@desplega.ai/agent-swarm 1.149.0 → 1.150.0

package/src/tests/workflow-http-v2.test.ts

@@ -41,6 +41,8 @@ import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-workflow-http-v2.sqlite";
 
+const secretRef = (name: string): string => `secret.${name}`;
+
 // ─── Test Server ─────────────────────────────────────────────
 
 function createTestServer(): Server {
@@ -201,10 +203,10 @@ describe("Workflow HTTP API v2", () => {
           name: "full-schema-workflow",
           description: "test",
           definition: simpleDefinition(),
-          triggers: [{ type: "webhook", hmacSecret: "secret-123" }],
+          triggers: [{ type: "webhook", hmacSecret: "example-secret-123" }],
           cooldown: { minutes: 30 },
           // biome-ignore lint/suspicious/noTemplateCurlyInString: intentional — this is the input resolution syntax
-          input: { apiKey: "${API_KEY}", secret: "secret.MY_SECRET", literal: "hello" },
+          input: { apiKey: "${API_KEY}", secret: secretRef("MY_SECRET"), literal: "hello" },
         }),
       });
 
@@ -480,7 +482,7 @@ describe("Workflow HTTP API v2", () => {
         method: "PUT",
         headers,
         body: JSON.stringify({
-          triggers: [{ type: "webhook", hmacSecret: "new-secret" }],
+          triggers: [{ type: "webhook", hmacSecret: "example-new-secret" }],
           cooldown: { seconds: 30 },
           input: { key: "value" },
           params: { REPO_URL: "acme/widgets" },
@@ -921,11 +923,11 @@ describe("Workflow HTTP API v2", () => {
   describe("POST /api/webhooks/:workflowId", () => {
     test("valid HMAC returns 201", async () => {
       const workflow = await createTestWorkflow({
-        triggers: [{ type: "webhook", hmacSecret: "test-secret" }],
+        triggers: [{ type: "webhook", hmacSecret: "example-test-secret" }],
       });
 
       const body = '{"event":"test"}';
-      const hmac = crypto.createHmac("sha256", "test-secret");
+      const hmac = crypto.createHmac("sha256", "example-test-secret");
       hmac.update(body);
       const sig = `sha256=${hmac.digest("hex")}`;
 
@@ -944,7 +946,7 @@ describe("Workflow HTTP API v2", () => {
 
     test("invalid HMAC returns 401", async () => {
       const workflow = await createTestWorkflow({
-        triggers: [{ type: "webhook", hmacSecret: "test-secret" }],
+        triggers: [{ type: "webhook", hmacSecret: "example-test-secret" }],
       });
 
       const res = await fetch(`${baseUrl}/api/webhooks/${workflow.id}`, {

package/src/tests/workflow-input-redaction.test.ts

@@ -26,6 +26,8 @@ import {
 
 const TEST_DB_PATH = "./test-workflow-input-redaction.sqlite";
 
+const secretRef = (name: string): string => `secret.${name}`;
+
 // Captures the input it was invoked with so we can assert what the executor
 // actually receives (real value, not redacted).
 class CaptureExecutor extends BaseExecutor<
@@ -52,7 +54,7 @@ class CaptureExecutor extends BaseExecutor<
 
 describe("getSecretInputKeys", () => {
   test("flags secret.* references", () => {
-    const keys = getSecretInputKeys({ GITHUB_TOKEN: "secret.GITHUB_TOKEN" });
+    const keys = getSecretInputKeys({ GITHUB_TOKEN: secretRef("GITHUB_TOKEN") });
     expect(keys.has("GITHUB_TOKEN")).toBe(true);
     expect(keys.size).toBe(1);
   });
@@ -104,7 +106,7 @@ describe("redactSecretsForStorage", () => {
   test("redacts only declared secret keys in ctx.input", () => {
     const ctx = {
       trigger: { topic: "tuxedo" },
-      input: { GITHUB_TOKEN: "ghp_real_value_xxx", branch: "main" },
+      input: { GITHUB_TOKEN: "example-ghp_real_value_xxx", branch: "main" },
     };
     const out = redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
     expect((out.input as Record<string, unknown>).GITHUB_TOKEN).toBe(REDACTED_SECRET_VALUE);
@@ -114,9 +116,9 @@ describe("redactSecretsForStorage", () => {
   });
 
