@testsmith/api-spector-agent 0.4.8 → 0.5.0

package/dist/index.cjs

@@ -463,11 +463,11 @@ var require_dom = __commonJS({
     function splitOnASCIIWhitespace(input) {
       return input ? input.split(/[\t\n\f\r ]+/).filter(notEmptyString) : [];
     }
-    function orderedSetReducer(current, element) {
-      if (!current.hasOwnProperty(element)) {
-        current[element] = true;
+    function orderedSetReducer(current2, element) {
+      if (!current2.hasOwnProperty(element)) {
+        current2[element] = true;
       }
-      return current;
+      return current2;
     }
     function toOrderedSet(input) {
       if (!input) return [];
@@ -4709,9 +4709,9 @@ var require_dom_parser = __commonJS({
         }
       },
       endElement: function(namespaceURI, localName, qName) {
-        var current = this.currentElement;
-        var tagName = current.tagName;
-        this.currentElement = current.parentNode;
+        var current2 = this.currentElement;
+        var tagName = current2.tagName;
+        this.currentElement = current2.parentNode;
       },
       startPrefixMapping: function(prefix, uri) {
       },
@@ -7472,9 +7472,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve4, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve(data);
+              return err ? reject(err) : resolve4(data);
             });
           });
         }
@@ -7512,9 +7512,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve4, reject) => {
             this.destroy(err, (err2, data) => {
-              return err2 ? reject(err2) : resolve(data);
+              return err2 ? reject(err2) : resolve4(data);
             });
           });
         }
@@ -10991,8 +10991,8 @@ var require_promise = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve, reject) => {
-        res = resolve;
+      const promise = new Promise((resolve4, reject) => {
+        res = resolve4;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -12293,12 +12293,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve, reject) => {
+      const waitForDrain = () => new Promise((resolve4, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve;
+          callback = resolve4;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -13143,12 +13143,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve, reject) => {
+      const waitForDrain = () => new Promise((resolve4, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve;
+          callback = resolve4;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -13459,16 +13459,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve) => {
+        return new Promise((resolve4) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve;
+            this[kClosedResolve] = resolve4;
           } else {
-            resolve(null);
+            resolve4(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve) => {
+        return new Promise((resolve4) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i68 = 0; i68 < requests.length; i68++) {
             const request = requests[i68];
@@ -13479,7 +13479,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve(null);
+            resolve4(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -13879,8 +13879,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve) => {
-            this[kClosedResolve] = resolve;
+          return new Promise((resolve4) => {
+            this[kClosedResolve] = resolve4;
           });
         }
       }
@@ -14972,10 +14972,10 @@ var require_socks5_proxy_agent = __commonJS({
         const proxyHost = this[kProxyUrl].hostname;
         const proxyPort = parseInt(this[kProxyUrl].port) || 1080;
         debug("creating SOCKS5 connection to", proxyHost, proxyPort);
-        const socket = await new Promise((resolve, reject) => {
+        const socket = await new Promise((resolve4, reject) => {
           const onConnect = () => {
             socket2.removeListener("error", onError);
-            resolve(socket2);
+            resolve4(socket2);
           };
           const onError = (err) => {
             socket2.removeListener("connect", onConnect);
@@ -14994,14 +14994,14 @@ var require_socks5_proxy_agent = __commonJS({
           socket.destroy();
         });
         await socks5Client.handshake();
-        await new Promise((resolve, reject) => {
+        await new Promise((resolve4, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 authentication timeout"));
           }, 5e3);
           const onAuthenticated = () => {
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve();
+            resolve4();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -15010,14 +15010,14 @@ var require_socks5_proxy_agent = __commonJS({
           };
           if (socks5Client.state === "authenticated") {
             clearTimeout(timeout);
-            resolve();
+            resolve4();
           } else {
             socks5Client.once("authenticated", onAuthenticated);
             socks5Client.once("error", onError);
           }
         });
         await socks5Client.connect(targetHost, targetPort);
-        await new Promise((resolve, reject) => {
+        await new Promise((resolve4, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 connection timeout"));
           }, 5e3);
@@ -15025,7 +15025,7 @@ var require_socks5_proxy_agent = __commonJS({
             debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve();
+            resolve4();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -15066,8 +15066,8 @@ var require_socks5_proxy_agent = __commonJS({
                       servername: targetHost,
                       ...connectOpts.tls || {}
                     });
-                    await new Promise((resolve, reject) => {
-                      finalSocket.once("secureConnect", resolve);
+                    await new Promise((resolve4, reject) => {
+                      finalSocket.once("secureConnect", resolve4);
                       finalSocket.once("error", reject);
                     });
                   }
@@ -16092,7 +16092,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve4, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit || this[kBytesRead] > limit) {
             this.destroy(new AbortError());
           }
@@ -16106,11 +16106,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError());
               } else {
-                resolve(null);
+                resolve4(null);
               }
             });
           } else {
-            this.on("close", resolve);
+            this.on("close", resolve4);
           }
           this.on("error", noop).on("data", () => {
             if (this[kBytesRead] > limit) {
@@ -16138,7 +16138,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve4, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -16153,7 +16153,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve,
+              resolve: resolve4,
               reject,
               length: 0,
               body: []
@@ -16227,18 +16227,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve, stream, length } = consume2;
+      const { type, body, resolve: resolve4, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve(chunksDecode(body, length, encoding));
+          resolve4(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve4(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve(chunksConcat(body, length).buffer);
+          resolve4(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve(new Blob(body, { type: stream[kContentType] }));
+          resolve4(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve(chunksConcat(body, length));
