@testsmith/api-spector 0.3.5 → 0.3.7

package/out/main/chunks/{request-collection-8TOVNXE0.js → request-exec-AQD6cEgT.js}

@@ -23,14 +23,15 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 const undici = require("undici");
 const promises = require("fs/promises");
-const authBuilder = require("./auth-builder-CUs9yzOF.js");
-const vm = require("vm");
+const handle = require("./handle-BCnNIZZr.js");
 const crypto = require("crypto");
+const path = require("path");
 const dayjs = require("dayjs");
+const vm = require("vm");
 const tv4 = require("tv4");
 const jsonpathPlus = require("jsonpath-plus");
 const xmldom = require("@xmldom/xmldom");
-const path = require("path");
+const http = require("http");
 const Ajv = require("ajv");
 function _interopNamespaceDefault(e) {
   const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
@@ -48,8 +49,8 @@ function _interopNamespaceDefault(e) {
   n.default = e;
   return Object.freeze(n);
 }
-const vm__namespace = /* @__PURE__ */ _interopNamespaceDefault(vm);
 const crypto__namespace = /* @__PURE__ */ _interopNamespaceDefault(crypto);
+const vm__namespace = /* @__PURE__ */ _interopNamespaceDefault(vm);
 let globals = {};
 let currentDir = null;
 function globalsPath(dir) {
@@ -78,6 +79,171 @@ function setGlobals(next) {
 function patchGlobals(patch) {
   globals = { ...globals, ...patch };
 }
+const MASTER_KEY_ENV = "API_SPECTOR_MASTER_KEY";
+let secretStore = {};
+let secretStorePath = null;
+async function initSecretStore(userDataPath) {
+  secretStorePath = path.join(userDataPath, "secrets.json");
+  try {
+    const raw = await promises.readFile(secretStorePath, "utf8");
+    secretStore = JSON.parse(raw);
+  } catch {
+    secretStore = {};
+  }
+}
+async function persistSecretStore() {
+  if (!secretStorePath) return;
+  await promises.writeFile(secretStorePath, JSON.stringify(secretStore, null, 2), "utf8");
+}
+function getSafeStorage() {
+  try {
+    const { safeStorage } = require("electron");
+    if (typeof safeStorage?.isEncryptionAvailable === "function") return safeStorage;
+    return null;
+  } catch {
+    return null;
+  }
+}
+function registerSecretHandlers(ipc) {
+  handle.handleIpc(ipc, handle.IPC.secret.checkMasterKey, () => {
+    return { set: Boolean(process.env[MASTER_KEY_ENV]) };
+  });
+  handle.handleIpc(ipc, handle.IPC.secret.setMasterKey, (_e, value) => {
+    process.env[MASTER_KEY_ENV] = value;
+  });
+  handle.handleIpc(ipc, handle.IPC.secret.set, async (_e, ref, value) => {
+    const ss = getSafeStorage();
+    if (!ss || !ss.isEncryptionAvailable()) {
+      throw new Error("OS encryption is not available - set the secret via environment variable instead");
+    }
+    secretStore[ref] = ss.encryptString(value).toString("base64");
+    await persistSecretStore();
+  });
+}
+function decryptSecret(encrypted, salt, iv, password) {
+  const saltBuf = Buffer.from(salt, "base64");
+  const ivBuf = Buffer.from(iv, "base64");
+  const encBuf = Buffer.from(encrypted, "base64");
+  const key = crypto.pbkdf2Sync(password, saltBuf, 1e5, 32, "sha256");
+  const authTag = encBuf.subarray(encBuf.length - 16);
+  const ciphertext = encBuf.subarray(0, encBuf.length - 16);
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, ivBuf);
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+async function getSecret(ref) {
+  const stored = secretStore[ref];
+  if (stored) {
