@testsmith/api-spector 0.3.5 → 0.3.7

package/out/main/chunks/auth-builder-CUs9yzOF.js

@@ -1,623 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-const crypto = require("crypto");
-const http = require("http");
-const promises = require("fs/promises");
-const handle = require("./handle-C0IQL-Vl.js");
-const path = require("path");
-const dayjs = require("dayjs");
-const vm = require("vm");
-function _interopNamespaceDefault(e) {
-  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
-  if (e) {
-    for (const k in e) {
-      if (k !== "default") {
-        const d = Object.getOwnPropertyDescriptor(e, k);
-        Object.defineProperty(n, k, d.get ? d : {
-          enumerable: true,
-          get: () => e[k]
-        });
-      }
-    }
-  }
-  n.default = e;
-  return Object.freeze(n);
-}
-const vm__namespace = /* @__PURE__ */ _interopNamespaceDefault(vm);
-const MASTER_KEY_ENV = "API_SPECTOR_MASTER_KEY";
-let secretStore = {};
-let secretStorePath = null;
-async function initSecretStore(userDataPath) {
-  secretStorePath = path.join(userDataPath, "secrets.json");
-  try {
-    const raw = await promises.readFile(secretStorePath, "utf8");
-    secretStore = JSON.parse(raw);
-  } catch {
-    secretStore = {};
-  }
-}
-async function persistSecretStore() {
-  if (!secretStorePath) return;
-  await promises.writeFile(secretStorePath, JSON.stringify(secretStore, null, 2), "utf8");
-}
-function getSafeStorage() {
-  try {
-    const { safeStorage } = require("electron");
-    if (typeof safeStorage?.isEncryptionAvailable === "function") return safeStorage;
-    return null;
-  } catch {
-    return null;
-  }
-}
-function registerSecretHandlers(ipc) {
-  handle.handleIpc(ipc, handle.IPC.secret.checkMasterKey, () => {
-    return { set: Boolean(process.env[MASTER_KEY_ENV]) };
-  });
-  handle.handleIpc(ipc, handle.IPC.secret.setMasterKey, (_e, value) => {
-    process.env[MASTER_KEY_ENV] = value;
-  });
-  handle.handleIpc(ipc, handle.IPC.secret.set, async (_e, ref, value) => {
-    const ss = getSafeStorage();
-    if (!ss || !ss.isEncryptionAvailable()) {
-      throw new Error("OS encryption is not available — set the secret via environment variable instead");
-    }
-    secretStore[ref] = ss.encryptString(value).toString("base64");
-    await persistSecretStore();
-  });
-}
-function decryptSecret(encrypted, salt, iv, password) {
-  const saltBuf = Buffer.from(salt, "base64");
-  const ivBuf = Buffer.from(iv, "base64");
-  const encBuf = Buffer.from(encrypted, "base64");
-  const key = crypto.pbkdf2Sync(password, saltBuf, 1e5, 32, "sha256");
-  const authTag = encBuf.subarray(encBuf.length - 16);
-  const ciphertext = encBuf.subarray(0, encBuf.length - 16);
-  const decipher = crypto.createDecipheriv("aes-256-gcm", key, ivBuf);
-  decipher.setAuthTag(authTag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-async function getSecret(ref) {
-  const stored = secretStore[ref];
-  if (stored) {
-    const ss = getSafeStorage();
-    if (ss && ss.isEncryptionAvailable()) {
-      try {
-        return ss.decryptString(Buffer.from(stored, "base64"));
-      } catch {
-      }
-    }
-  }
-  return process.env[ref] ?? null;
-}
-let _fakerCache = null;
-async function getFaker() {
-  if (!_fakerCache) _fakerCache = await import("@faker-js/faker");
