Defines `RefController` and `Revealer` for handling encrypted references (e.g., GPG, Vault, KMS). `RefController` auto-registers backends via a class registry pattern, and `Revealer` performs iterative multi-pass resolution of nested references within dictionaries, ensuring dependencies between references (e.g., deriving a public key from a private key) are resolved correctly. The `compile_obj` method handles arbitrary nested structures, and `Revealer.compile_dict_with_dependency_resolution` uses a safety-limit loop to converge on stable values. This component demonstrates sophisticated dependency graph resolution and is reusable as a standalone secrets-compilation engine.

Provides the abstract `InputType` base class that all compiler backends (Jsonnet, Jinja2, Kadet, Helm, etc.) must implement. `InputType` defines the `compile_file()` and `compile_obj()` methods, with `compile_obj()` handling glob expansion, search paths, deduplication, and error wrapping. The `to_file()` method uses `CompiledFile`/`CompilingFile` context managers to write outputs with format-specific serialization (YAML, JSON, TOML) and secret reveal logic. This pattern enables adding new input types with minimal boilerplate and is cleanly separated from the rest of the pipeline.

Implements `InputCache`, a filesystem-based cache keyed by deterministic hashes (BLAKE2b) of inventory digests, topic digests, Helm dependency digests, and input file contents. It uses lock files for multiprocess safety and provides `CacheMetrics` via `multiprocessing.Value` for instrumentation. The cache eviction policy is based on a maximum size per target. This component solves a common problem in template-heavy compilation pipelines—avoiding redundant work—and its design is self-contained enough to be extracted for other build systems.