+    const ss = getSafeStorage();
+    if (ss && ss.isEncryptionAvailable()) {
+      try {
+        return ss.decryptString(Buffer.from(stored, "base64"));
+      } catch {
+      }
+    }
+  }
+  return process.env[ref] ?? null;
+}
+let _fakerCache$1 = null;
+async function getFaker$1() {
+  if (!_fakerCache$1) _fakerCache$1 = await import("@faker-js/faker");
+  return _fakerCache$1.faker;
+}
+let _exprContext = null;
+async function buildDynamicVars() {
+  const faker = await getFaker$1();
+  const now = dayjs();
+  _exprContext = { faker, dayjs };
+  return {
+    $uuid: faker.string.uuid(),
+    $timestamp: String(Date.now()),
+    $isoTimestamp: now.toISOString(),
+    $randomInt: String(faker.number.int({ min: 0, max: 1e3 })),
+    $randomFloat: String(faker.number.float({ min: 0, max: 1e3, fractionDigits: 2 })),
+    $randomBoolean: String(faker.datatype.boolean()),
+    $randomEmail: faker.internet.email(),
+    $randomUsername: faker.internet.username(),
+    $randomPassword: faker.internet.password(),
+    $randomFullName: faker.person.fullName(),
+    $randomFirstName: faker.person.firstName(),
+    $randomLastName: faker.person.lastName(),
+    $randomWord: faker.lorem.word(),
+    $randomPhrase: faker.lorem.sentence(),
+    $randomUrl: faker.internet.url(),
+    $randomIp: faker.internet.ip(),
+    $randomHexColor: faker.color.rgb({ format: "hex", casing: "lower" })
+  };
+}
+function interpolate(str, vars) {
+  return str.replace(/\{\{([^}]+)\}\}/g, (match, key) => {
+    const trimmed = key.trim();
+    if (trimmed in vars) return vars[trimmed];
+    if (_exprContext && (trimmed.includes(".") || trimmed.includes("("))) {
+      try {
+        const result = vm__namespace.runInNewContext(trimmed, _exprContext);
+        if (result !== void 0 && result !== null) return String(result);
+      } catch {
+      }
+    }
+    return match;
+  });
+}
+function buildUrl(baseUrl, params, vars) {
+  const templateTokens = /* @__PURE__ */ new Set();
+  baseUrl.replace(/\{\{([^}]+)\}\}/g, (_m, name) => {
+    templateTokens.add(String(name).trim());
+    return "";
+  });
+  const enabled = (params ?? []).filter((p) => p.enabled && p.key);
+  const pathRows = [];
+  const queryRows = [];
+  for (const p of enabled) {
+    const isPath = p.paramType === "path" || templateTokens.has(p.key);
+    if (isPath) pathRows.push(p);
+    else queryRows.push(p);
+  }
+  const mergedVars = pathRows.length ? {
+    ...vars,
+    ...Object.fromEntries(pathRows.map((p) => [p.key, interpolate(p.value, vars)]))
+  } : vars;
+  const url = interpolate(baseUrl, mergedVars);
+  if (!queryRows.length) return url;
+  const sep = url.includes("?") ? "&" : "?";
+  const qs = queryRows.map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");
+  return url + sep + qs;
+}
+async function buildEnvVars(environment) {
+  const vars = {};
+  if (!environment) return vars;
+  const masterKey = process.env["API_SPECTOR_MASTER_KEY"];
+  for (const v of environment.variables) {
+    if (!v.enabled) continue;
+    if (v.envRef) {
+      const envValue = process.env[v.envRef];
+      if (envValue !== void 0) vars[v.key] = envValue;
+    } else if (v.secret && v.secretEncrypted && v.secretSalt && v.secretIv) {
+      if (masterKey) {
+        try {
+          vars[v.key] = decryptSecret(v.secretEncrypted, v.secretSalt, v.secretIv, masterKey);
+        } catch {
+        }
+      }
