@kitsy/cnos 1.6.1 → 1.8.0

package/dist/plugin/dotenv.cjs

@@ -37,8 +37,8 @@ __export(dotenv_exports, {
 module.exports = __toCommonJS(dotenv_exports);
 
 // ../../plugins/dotenv/src/index.ts
-var import_promises11 = require("fs/promises");
-var import_node_path11 = __toESM(require("path"), 1);
+var import_promises13 = require("fs/promises");
+var import_node_path14 = __toESM(require("path"), 1);
 
 // ../core/src/keychain/linux.ts
 var import_node_child_process = require("child_process");
@@ -56,21 +56,36 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 
 // ../core/src/utils/path.ts
-var import_promises2 = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
+var import_promises4 = require("fs/promises");
+var import_node_os3 = __toESM(require("os"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 
 // ../core/src/discovery/findCnosrc.ts
-var import_promises = require("fs/promises");
-var import_node_path = __toESM(require("path"), 1);
+var import_promises3 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
+// ../core/src/discovery/resolveRoot.ts
+var import_promises2 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_child_process4 = require("child_process");
+var import_node_os2 = __toESM(require("os"), 1);
+
+// ../core/src/discovery/cache/cacheMetadata.ts
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+
+// ../core/src/discovery/cache/cachePaths.ts
+var import_node_crypto = require("crypto");
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+
 // ../core/src/utils/path.ts
 function interpolatePathTemplate(template, tokens) {
   return Object.entries(tokens).reduce(
@@ -92,47 +107,47 @@ function stripWorkspaceTemplatePrefix(template) {
 function resolveWorkspaceScopedPath(workspaceRoot, template, tokens) {
   const relativeTemplate = stripWorkspaceTemplatePrefix(template);
   const interpolated = interpolatePathTemplate(relativeTemplate, tokens);
-  return import_node_path2.default.resolve(workspaceRoot, interpolated);
+  return import_node_path5.default.resolve(workspaceRoot, interpolated);
 }
 function toPortablePath(targetPath) {
   return targetPath.replace(/\\/g, "/");
 }
 
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises4 = require("fs/promises");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/profiles/expandProfileChain.ts
-var import_promises5 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/workspaces/resolveWorkspaceContext.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/auditLog.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises11 = require("fs/promises");
+var import_node_path12 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
+var import_promises10 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/prompt.ts
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
 // ../core/src/runtime/toServerProjection.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // ../core/src/runtime/dump.ts
-var import_promises10 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_promises12 = require("fs/promises");
+var import_node_path13 = __toESM(require("path"), 1);
 
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
@@ -141,8 +156,8 @@ function normalizeMappingConfig(config = {}) {
     explicit: config.explicit ?? {}
   };
 }
-function fromScreamingSnake(path12) {
-  return path12.split("_").map((segment) => segment.trim().toLowerCase()).filter(Boolean).join(".");
+function fromScreamingSnake(path15) {
+  return path15.split("_").map((segment) => segment.trim().toLowerCase()).filter(Boolean).join(".");
 }
 function envVarToLogicalKey(envVar, config = {}) {
   const normalized = normalizeMappingConfig(config);
@@ -223,7 +238,7 @@ function dotenvEntriesFromObject(values, mapping = {}, originFile, workspaceId =
 }
 async function readIfPresent(filePath) {
   try {
-    return await (0, import_promises11.readFile)(filePath, "utf8");
+    return await (0, import_promises13.readFile)(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -242,7 +257,7 @@ function createDotenvPlugin() {
           workspace: workspaceRoot.workspaceId
         });
         for (const fileName of fileNames) {
-          const absolutePath = import_node_path11.default.join(envRoot, fileName);
+          const absolutePath = import_node_path14.default.join(envRoot, fileName);
           const document = await readIfPresent(absolutePath);
           if (!document) {
             continue;
@@ -251,7 +266,7 @@ function createDotenvPlugin() {
             ...dotenvEntriesFromObject(
               parseDotenv(document),
               config.envMapping,
-              toPortablePath(import_node_path11.default.relative(import_node_path11.default.dirname(context.manifestRoot), absolutePath)),
+              toPortablePath(import_node_path14.default.relative(import_node_path14.default.dirname(context.manifestRoot), absolutePath)),
               workspaceRoot.workspaceId
             )
           );

