@griffin-app/griffin-executor 0.1.0

package/dist/secrets/resolver.js

@@ -0,0 +1,188 @@
+import { isSecretRef, isStringLiteral, SecretResolutionError } from "./types.js";
+/**
+ * Recursively collect all secret references and string literals from a value.
+ * @param value - The value to scan
+ * @param currentPath - Current path in the object tree
+ * @param collected - Accumulator for found secrets and literals
+ */
+function collectSecretsFromValue(value, currentPath, collected) {
+    if (value === null || value === undefined) {
+        return;
+    }
+    if (isSecretRef(value)) {
+        collected.refs.push(value.$secret);
+        collected.paths.push({
+            path: [...currentPath],
+            secretRef: value.$secret,
+        });
+        return;
+    }
+    if (isStringLiteral(value)) {
+        collected.literalPaths.push({
+            path: [...currentPath],
+            value: value.$literal,
+        });
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            collectSecretsFromValue(value[i], [...currentPath, i], collected);
+        }
+        return;
+    }
+    if (typeof value === "object") {
+        for (const [key, val] of Object.entries(value)) {
+            collectSecretsFromValue(val, [...currentPath, key], collected);
+        }
+    }
+}
+/**
+ * Collect all secret references and string literals from a test monitor.
+ * Scans endpoint headers and bodies for $secret markers and $literal wrappers.
+ */
+export function collectSecretsFromMonitor(monitor) {
+    const collected = {
+        refs: [],
+        paths: [],
+        literalPaths: [],
+    };
+    for (let nodeIndex = 0; nodeIndex < monitor.nodes.length; nodeIndex++) {
+        const node = monitor.nodes[nodeIndex];
+        // Only endpoints can have secrets (in headers and body)
+        if (node.type !== "HTTP_REQUEST") {
+            continue;
+        }
+        //const endpoint = node;
+        // Scan headers
+        if (node.headers) {
+            for (const [headerKey, headerValue] of Object.entries(node.headers)) {
+                collectSecretsFromValue(headerValue, ["nodes", nodeIndex, "headers", headerKey], collected);
+            }
+        }
+        // Scan body
+        if (node.body !== undefined) {
+            collectSecretsFromValue(node.body, ["nodes", nodeIndex, "body"], collected);
+        }
+    }
+    // Deduplicate refs by creating a unique key
+    const seen = new Set();
+    const uniqueRefs = [];
+    for (const ref of collected.refs) {
+        const key = `${ref.ref}:${ref.version || ""}:${ref.field || ""}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            uniqueRefs.push(ref);
+        }
+    }
+    collected.refs = uniqueRefs;
+    return collected;
+}
+/**
+ * Set a value at a path in an object.
+ * Creates intermediate objects/arrays as needed.
+ */
+function setAtPath(obj, path, value) {
+    if (path.length === 0) {
+        return;
+    }
+    let current = obj;
+    for (let i = 0; i < path.length - 1; i++) {
+        const key = path[i];
+        if (current[key] === undefined) {
+            // Create intermediate object or array based on next key type
+            current[key] = typeof path[i + 1] === "number" ? [] : {};
+        }
+        current = current[key];
+    }
+    current[path[path.length - 1]] = value;
+}
+/**
+ * Deep clone a value.
+ */
+function deepClone(value) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    return JSON.parse(JSON.stringify(value));
+}
+/**
+ * Resolve all secrets and unwrap string literals in a monitor and return a new monitor with substituted values.
+ * The original monitor is not modified.
+ *
+ * @param monitor - The test monitor containing secret references and string literals
+ * @param provider - The secret provider (required when monitor contains secret refs)
+ * @returns A new monitor with all secrets resolved to their values and literals unwrapped
+ * @throws SecretResolutionError if any secret cannot be resolved (fail-fast)
+ */
+export async function resolveSecretsInMonitor(monitor, provider) {
+    // Collect all secret references and string literals
+    const collected = collectSecretsFromMonitor(monitor);
+    if (collected.refs.length === 0 && collected.literalPaths.length === 0) {
+        // No secrets or literals to resolve
+        return monitor;
+    }
+    // Resolve secrets when we have refs (provider required)
+    if (collected.refs.length > 0 && !provider) {
+        throw new SecretResolutionError("Monitor contains secret references but no secret provider was provided", { ref: "unknown" });
+    }
+    // Clone the monitor for modification
+    const resolvedMonitor = deepClone(monitor);
+    // Substitute resolved secret values at each path
+    if (provider) {
+        for (const { path, secretRef } of collected.paths) {
+            const value = await provider.resolve(secretRef.ref, {
+                version: secretRef.version,
+                field: secretRef.field,
+            });
+            setAtPath(resolvedMonitor, path, value);
+        }
+    }
+    // Unwrap string literals at each path
+    for (const { path, value } of collected.literalPaths) {
+        setAtPath(resolvedMonitor, path, value);
+    }
+    return resolvedMonitor;
+}
+/**
+ * Check if a monitor contains any secret references or string literals that need resolution.
+ * Useful for short-circuiting resolution when no secrets or literals are present.
+ */
+export function planHasSecrets(monitor) {
+    for (const node of monitor.nodes) {
+        if (node.type !== "HTTP_REQUEST") {
+            continue;
+        }
+        // Check headers
+        if (node.headers) {
+            for (const headerValue of Object.values(node.headers)) {
+                if (isSecretRef(headerValue) || isStringLiteral(headerValue)) {
+                    return true;
+                }
+            }
+        }
+        // Check body (recursive check)
+        if (node.body !== undefined && containsSecretOrLiteral(node.body)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Recursively check if a value contains any secret references or string literals.
+ */
+function containsSecretOrLiteral(value) {
+    if (value === null || value === undefined) {
+        return false;
+    }
+    if (isSecretRef(value) || isStringLiteral(value)) {
+        return true;
+    }
+    if (Array.isArray(value)) {
+        return value.some(containsSecretOrLiteral);
+    }
+    if (typeof value === "object") {
+        return Object.values(value).some(containsSecretOrLiteral);
+    }
+    return false;
+}
+//# sourceMappingURL=resolver.js.map