+          resolve4(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -16428,9 +16428,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve4, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -16642,9 +16642,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve4, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -16932,9 +16932,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve4, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -17027,9 +17027,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve4, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -18297,7 +18297,7 @@ var require_snapshot_recorder = __commonJS({
   "node_modules/undici/lib/mock/snapshot-recorder.js"(exports2, module2) {
     "use strict";
     var { writeFile: writeFile2, readFile: readFile4, mkdir } = require("node:fs/promises");
-    var { dirname, resolve } = require("node:path");
+    var { dirname, resolve: resolve4 } = require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -18498,7 +18498,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile4(resolve(path), "utf8");
+          const data = await readFile4(resolve4(path), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -18527,7 +18527,7 @@ var require_snapshot_recorder = __commonJS({
         if (!path) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve(path);
+        const resolvedPath = resolve4(path);
         await mkdir(dirname(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
@@ -25365,7 +25365,7 @@ var require_fetch = __commonJS({
         const agent = fetchParams.controller.dispatcher;
         const path = url.pathname + url.search;
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
-        return new Promise((resolve, reject) => agent.dispatch(
+        return new Promise((resolve4, reject) => agent.dispatch(
           {
             path: hasTrailingQuestionMark ? `${path}?` : path,
             origin: url.origin,
@@ -25445,7 +25445,7 @@ var require_fetch = __commonJS({
                 }
               }
               const onError = this.onError.bind(this);
-              resolve({
+              resolve4({
                 status,
                 statusText,
                 headersList,
@@ -25498,7 +25498,7 @@ var require_fetch = __commonJS({
                   headersList.append(headerName, String(value), true);
                 }
               }
-              resolve({
+              resolve4({
                 status,
                 statusText: STATUS_CODES2[status],
                 headersList,
@@ -25514,7 +25514,7 @@ var require_fetch = __commonJS({
               for (let i68 = 0; i68 < rawHeaders.length; i68 += 2) {
                 headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i68]), rawHeaders[i68 + 1].toString("latin1"), true);
               }
-              resolve({
+              resolve4({
                 status,
                 statusText: STATUS_CODES2[status],
                 headersList,
@@ -25901,8 +25901,8 @@ var require_cache3 = __commonJS({
        * @returns {requestResponseList}
        */
       #batchCacheOperations(operations) {
-        const cache = this.#relevantRequestResponseList;
-        const backupCache = [...cache];
+        const cache2 = this.#relevantRequestResponseList;
+        const backupCache = [...cache2];
         const addedItems = [];
         const resultList = [];
         try {
@@ -25929,9 +25929,9 @@ var require_cache3 = __commonJS({
                 return [];
               }
               for (const requestResponse of requestResponses) {
-                const idx = cache.indexOf(requestResponse);
+                const idx = cache2.indexOf(requestResponse);
                 assert(idx !== -1);
-                cache.splice(idx, 1);
+                cache2.splice(idx, 1);
               }
             } else if (operation.type === "put") {
               if (operation.response == null) {
@@ -25961,11 +25961,11 @@ var require_cache3 = __commonJS({
               }
               requestResponses = this.#queryCache(operation.request);
               for (const requestResponse of requestResponses) {
-                const idx = cache.indexOf(requestResponse);
+                const idx = cache2.indexOf(requestResponse);
                 assert(idx !== -1);
-                cache.splice(idx, 1);
+                cache2.splice(idx, 1);
               }
-              cache.push([operation.request, operation.response]);
+              cache2.push([operation.request, operation.response]);
               addedItems.push([operation.request, operation.response]);
             }
             resultList.push([operation.request, operation.response]);
@@ -26142,13 +26142,13 @@ var require_cachestorage = __commonJS({
         if (options.cacheName != null) {
           if (this.#caches.has(options.cacheName)) {
             const cacheList = this.#caches.get(options.cacheName);
-            const cache = new Cache(kConstruct, cacheList);
-            return await cache.match(request, options);
+            const cache2 = new Cache(kConstruct, cacheList);
+            return await cache2.match(request, options);
           }
         } else {
           for (const cacheList of this.#caches.values()) {
-            const cache = new Cache(kConstruct, cacheList);
-            const response = await cache.match(request, options);
+            const cache2 = new Cache(kConstruct, cacheList);
+            const response = await cache2.match(request, options);
             if (response !== void 0) {
               return response;
             }
@@ -26178,12 +26178,12 @@ var require_cachestorage = __commonJS({
         webidl.argumentLengthCheck(arguments, 1, prefix);
         cacheName = webidl.converters.DOMString(cacheName, prefix, "cacheName");
         if (this.#caches.has(cacheName)) {
-          const cache2 = this.#caches.get(cacheName);
-          return new Cache(kConstruct, cache2);
+          const cache3 = this.#caches.get(cacheName);
+          return new Cache(kConstruct, cache3);
         }
-        const cache = [];
-        this.#caches.set(cacheName, cache);
-        return new Cache(kConstruct, cache);
+        const cache2 = [];
+        this.#caches.set(cacheName, cache2);
+        return new Cache(kConstruct, cache2);
       }
       /**
        * @see https://w3c.github.io/ServiceWorker/#cache-storage-delete
@@ -40543,20 +40543,20 @@ var require_compile = __commonJS({
     var util_1 = require_util7();
     var validate_1 = require_validate();
     var SchemaEnv = class {
-      constructor(env) {
+      constructor(env5) {
         var _a3;
         this.refs = {};
         this.dynamicAnchors = {};
         let schema;
-        if (typeof env.schema == "object")
-          schema = env.schema;
-        this.schema = env.schema;
-        this.schemaId = env.schemaId;
-        this.root = env.root || this;
-        this.baseId = (_a3 = env.baseId) !== null && _a3 !== void 0 ? _a3 : (0, resolve_1.normalizeId)(schema === null || schema === void 0 ? void 0 : schema[env.schemaId || "$id"]);
-        this.schemaPath = env.schemaPath;
-        this.localRefs = env.localRefs;
-        this.meta = env.meta;
+        if (typeof env5.schema == "object")
+          schema = env5.schema;
+        this.schema = env5.schema;
+        this.schemaId = env5.schemaId;
+        this.root = env5.root || this;
+        this.baseId = (_a3 = env5.baseId) !== null && _a3 !== void 0 ? _a3 : (0, resolve_1.normalizeId)(schema === null || schema === void 0 ? void 0 : schema[env5.schemaId || "$id"]);
+        this.schemaPath = env5.schemaPath;
+        this.localRefs = env5.localRefs;
+        this.meta = env5.meta;
         this.$async = schema === null || schema === void 0 ? void 0 : schema.$async;
         this.refs = {};
       }