-  return _fakerCache.faker;
-}
-let _exprContext = null;
-async function buildDynamicVars() {
-  const faker = await getFaker();
-  const now = dayjs();
-  _exprContext = { faker, dayjs };
-  return {
-    $uuid: faker.string.uuid(),
-    $timestamp: String(Date.now()),
-    $isoTimestamp: now.toISOString(),
-    $randomInt: String(faker.number.int({ min: 0, max: 1e3 })),
-    $randomFloat: String(faker.number.float({ min: 0, max: 1e3, fractionDigits: 2 })),
-    $randomBoolean: String(faker.datatype.boolean()),
-    $randomEmail: faker.internet.email(),
-    $randomUsername: faker.internet.username(),
-    $randomPassword: faker.internet.password(),
-    $randomFullName: faker.person.fullName(),
-    $randomFirstName: faker.person.firstName(),
-    $randomLastName: faker.person.lastName(),
-    $randomWord: faker.lorem.word(),
-    $randomPhrase: faker.lorem.sentence(),
-    $randomUrl: faker.internet.url(),
-    $randomIp: faker.internet.ip(),
-    $randomHexColor: faker.color.rgb({ format: "hex", casing: "lower" })
-  };
-}
-function interpolate(str, vars) {
-  return str.replace(/\{\{([^}]+)\}\}/g, (match, key) => {
-    const trimmed = key.trim();
-    if (trimmed in vars) return vars[trimmed];
-    if (_exprContext && (trimmed.includes(".") || trimmed.includes("("))) {
-      try {
-        const result = vm__namespace.runInNewContext(trimmed, _exprContext);
-        if (result !== void 0 && result !== null) return String(result);
-      } catch {
-      }
-    }
-    return match;
-  });
-}
-function buildUrl(baseUrl, params, vars) {
-  const templateTokens = /* @__PURE__ */ new Set();
-  baseUrl.replace(/\{\{([^}]+)\}\}/g, (_m, name) => {
-    templateTokens.add(String(name).trim());
-    return "";
-  });
-  const enabled = (params ?? []).filter((p) => p.enabled && p.key);
-  const pathRows = [];
-  const queryRows = [];
-  for (const p of enabled) {
-    const isPath = p.paramType === "path" || templateTokens.has(p.key);
-    if (isPath) pathRows.push(p);
-    else queryRows.push(p);
-  }
-  const mergedVars = pathRows.length ? {
-    ...vars,
-    ...Object.fromEntries(pathRows.map((p) => [p.key, interpolate(p.value, vars)]))
-  } : vars;
-  const url = interpolate(baseUrl, mergedVars);
-  if (!queryRows.length) return url;
-  const sep = url.includes("?") ? "&" : "?";
-  const qs = queryRows.map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");
-  return url + sep + qs;
-}
-async function buildEnvVars(environment) {
-  const vars = {};
-  if (!environment) return vars;
-  const masterKey = process.env["API_SPECTOR_MASTER_KEY"];
-  for (const v of environment.variables) {
-    if (!v.enabled) continue;
-    if (v.envRef) {
-      const envValue = process.env[v.envRef];
-      if (envValue !== void 0) vars[v.key] = envValue;
-    } else if (v.secret && v.secretEncrypted && v.secretSalt && v.secretIv) {
-      if (masterKey) {
-        try {
-          vars[v.key] = decryptSecret(v.secretEncrypted, v.secretSalt, v.secretIv, masterKey);
-        } catch {
-        }
-      }
-      if (vars[v.key] === void 0 && process.env[v.key] !== void 0) {
-        vars[v.key] = process.env[v.key];
-      }
-    } else if (v.secret) {
-      if (process.env[v.key] !== void 0) {
-        vars[v.key] = process.env[v.key];