package/dist/secrets/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/secrets/resolver.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAoBjF;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,WAAgC,EAChC,SAA2B;IAE3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC;YAC1B,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC;YACtB,KAAK,EAAE,KAAK,CAAC,QAAQ;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,uBAAuB,CAAC,GAAG,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAkB;IAElB,MAAM,SAAS,GAAqB;QAClC,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEtC,wDAAwD;QACxD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QAED,wBAAwB;QAExB,eAAe;QACf,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpE,uBAAuB,CACrB,WAAW,EACX,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAC1C,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAED,YAAY;QACZ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,uBAAuB,CACrB,IAAI,CAAC,IAAI,EACT,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAC5B,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAoB,EAAE,CAAC;IAEvC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAI,GAAG,UAAU,CAAC;IAC5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAChB,GAAY,EACZ,IAAyB,EACzB,KAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAQ,GAAG,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,6DAA6D;YAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAI,KAAQ;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAkB,EAClB,QAA+B;IAE/B,oDAAoD;IACpD,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,oCAAoC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,wDAAwD;IACxD,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,qBAAqB,CAC7B,wEAAwE,EACxE,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAE3C,iDAAiD;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;gBAClD,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC,CAAC;YACH,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QACrD,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAkB;IAC/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QAED,gBAAgB;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,IAAI,WAAW,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7D,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/secrets/secrets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secrets.test.d.ts.map

package/dist/secrets/secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.d.ts","sourceRoot":"","sources":["../../src/secrets/secrets.test.ts"],"names":[],"mappings":""}

