
+declare function resolveCnosCacheRoot(processEnv?: Record<string, string | undefined>): string;
+declare function createRemoteRootCacheKey(uri: string): string;
+declare function resolveRemoteRootCachePaths(uri: string, processEnv?: Record<string, string | undefined>): RemoteRootCachePaths;
+
 declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
 
 declare function resolveManifestRoot(options?: {
     root?: string;
     cwd?: string;
+    processEnv?: Record<string, string | undefined>;
+    cacheMode?: 'runtime' | 'build' | 'dev';
+    cacheTtlSeconds?: number;
+    forceRefresh?: boolean;
 }): Promise<{
     manifestRoot: string;
     consumerRoot: string;
+    rootResolution: RootResolution;
     anchorPath?: string;
     workspace?: string;
 }>;
@@ -193,4 +246,4 @@ interface WatchTargetSet {
 }
 declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CNOS_PROJECTION_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, deserializeServerProjection, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readServerProjectionFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, serializeServerProjection, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };
+export { CNOS_GRAPH_ENV_VAR, CNOS_PROJECTION_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, DerivedValue, ParsedDerivation, type RemoteRootCacheMetadata, type ResolvedVaultDefinition, RootResolution, SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createRemoteRootCacheKey, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, deserializeServerProjection, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isDerivedValue, isImmutableGitRef, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, normalizeDerivedValue, parseDerivation, parseGitUri, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRemoteRootCacheMetadata, readRuntimeGraphFromEnv, readServerProjectionFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCnosCacheRoot, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveRemoteRootCachePaths, resolveRootUri, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, serializeServerProjection, stringifyYaml, validateDerivedTargetNamespace, validateParsedDerivation, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeRemoteRootCacheMetadata, writeVaultSessionKey };

package/dist/internal.js

@@ -11,12 +11,13 @@ import {
   serializeRuntimeGraph,
   serializeSecretPayload,
   serializeServerProjection
-} from "./chunk-XSUP7JKH.js";
+} from "./chunk-GHGJFRDL.js";
 import {
   CnosAuthenticationError,
   CnosSecurityError,
   clearAllVaultSessionKeys,
   clearVaultSessionKey,
+  createRemoteRootCacheKey,
   createSecretVault,
   createSecretVaultProvider,
   deleteLocalSecret,
@@ -27,19 +28,28 @@ import {
   getNamespaceDefinition,
   getVaultPassphraseEnvVar,
   getVaultSessionKeyEnvVar,
+  isDerivedValue,
+  isImmutableGitRef,
   isPassphraseEnvRef,
   isSecretReference,
   listLocalSecrets,
   listSecretVaults,
   loadManifest,
+  normalizeDerivedValue,
+  parseDerivation,
+  parseGitUri,
   parseYaml,
   readKeychain,
   readLocalSecret,
+  readRemoteRootCacheMetadata,
   readVaultMetadata,
   removeLocalVaultFiles,
+  resolveCnosCacheRoot,
   resolveConfigDocumentPath,
   resolveConfiguredVaultPassphrase,
   resolveManifestRoot,
+  resolveRemoteRootCachePaths,
+  resolveRootUri,
   resolveSecretPassphrase,
   resolveSecretStoreRoot,
   resolveSecretVaultFile,
@@ -47,11 +57,14 @@ import {
   resolveVaultAuth,
   resolveVaultDefinition,
   stringifyYaml,
+  validateDerivedTargetNamespace,
+  validateParsedDerivation,
   validateRuntime,
   writeKeychain,
   writeLocalSecret,
+  writeRemoteRootCacheMetadata,
   writeVaultSessionKey
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // src/codegen/generateTypes.ts
 function toPascalCase(value) {
@@ -209,7 +222,8 @@ function resolveCodegenPaths(repoRoot, out) {
 }
 async function writeCodegenOutput(options = {}) {
   const loadedManifest = await loadManifest(options.root ? { root: options.root } : {});
-  const paths = resolveCodegenPaths(loadedManifest.repoRoot, options.out);
+  const outputRoot = loadedManifest.rootResolution.remote ? loadedManifest.consumerRoot : loadedManifest.repoRoot;
+  const paths = resolveCodegenPaths(outputRoot, options.out);
   const generated = generateCodegenContent(loadedManifest.manifest, loadedManifest.manifestPath, paths.typeImportPath);
   await mkdir(path.dirname(paths.typesPath), { recursive: true });
   await mkdir(path.dirname(paths.runtimePath), { recursive: true });
@@ -652,6 +666,7 @@ export {
   clearAllVaultSessionKeys,
   clearVaultSessionKey,
   compareSchemaToGraph,
+  createRemoteRootCacheKey,
   createSecretVault,
   createSecretVaultProvider,
   deleteLocalSecret,
@@ -668,23 +683,32 @@ export {
   getVaultPassphraseEnvVar,
   getVaultSessionKeyEnvVar,
   graphRequiresSecretHydration,
+  isDerivedValue,
+  isImmutableGitRef,
   isPassphraseEnvRef,
   isSecretReference,
   listLocalSecrets,
   listSecretVaults,
   loadManifest,
+  normalizeDerivedValue,
+  parseDerivation,
+  parseGitUri,
   parseYaml,
   proposeMapping,
   readKeychain,
   readLocalSecret,
+  readRemoteRootCacheMetadata,
   readRuntimeGraphFromEnv,
   readServerProjectionFromEnv,
   readVaultMetadata,
   removeLocalVaultFiles,
+  resolveCnosCacheRoot,
   resolveCodegenPaths,
   resolveConfigDocumentPath,
   resolveConfiguredVaultPassphrase,
   resolveManifestRoot,
+  resolveRemoteRootCachePaths,
+  resolveRootUri,
   resolveSecretPassphrase,
   resolveSecretStoreRoot,
   resolveSecretVaultFile,
@@ -697,11 +721,14 @@ export {
   serializeSecretPayload,
   serializeServerProjection,
   stringifyYaml,
+  validateDerivedTargetNamespace,
+  validateParsedDerivation,
   validateRuntime,
   watchFiles,
   watchSchema,
   writeCodegenOutput,
   writeKeychain,
   writeLocalSecret,
+  writeRemoteRootCacheMetadata,
   writeVaultSessionKey
 };