+      if (vars[v.key] === void 0 && process.env[v.key] !== void 0) {
+        vars[v.key] = process.env[v.key];
+      }
+    } else if (v.secret) {
+      if (process.env[v.key] !== void 0) {
+        vars[v.key] = process.env[v.key];
+      }
+    } else {
+      vars[v.key] = v.value;
+    }
+  }
+  return vars;
+}
+function mergeVars(envVars, collectionVars, globals2, localVars = {}, dynamicVars = {}) {
+  return { ...dynamicVars, ...globals2, ...collectionVars, ...envVars, ...localVars };
+}
 function xmlFindAll(node, tag, nth) {
   const results = [];
   const siblings = Array.from(node.childNodes).filter((c) => c.nodeType === 1 && c.tagName === tag);
@@ -469,6 +635,404 @@ function normalizeProxyInput(input) {
 function ensureScheme(value) {
   return /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(value) ? value : `http://${value}`;
 }
+const SIGNATURE = Buffer.from("NTLMSSP\0", "latin1");
+const F_UNICODE = 1;
+const F_OEM = 2;
+const F_REQUEST_TARGET = 4;
+const F_NTLM = 512;
+const F_ALWAYS_SIGN = 32768;
+const F_EXT_SESSION = 524288;
+const TYPE1_FLAGS = F_UNICODE | F_OEM | F_REQUEST_TARGET | F_NTLM | F_ALWAYS_SIGN | F_EXT_SESSION;
+const TYPE3_FLAGS = F_UNICODE | F_NTLM | F_ALWAYS_SIGN | F_EXT_SESSION;
+function rotl(x, n) {
+  return (x << n | x >>> 32 - n) >>> 0;
+}
+function md4(msg) {
+  const len = msg.length;
+  const bitLen = len * 8;
+  const padLen = (56 - (len + 1) % 64 + 64) % 64;
+  const total = len + 1 + padLen + 8;
+  const buf = Buffer.alloc(total);
+  msg.copy(buf, 0);
+  buf[len] = 128;
+  buf.writeUInt32LE(bitLen >>> 0, total - 8);
+  buf.writeUInt32LE(Math.floor(bitLen / 4294967296) >>> 0, total - 4);
+  let a = 1732584193, b = 4023233417, c = 2562383102, d = 271733878;
+  const X = new Array(16);
+  const F = (x, y, z) => x & y | ~x & z;
+  const G = (x, y, z) => x & y | x & z | y & z;
+  const H = (x, y, z) => x ^ y ^ z;
+  const FF = (aa, bb, cc, dd, k, s) => rotl(aa + F(bb, cc, dd) + X[k] >>> 0, s);
+  const GG = (aa, bb, cc, dd, k, s) => rotl(aa + G(bb, cc, dd) + X[k] + 1518500249 >>> 0, s);
+  const HH = (aa, bb, cc, dd, k, s) => rotl(aa + H(bb, cc, dd) + X[k] + 1859775393 >>> 0, s);
+  for (let i = 0; i < total; i += 64) {
+    for (let j = 0; j < 16; j++) X[j] = buf.readUInt32LE(i + j * 4);
+    const aa = a, bb = b, cc = c, dd = d;
+    for (let k = 0; k < 16; k += 4) {
+      a = FF(a, b, c, d, k, 3);
+      d = FF(d, a, b, c, k + 1, 7);
+      c = FF(c, d, a, b, k + 2, 11);
+      b = FF(b, c, d, a, k + 3, 19);
+    }
+    for (let k = 0; k < 4; k++) {
+      a = GG(a, b, c, d, k, 3);
+      d = GG(d, a, b, c, k + 4, 5);
+      c = GG(c, d, a, b, k + 8, 9);
+      b = GG(b, c, d, a, k + 12, 13);
+    }
+    const order = [0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15];
+    for (let k = 0; k < 16; k += 4) {
+      a = HH(a, b, c, d, order[k], 3);
+      d = HH(d, a, b, c, order[k + 1], 9);
+      c = HH(c, d, a, b, order[k + 2], 11);
+      b = HH(b, c, d, a, order[k + 3], 15);
+    }
+    a = a + aa >>> 0;
+    b = b + bb >>> 0;
+    c = c + cc >>> 0;
+    d = d + dd >>> 0;
+  }
+  const out = Buffer.alloc(16);
+  out.writeUInt32LE(a, 0);
+  out.writeUInt32LE(b, 4);
+  out.writeUInt32LE(c, 8);
+  out.writeUInt32LE(d, 12);
+  return out;
+}
+const utf16le = (s) => Buffer.from(s, "utf16le");
+const hmacMd5 = (key, data) => crypto.createHmac("md5", key).update(data).digest();
