fix(resolver): resolve a reference to a secret against the live source on update