-      }
-    } else {
-      vars[v.key] = v.value;
-    }
-  }
-  return vars;
-}
-function mergeVars(envVars, collectionVars, globals, localVars = {}, dynamicVars = {}) {
-  return { ...dynamicVars, ...globals, ...collectionVars, ...envVars, ...localVars };
-}
-const SIGNATURE = Buffer.from("NTLMSSP\0", "latin1");
-const F_UNICODE = 1;
-const F_OEM = 2;
-const F_REQUEST_TARGET = 4;
-const F_NTLM = 512;
-const F_ALWAYS_SIGN = 32768;
-const F_EXT_SESSION = 524288;
-const TYPE1_FLAGS = F_UNICODE | F_OEM | F_REQUEST_TARGET | F_NTLM | F_ALWAYS_SIGN | F_EXT_SESSION;
-const TYPE3_FLAGS = F_UNICODE | F_NTLM | F_ALWAYS_SIGN | F_EXT_SESSION;
-function rotl(x, n) {
-  return (x << n | x >>> 32 - n) >>> 0;
-}
-function md4(msg) {
-  const len = msg.length;
-  const bitLen = len * 8;
-  const padLen = (56 - (len + 1) % 64 + 64) % 64;
-  const total = len + 1 + padLen + 8;
-  const buf = Buffer.alloc(total);
-  msg.copy(buf, 0);
-  buf[len] = 128;
-  buf.writeUInt32LE(bitLen >>> 0, total - 8);
-  buf.writeUInt32LE(Math.floor(bitLen / 4294967296) >>> 0, total - 4);
-  let a = 1732584193, b = 4023233417, c = 2562383102, d = 271733878;
-  const X = new Array(16);
-  const F = (x, y, z) => x & y | ~x & z;
-  const G = (x, y, z) => x & y | x & z | y & z;
-  const H = (x, y, z) => x ^ y ^ z;
-  const FF = (aa, bb, cc, dd, k, s) => rotl(aa + F(bb, cc, dd) + X[k] >>> 0, s);
-  const GG = (aa, bb, cc, dd, k, s) => rotl(aa + G(bb, cc, dd) + X[k] + 1518500249 >>> 0, s);
-  const HH = (aa, bb, cc, dd, k, s) => rotl(aa + H(bb, cc, dd) + X[k] + 1859775393 >>> 0, s);
-  for (let i = 0; i < total; i += 64) {
-    for (let j = 0; j < 16; j++) X[j] = buf.readUInt32LE(i + j * 4);
-    const aa = a, bb = b, cc = c, dd = d;
-    for (let k = 0; k < 16; k += 4) {
-      a = FF(a, b, c, d, k, 3);
-      d = FF(d, a, b, c, k + 1, 7);
-      c = FF(c, d, a, b, k + 2, 11);
-      b = FF(b, c, d, a, k + 3, 19);
-    }
-    for (let k = 0; k < 4; k++) {
-      a = GG(a, b, c, d, k, 3);
-      d = GG(d, a, b, c, k + 4, 5);
-      c = GG(c, d, a, b, k + 8, 9);
-      b = GG(b, c, d, a, k + 12, 13);
-    }
-    const order = [0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15];
-    for (let k = 0; k < 16; k += 4) {
-      a = HH(a, b, c, d, order[k], 3);
-      d = HH(d, a, b, c, order[k + 1], 9);
-      c = HH(c, d, a, b, order[k + 2], 11);
-      b = HH(b, c, d, a, order[k + 3], 15);
-    }
-    a = a + aa >>> 0;
-    b = b + bb >>> 0;
-    c = c + cc >>> 0;
-    d = d + dd >>> 0;
-  }
-  const out = Buffer.alloc(16);
-  out.writeUInt32LE(a, 0);
-  out.writeUInt32LE(b, 4);
-  out.writeUInt32LE(c, 8);
-  out.writeUInt32LE(d, 12);
-  return out;
-}
-const utf16le = (s) => Buffer.from(s, "utf16le");
-const hmacMd5 = (key, data) => crypto.createHmac("md5", key).update(data).digest();
-function ntowfv2(user, domain, password) {
-  const ntHash = md4(utf16le(password));
-  return hmacMd5(ntHash, utf16le(user.toUpperCase() + domain));
-}
-function filetime(unixMs) {
-  const ticks = (BigInt(unixMs) + 11644473600000n) * 10000n;
-  const buf = Buffer.alloc(8);
-  buf.writeBigUInt64LE(ticks);
-  return buf;
-}
-function createType1Message() {
-  const msg = Buffer.alloc(32);
-  SIGNATURE.copy(msg, 0);
-  msg.writeUInt32LE(1, 8);
-  msg.writeUInt32LE(TYPE1_FLAGS, 12);
-  msg.writeUInt32LE(32, 16);