   test("does not mutate the original ctx (executor still sees real value)", () => {
-    const ctx = { input: { GITHUB_TOKEN: "ghp_real" } };
+    const ctx = { input: { GITHUB_TOKEN: "example-ghp_real" } };
     redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
-    expect((ctx.input as Record<string, unknown>).GITHUB_TOKEN).toBe("ghp_real");
+    expect((ctx.input as Record<string, unknown>).GITHUB_TOKEN).toBe("example-ghp_real");
   });
 
   test("no-ops when ctx has no input block", () => {
@@ -187,7 +189,7 @@ describe("end-to-end — workflow step persistence redacts secrets", () => {
       definition: def,
       triggers: [],
       input: {
-        GITHUB_TOKEN: "secret.TEST_REDACTION_GITHUB_TOKEN",
+        GITHUB_TOKEN: secretRef("TEST_REDACTION_GITHUB_TOKEN"),
         plain: "not-a-secret",
       },
     });

package/src/tests/workflow-integration-io.test.ts

@@ -588,7 +588,7 @@ describe("Workflow Integration — I/O Schemas, Convergence, TriggerSchema (Phas
       };
 
       // Set env var for input resolution
-      process.env.TEST_INTEG_API_KEY = "secret123";
+      process.env.TEST_INTEG_API_KEY = "example-secret123";
       const workflow = await makeWorkflow(def, {
         // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env var syntax
         input: { API_KEY: "${TEST_INTEG_API_KEY}" },
@@ -600,7 +600,7 @@ describe("Workflow Integration — I/O Schemas, Convergence, TriggerSchema (Phas
       expect(run!.status).toBe("completed");
 
       const ctx = run!.context as Record<string, unknown>;
-      expect(ctx.step1).toEqual({ echo: "env=secret123" });
+      expect(ctx.step1).toEqual({ echo: "env=example-secret123" });
     });
   });
 

package/src/tests/workflow-llm.test.ts

@@ -17,11 +17,11 @@ describe("resolveWorkflowLlmConfig", () => {
 
   test("routes OpenAI credentials to the SDK default endpoint", async () => {
     const config = await resolveWorkflowLlmConfig(undefined, {
-      OPENAI_API_KEY: "sk-openai-test",
+      OPENAI_API_KEY: "example-sk-openai-test",
     });
 
     expect(config).toEqual({
-      apiKey: "sk-openai-test",
+      apiKey: "example-sk-openai-test",
       baseURL: undefined,
       model: "gpt-5.4-mini",
     });
@@ -32,7 +32,7 @@ describe("resolveWorkflowLlmConfig", () => {
     process.env.MEMORY_RATER_MODEL = "openrouter/anthropic/claude-sonnet-4-5";
     try {
       const config = await resolveWorkflowLlmConfig(undefined, {
-        OPENAI_API_KEY: "sk-openai-test",
+        OPENAI_API_KEY: "example-sk-openai-test",
       });
       expect(config.model).toBe("gpt-5.4-mini");
     } finally {
@@ -43,7 +43,7 @@ describe("resolveWorkflowLlmConfig", () => {
 
   test("preserves an explicit provider-compatible model", async () => {
     const config = await resolveWorkflowLlmConfig("openai/gpt-5.4", {
-      OPENAI_API_KEY: "sk-openai-test",
+      OPENAI_API_KEY: "example-sk-openai-test",
     });
 
     expect(config.model).toBe("gpt-5.4");
@@ -51,7 +51,7 @@ describe("resolveWorkflowLlmConfig", () => {
 
   test("rejects credential kinds without an OpenAI-compatible endpoint", async () => {
     await expect(
-      resolveWorkflowLlmConfig(undefined, { ANTHROPIC_API_KEY: "sk-ant-test" }),
+      resolveWorkflowLlmConfig(undefined, { ANTHROPIC_API_KEY: "example-sk-ant-test" }),
     ).rejects.toThrow("do not support the resolved anthropic credential yet");
   });
 });