@@ -40654,7 +40654,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve.call(this, root, ref);
+      let _sch = resolve4.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -40681,7 +40681,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s210) {
       return s1.schema === s210.schema && s1.root === s210.root && s1.baseId === s210.baseId;
     }
-    function resolve(root, ref) {
+    function resolve4(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -40740,15 +40740,15 @@ var require_compile = __commonJS({
           baseId = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schId);
         }
       }
-      let env;
+      let env5;
       if (typeof schema != "boolean" && schema.$ref && !(0, util_1.schemaHasRulesButRef)(schema, this.RULES)) {
         const $ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schema.$ref);
-        env = resolveSchema.call(this, root, $ref);
+        env5 = resolveSchema.call(this, root, $ref);
       }
       const { schemaId } = this.opts;
-      env = env || new SchemaEnv({ schema, schemaId, root, baseId });
-      if (env.schema !== env.root.schema)
-        return env;
+      env5 = env5 || new SchemaEnv({ schema, schemaId, root, baseId });
+      if (env5.schema !== env5.root.schema)
+        return env5;
       return void 0;
     }
   }
@@ -41256,7 +41256,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve(baseURI, relativeURI, options) {
+    function resolve4(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -41483,7 +41483,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve,
+      resolve: resolve4,
       resolveComponent,
       equal,
       serialize,
@@ -42149,8 +42149,8 @@ var require_ref = __commonJS({
       schemaType: "string",
       code(cxt) {
         const { gen, schema: $ref, it: it4 } = cxt;
-        const { baseId, schemaEnv: env, validateName, opts, self: self2 } = it4;
-        const { root } = env;
+        const { baseId, schemaEnv: env5, validateName, opts, self: self2 } = it4;
+        const { root } = env5;
         if (($ref === "#" || $ref === "#/") && baseId === root.baseId)
           return callRootRef();
         const schOrEnv = compile_1.resolveRef.call(self2, root, baseId, $ref);
@@ -42160,8 +42160,8 @@ var require_ref = __commonJS({
           return callValidate(schOrEnv);
         return inlineRefSchema(schOrEnv);
         function callRootRef() {
-          if (env === root)
-            return callRef(cxt, validateName, env, env.$async);
+          if (env5 === root)
+            return callRef(cxt, validateName, env5, env5.$async);
           const rootName = gen.scopeValue("root", { ref: root });
           return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root, root.$async);
         }
@@ -42191,14 +42191,14 @@ var require_ref = __commonJS({
     exports2.getValidate = getValidate;
     function callRef(cxt, v60, sch, $async) {
       const { gen, it: it4 } = cxt;
-      const { allErrors, schemaEnv: env, opts } = it4;
+      const { allErrors, schemaEnv: env5, opts } = it4;
       const passCxt = opts.passContext ? names_1.default.this : codegen_1.nil;
       if ($async)
         callAsyncRef();
       else
         callSyncRef();
       function callAsyncRef() {
-        if (!env.$async)
+        if (!env5.$async)
           throw new Error("async schema referenced by sync schema");
         const valid = gen.let("valid");
         gen.try(() => {
@@ -44338,6 +44338,479 @@ async function readStream(body, kind, startMs, opts = {}) {
   return { events, text, close, firstEventMs: firstEventMs < 0 ? 0 : firstEventMs };
 }
 
+// src/main/secrets/registry.ts
+var providers = /* @__PURE__ */ new Map();
+function registerSecretProvider(provider) {
+  providers.set(provider.scheme.toLowerCase(), provider);
+}
+function schemeOf(ref) {
+  const m75 = /^([a-z][a-z0-9+.-]*):/i.exec(ref);
+  if (!m75) return null;
+  const scheme = m75[1].toLowerCase();
+  return providers.has(scheme) ? scheme : null;
+}
+function hasSecretScheme(ref) {
+  return schemeOf(ref) !== null;
+}
+async function resolveExternalSecret(ref, ctx = {}) {
+  const scheme = schemeOf(ref);
+  if (!scheme) return null;
+  const provider = providers.get(scheme);
+  const refBody = ref.slice(scheme.length + 1);
+  return provider.resolve(refBody, ctx);
+}
+
+// src/main/secrets/providers/vault.ts
+var import_node_fs = require("node:fs");
+var import_node_os = require("node:os");
+var import_node_path = require("node:path");
+
+// src/main/secrets/config.ts
+var current;
+function getSecretsConfig() {
+  return current;
+}
+
+// src/main/secrets/providers/vault.ts
+function env(...names) {
+  for (const n63 of names) {
+    const v60 = process.env[n63];
+    if (v60 !== void 0 && v60 !== "") return v60;
+  }
+  return void 0;
+}
+function readFileTrim(path) {
+  try {
+    return (0, import_node_fs.readFileSync)(path, "utf8").trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveConn() {
+  const cfg = getSecretsConfig()?.vault ?? {};
+  const address = env("VAULT_ADDR", "API_SPECTOR_VAULT_ADDR") ?? cfg.address;
+  if (!address) {
+    throw new Error("Vault is not configured: set VAULT_ADDR (or settings.secrets.vault.address)");
+  }
+  const token = env("VAULT_TOKEN", "API_SPECTOR_VAULT_TOKEN") ?? readFileTrim((0, import_node_path.join)((0, import_node_os.homedir)(), ".vault-token"));
+  const roleId = env("VAULT_ROLE_ID", "API_SPECTOR_VAULT_ROLE_ID") ?? cfg.roleId;
+  const secretId = env("VAULT_SECRET_ID", "API_SPECTOR_VAULT_SECRET_ID");
+  const jwt = env("VAULT_JWT", "API_SPECTOR_VAULT_JWT") ?? (env("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH") ? readFileTrim(env("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH")) : void 0);
+  const jwtRole = env("VAULT_JWT_ROLE", "API_SPECTOR_VAULT_JWT_ROLE") ?? cfg.jwtRole;
+  const explicit = env("VAULT_AUTH_METHOD", "API_SPECTOR_VAULT_AUTH_METHOD") ?? cfg.authMethod;
+  const authMethod = explicit ?? (token ? "token" : roleId ? "approle" : jwt ? "jwt" : "token");
+  return {
+    address: address.replace(/\/+$/, ""),
+    namespace: env("VAULT_NAMESPACE", "API_SPECTOR_VAULT_NAMESPACE") ?? cfg.namespace,
+    authMethod,
+    token,
+    roleId,
+    secretId,
+    jwt,
+    jwtRole,
+    loginMount: cfg.loginMount,
+    kvVersion: env("VAULT_KV_VERSION", "API_SPECTOR_VAULT_KV_VERSION") ?? cfg.kvVersion ?? "auto",
+    skipVerify: (env("VAULT_SKIP_VERIFY", "API_SPECTOR_VAULT_SKIP_VERIFY") ?? "").toLowerCase() === "true" || cfg.skipVerify === true,
+    caPath: env("VAULT_CACERT", "API_SPECTOR_VAULT_CACERT")
+  };
+}
+var cachedToken = null;
+var secretCache = /* @__PURE__ */ new Map();
+var _dispatcher;
+var _dispatcherKey = "";
+async function dispatcherFor(conn) {
+  if (!conn.skipVerify && !conn.caPath) return void 0;
+  const key = `${conn.skipVerify}|${conn.caPath ?? ""}`;
+  if (_dispatcher && _dispatcherKey === key) return _dispatcher;
+  const { Agent: Agent2 } = await Promise.resolve().then(() => __toESM(require_undici()));
+  const connect = {};
+  if (conn.skipVerify) connect.rejectUnauthorized = false;
+  if (conn.caPath) {
+    const ca7 = readFileTrim(conn.caPath);
+    if (ca7) connect.ca = ca7;
+  }
+  _dispatcher = new Agent2({ connect });
+  _dispatcherKey = key;
+  return _dispatcher;
+}
+async function vaultFetch(conn, path, init = {}) {
+  const headers = { ...init.headers };
+  if (conn.namespace) headers["X-Vault-Namespace"] = conn.namespace;
+  if (init.token) headers["X-Vault-Token"] = init.token;
+  const dispatcher = await dispatcherFor(conn);
+  const res = await fetch(`${conn.address}/v1/${path}`, {
+    ...init,
+    headers,
+    // undici honours `dispatcher`; the field is not in the DOM RequestInit type.