-  msg.writeUInt32LE(32, 24);
-  return msg.toString("base64");
-}
-function decodeType2Message(token) {
-  const buf = Buffer.isBuffer(token) ? token : Buffer.from(token, "base64");
-  if (buf.length < 32 || !buf.subarray(0, 8).equals(SIGNATURE)) {
-    throw new Error("Invalid NTLM Type 2 message");
-  }
-  const flags = buf.readUInt32LE(20);
-  const serverChallenge = Buffer.from(buf.subarray(24, 32));
-  let targetInfo = Buffer.alloc(0);
-  if (buf.length >= 48) {
-    const tiLen = buf.readUInt16LE(40);
-    const tiOff = buf.readUInt32LE(44);
-    if (tiLen > 0 && tiOff + tiLen <= buf.length) {
-      targetInfo = Buffer.from(buf.subarray(tiOff, tiOff + tiLen));
-    }
-  }
-  return { serverChallenge, targetInfo, flags };
-}
-function computeNtlmV2Response(opts) {
-  const responseKey = ntowfv2(opts.user, opts.domain, opts.password);
-  const blob = Buffer.concat([
-    Buffer.from([1, 1, 0, 0]),
-    // RespType + HiRespType + reserved
-    Buffer.from([0, 0, 0, 0]),
-    opts.timestamp,
-    opts.clientChallenge,
-    Buffer.from([0, 0, 0, 0]),
-    opts.targetInfo,
-    Buffer.from([0, 0, 0, 0])
-  ]);
-  const ntProof = hmacMd5(responseKey, Buffer.concat([opts.serverChallenge, blob]));
-  const ntResponse = Buffer.concat([ntProof, blob]);
-  const lmProof = hmacMd5(responseKey, Buffer.concat([opts.serverChallenge, opts.clientChallenge]));
-  const lmResponse = Buffer.concat([lmProof, opts.clientChallenge]);
-  return { ntResponse, lmResponse, ntProof };
-}
-function createType3Message(opts) {
-  const domain = opts.domain ?? "";
-  const workstation = opts.workstation ?? "";
-  const clientChallenge = opts.clientChallenge ?? crypto.randomBytes(8);
-  const timestamp = filetime(opts.timestamp ?? Date.now());
-  const { ntResponse, lmResponse } = computeNtlmV2Response({
-    user: opts.user,
-    domain,
-    password: opts.password,
-    serverChallenge: opts.challenge.serverChallenge,
-    targetInfo: opts.challenge.targetInfo,
-    clientChallenge,
-    timestamp
-  });
-  const domainBuf = utf16le(domain);
-  const userBuf = utf16le(opts.user);
-  const wsBuf = utf16le(workstation);
-  const HEADER = 64;
-  const payload = Buffer.concat([lmResponse, ntResponse, domainBuf, userBuf, wsBuf]);
-  const msg = Buffer.alloc(HEADER + payload.length);
-  SIGNATURE.copy(msg, 0);
-  msg.writeUInt32LE(3, 8);
-  let off = HEADER;
-  const writeField = (pos, buf) => {
-    msg.writeUInt16LE(buf.length, pos);
-    msg.writeUInt16LE(buf.length, pos + 2);
-    msg.writeUInt32LE(buf.length ? off : HEADER, pos + 4);
-    buf.copy(msg, off);
-    off += buf.length;
-  };
-  writeField(12, lmResponse);
-  writeField(20, ntResponse);
-  writeField(28, domainBuf);
-  writeField(36, userBuf);
-  writeField(44, wsBuf);
-  msg.writeUInt16LE(0, 52);
-  msg.writeUInt16LE(0, 54);
-  msg.writeUInt32LE(HEADER, 56);
-  msg.writeUInt32LE(TYPE3_FLAGS, 60);
-  return msg.toString("base64");
-}
-async function buildAuthHeaders(auth, vars) {
-  const headers = {};
-  if (auth.type === "bearer") {
-    let token = auth.token ?? "";
-    if (!token && auth.tokenSecretRef) token = await getSecret(auth.tokenSecretRef) ?? "";
-    token = interpolate(token, vars);
-    if (token) headers["Authorization"] = `Bearer ${token}`;
-  }
-  if (auth.type === "basic") {