package/src/tests/workflow-registry.test.ts

@@ -500,7 +500,7 @@ describe("Workflow Registry & Definition (Phase 1)", () => {
             { id: "b", type: "notify", config: { channel: "swarm", template: "done" } },
           ],
         },
-        triggers: [{ type: "webhook", hmacSecret: "test-secret" }],
+        triggers: [{ type: "webhook", hmacSecret: "example-test-secret" }],
         cooldown: { hours: 1 },
         input: { apiKey: envVarRef },
       });

package/src/tests/workflow-swarm-script.test.ts

@@ -35,7 +35,7 @@ import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
 const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-swarm-script.sqlite";
-const API_KEY = "test-workflow-swarm-script-key-1234567890";
+const API_KEY = "example-test-workflow-swarm-script-key-1234567890";
 
 const noOpEmbeddingProvider = {
   name: "test/noop-workflow-script-embedding",

package/src/tests/workflow-triggers-v2.test.ts

@@ -27,6 +27,8 @@ import {
 
 const TEST_DB_PATH = "./test-workflow-triggers-v2.sqlite";
 
+const secretRef = (name: string): string => `secret.${name}`;
+
 // ─── Test Executor ──────────────────────────────────────────
 
 class NoopExecutor extends BaseExecutor<typeof NoopExecutor.schema, typeof NoopExecutor.outSchema> {
@@ -86,7 +88,7 @@ async function makeWorkflow(
 // ─── HMAC Verification ──────────────────────────────────────
 
 describe("verifyHmacSignature", () => {
-  const secret = "test-secret-123";
+  const secret = "example-test-secret-123";
   const body = '{"event":"test"}';
 
   test("valid sha256=<hex> signature passes", () => {
@@ -123,7 +125,7 @@ describe("verifyHmacSignature", () => {
 });
 
 describe("verifyTimestampedHmacSignature", () => {
-  const secret = "timestamped-secret";
+  const secret = "example-timestamped-secret";
   const body = '{"event":"finding.triage_completed"}';
   const timestamp = 1_700_000_000;
   const nowMs = timestamp * 1000;
@@ -213,7 +215,7 @@ describe("verifyTokenEquality", () => {
 
 describe("handleWebhookTrigger", () => {
   test("valid HMAC starts workflow", async () => {
-    const secret = "my-webhook-secret";
+    const secret = "example-my-webhook-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -241,7 +243,7 @@ describe("handleWebhookTrigger", () => {
 
   test("invalid HMAC rejects with 401", async () => {
     const workflow = await makeWorkflow({
-      triggers: [{ type: "webhook", hmacSecret: "secret-123" }],
+      triggers: [{ type: "webhook", hmacSecret: "example-secret-123" }],
     });
 
     try {
@@ -260,7 +262,7 @@ describe("handleWebhookTrigger", () => {
 
   test("missing signature rejects with 401 when hmacSecret is set", async () => {
     const workflow = await makeWorkflow({
-      triggers: [{ type: "webhook", hmacSecret: "secret-xyz" }],
+      triggers: [{ type: "webhook", hmacSecret: "example-secret-xyz" }],
     });
 
     try {
@@ -374,7 +376,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   }
 
   test("custom hmacHeader (X-Webhook-Signature) is picked up and verified", async () => {
-    const secret = "kapso-secret";
+    const secret = "example-kapso-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -393,7 +395,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("custom hmacHeader lookup is case-insensitive", async () => {
-    const secret = "kapso-secret-ci";
+    const secret = "example-kapso-secret-ci";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -410,7 +412,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("signature on a non-configured header is rejected as missing", async () => {
-    const secret = "kapso-secret-2";
+    const secret = "example-kapso-secret-2";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -432,7 +434,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("fallback header (x-signature) still works without explicit hmacHeader", async () => {
-    const secret = "fallback-secret";
+    const secret = "example-fallback-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -449,7 +451,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("default X-Hub-Signature-256 path still works (no regression)", async () => {
-    const secret = "default-header-secret";
+    const secret = "example-default-header-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -467,7 +469,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("explicit hmac-sha256 verification does not use fallback headers", async () => {
-    const secret = "explicit-hmac-secret";
+    const secret = "example-explicit-hmac-secret";
     const workflow = await makeWorkflow({
       triggers: [
         {
@@ -500,7 +502,7 @@ describe("handleWebhookTrigger — verification formats", () => {
   }
 