package/dist/plugin/dotenv.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CKrBlWGI.cjs';
-import { E as EnvMappingConfig } from '../envNaming-gMVnPOfe.cjs';
+import { L as LoaderPlugin, a as ConfigEntry } from '../core-BJ8xewez.cjs';
+import { E as EnvMappingConfig } from '../envNaming-rx71gpi0.cjs';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CKrBlWGI.js';
-import { E as EnvMappingConfig } from '../envNaming-B7Mztkcf.js';
+import { L as LoaderPlugin, a as ConfigEntry } from '../core-BJ8xewez.js';
+import { E as EnvMappingConfig } from '../envNaming-BRyiuPoI.js';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-BMAD24KC.js";
-import "../chunk-S7H2UULC.js";
+} from "../chunk-OA7FQGAG.js";
+import "../chunk-2TL42I6M.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,

package/dist/plugin/env-export.cjs

@@ -68,33 +68,48 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 
 // ../core/src/utils/path.ts
-var import_promises2 = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
+var import_promises4 = require("fs/promises");
+var import_node_os3 = __toESM(require("os"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 
 // ../core/src/discovery/findCnosrc.ts
-var import_promises = require("fs/promises");
-var import_node_path = __toESM(require("path"), 1);
+var import_promises3 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
+// ../core/src/discovery/resolveRoot.ts
+var import_promises2 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_child_process4 = require("child_process");
+var import_node_os2 = __toESM(require("os"), 1);
+
+// ../core/src/discovery/cache/cacheMetadata.ts
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+
+// ../core/src/discovery/cache/cachePaths.ts
+var import_node_crypto = require("crypto");
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+
 // ../core/src/utils/path.ts
 function stripNamespace(key) {
   return key.split(".").slice(1).join(".");
 }
 
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises4 = require("fs/promises");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/profiles/expandProfileChain.ts
-var import_promises5 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/promotions/validatePromotion.ts
 var DEFAULT_DATA_NAMESPACE = {
@@ -114,21 +129,21 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
 }
 
 // ../core/src/workspaces/resolveWorkspaceContext.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/auditLog.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises11 = require("fs/promises");
+var import_node_path12 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
+var import_promises10 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 function isObject(value) {
@@ -143,7 +158,7 @@ var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
 // ../core/src/runtime/toServerProjection.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // ../core/src/runtime/toEnv.ts
 function normalizeEnvValue(value) {
@@ -158,7 +173,7 @@ function normalizeEnvValue(value) {
   }
   return JSON.stringify(value);
 }
-function toEnv(graph, manifest, options = {}) {
+function toEnv(graph, manifest, options = {}, helpers = {}) {
   const includeSecrets = options.includeSecrets ?? true;
   const output = {};
   const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
@@ -179,7 +194,11 @@ function toEnv(graph, manifest, options = {}) {
     if (isSecretReference(entry.value)) {
       continue;
     }
-    output[envVar] = normalizeEnvValue(entry.value);
+    const value = helpers.read ? helpers.read(logicalKey) : entry.value;
+    if (value === void 0) {
+      continue;
+    }
+    output[envVar] = normalizeEnvValue(value);
   }
   return output;
 }
@@ -216,21 +235,31 @@ function resolvePublicPrefix(manifest, options) {
   }
   return manifest.public.frameworks[options.framework] ?? "";
 }
-function toPublicEnv(graph, manifest, options = {}) {
+function toPublicEnv(graph, manifest, options = {}, helpers = {}) {
   const prefix = resolvePublicPrefix(manifest, options);
   const output = {};
   const promotions = Array.from(graph.entries.values()).filter((entry) => entry.namespace === "public").sort((left, right) => left.key.localeCompare(right.key));
   for (const resolved of promotions) {
+    if (helpers.isRuntimeDependent?.(resolved.key)) {
+      const value2 = helpers.read?.(resolved.key);
+      if (value2 === void 0) {
+        throw new CnosManifestError(`Cannot build public output for ${resolved.key} because it depends on runtime-only values.`);
+      }
+    }
     const baseEnvVar = fallbackPublicEnvVar(stripNamespace(resolved.key));
     const envVar = prefix && !baseEnvVar.startsWith(prefix) ? `${prefix}${baseEnvVar}` : baseEnvVar;
-    output[envVar] = normalizeEnvValue2(resolved.value);
+    const value = helpers.read ? helpers.read(resolved.key) : resolved.value;
+    if (value === void 0) {
+      continue;
+    }
+    output[envVar] = normalizeEnvValue2(value);
   }
   return output;
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises10 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_promises12 = require("fs/promises");
+var import_node_path13 = __toESM(require("path"), 1);
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/plugin/env-export.d.cts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-CKrBlWGI.cjs';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CmBsy53P.cjs';
+import { E as ExporterPlugin } from '../core-BJ8xewez.cjs';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-ivRtLjcw.cjs';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.d.ts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-CKrBlWGI.js';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-q6VwWxXZ.js';
+import { E as ExporterPlugin } from '../core-BJ8xewez.js';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CCSgdvI9.js';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-VGZREX5D.js";
+} from "../chunk-RYIARE4M.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-S7H2UULC.js";
+} from "../chunk-2TL42I6M.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.cjs