package/dist/secrets/secrets.test.js

@@ -0,0 +1,317 @@
+import { describe, it, expect } from "vitest";
+import { isSecretRef, isStringLiteral } from "./types.js";
+import { EnvSecretProvider } from "./providers/env.js";
+import { resolveSecretsInMonitor, collectSecretsFromMonitor, planHasSecrets, } from "./resolver.js";
+// Helper to create a secret ref (mirrors the DSL's secret function)
+function createSecretRef(ref) {
+    return { $secret: { ref } };
+}
+// Helper to create a string literal (mirrors the schema's StringLiteral)
+function createStringLiteral(value) {
+    return { $literal: value };
+}
+describe("Secret Types", () => {
+    describe("isSecretRef", () => {
+        it("should return true for valid secret refs", () => {
+            expect(isSecretRef({ $secret: { ref: "API_KEY" } })).toBe(true);
+            expect(isSecretRef({
+                $secret: { ref: "my-secret", version: "1" },
+            })).toBe(true);
+        });
+        it("should return false for non-secret values", () => {
+            expect(isSecretRef("string")).toBe(false);
+            expect(isSecretRef(123)).toBe(false);
+            expect(isSecretRef(null)).toBe(false);
+            expect(isSecretRef(undefined)).toBe(false);
+            expect(isSecretRef({})).toBe(false);
+            expect(isSecretRef({ secret: { ref: "KEY" } })).toBe(false); // wrong key
+            expect(isSecretRef({ $literal: "value" })).toBe(false); // string literal
+        });
+    });
+    describe("isStringLiteral", () => {
+        it("should return true for valid string literals", () => {
+            expect(isStringLiteral({ $literal: "application/json" })).toBe(true);
+            expect(isStringLiteral({ $literal: "" })).toBe(true);
+            expect(isStringLiteral({ $literal: "Bearer token-123" })).toBe(true);
+        });
+        it("should return false for non-literal values", () => {
+            expect(isStringLiteral("string")).toBe(false);
+            expect(isStringLiteral(123)).toBe(false);
+            expect(isStringLiteral(null)).toBe(false);
+            expect(isStringLiteral(undefined)).toBe(false);
+            expect(isStringLiteral({})).toBe(false);
+            expect(isStringLiteral({ literal: "value" })).toBe(false); // wrong key
+            expect(isStringLiteral({ $secret: { ref: "KEY" } })).toBe(false); // secret ref
+        });
+    });
+});
+describe("EnvSecretProvider", () => {
+    it("should resolve environment variables", async () => {
+        const provider = new EnvSecretProvider({
+            env: { MY_API_KEY: "test-key-123" },
+        });
+        const result = await provider.resolve("MY_API_KEY");
+        expect(result).toBe("test-key-123");
+    });
+    it("should throw for missing environment variables", async () => {
+        const provider = new EnvSecretProvider({ env: {} });
+        await expect(provider.resolve("MISSING_VAR")).rejects.toThrow(/not set/);
+    });
+    it("should support prefix", async () => {
+        const provider = new EnvSecretProvider({
+            env: { APP_API_KEY: "prefixed-value" },
+            prefix: "APP_",
+        });
+        const result = await provider.resolve("API_KEY");
+        expect(result).toBe("prefixed-value");
+    });
+});
+describe("Monitor Secret Resolution", () => {
+    const createTestMonitor = (headers, body) => ({
+        id: "test-monitor-1",
+        name: "Test Monitor",
+        version: "1.0",
+        environment: "default",
+        project: "test-project",
+        frequency: { every: 1, unit: "MINUTE" },
+        nodes: [
+            {
+                id: "endpoint-1",
+                type: "HTTP_REQUEST",
+                method: "GET",
+                path: "/api/test",
+                base: "https://api.example.com",
+                response_format: "JSON",
+                headers,
+                body,
+            },
+        ],
+        edges: [
+            { from: "__START__", to: "endpoint-1" },
+            { from: "endpoint-1", to: "__END__" },
+        ],
+    });
+    describe("planHasSecrets", () => {
+        it("should return false for monitors without secrets or literals", () => {
+            const monitor = createTestMonitor({ "Content-Type": "application/json" });
+            expect(planHasSecrets(monitor)).toBe(false);
+        });
+        it("should return true for monitors with secret refs in headers", () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+            });
+            expect(planHasSecrets(monitor)).toBe(true);
+        });
+        it("should return true for monitors with secret refs in body", () => {
+            const monitor = createTestMonitor(undefined, {
+                token: createSecretRef("TOKEN"),
+            });
+            expect(planHasSecrets(monitor)).toBe(true);
+        });
+        it("should return true for monitors with string literals in headers", () => {
+            const monitor = createTestMonitor({
+                "Content-Type": createStringLiteral("application/json"),
+            });
+            expect(planHasSecrets(monitor)).toBe(true);
+        });
+        it("should return true for monitors with string literals in body", () => {
+            const monitor = createTestMonitor(undefined, {
+                type: createStringLiteral("test"),
+            });
+            expect(planHasSecrets(monitor)).toBe(true);
+        });
+    });
+    describe("collectSecretsFromMonitor", () => {
+        it("should collect secrets from headers", () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+                "X-Custom": createSecretRef("custom-secret"),
+            });
+            const collected = collectSecretsFromMonitor(monitor);
+            expect(collected.refs).toHaveLength(2);
+            expect(collected.refs).toContainEqual({ ref: "API_KEY" });
+            expect(collected.refs).toContainEqual({ ref: "custom-secret" });
+        });
+        it("should collect secrets from nested body", () => {
+            const monitor = createTestMonitor(undefined, {
+                auth: {
+                    token: createSecretRef("TOKEN"),
+                },
+                items: [{ key: createSecretRef("ITEM_KEY") }],
+            });
+            const collected = collectSecretsFromMonitor(monitor);
+            expect(collected.refs).toHaveLength(2);
+            expect(collected.refs).toContainEqual({ ref: "TOKEN" });
+            expect(collected.refs).toContainEqual({ ref: "ITEM_KEY" });
+        });
+        it("should deduplicate secret refs", () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+                "X-Backup-Auth": createSecretRef("API_KEY"),
+            });
+            const collected = collectSecretsFromMonitor(monitor);
+            expect(collected.refs).toHaveLength(1);
+            expect(collected.paths).toHaveLength(2);
+        });
+        it("should collect string literals from headers", () => {
+            const monitor = createTestMonitor({
+                "Content-Type": createStringLiteral("application/json"),