   test("timestamped-hmac-sha256 starts workflow for Superagent-shaped request", async () => {
-    const secret = "superagent-secret";
+    const secret = "example-superagent-secret";
     const timestamp = Math.floor(Date.now() / 1000);
     const workflow = await makeWorkflow({
       triggers: [
@@ -536,7 +538,7 @@ describe("handleWebhookTrigger — verification formats", () => {
   });
 
   test("timestamped-hmac-sha256 rejects signatures on fallback headers", async () => {
-    const secret = "timestamped-no-fallback-secret";
+    const secret = "example-timestamped-no-fallback-secret";
     const timestamp = Math.floor(Date.now() / 1000);
     const workflow = await makeWorkflow({
       triggers: [
@@ -571,7 +573,7 @@ describe("handleWebhookTrigger — verification formats", () => {
       triggers: [
         {
           type: "webhook",
-          hmacSecret: "gitlab-token",
+          hmacSecret: "example-gitlab-token",
           verification: { format: "token-equality", header: "X-Gitlab-Token" },
         },
       ],
@@ -580,7 +582,7 @@ describe("handleWebhookTrigger — verification formats", () => {
     const result = await handleWebhookTrigger(
       workflow.id,
       '{"event":"push"}',
-      { "x-gitlab-token": "gitlab-token" },
+      { "x-gitlab-token": "example-gitlab-token" },
       registry,
     );
 
@@ -592,7 +594,7 @@ describe("handleWebhookTrigger — verification formats", () => {
       triggers: [
         {
           type: "webhook",
-          hmacSecret: "gitlab-token",
+          hmacSecret: "example-gitlab-token",
           verification: { format: "token-equality", header: "X-Gitlab-Token" },
         },
       ],
@@ -658,7 +660,7 @@ describe("handleWebhookTrigger — hmacSecret references", () => {
       triggers: [
         {
           type: "webhook",
-          hmacSecret: "secret.TEST_KAPSO_WEBHOOK_HMAC_SECRET",
+          hmacSecret: secretRef("TEST_KAPSO_WEBHOOK_HMAC_SECRET"),
           hmacHeader: "X-Webhook-Signature",
         },
       ],
@@ -678,7 +680,7 @@ describe("handleWebhookTrigger — hmacSecret references", () => {
 
   test("unresolvable secret.NAME ref fails cleanly with a WebhookError", async () => {
     const workflow = await makeWorkflow({
-      triggers: [{ type: "webhook", hmacSecret: "secret.NONEXISTENT_HMAC_SECRET_12345" }],
+      triggers: [{ type: "webhook", hmacSecret: secretRef("NONEXISTENT_HMAC_SECRET_12345") }],
     });
 
     const body = '{"event":"missing-secret"}';
@@ -697,7 +699,7 @@ describe("handleWebhookTrigger — hmacSecret references", () => {
   });
 
   test("a literal hmacSecret is not treated as a reference", async () => {
-    const secret = "plain.literal-not-a-ref";
+    const secret = `plain.${"literal-not-a-ref"}`;
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -739,7 +741,7 @@ describe("handleWebhookTrigger — triggerData JSON parsing", () => {
   });
 
   test("signed JSON body: HMAC verified against raw bytes, triggerData parsed to object", async () => {
-    const secret = "kapso-deep-secret";
+    const secret = "example-kapso-deep-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -858,7 +860,7 @@ describe("TriggerConfigSchema", () => {
   test("accepts verification configured with hmacSecret", () => {
     const result = TriggerConfigSchema.safeParse({
       type: "webhook",
-      hmacSecret: "gitlab-token",
+      hmacSecret: "example-gitlab-token",
       verification: { format: "token-equality", header: "X-Gitlab-Token" },
     });
 