package/dist/plugin/basic-schema.cjs

@@ -34,6 +34,13 @@ __export(basic_schema_exports, {
 });
 module.exports = __toCommonJS(basic_schema_exports);
 
+// ../core/src/derive/evaluator.ts
+function isDerivedValue(value) {
+  return Boolean(
+    value && typeof value === "object" && !Array.isArray(value) && "$derive" in value
+  );
+}
+
 // ../core/src/keychain/linux.ts
 var import_node_child_process = require("child_process");
 var import_node_util = require("util");
@@ -50,32 +57,47 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 
 // ../core/src/utils/path.ts
-var import_promises2 = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
+var import_promises4 = require("fs/promises");
+var import_node_os3 = __toESM(require("os"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 
 // ../core/src/discovery/findCnosrc.ts
-var import_promises = require("fs/promises");
-var import_node_path = __toESM(require("path"), 1);
+var import_promises3 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
+// ../core/src/discovery/resolveRoot.ts
+var import_promises2 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_child_process4 = require("child_process");
+var import_node_os2 = __toESM(require("os"), 1);
+
+// ../core/src/discovery/cache/cacheMetadata.ts
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+
+// ../core/src/discovery/cache/cachePaths.ts
+var import_node_crypto = require("crypto");
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises4 = require("fs/promises");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/profiles/expandProfileChain.ts
-var import_promises5 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/workspaces/resolveWorkspaceContext.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/validation/basicSchema.ts
 function describeValueType(value) {
@@ -179,6 +201,10 @@ function applySchemaRules(graph, schema) {
       }
       continue;
     }
+    if (isDerivedValue(resolvedEntry.value)) {
+      nextEntries.set(key, resolvedEntry);
+      continue;
+    }
     const coercedValue = coerceValue(resolvedEntry.value, rule);
     const nextResolvedEntry = coercedValue === resolvedEntry.value ? resolvedEntry : {
       ...resolvedEntry,
@@ -225,28 +251,28 @@ function applySchemaRules(graph, schema) {
 }
 
 // ../core/src/secrets/auditLog.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises11 = require("fs/promises");
+var import_node_path12 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
+var import_promises10 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/prompt.ts
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
 // ../core/src/runtime/toServerProjection.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // ../core/src/runtime/dump.ts
-var import_promises10 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_promises12 = require("fs/promises");
+var import_node_path13 = __toESM(require("path"), 1);
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/plugin/basic-schema.d.cts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../plugin-CKrBlWGI.cjs';
+import { V as ValidatorPlugin } from '../core-BJ8xewez.cjs';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.d.ts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../plugin-CKrBlWGI.js';
+import { V as ValidatorPlugin } from '../core-BJ8xewez.js';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-MW4OVAT3.js";
-import "../chunk-S7H2UULC.js";
+} from "../chunk-5KIQCYFH.js";
+import "../chunk-2TL42I6M.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.cjs

@@ -52,61 +52,76 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 
 // ../core/src/utils/path.ts
-var import_promises2 = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
+var import_promises4 = require("fs/promises");
+var import_node_os3 = __toESM(require("os"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 
 // ../core/src/discovery/findCnosrc.ts
-var import_promises = require("fs/promises");
-var import_node_path = __toESM(require("path"), 1);
+var import_promises3 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
+// ../core/src/discovery/resolveRoot.ts
+var import_promises2 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_child_process4 = require("child_process");
+var import_node_os2 = __toESM(require("os"), 1);
+
+// ../core/src/discovery/cache/cacheMetadata.ts
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+
+// ../core/src/discovery/cache/cachePaths.ts
+var import_node_crypto = require("crypto");
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+
 // ../core/src/utils/path.ts
 function joinConfigPath(...parts) {
   return parts.flatMap((part) => part.split(".")).map((part) => part.trim()).filter(Boolean).join(".");
 }
 
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises4 = require("fs/promises");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/profiles/expandProfileChain.ts
-var import_promises5 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/workspaces/resolveWorkspaceContext.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/auditLog.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises11 = require("fs/promises");
+var import_node_path12 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
+var import_promises10 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/prompt.ts
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
 // ../core/src/runtime/toServerProjection.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // ../core/src/runtime/dump.ts
-var import_promises10 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_promises12 = require("fs/promises");
+var import_node_path13 = __toESM(require("path"), 1);
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/plugin/cli-args.d.cts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-CKrBlWGI.cjs';
+import { a as ConfigEntry, L as LoaderPlugin } from '../core-BJ8xewez.cjs';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.d.ts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-CKrBlWGI.js';
+import { a as ConfigEntry, L as LoaderPlugin } from '../core-BJ8xewez.js';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-JYWQFMW5.js";
-import "../chunk-S7H2UULC.js";
+} from "../chunk-2DGT7N7E.js";
+import "../chunk-2TL42I6M.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,