-    let password = auth.password ?? "";
-    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
-    password = interpolate(password, vars);
-    const username = interpolate(auth.username ?? "", vars);
-    headers["Authorization"] = `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
-  }
-  if (auth.type === "apikey" && auth.apiKeyIn === "header") {
-    let value = auth.apiKeyValue ?? "";
-    if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
-    value = interpolate(value, vars);
-    headers[auth.apiKeyName ?? "X-API-Key"] = value;
-  }
-  if (auth.type === "oauth2") {
-    const now = Date.now();
-    if (auth.oauth2CachedToken && auth.oauth2TokenExpiry && auth.oauth2TokenExpiry > now + 5e3) {
-      headers["Authorization"] = `Bearer ${auth.oauth2CachedToken}`;
-    }
-  }
-  return headers;
-}
-async function buildApiKeyParam(auth, vars) {
-  if (auth.type !== "apikey" || auth.apiKeyIn !== "query") return null;
-  let value = auth.apiKeyValue ?? "";
-  if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
-  value = interpolate(value, vars);
-  return { key: auth.apiKeyName ?? "apikey", value };
-}
-function parseDigestChallenge(wwwAuth) {
-  const extract = (key) => {
-    const m = new RegExp(`${key}="([^"]*)"`, "i").exec(wwwAuth);
-    return m ? m[1] : "";
-  };
-  const extractUnquoted = (key) => {
-    const m = new RegExp(`${key}=([^,\\s]+)`, "i").exec(wwwAuth);
-    return m ? m[1] : "";
-  };
-  return {
-    realm: extract("realm"),
-    nonce: extract("nonce"),
-    qop: extract("qop") || extractUnquoted("qop") || void 0,
-    algorithm: extract("algorithm") || extractUnquoted("algorithm") || "MD5",
-    opaque: extract("opaque") || void 0
-  };
-}
-function md5(s) {
-  return crypto.createHash("md5").update(s).digest("hex");
-}
-function buildDigestAuthHeader(challenge, username, password, method, uri) {
-  const { realm, nonce, qop, algorithm, opaque } = challenge;
-  const algo = (algorithm ?? "MD5").toUpperCase();
-  const ha1 = algo === "MD5-SESS" ? md5(`${md5(`${username}:${realm}:${password}`)}:${nonce}:`) : md5(`${username}:${realm}:${password}`);
-  const ha2 = md5(`${method}:${uri}`);
-  let response;
-  let nc;
-  let cnonce;
-  if (qop === "auth" || qop === "auth-int") {
-    nc = "00000001";
-    cnonce = crypto.randomBytes(8).toString("hex");
-    response = md5(`${ha1}:${nonce}:${nc}:${cnonce}:${qop}:${ha2}`);
-  } else {
-    response = md5(`${ha1}:${nonce}:${ha2}`);
-  }
-  let header = `Digest username="${username}", realm="${realm}", nonce="${nonce}", uri="${uri}", response="${response}"`;
-  if (qop) header += `, qop=${qop}`;
-  if (nc) header += `, nc=${nc}`;
-  if (cnonce) header += `, cnonce="${cnonce}"`;
-  if (opaque) header += `, opaque="${opaque}"`;
-  if (algo !== "MD5") header += `, algorithm=${algo}`;
-  return header;
-}
-async function performDigestAuth(url, method, auth, vars, fetchFn) {
-  const probeResp = await fetchFn(url, { method, headers: {} });
-  if (probeResp.status !== 401) return null;
-  const wwwAuth = probeResp.headers.get("www-authenticate") ?? "";
-  if (!wwwAuth.toLowerCase().startsWith("digest")) return null;
-  const challenge = parseDigestChallenge(wwwAuth);
-  let password = auth.password ?? "";
-  if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