+    ...dispatcher ? { dispatcher } : {}
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`Vault ${res.status} on /v1/${path}: ${body.slice(0, 300)}`);
+  }
+  return res.json();
+}
+async function clientToken(conn) {
+  if (conn.authMethod === "token") {
+    if (!conn.token) {
+      throw new Error("Vault token auth selected but no token found (set VAULT_TOKEN or run `vault login`)");
+    }
+    return conn.token;
+  }
+  const now = Date.now();
+  if (cachedToken && cachedToken.expiresAt > now + 5e3) return cachedToken.value;
+  let mount;
+  let body;
+  if (conn.authMethod === "approle") {
+    if (!conn.roleId || !conn.secretId) {
+      throw new Error("Vault AppRole auth needs VAULT_ROLE_ID and VAULT_SECRET_ID");
+    }
+    mount = conn.loginMount ?? "approle";
+    body = { role_id: conn.roleId, secret_id: conn.secretId };
+  } else {
+    if (!conn.jwt || !conn.jwtRole) {
+      throw new Error("Vault JWT/OIDC auth needs a JWT (VAULT_JWT or VAULT_JWT_PATH) and a role (VAULT_JWT_ROLE)");
+    }
+    mount = conn.loginMount ?? "jwt";
+    body = { role: conn.jwtRole, jwt: conn.jwt };
+  }
+  const json = await vaultFetch(conn, `auth/${mount}/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const token = json?.auth?.client_token;
+  if (!token) throw new Error("Vault login did not return a client token");
+  const ttl = Number(json?.auth?.lease_duration ?? 0);
+  cachedToken = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  return token;
+}
+async function readSecret(refBody) {
+  const hash = refBody.lastIndexOf("#");
+  if (hash < 0) {
+    throw new Error(`Vault reference must be 'vault:<path>#<key>' (got 'vault:${refBody}')`);
+  }
+  const path = refBody.slice(0, hash).replace(/^\/+/, "");
+  const key = refBody.slice(hash + 1);
+  if (!path || !key) {
+    throw new Error(`Vault reference must be 'vault:<path>#<key>' (got 'vault:${refBody}')`);
+  }
+  const conn = resolveConn();
+  const cacheKey = `${conn.address}|${conn.namespace ?? ""}|${path}`;
+  const now = Date.now();
+  let bag;
+  const hit = secretCache.get(cacheKey);
+  if (hit && hit.expiresAt > now) {
+    bag = hit.bag;
+  } else {
+    const json = await vaultFetch(conn, path, { token: await clientToken(conn) });
+    const isV2 = conn.kvVersion === "2" || conn.kvVersion === "auto" && json?.data?.data !== void 0 && json?.data?.metadata !== void 0;
+    bag = isV2 ? json?.data?.data : json?.data;
+    const lease = Number(json?.lease_duration ?? 0);
+    if (bag) {
+      secretCache.set(cacheKey, { bag, expiresAt: lease > 0 ? now + lease * 1e3 : now + 5 * 6e4 });
+    }
+  }
+  if (!bag || !(key in bag)) {
+    throw new Error(`Vault secret at '${path}' has no key '${key}'`);
+  }
+  return String(bag[key]);
+}
+var vaultProvider = {
+  scheme: "vault",
+  resolve: (refBody) => readSecret(refBody)
+};
+
+// src/main/secrets/providers/sigv4.ts
+var import_node_crypto = require("node:crypto");
+function hmac(key, data) {
+  return (0, import_node_crypto.createHmac)("sha256", key).update(data, "utf8").digest();
+}
+function sha256hex(data) {
+  return (0, import_node_crypto.createHash)("sha256").update(data, "utf8").digest("hex");
+}
+function signSigV4(input) {
+  const amzDate = input.now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const dateStamp = amzDate.slice(0, 8);
+  const headers = { ...input.headers, host: input.host, "x-amz-date": amzDate };
+  if (input.sessionToken) headers["x-amz-security-token"] = input.sessionToken;
+  const lower = {};
+  for (const k68 of Object.keys(headers)) lower[k68.toLowerCase()] = headers[k68].trim().replace(/\s+/g, " ");
+  const sortedKeys = Object.keys(lower).sort();
+  const canonicalHeaders = sortedKeys.map((k68) => `${k68}:${lower[k68]}
+`).join("");
+  const signedHeaders = sortedKeys.join(";");
+  const payloadHash = sha256hex(input.body);
+  const canonicalRequest = [input.method, input.path, input.query ?? "", canonicalHeaders, signedHeaders, payloadHash].join("\n");
+  const scope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(canonicalRequest)].join("\n");
+  const kDate = hmac(`AWS4${input.secretAccessKey}`, dateStamp);
+  const kRegion = hmac(kDate, input.region);
+  const kService = hmac(kRegion, input.service);
+  const kSigning = hmac(kService, "aws4_request");
+  const signature = (0, import_node_crypto.createHmac)("sha256", kSigning).update(stringToSign, "utf8").digest("hex");
+  return {
+    ...headers,
+    Authorization: `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+  };
+}
+
+// src/main/secrets/providers/aws.ts
+function env2(...names) {
+  for (const n63 of names) {
+    const v60 = process.env[n63];
+    if (v60 !== void 0 && v60 !== "") return v60;
+  }
+  return void 0;
+}
+function resolveConn2() {
+  const cfg = getSecretsConfig()?.aws ?? {};
+  const region = env2("AWS_REGION", "AWS_DEFAULT_REGION", "API_SPECTOR_AWS_REGION") ?? cfg.region;
+  const accessKeyId = env2("AWS_ACCESS_KEY_ID");