+                Accept: createStringLiteral("application/xml"),
+            });
+            const collected = collectSecretsFromMonitor(monitor);
+            expect(collected.refs).toHaveLength(0);
+            expect(collected.literalPaths).toHaveLength(2);
+            expect(collected.literalPaths).toContainEqual({
+                path: ["nodes", 0, "headers", "Content-Type"],
+                value: "application/json",
+            });
+            expect(collected.literalPaths).toContainEqual({
+                path: ["nodes", 0, "headers", "Accept"],
+                value: "application/xml",
+            });
+        });
+        it("should collect both secrets and literals", () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+                "Content-Type": createStringLiteral("application/json"),
+            });
+            const collected = collectSecretsFromMonitor(monitor);
+            expect(collected.refs).toHaveLength(1);
+            expect(collected.refs).toContainEqual({ ref: "API_KEY" });
+            expect(collected.literalPaths).toHaveLength(1);
+            expect(collected.literalPaths).toContainEqual({
+                path: ["nodes", 0, "headers", "Content-Type"],
+                value: "application/json",
+            });
+        });
+    });
+    describe("resolveSecretsInMonitor", () => {
+        it("should resolve secrets in headers", async () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+                "Content-Type": "application/json",
+            });
+            const provider = new EnvSecretProvider({
+                env: { API_KEY: "Bearer secret-token" },
+            });
+            const resolved = await resolveSecretsInMonitor(monitor, provider);
+            const endpoint = resolved.nodes[0];
+            if (endpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(endpoint.headers?.Authorization).toBe("Bearer secret-token");
+            expect(endpoint.headers?.["Content-Type"]).toBe("application/json");
+        });
+        it("should resolve secrets in body", async () => {
+            const monitor = createTestMonitor(undefined, {
+                token: createSecretRef("TOKEN"),
+                data: "plain-value",
+            });
+            const provider = new EnvSecretProvider({
+                env: { TOKEN: "resolved-token" },
+            });
+            const resolved = await resolveSecretsInMonitor(monitor, provider);
+            const endpoint = resolved.nodes[0];
+            if (endpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(endpoint.body.token).toBe("resolved-token");
+            expect(endpoint.body.data).toBe("plain-value");
+        });
+        it("should not modify original monitor", async () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+            });
+            const provider = new EnvSecretProvider({
+                env: { API_KEY: "secret" },
+            });
+            const resolved = await resolveSecretsInMonitor(monitor, provider);
+            // Original should still have secret ref
+            const originalEndpoint = monitor.nodes[0];
+            if (originalEndpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(originalEndpoint.headers?.Authorization).toEqual(createSecretRef("API_KEY"));
+            // Resolved should have string
+            const resolvedEndpoint = resolved.nodes[0];
+            if (resolvedEndpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(resolvedEndpoint.headers?.Authorization).toBe("secret");
+        });
+        it("should throw when no provider configured", async () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+            });
+            await expect(resolveSecretsInMonitor(monitor, null)).rejects.toThrow(/Monitor contains secret references but no secret provider was provided/);
+        });
+        it("should throw for missing secret", async () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("MISSING_KEY"),
+            });
+            const provider = new EnvSecretProvider({ env: {} });
+            await expect(resolveSecretsInMonitor(monitor, provider)).rejects.toThrow(/not set/);
+        });
+        it("should unwrap string literals in headers", async () => {
+            const monitor = createTestMonitor({
+                "Content-Type": createStringLiteral("application/json"),
+                Accept: createStringLiteral("application/xml"),
+            });
+            const resolved = await resolveSecretsInMonitor(monitor, null);
+            const endpoint = resolved.nodes[0];
+            if (endpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(endpoint.headers?.["Content-Type"]).toBe("application/json");
+            expect(endpoint.headers?.Accept).toBe("application/xml");
+        });
+        it("should unwrap string literals in body", async () => {
+            const monitor = createTestMonitor(undefined, {
+                type: createStringLiteral("test-type"),
+                data: "plain-value",
+            });
+            const resolved = await resolveSecretsInMonitor(monitor, null);
+            const endpoint = resolved.nodes[0];
+            if (endpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(endpoint.body.type).toBe("test-type");
+            expect(endpoint.body.data).toBe("plain-value");
+        });
+        it("should resolve both secrets and literals", async () => {
+            const monitor = createTestMonitor({
+                Authorization: createSecretRef("API_KEY"),
+                "Content-Type": createStringLiteral("application/json"),
+            });
+            const provider = new EnvSecretProvider({
+                env: { API_KEY: "Bearer secret-token" },
+            });
+            const resolved = await resolveSecretsInMonitor(monitor, provider);
+            const endpoint = resolved.nodes[0];
+            if (endpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(endpoint.headers?.Authorization).toBe("Bearer secret-token");
+            expect(endpoint.headers?.["Content-Type"]).toBe("application/json");
+        });
+        it("should not modify original monitor with literals", async () => {
+            const monitor = createTestMonitor({
+                "Content-Type": createStringLiteral("application/json"),
+            });
+            const resolved = await resolveSecretsInMonitor(monitor, null);
+            // Original should still have literal wrapper
+            const originalEndpoint = monitor.nodes[0];
+            if (originalEndpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(originalEndpoint.headers?.["Content-Type"]).toEqual(createStringLiteral("application/json"));
+            // Resolved should have unwrapped string
+            const resolvedEndpoint = resolved.nodes[0];
+            if (resolvedEndpoint.type !== "HTTP_REQUEST") {
+                throw new Error("HttpRequest not found");
+            }
+            expect(resolvedEndpoint.headers?.["Content-Type"]).toBe("application/json");
+        });
+    });
+});
+//# sourceMappingURL=secrets.test.js.map