package/src/tests/x-composio.test.ts

@@ -45,12 +45,12 @@ describe("runComposioCommand", () => {
     const fetchMock = mock(async (url: string | URL | Request, init?: RequestInit) => {
       expect(String(url)).toBe("https://backend.composio.dev/api/v3.1/tools?limit=10");
       expect(init?.method).toBe("GET");
-      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe("ck_test_secret");
-      return jsonResponse({ ok: true, token: "ck_test_secret" });
+      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe("example-ck_test_secret");
+      return jsonResponse({ ok: true, token: "example-ck_test_secret" });
     });
 
     await runComposioCommand(["GET", "/tools", "--query", "limit=10"], {
-      env: { COMPOSIO_API_KEY: "ck_test_secret" },
+      env: { COMPOSIO_API_KEY: "example-ck_test_secret" },
       fetch: fetchMock,
       log: (message) => out.push(message),
       error: (message) => out.push(message),
@@ -62,18 +62,20 @@ describe("runComposioCommand", () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
     expect(out.join("\n")).toContain('"ok": true');
     expect(out.join("\n")).toContain("[REDACTED:COMPOSIO_API_KEY]");
-    expect(out.join("\n")).not.toContain("ck_test_secret");
+    expect(out.join("\n")).not.toContain("example-ck_test_secret");
   });
 
   test("uses org key header when --org is passed", async () => {
     const fetchMock = mock(async (_url: string | URL | Request, init?: RequestInit) => {
-      expect((init?.headers as Record<string, string>)["x-org-api-key"]).toBe("org_secret_value");
+      expect((init?.headers as Record<string, string>)["x-org-api-key"]).toBe(
+        "example-org_secret_value",
+      );
       expect((init?.headers as Record<string, string>)["x-api-key"]).toBeUndefined();
       return jsonResponse({ ok: true });
     });
 
     await runComposioCommand(["GET", "/org/projects", "--org"], {
-      env: { COMPOSIO_ORG_API_KEY: "org_secret_value" },
+      env: { COMPOSIO_ORG_API_KEY: "example-org_secret_value" },
       fetch: fetchMock,
       log: () => {},
       error: () => {},
@@ -108,7 +110,7 @@ describe("runXCommand", () => {
   test("dispatches to composio target", async () => {
     const fetchMock = mock(async () => jsonResponse({ ok: true }));
     await runXCommand(["composio", "GET", "/tools"], {
-      env: { COMPOSIO_API_KEY: "ck_test_secret" },
+      env: { COMPOSIO_API_KEY: "example-ck_test_secret" },
       fetch: fetchMock,
       log: () => {},
       error: () => {},

package/src/tests/x402-client.test.ts

@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { createX402Client } from "../x402/client.ts";
 
 // A valid test private key (DO NOT use in production — this is a well-known throwaway key)
-const TEST_PRIVATE_KEY = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
+const TEST_PRIVATE_KEY = `0x${"11".repeat(32)}`;
 
 describe("createX402Client", () => {
   const originalEnv = { ...process.env };

package/src/tests/x402-config.test.ts

@@ -1,6 +1,9 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { loadX402Config } from "../x402/config.ts";
 
+const TEST_PRIVATE_KEY = `0x${"11".repeat(32)}`;
+const TEST_PRIVATE_KEY_WITHOUT_PREFIX = TEST_PRIVATE_KEY.slice(2);
+
 describe("loadX402Config", () => {
   const originalEnv = { ...process.env };
 
@@ -28,25 +31,20 @@ describe("loadX402Config", () => {
   // --- Viem signer tests ---
 
   test("auto-detects viem signer when EVM_PRIVATE_KEY is set", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
 
     const config = loadX402Config();
     expect(config.signerType).toBe("viem");
-    expect(config.evmPrivateKey).toBe(
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678",
-    );
+    expect(config.evmPrivateKey).toBe(TEST_PRIVATE_KEY);
   });
 
   test("throws when EVM_PRIVATE_KEY does not start with 0x", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "deadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY_WITHOUT_PREFIX;
     expect(() => loadX402Config()).toThrow("EVM_PRIVATE_KEY must start with '0x'");
   });
 
   test("returns config with defaults when only EVM_PRIVATE_KEY is set", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
 
     const config = loadX402Config();
 