@@ -40,11 +40,11 @@ __export(filesystem_exports, {
 module.exports = __toCommonJS(filesystem_exports);
 
 // ../../plugins/filesystem/src/filesystemSecretsReader.ts
-var import_promises12 = require("fs/promises");
+var import_promises14 = require("fs/promises");
 
 // ../../plugins/filesystem/src/helpers.ts
-var import_promises11 = require("fs/promises");
-var import_node_path11 = __toESM(require("path"), 1);
+var import_promises13 = require("fs/promises");
+var import_node_path14 = __toESM(require("path"), 1);
 
 // ../core/src/errors.ts
 var CnosError = class extends Error {
@@ -61,6 +61,13 @@ var CnosManifestError = class extends CnosError {
   manifestPath;
 };
 
+// ../core/src/derive/evaluator.ts
+function isDerivedValue(value) {
+  return Boolean(
+    value && typeof value === "object" && !Array.isArray(value) && "$derive" in value
+  );
+}
+
 // ../core/src/keychain/linux.ts
 var import_node_child_process = require("child_process");
 var import_node_util = require("util");
@@ -77,17 +84,17 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 
 // ../core/src/utils/path.ts
-var import_promises2 = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
+var import_promises4 = require("fs/promises");
+var import_node_os3 = __toESM(require("os"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 
 // ../core/src/discovery/findCnosrc.ts
-var import_promises = require("fs/promises");
-var import_node_path = __toESM(require("path"), 1);
+var import_promises3 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
@@ -95,35 +102,50 @@ function parseYaml(source) {
   return (0, import_yaml.parse)(source);
 }
 
+// ../core/src/discovery/resolveRoot.ts
+var import_promises2 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+var import_node_child_process4 = require("child_process");
+var import_node_os2 = __toESM(require("os"), 1);
+
+// ../core/src/discovery/cache/cacheMetadata.ts
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+
+// ../core/src/discovery/cache/cachePaths.ts
+var import_node_crypto = require("crypto");
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+
 // ../core/src/utils/path.ts
 function toPortablePath(targetPath) {
   return targetPath.replace(/\\/g, "/");
 }
 
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises4 = require("fs/promises");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/profiles/expandProfileChain.ts
-var import_promises5 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/workspaces/resolveWorkspaceContext.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/auditLog.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises11 = require("fs/promises");
+var import_node_path12 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
+var import_promises10 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 function isObject(value) {
@@ -138,18 +160,18 @@ var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
 // ../core/src/runtime/toServerProjection.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // ../core/src/runtime/dump.ts
-var import_promises10 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_promises12 = require("fs/promises");
+var import_node_path13 = __toESM(require("path"), 1);
 