package/dist/secrets/secrets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.js","sourceRoot":"","sources":["../../src/secrets/secrets.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,oEAAoE;AACpE,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,CACJ,WAAW,CAAC;gBACV,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE;aAC5C,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;YACzE,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;YACvE,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;SACpC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAEpD,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACtC,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,iBAAiB,GAAG,CACxB,OAAiC,EACjC,IAAc,EACH,EAAE,CACb,CAAC;QACC,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvC,KAAK,EAAE;YACL;gBACE,EAAE,EAAE,YAAY;gBAChB,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,eAAe,EAAE,MAAM;gBACvB,OAAO;gBACP,IAAI;aACL;SACF;QACD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE;YACvC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE;SACtC;KACF,CAAc,CAAC;IAElB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC1E,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE;gBAC3C,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,cAAc,EAAE,mBAAmB,CAAC,kBAAkB,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE;gBAC3C,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;gBACzC,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAErD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE;gBAC3C,IAAI,EAAE;oBACJ,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;iBAChC;gBACD,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAErD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;gBACzC,eAAe,EAAE,eAAe,CAAC,SAAS,CAAC;aAC5C,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAErD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,cAAc,EAAE,mBAAmB,CAAC,kBAAkB,CAAC;gBACvD,MAAM,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;aAC/C,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAErD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC;gBAC5C,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC;gBAC7C,KAAK,EAAE,kBAAkB;aAC1B,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC;gBAC5C,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC;gBACvC,KAAK,EAAE,iBAAiB;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;gBACzC,cAAc,EAAE,mBAAmB,CAAC,kBAAkB,CAAC;aACxD,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAErD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC;gBAC5C,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC;gBAC7C,KAAK,EAAE,kBAAkB;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;gBACzC,cAAc,EAAE,kBAAkB;aACnC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;gBACrC,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;aACxC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAElE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE;gBAC3C,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;gBAC/B,IAAI,EAAE,aAAa;aACpB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;gBACrC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;aACjC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAElE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAE,QAAQ,CAAC,IAA0B,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC1E,MAAM,CAAE,QAAQ,CAAC,IAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;aAC1C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;gBACrC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;aAC3B,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAElE,wCAAwC;YACxC,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,gBAAgB,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,OAAO,CACrD,eAAe,CAAC,SAAS,CAAC,CAC3B,CAAC;YAEF,8BAA8B;YAC9B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,gBAAgB,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;aAC1C,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAClE,wEAAwE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC;aAC9C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpD,MAAM,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtE,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,cAAc,EAAE,mBAAmB,CAAC,kBAAkB,CAAC;gBACvD,MAAM,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;aAC/C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACpE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE;gBAC3C,IAAI,EAAE,mBAAmB,CAAC,WAAW,CAAC;gBACtC,IAAI,EAAE,aAAa;aACpB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAE,QAAQ,CAAC,IAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,MAAM,CAAE,QAAQ,CAAC,IAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,aAAa,EAAE,eAAe,CAAC,SAAS,CAAC;gBACzC,cAAc,EAAE,mBAAmB,CAAC,kBAAkB,CAAC;aACxD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;gBACrC,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;aACxC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAElE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,cAAc,EAAE,mBAAmB,CAAC,kBAAkB,CAAC;aACxD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE9D,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,gBAAgB,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CACxD,mBAAmB,CAAC,kBAAkB,CAAC,CACxC,CAAC;YAEF,wCAAwC;YACxC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,gBAAgB,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CACrD,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/secrets/types.d.ts