-  password = interpolate(password, vars);
-  const username = interpolate(auth.username ?? "", vars);
-  let uri = "/";
-  try {
-    uri = new URL(url).pathname + (new URL(url).search ?? "");
-  } catch {
-  }
-  return buildDigestAuthHeader(challenge, username, password, method, uri);
-}
-function extractNtlmChallenge(value) {
-  if (!value) return null;
-  const values = Array.isArray(value) ? value : [value];
-  for (const v of values) {
-    for (const part of v.split(",")) {
-      const m = /^\s*NTLM\s+(.+)\s*$/i.exec(part);
-      if (m) return m[1].trim();
-    }
-  }
-  return null;
-}
-async function buildNtlmConnectOpts(tls) {
-  if (!tls) return void 0;
-  const connect = {};
-  if (tls.rejectUnauthorized !== void 0) connect["rejectUnauthorized"] = tls.rejectUnauthorized;
-  if (tls.caCertPath) {
-    try {
-      connect["ca"] = await promises.readFile(tls.caCertPath);
-    } catch {
-    }
-  }
-  if (tls.clientCertPath) {
-    try {
-      connect["cert"] = await promises.readFile(tls.clientCertPath);
-    } catch {
-    }
-  }
-  if (tls.clientKeyPath) {
-    try {
-      connect["key"] = await promises.readFile(tls.clientKeyPath);
-    } catch {
-    }
-  }
-  return Object.keys(connect).length ? connect : void 0;
-}
-async function performNtlmRequest(opts) {
-  if (opts.proxy?.url) {
-    throw new Error("NTLM authentication through a proxy is not supported. Disable the proxy for this request, or target the server directly.");
-  }
-  const { Client } = await import("undici");
-  let password = opts.auth.password ?? "";
-  if (!password && opts.auth.passwordSecretRef) password = await getSecret(opts.auth.passwordSecretRef) ?? "";
-  password = interpolate(password, opts.vars);
-  const username = interpolate(opts.auth.username ?? "", opts.vars);
-  const domain = interpolate(opts.auth.ntlmDomain ?? "", opts.vars);
-  const workstation = interpolate(opts.auth.ntlmWorkstation ?? "", opts.vars);
-  const parsed = new URL(opts.url);
-  const origin = `${parsed.protocol}//${parsed.host}`;
-  const path2 = parsed.pathname + parsed.search;
-  const connect = await buildNtlmConnectOpts(opts.tls);
-  const client = new Client(origin, { pipelining: 1, ...connect ? { connect } : {} });
-  const toAdapter = (statusCode, headers, bodyText) => {
-    const entries = [];
-    for (const [k, v] of Object.entries(headers)) {
-      if (v === void 0) continue;
-      entries.push([k, Array.isArray(v) ? v.join(", ") : String(v)]);
-    }
-    return {
-      status: statusCode,
-      statusText: http.STATUS_CODES[statusCode] ?? "",
-      headers: { forEach: (cb) => entries.forEach(([k, v]) => cb(v, k)) },
-      text: () => Promise.resolve(bodyText)
-    };
-  };
-  try {
-    const negotiate = await client.request({
-      path: path2,
-      method: opts.method,
-      headers: { authorization: `NTLM ${createType1Message()}` }
-    });
-    await negotiate.body.text();
-    const challengeToken = extractNtlmChallenge(negotiate.headers["www-authenticate"]);
-    if (negotiate.statusCode !== 401 || !challengeToken) {
-      const second = await client.request({ path: path2, method: opts.method, headers: opts.baseHeaders, body: opts.body });
-      const bodyText2 = await second.body.text();
-      return toAdapter(second.statusCode, second.headers, bodyText2);