+  const secretAccessKey = env2("AWS_SECRET_ACCESS_KEY");
+  if (!region) throw new Error("AWS Secrets Manager: no region (set AWS_REGION or settings.secrets.aws.region)");
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("AWS Secrets Manager: no credentials (set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY)");
+  }
+  return { region, accessKeyId, secretAccessKey, sessionToken: env2("AWS_SESSION_TOKEN") };
+}
+var cache = /* @__PURE__ */ new Map();
+async function getSecretString(conn, secretId) {
+  const cacheKey = `${conn.region}|${secretId}`;
+  const now = Date.now();
+  const hit = cache.get(cacheKey);
+  if (hit && hit.expiresAt > now) return hit.raw;
+  const host = `secretsmanager.${conn.region}.amazonaws.com`;
+  const body = JSON.stringify({ SecretId: secretId });
+  const headers = signSigV4({
+    method: "POST",
+    host,
+    path: "/",
+    headers: {
+      "content-type": "application/x-amz-json-1.1",
+      "x-amz-target": "secretsmanager.GetSecretValue"
+    },
+    body,
+    service: "secretsmanager",
+    region: conn.region,
+    accessKeyId: conn.accessKeyId,
+    secretAccessKey: conn.secretAccessKey,
+    sessionToken: conn.sessionToken,
+    now: new Date(now)
+  });
+  const res = await fetch(`https://${host}/`, { method: "POST", headers, body });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`AWS Secrets Manager ${res.status} for '${secretId}': ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const raw = json?.SecretString;
+  if (raw === void 0) throw new Error(`AWS secret '${secretId}' has no SecretString (binary secrets are not supported)`);
+  cache.set(cacheKey, { raw, expiresAt: now + 5 * 6e4 });
+  return raw;
+}
+async function resolve(refBody) {
+  const hash = refBody.lastIndexOf("#");
+  const secretId = hash < 0 ? refBody : refBody.slice(0, hash);
+  const key = hash < 0 ? null : refBody.slice(hash + 1);
+  if (!secretId) throw new Error(`AWS reference must be 'aws:<secretId>[#<key>]' (got 'aws:${refBody}')`);
+  const raw = await getSecretString(resolveConn2(), secretId);
+  if (key === null) return raw;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`AWS secret '${secretId}' is not JSON, so key '${key}' cannot be read (drop the '#${key}')`);
+  }
+  if (!(key in parsed)) throw new Error(`AWS secret '${secretId}' has no key '${key}'`);
+  return String(parsed[key]);
+}
+var awsSecretsProvider = {
+  scheme: "aws",
+  resolve: (refBody) => resolve(refBody)
+};
+
+// src/main/secrets/providers/azure.ts
+function env3(...names) {
+  for (const n63 of names) {
+    const v60 = process.env[n63];
+    if (v60 !== void 0 && v60 !== "") return v60;
+  }
+  return void 0;
+}
+function resolveConn3() {
+  const cfg = getSecretsConfig()?.azure ?? {};
+  const tenantId = env3("AZURE_TENANT_ID", "API_SPECTOR_AZURE_TENANT_ID") ?? cfg.tenantId;
+  const clientId = env3("AZURE_CLIENT_ID", "API_SPECTOR_AZURE_CLIENT_ID") ?? cfg.clientId;
+  const clientSecret = env3("AZURE_CLIENT_SECRET", "API_SPECTOR_AZURE_CLIENT_SECRET");
+  if (!tenantId || !clientId || !clientSecret) {
+    throw new Error("Azure Key Vault: set AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET");
+  }
+  return { tenantId, clientId, clientSecret, defaultVault: cfg.vault };
+}
+var cachedToken2 = null;
+var secretCache2 = /* @__PURE__ */ new Map();
+async function accessToken(conn) {
+  const now = Date.now();
+  if (cachedToken2 && cachedToken2.expiresAt > now + 3e4) return cachedToken2.value;
+  const form = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: conn.clientId,
+    client_secret: conn.clientSecret,
+    scope: "https://vault.azure.net/.default"
+  });
+  const res = await fetch(`https://login.microsoftonline.com/${conn.tenantId}/oauth2/v2.0/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Azure AD token ${res.status}: ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const token = json?.access_token;
+  if (!token) throw new Error("Azure AD did not return an access token");
+  const ttl = Number(json?.expires_in ?? 0);
+  cachedToken2 = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  return token;
+}
+function secretUrl(refBody, defaultVault) {
+  if (/^https?:\/\//i.test(refBody)) {
+    return refBody.split("#")[0];
+  }
+  const parts = refBody.replace(/^\/+/, "").split("/");
+  let vault;
+  let name;
+  let version = "";
+  if (parts.length >= 2) {
+    [vault, name, version = ""] = parts;
+  } else if (parts.length === 1 && defaultVault) {
+    vault = defaultVault;
+    name = parts[0];
+  } else {
+    throw new Error(`Azure reference must be 'azure:<vault>/<secret>[/<version>]' (got 'azure:${refBody}')`);
+  }
+  const base = /^https?:\/\//i.test(vault) ? vault.replace(/\/+$/, "") : `https://${vault}.vault.azure.net`;
+  const path = version ? `secrets/${name}/${version}` : `secrets/${name}`;
+  return `${base}/${path}?api-version=7.4`;
+}
+async function resolve2(refBody) {
+  const conn = resolveConn3();