@@ -0,0 +1,70 @@
+import { StringLiteral } from "@griffin-app/griffin-hub-sdk";
+/**
+ * Data structure for a secret reference as it appears in a monitor.
+ */
+export interface SecretRefData {
+    ref: string;
+    version?: string;
+    field?: string;
+}
+/**
+ * Secret reference marker in monitor JSON.
+ */
+export interface SecretRef {
+    $secret: SecretRefData;
+}
+/**
+ * Options passed to secret resolution.
+ */
+export interface SecretResolveOptions {
+    version?: string;
+    field?: string;
+}
+/**
+ * Interface that all secret providers must implement.
+ */
+export interface SecretProvider {
+    /** Unique name of the provider (e.g., "env", "aws", "vault") */
+    readonly name: string;
+    /**
+     * Resolve a single secret reference.
+     * @param ref - The secret path/identifier within this provider
+     * @param options - Optional version or field extraction
+     * @returns The resolved secret value
+     * @throws Error if secret cannot be resolved
+     */
+    resolve(ref: string, options?: SecretResolveOptions): Promise<string>;
+    /**
+     * Optional batch resolution for efficiency.
+     * Default implementation calls resolve() for each ref.
+     */
+    resolveMany?(refs: Array<{
+        ref: string;
+        options?: SecretResolveOptions;
+    }>): Promise<Map<string, string>>;
+    /**
+     * Optional validation/health check.
+     * Called during provider initialization.
+     */
+    validate?(): Promise<void>;
+}
+/**
+ * Error thrown when secret resolution fails.
+ */
+export declare class SecretResolutionError extends Error {
+    readonly ref: string;
+    readonly cause?: Error;
+    constructor(message: string, details: {
+        ref: string;
+        cause?: unknown;
+    });
+}
+/**
+ * Type guard to check if a value is a secret reference.
+ */
+export declare function isSecretRef(value: unknown): value is SecretRef;
+/**
+ * Type guard to check if a value is a string literal.
+ */
+export declare function isStringLiteral(value: unknown): value is StringLiteral;
+//# sourceMappingURL=types.d.ts.map

package/dist/secrets/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtE;;;OAGG;IACH,WAAW,CAAC,CACV,IAAI,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;KAAE,CAAC,GAC3D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,KAAK,CAAC,EAAE,KAAK,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAgB9D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAOtE"}

package/dist/secrets/types.js

@@ -0,0 +1,42 @@
+/**
+ * Error thrown when secret resolution fails.
+ */
+export class SecretResolutionError extends Error {
+    ref;
+    cause;
+    constructor(message, details) {
+        super(message);
+        this.name = "SecretResolutionError";
+        this.ref = details.ref;
+        if (details.cause instanceof Error) {
+            this.cause = details.cause;
+        }
+    }
+}
+/**
+ * Type guard to check if a value is a secret reference.
+ */
+export function isSecretRef(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const obj = value;
+    if (!("$secret" in obj) ||
+        typeof obj.$secret !== "object" ||
+        obj.$secret === null) {
+        return false;
+    }
+    const secretData = obj.$secret;
+    return typeof secretData.ref === "string";
+}
+/**
+ * Type guard to check if a value is a string literal.
+ */
+export function isStringLiteral(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const obj = value;
+    return "$literal" in obj && typeof obj.$literal === "string";
+}
+//# sourceMappingURL=types.js.map