 // ../../plugins/filesystem/src/helpers.ts
 var YAML_EXTENSIONS = /* @__PURE__ */ new Set([".yml", ".yaml"]);
 var FILESYSTEM_PLUGIN_ID = "@kitsy/cnos/plugins/filesystem";
 async function existsDirectory(targetPath) {
   try {
-    const stat2 = await (0, import_promises11.readdir)(targetPath);
+    const stat2 = await (0, import_promises13.readdir)(targetPath);
     void stat2;
     return true;
   } catch {
@@ -157,15 +179,15 @@ async function existsDirectory(targetPath) {
   }
 }
 async function collectYamlFiles(root) {
-  const entries = await (0, import_promises11.readdir)(root, { withFileTypes: true });
+  const entries = await (0, import_promises13.readdir)(root, { withFileTypes: true });
   const results = [];
   for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-    const absolutePath = import_node_path11.default.join(root, entry.name);
+    const absolutePath = import_node_path14.default.join(root, entry.name);
     if (entry.isDirectory()) {
       results.push(...await collectYamlFiles(absolutePath));
       continue;
     }
-    if (entry.isFile() && YAML_EXTENSIONS.has(import_node_path11.default.extname(entry.name).toLowerCase())) {
+    if (entry.isFile() && YAML_EXTENSIONS.has(import_node_path14.default.extname(entry.name).toLowerCase())) {
       results.push(absolutePath);
     }
   }
@@ -173,16 +195,16 @@ async function collectYamlFiles(root) {
 }
 async function collectFilesystemLayerFiles(manifestRoot, workspaceRoots, sourceRoot, activeLayers) {
   const files = [];
-  const repoRoot = import_node_path11.default.dirname(manifestRoot);
+  const repoRoot = import_node_path14.default.dirname(manifestRoot);
   for (const workspaceRoot of workspaceRoots) {
-    const resolvedRoot = import_node_path11.default.resolve(workspaceRoot.path, sourceRoot);
+    const resolvedRoot = import_node_path14.default.resolve(workspaceRoot.path, sourceRoot);
     for (const layer of activeLayers) {
-      const layerRoot = import_node_path11.default.join(resolvedRoot, layer);
+      const layerRoot = import_node_path14.default.join(resolvedRoot, layer);
       if (!await existsDirectory(layerRoot)) {
         continue;
       }
       for (const absolutePath of await collectYamlFiles(layerRoot)) {
-        const relativePath = import_node_path11.default.relative(repoRoot, absolutePath);
+        const relativePath = import_node_path14.default.relative(repoRoot, absolutePath);
         files.push({
           absolutePath,
           relativePath: toPortablePath(relativePath.startsWith("..") ? absolutePath : relativePath),
@@ -202,7 +224,7 @@ function assertObjectDocument(value, filePath) {
 function flattenConfigObject(value, options = {}, prefix = "") {
   return Object.entries(value).reduce((accumulator, [key, nestedValue]) => {
     const nextKey = prefix ? `${prefix}.${key}` : key;
-    if (nestedValue && typeof nestedValue === "object" && !Array.isArray(nestedValue) && !options.stopAtLeaf?.(nestedValue)) {
+    if (nestedValue && typeof nestedValue === "object" && !Array.isArray(nestedValue) && !isDerivedValue(nestedValue) && !options.stopAtLeaf?.(nestedValue)) {
       Object.assign(
         accumulator,
         flattenConfigObject(nestedValue, options, nextKey)
@@ -259,7 +281,7 @@ function createFilesystemSecretsPlugin() {
       );
       const entries = [];
       for (const file of files) {
-        const document = await (0, import_promises12.readFile)(file.absolutePath, "utf8");
+        const document = await (0, import_promises14.readFile)(file.absolutePath, "utf8");
         const fileEntries = filesystemSecretsReader(file.relativePath, document, file.workspaceId);
         for (const entry of fileEntries) {
           const metadata = toSecretReferenceMetadata(entry.value);
@@ -275,7 +297,7 @@ function createFilesystemSecretsPlugin() {
 }
 
 // ../../plugins/filesystem/src/filesystemValuesReader.ts
-var import_promises13 = require("fs/promises");
+var import_promises15 = require("fs/promises");
 function filesystemValuesReader(filePath, document, workspaceId = "default") {
   return yamlObjectToEntries(document, filePath, "value", "filesystem-values", workspaceId);
 }
@@ -296,7 +318,7 @@ function createFilesystemValuesPlugin() {
       ).map(([namespace]) => namespace);
       const entries = [];
       for (const file of files) {
-        const document = await (0, import_promises13.readFile)(file.absolutePath, "utf8");
+        const document = await (0, import_promises15.readFile)(file.absolutePath, "utf8");
         entries.push(...filesystemValuesReader(file.relativePath, document, file.workspaceId));
       }
       for (const namespace of customNamespaces) {
@@ -311,7 +333,7 @@ function createFilesystemValuesPlugin() {
           layers
         );
         for (const file of namespaceFiles) {
-          const document = await (0, import_promises13.readFile)(file.absolutePath, "utf8");
+          const document = await (0, import_promises15.readFile)(file.absolutePath, "utf8");
           entries.push(...yamlObjectToEntries(document, file.relativePath, namespace, "filesystem-values", file.workspaceId));
         }
       }

package/dist/plugin/filesystem.d.cts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-CKrBlWGI.cjs';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, m as NamespaceName } from '../core-BJ8xewez.cjs';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.d.ts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-CKrBlWGI.js';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, m as NamespaceName } from '../core-BJ8xewez.js';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-UR7CHHNN.js";
-import "../chunk-S7H2UULC.js";
+} from "../chunk-TT4NV56Z.js";
+import "../chunk-2TL42I6M.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,