+  const url = secretUrl(refBody, conn.defaultVault);
+  const now = Date.now();
+  const hit = secretCache2.get(url);
+  if (hit && hit.expiresAt > now) return hit.value;
+  const res = await fetch(url, { headers: { authorization: `Bearer ${await accessToken(conn)}` } });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Azure Key Vault ${res.status} for '${refBody}': ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const value = json?.value;
+  if (value === void 0) throw new Error(`Azure Key Vault secret '${refBody}' has no value`);
+  secretCache2.set(url, { value, expiresAt: now + 5 * 6e4 });
+  return value;
+}
+var azureKeyVaultProvider = {
+  scheme: "azure",
+  resolve: (refBody) => resolve2(refBody)
+};
+
+// src/main/secrets/providers/onepassword.ts
+function env4(...names) {
+  for (const n63 of names) {
+    const v60 = process.env[n63];
+    if (v60 !== void 0 && v60 !== "") return v60;
+  }
+  return void 0;
+}
+function resolveConn4() {
+  const cfg = getSecretsConfig()?.onePassword ?? {};
+  const host = env4("OP_CONNECT_HOST", "API_SPECTOR_OP_CONNECT_HOST") ?? cfg.connectHost;
+  const token = env4("OP_CONNECT_TOKEN", "API_SPECTOR_OP_CONNECT_TOKEN");
+  if (!host || !token) {
+    throw new Error("1Password: set OP_CONNECT_HOST and OP_CONNECT_TOKEN (1Password Connect)");
+  }
+  return { host: host.replace(/\/+$/, ""), token };
+}
+var itemCache = /* @__PURE__ */ new Map();
+var idCache = /* @__PURE__ */ new Map();
+async function opGet(conn, path) {
+  const res = await fetch(`${conn.host}${path}`, { headers: { authorization: `Bearer ${conn.token}` } });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`1Password Connect ${res.status} on ${path}: ${text.slice(0, 300)}`);
+  }
+  return res.json();
+}
+var isId = (s71) => /^[a-z0-9]{26}$/i.test(s71);
+async function vaultId(conn, vault) {
+  if (isId(vault)) return vault;
+  const cacheKey = `vaults:${vault}`;
+  const cached = idCache.get(cacheKey);
+  if (cached) return cached;
+  const list = await opGet(conn, `/v1/vaults?filter=${encodeURIComponent(`name eq "${vault}"`)}`);
+  const id = Array.isArray(list) && list[0]?.id;
+  if (!id) throw new Error(`1Password: vault '${vault}' not found`);
+  idCache.set(cacheKey, id);
+  return id;
+}
+async function itemId(conn, vid, item) {
+  if (isId(item)) return item;
+  const cacheKey = `items:${vid}:${item}`;
+  const cached = idCache.get(cacheKey);
+  if (cached) return cached;
+  const list = await opGet(conn, `/v1/vaults/${vid}/items?filter=${encodeURIComponent(`title eq "${item}"`)}`);
+  const id = Array.isArray(list) && list[0]?.id;
+  if (!id) throw new Error(`1Password: item '${item}' not found in vault`);
+  idCache.set(cacheKey, id);
+  return id;
+}
+async function resolve3(refBody) {
+  const parts = refBody.replace(/^\/\//, "").replace(/^\/+/, "").split("/").filter(Boolean);
+  if (parts.length < 3) {
+    throw new Error(`1Password reference must be 'op://<vault>/<item>/<field>' (got 'op:${refBody}')`);
+  }
+  const [vault, item, ...rest] = parts;
+  const sectionLabel = rest.length >= 2 ? rest[0] : null;
+  const fieldLabel = rest[rest.length - 1];
+  const conn = resolveConn4();
+  const vid = await vaultId(conn, vault);
+  const iid = await itemId(conn, vid, item);
+  const cacheKey = `${vid}/${iid}`;
+  const now = Date.now();
+  let fields;
+  const hit = itemCache.get(cacheKey);
+  if (hit && hit.expiresAt > now) {
+    fields = hit.fields;
+  } else {
+    const doc = await opGet(conn, `/v1/vaults/${vid}/items/${iid}`);
+    fields = Array.isArray(doc?.fields) ? doc.fields : [];
+    itemCache.set(cacheKey, { fields, expiresAt: now + 5 * 6e4 });
+  }
+  const match = fields.find((f74) => {
+    const labelOk = String(f74?.label ?? "").toLowerCase() === fieldLabel.toLowerCase() || f74?.id === fieldLabel;
+    if (!labelOk) return false;
+    if (!sectionLabel) return true;
+    return String(f74?.section?.label ?? "").toLowerCase() === sectionLabel.toLowerCase();
+  });
+  if (!match || match.value === void 0) {
+    throw new Error(`1Password: field '${fieldLabel}' not found on item '${item}'`);
+  }
+  return String(match.value);
+}
+var onePasswordProvider = {
+  scheme: "op",
+  resolve: (refBody) => resolve3(refBody)
+};
+
+// src/main/secrets/index.ts
+registerSecretProvider(vaultProvider);
+registerSecretProvider(awsSecretsProvider);
+registerSecretProvider(azureKeyVaultProvider);
+registerSecretProvider(onePasswordProvider);
+
 // src/main/ipc/secret-handler.ts
 var secretStore = {};
 function getSafeStorage() {
@@ -44350,6 +44823,9 @@ function getSafeStorage() {
   }
 }
 async function getSecret(ref) {
+  if (hasSecretScheme(ref)) {
+    return resolveExternalSecret(ref);
+  }
   const stored = secretStore[ref];
   if (stored) {
     const ss = getSafeStorage();
@@ -44488,10 +44964,10 @@ var Hooks = class {
    * @param {Object<string, any>} env The environment variables of the hook passed to all callbacks registered.