@@ -59,33 +57,32 @@ describe("loadX402Config", () => {
   // --- Openfort signer tests ---
 
   test("auto-detects openfort signer when OPENFORT_API_KEY is set", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
-    process.env.OPENFORT_WALLET_SECRET = "base64secret";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
+    process.env.OPENFORT_WALLET_SECRET = "example-base64secret";
 
     const config = loadX402Config();
     expect(config.signerType).toBe("openfort");
-    expect(config.openfortApiKey).toBe("sk_test_abc123");
-    expect(config.openfortWalletSecret).toBe("base64secret");
+    expect(config.openfortApiKey).toBe("example-sk_test_abc123");
+    expect(config.openfortWalletSecret).toBe("example-base64secret");
   });
 
   test("openfort takes priority over viem when both are set", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
-    process.env.OPENFORT_WALLET_SECRET = "base64secret";
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
+    process.env.OPENFORT_WALLET_SECRET = "example-base64secret";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
 
     const config = loadX402Config();
     expect(config.signerType).toBe("openfort");
   });
 
   test("throws when openfort signer is selected but OPENFORT_WALLET_SECRET is missing", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
     expect(() => loadX402Config()).toThrow("OPENFORT_WALLET_SECRET is required");
   });
 
   test("includes OPENFORT_WALLET_ADDRESS when set", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
-    process.env.OPENFORT_WALLET_SECRET = "base64secret";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
+    process.env.OPENFORT_WALLET_SECRET = "example-base64secret";
     process.env.OPENFORT_WALLET_ADDRESS = "0x1234567890abcdef1234567890abcdef12345678";
 
     const config = loadX402Config();
@@ -96,9 +93,8 @@ describe("loadX402Config", () => {
 
   test("respects explicit X402_SIGNER_TYPE=viem", () => {
     process.env.X402_SIGNER_TYPE = "viem";
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
 
     const config = loadX402Config();
     expect(config.signerType).toBe("viem");
@@ -106,16 +102,14 @@ describe("loadX402Config", () => {
 
   test("throws on invalid X402_SIGNER_TYPE", () => {
     process.env.X402_SIGNER_TYPE = "invalid";
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     expect(() => loadX402Config()).toThrow('X402_SIGNER_TYPE must be "openfort" or "viem"');
   });
 
   // --- Spending limit tests ---
 
   test("parses custom X402_MAX_AUTO_APPROVE", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "5.50";
 
     const config = loadX402Config();
@@ -123,8 +117,7 @@ describe("loadX402Config", () => {
   });
 
   test("parses custom X402_DAILY_LIMIT", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_DAILY_LIMIT = "25.00";
 
     const config = loadX402Config();
@@ -132,8 +125,7 @@ describe("loadX402Config", () => {
   });
 
   test("uses custom X402_NETWORK", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_NETWORK = "eip155:8453";
 
     const config = loadX402Config();
@@ -141,40 +133,35 @@ describe("loadX402Config", () => {
   });
 
   test("throws when X402_MAX_AUTO_APPROVE is not a valid number", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "abc";
 
     expect(() => loadX402Config()).toThrow("X402_MAX_AUTO_APPROVE must be a positive number");
   });
 
   test("throws when X402_MAX_AUTO_APPROVE is zero", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "0";
 
     expect(() => loadX402Config()).toThrow("X402_MAX_AUTO_APPROVE must be a positive number");
   });
 
   test("throws when X402_MAX_AUTO_APPROVE is negative", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "-1";
 
     expect(() => loadX402Config()).toThrow("X402_MAX_AUTO_APPROVE must be a positive number");
   });
 
   test("throws when X402_DAILY_LIMIT is not a valid number", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_DAILY_LIMIT = "not-a-number";
 
     expect(() => loadX402Config()).toThrow("X402_DAILY_LIMIT must be a positive number");
   });
 
   test("throws when X402_DAILY_LIMIT is zero", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_DAILY_LIMIT = "0";
 
     expect(() => loadX402Config()).toThrow("X402_DAILY_LIMIT must be a positive number");