-    }
-    const challenge = decodeType2Message(challengeToken);
-    const type3 = createType3Message({ user: username, password, domain, workstation, challenge });
-    const authed = await client.request({
-      path: path2,
-      method: opts.method,
-      headers: { ...opts.baseHeaders, authorization: `NTLM ${type3}` },
-      body: opts.body
-    });
-    const bodyText = await authed.body.text();
-    return toAdapter(authed.statusCode, authed.headers, bodyText);
-  } finally {
-    await client.close().catch(() => {
-    });
-  }
-}
-async function fetchOAuth2Token(auth, vars) {
-  const flow = auth.oauth2Flow ?? "client_credentials";
-  if (flow === "authorization_code") {
-    throw new Error("authorization_code flow requires the oauth2:startFlow IPC call from the renderer.");
-  }
-  if (flow === "implicit") {
-    throw new Error("implicit flow cannot be performed server-side — tokens must be obtained via the browser redirect.");
-  }
-  const tokenUrl = interpolate(auth.oauth2TokenUrl ?? "", vars);
-  if (!tokenUrl) throw new Error("OAuth 2.0: tokenUrl is required.");
-  const clientId = interpolate(auth.oauth2ClientId ?? "", vars);
-  let clientSecret = auth.oauth2ClientSecret ?? "";
-  if (!clientSecret && auth.oauth2ClientSecretRef) {
-    clientSecret = await getSecret(auth.oauth2ClientSecretRef) ?? "";
-  }
-  clientSecret = interpolate(clientSecret, vars);
-  const params = new URLSearchParams();
-  params.set("grant_type", flow === "password" ? "password" : "client_credentials");
-  params.set("client_id", clientId);
-  params.set("client_secret", clientSecret);
-  if (auth.oauth2Scopes) params.set("scope", auth.oauth2Scopes);
-  if (flow === "password") {
-    let password = auth.password ?? "";
-    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
-    password = interpolate(password, vars);
-    params.set("username", interpolate(auth.username ?? "", vars));
-    params.set("password", password);
-  }
-  const { fetch: nodeFetch } = await import("undici");
-  const resp = await nodeFetch(tokenUrl, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: params.toString()
-  });
-  if (!resp.ok) {
-    const body = await resp.text();
-    throw new Error(`OAuth 2.0 token request failed (${resp.status}): ${body}`);
-  }
-  const json = await resp.json();
-  const accessToken = String(json["access_token"] ?? "");
-  if (!accessToken) throw new Error("OAuth 2.0: token response missing access_token.");
-  const expiresIn = Number(json["expires_in"] ?? 3600);
-  const expiresAt = Date.now() + expiresIn * 1e3;
-  return {
-    accessToken,
-    expiresAt,
-    refreshToken: json["refresh_token"] ? String(json["refresh_token"]) : void 0
-  };
-}
-exports.buildApiKeyParam = buildApiKeyParam;
-exports.buildAuthHeaders = buildAuthHeaders;
-exports.buildDynamicVars = buildDynamicVars;
-exports.buildEnvVars = buildEnvVars;
-exports.buildUrl = buildUrl;
-exports.fetchOAuth2Token = fetchOAuth2Token;
-exports.getSecret = getSecret;
-exports.initSecretStore = initSecretStore;
-exports.interpolate = interpolate;
-exports.mergeVars = mergeVars;
-exports.performDigestAuth = performDigestAuth;
-exports.performNtlmRequest = performNtlmRequest;
-exports.registerSecretHandlers = registerSecretHandlers;