    * @public
    */
-  run(name, env) {
+  run(name, env5) {
     this[name] = this[name] || [];
     this[name].forEach(function(callback) {
-      callback.call(env && env.context ? env.context : env, env);
+      callback.call(env5 && env5.context ? env5.context : env5, env5);
     });
   }
 };
@@ -44744,12 +45220,12 @@ var Jsep = class _Jsep {
    */
   runHook(name, node) {
     if (_Jsep.hooks[name]) {
-      const env = {
+      const env5 = {
         context: this,
         node
       };
-      _Jsep.hooks.run(name, env);
-      return env.node;
+      _Jsep.hooks.run(name, env5);
+      return env5.node;
     }
     return node;
   }
@@ -44760,14 +45236,14 @@ var Jsep = class _Jsep {
    */
   searchHook(name) {
     if (_Jsep.hooks[name]) {
-      const env = {
+      const env5 = {
         context: this
       };
       _Jsep.hooks[name].find(function(callback) {
-        callback.call(env.context, env);
-        return env.node;
+        callback.call(env5.context, env5);
+        return env5.node;
       });
-      return env.node;
+      return env5.node;
     }
   }
   /**
@@ -45365,10 +45841,10 @@ var CONDITIONAL_EXP = "ConditionalExpression";
 var ternary = {
   name: "ternary",
   init(jsep2) {
-    jsep2.hooks.add("after-expression", function gobbleTernary(env) {
-      if (env.node && this.code === jsep2.QUMARK_CODE) {
+    jsep2.hooks.add("after-expression", function gobbleTernary(env5) {
+      if (env5.node && this.code === jsep2.QUMARK_CODE) {
         this.index++;
-        const test = env.node;
+        const test = env5.node;
         const consequent = this.gobbleExpression();
         if (!consequent) {
           this.throwError("Expected expression");
@@ -45380,7 +45856,7 @@ var ternary = {
           if (!alternate) {
             this.throwError("Expected expression");
           }
-          env.node = {
+          env5.node = {
             type: CONDITIONAL_EXP,
             test,
             consequent,
@@ -45391,9 +45867,9 @@ var ternary = {
             while (newTest.right.operator && jsep2.binary_ops[newTest.right.operator] <= 0.9) {
               newTest = newTest.right;
             }
-            env.node.test = newTest.right;
-            newTest.right = env.node;
-            env.node = test;
+            env5.node.test = newTest.right;
+            newTest.right = env5.node;
+            env5.node = test;
           }
         } else {
           this.throwError("Expected :");
@@ -45408,7 +45884,7 @@ var BSLASH_CODE = 92;
 var index = {
   name: "regex",
   init(jsep2) {
-    jsep2.hooks.add("gobble-token", function gobbleRegexLiteral(env) {
+    jsep2.hooks.add("gobble-token", function gobbleRegexLiteral(env5) {
       if (this.code === FSLASH_CODE) {
         const patternIndex = ++this.index;
         let inCharSet = false;
@@ -45430,13 +45906,13 @@ var index = {
             } catch (e20) {
               this.throwError(e20.message);
             }
-            env.node = {
+            env5.node = {
               type: jsep2.LITERAL,
               value,
               raw: this.expr.slice(patternIndex - 1, this.index)
             };
-            env.node = this.gobbleTokenProperty(env.node);
-            return env.node;
+            env5.node = this.gobbleTokenProperty(env5.node);
+            return env5.node;
           }
           if (this.code === jsep2.OBRACK_CODE) {
             inCharSet = true;
@@ -45460,41 +45936,41 @@ var plugin = {
   init(jsep2) {
     const updateNodeTypes = [jsep2.IDENTIFIER, jsep2.MEMBER_EXP];
     plugin.assignmentOperators.forEach((op) => jsep2.addBinaryOp(op, plugin.assignmentPrecedence, true));
-    jsep2.hooks.add("gobble-token", function gobbleUpdatePrefix(env) {
+    jsep2.hooks.add("gobble-token", function gobbleUpdatePrefix(env5) {
       const code = this.code;
       if (plugin.updateOperators.some((c70) => c70 === code && c70 === this.expr.charCodeAt(this.index + 1))) {
         this.index += 2;
-        env.node = {
+        env5.node = {
           type: "UpdateExpression",
           operator: code === PLUS_CODE ? "++" : "--",
           argument: this.gobbleTokenProperty(this.gobbleIdentifier()),
           prefix: true
         };
-        if (!env.node.argument || !updateNodeTypes.includes(env.node.argument.type)) {
-          this.throwError(`Unexpected ${env.node.operator}`);
+        if (!env5.node.argument || !updateNodeTypes.includes(env5.node.argument.type)) {
+          this.throwError(`Unexpected ${env5.node.operator}`);
         }
       }
     });
-    jsep2.hooks.add("after-token", function gobbleUpdatePostfix(env) {
-      if (env.node) {
+    jsep2.hooks.add("after-token", function gobbleUpdatePostfix(env5) {
+      if (env5.node) {
         const code = this.code;
         if (plugin.updateOperators.some((c70) => c70 === code && c70 === this.expr.charCodeAt(this.index + 1))) {
-          if (!updateNodeTypes.includes(env.node.type)) {
-            this.throwError(`Unexpected ${env.node.operator}`);
+          if (!updateNodeTypes.includes(env5.node.type)) {
+            this.throwError(`Unexpected ${env5.node.operator}`);
           }
           this.index += 2;
-          env.node = {
+          env5.node = {
             type: "UpdateExpression",
             operator: code === PLUS_CODE ? "++" : "--",
-            argument: env.node,
+            argument: env5.node,
             prefix: false
           };
         }
       }
     });
-    jsep2.hooks.add("after-expression", function gobbleAssignment(env) {
-      if (env.node) {
-        updateBinariesToAssignments(env.node);
+    jsep2.hooks.add("after-expression", function gobbleAssignment(env5) {
+      if (env5.node) {
+        updateBinariesToAssignments(env5.node);
       }
     });
     function updateBinariesToAssignments(node) {
@@ -46112,10 +46588,10 @@ JSONPath.toPointer = function(pointer) {
 };
 JSONPath.toPathArray = function(expr) {
   const {
-    cache
+    cache: cache2
   } = JSONPath;
-  if (cache[expr]) {
-    return cache[expr].concat();
+  if (cache2[expr]) {
+    return cache2[expr].concat();
   }
   const subx = [];
   const normalized = expr.replaceAll(/@(?:null|boolean|number|string|integer|undefined|nonFinite|scalar|array|object|function|other)\(\)/gu, ";$&;").replaceAll(/[['](\??\(.*?\))[\]'](?!.\])/gu, function($0, $1) {
@@ -46129,8 +46605,8 @@ JSONPath.toPathArray = function(expr) {
     const match = exp.match(/#(\d+)/u);
     return !match || !match[1] ? exp : subx[match[1]];
   });
-  cache[expr] = exprList;
-  return cache[expr].concat();
+  cache2[expr] = exprList;
+  return cache2[expr].concat();
 };
 JSONPath.prototype.safeVm = {
   Script: SafeScript
@@ -46392,9 +46868,9 @@ function buildAt(ctx, testResults, consoleOutput) {
       const counterBuf = Buffer.alloc(8);
       counterBuf.writeUInt32BE(Math.floor(counter / 4294967296), 0);
       counterBuf.writeUInt32BE(counter >>> 0, 4);
-      const hmac = crypto.createHmac(algorithm, keyBytes).update(counterBuf).digest();
-      const offset = hmac[hmac.length - 1] & 15;
-      const binCode = (hmac[offset] & 127) << 24 | (hmac[offset + 1] & 255) << 16 | (hmac[offset + 2] & 255) << 8 | hmac[offset + 3] & 255;
+      const hmac2 = crypto.createHmac(algorithm, keyBytes).update(counterBuf).digest();
+      const offset = hmac2[hmac2.length - 1] & 15;
+      const binCode = (hmac2[offset] & 127) << 24 | (hmac2[offset + 1] & 255) << 16 | (hmac2[offset + 2] & 255) << 8 | hmac2[offset + 3] & 255;
       return String(binCode % 10 ** digits).padStart(digits, "0");
     }
   };
@@ -46914,12 +47390,12 @@ async function fetchOAuth2Token(auth, vars) {
     throw new Error(`OAuth 2.0 token request failed (${resp.status}): ${body}`);
   }
   const json = await resp.json();
-  const accessToken = String(json["access_token"] ?? "");
-  if (!accessToken) throw new Error("OAuth 2.0: token response missing access_token.");
+  const accessToken2 = String(json["access_token"] ?? "");
+  if (!accessToken2) throw new Error("OAuth 2.0: token response missing access_token.");
   const expiresIn = Number(json["expires_in"] ?? 3600);
   const expiresAt = Date.now() + expiresIn * 1e3;
   return {
-    accessToken,
+    accessToken: accessToken2,
     expiresAt,
     refreshToken: json["refresh_token"] ? String(json["refresh_token"]) : void 0
   };
@@ -47185,7 +47661,10 @@ function buildBodyAndApplyHeaders(req, vars, headers) {
   return body;
 }
 async function performHttpExchange(opts) {
-  const { req, vars, resolvedUrl, dispatcher, proxy, tls, onSent } = opts;
+  const { req, resolvedUrl, dispatcher, proxy, tls, onSent } = opts;
+  let vars = opts.vars;
+  const inlineSecrets = await resolveInlineSecrets(req);
+  if (Object.keys(inlineSecrets).length) vars = { ...vars, ...inlineSecrets };
   const start = Date.now();
   if (req.auth.type === "oauth2") {
     const now = Date.now();
@@ -47299,6 +47778,29 @@ function syntheticHttpFailure(status, statusText) {
     error: `Request returned ${status} - no assertion was defined to verify the status code.`
   };
 }
+async function resolveInlineSecrets(req) {
+  const haystack = [
+    req.url ?? "",
+    JSON.stringify(req.params ?? []),
+    JSON.stringify(req.headers ?? []),
+    JSON.stringify(req.body ?? {}),
+    JSON.stringify(req.auth ?? {}),
+    req.preRequestScript ?? "",
+    req.postRequestScript ?? ""
+  ].join("\n");
+  const refs = /* @__PURE__ */ new Set();
+  for (const m75 of haystack.matchAll(/\{\{\s*([^}]+?)\s*\}\}/g)) {
+    const inner = m75[1].trim();
+    if (hasSecretScheme(inner)) refs.add(inner);
+  }
+  if (refs.size === 0) return {};
+  const out = {};
+  await Promise.all([...refs].map(async (ref) => {
+    const value = await resolveExternalSecret(ref);
+    if (value !== null) out[ref] = value;
+  }));
+  return out;
+}
 async function executeRunnerRequest(opts) {
   const { req, collectionVars, envVars, globals: globals2, dispatcher, piiMaskPatterns, proxy, tls, onScriptOutput } = opts;
   let { localVars } = opts;
@@ -47316,6 +47818,24 @@ async function executeRunnerRequest(opts) {
   let updatedCollectionVars = { ...collectionVars };
   let updatedGlobals = { ...globals2 };
   let preScriptError;
+  let inlineSecrets = {};
+  try {
+    inlineSecrets = await resolveInlineSecrets(req);
+  } catch (err) {
+    return {
+      result: {
+        ...base,
+        status: "error",
+        durationMs: 0,
+        error: err instanceof Error ? err.message : String(err)
+      },
+      updatedEnvVars,
+      updatedCollectionVars,
+      updatedGlobals,
+      updatedLocalVars: localVars
+    };
+  }
+  if (Object.keys(inlineSecrets).length) vars = { ...vars, ...inlineSecrets };
   if (req.preRequestScript?.trim()) {
     const r52 = await runScript(interpolate(req.preRequestScript, vars), {
       envVars: { ...envVars },
@@ -47333,6 +47853,7 @@ async function executeRunnerRequest(opts) {
     await persistGlobals();
     onScriptOutput?.("pre", r52.consoleOutput, r52.error);
     vars = mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
+    if (Object.keys(inlineSecrets).length) vars = { ...vars, ...inlineSecrets };
   }
   const resolvedUrl = buildUrl(req.url, req.params, vars);
   base.resolvedUrl = resolvedUrl;
@@ -47423,7 +47944,7 @@ var APP_URL = (process.env.APP_URL || "").replace(/\/+$/, "");
 var AGENT_TOKEN = process.env.AGENT_TOKEN || "";
 var RUNTIME_TOKEN = process.env.RUNTIME_TOKEN || "";
 var POLL_MS = Number(process.env.POLL_INTERVAL_MS || 5e3);
-var VERSION = true ? "0.4.8" : "";
+var VERSION = true ? "0.5.0" : "";
 var authHeaders = AGENT_TOKEN ? { Authorization: `Bearer ${AGENT_TOKEN}` } : RUNTIME_TOKEN ? { "X-Runtime-Token": RUNTIME_TOKEN } : {};
 async function postResult(m75, fields) {
   await fetch(`${APP_URL}/api/monitor-runtime/${m75.id}/result`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testsmith/api-spector-agent",
-  "version": "0.4.8",
+  "version": "0.5.0",
   "description": "API Spector private runner: monitor internal/local APIs the cloud cannot reach, with no inbound connections.",
   "license": "MIT",
   "homepage": "https://api-spector.dev",