+function ntowfv2(user, domain, password) {
+  const ntHash = md4(utf16le(password));
+  return hmacMd5(ntHash, utf16le(user.toUpperCase() + domain));
+}
+function filetime(unixMs) {
+  const ticks = (BigInt(unixMs) + 11644473600000n) * 10000n;
+  const buf = Buffer.alloc(8);
+  buf.writeBigUInt64LE(ticks);
+  return buf;
+}
+function createType1Message() {
+  const msg = Buffer.alloc(32);
+  SIGNATURE.copy(msg, 0);
+  msg.writeUInt32LE(1, 8);
+  msg.writeUInt32LE(TYPE1_FLAGS, 12);
+  msg.writeUInt32LE(32, 16);
+  msg.writeUInt32LE(32, 24);
+  return msg.toString("base64");
+}
+function decodeType2Message(token) {
+  const buf = Buffer.isBuffer(token) ? token : Buffer.from(token, "base64");
+  if (buf.length < 32 || !buf.subarray(0, 8).equals(SIGNATURE)) {
+    throw new Error("Invalid NTLM Type 2 message");
+  }
+  const flags = buf.readUInt32LE(20);
+  const serverChallenge = Buffer.from(buf.subarray(24, 32));
+  let targetInfo = Buffer.alloc(0);
+  if (buf.length >= 48) {
+    const tiLen = buf.readUInt16LE(40);
+    const tiOff = buf.readUInt32LE(44);
+    if (tiLen > 0 && tiOff + tiLen <= buf.length) {
+      targetInfo = Buffer.from(buf.subarray(tiOff, tiOff + tiLen));
+    }
+  }
+  return { serverChallenge, targetInfo, flags };
+}
+function computeNtlmV2Response(opts) {
+  const responseKey = ntowfv2(opts.user, opts.domain, opts.password);
+  const blob = Buffer.concat([
+    Buffer.from([1, 1, 0, 0]),
+    // RespType + HiRespType + reserved
+    Buffer.from([0, 0, 0, 0]),
+    opts.timestamp,
+    opts.clientChallenge,
+    Buffer.from([0, 0, 0, 0]),
+    opts.targetInfo,
+    Buffer.from([0, 0, 0, 0])
+  ]);
+  const ntProof = hmacMd5(responseKey, Buffer.concat([opts.serverChallenge, blob]));
+  const ntResponse = Buffer.concat([ntProof, blob]);
+  const lmProof = hmacMd5(responseKey, Buffer.concat([opts.serverChallenge, opts.clientChallenge]));
+  const lmResponse = Buffer.concat([lmProof, opts.clientChallenge]);
+  return { ntResponse, lmResponse, ntProof };
+}
+function createType3Message(opts) {
+  const domain = opts.domain ?? "";
+  const workstation = opts.workstation ?? "";
+  const clientChallenge = opts.clientChallenge ?? crypto.randomBytes(8);
+  const timestamp = filetime(opts.timestamp ?? Date.now());
+  const { ntResponse, lmResponse } = computeNtlmV2Response({
+    user: opts.user,
+    domain,
+    password: opts.password,
+    serverChallenge: opts.challenge.serverChallenge,
+    targetInfo: opts.challenge.targetInfo,
+    clientChallenge,
+    timestamp
+  });
+  const domainBuf = utf16le(domain);
+  const userBuf = utf16le(opts.user);
+  const wsBuf = utf16le(workstation);
+  const HEADER = 64;
+  const payload = Buffer.concat([lmResponse, ntResponse, domainBuf, userBuf, wsBuf]);
+  const msg = Buffer.alloc(HEADER + payload.length);
+  SIGNATURE.copy(msg, 0);
+  msg.writeUInt32LE(3, 8);
+  let off = HEADER;
+  const writeField = (pos, buf) => {
+    msg.writeUInt16LE(buf.length, pos);
+    msg.writeUInt16LE(buf.length, pos + 2);
+    msg.writeUInt32LE(buf.length ? off : HEADER, pos + 4);
+    buf.copy(msg, off);
+    off += buf.length;
+  };
+  writeField(12, lmResponse);
+  writeField(20, ntResponse);
+  writeField(28, domainBuf);
+  writeField(36, userBuf);
+  writeField(44, wsBuf);
+  msg.writeUInt16LE(0, 52);
+  msg.writeUInt16LE(0, 54);
+  msg.writeUInt32LE(HEADER, 56);
+  msg.writeUInt32LE(TYPE3_FLAGS, 60);
+  return msg.toString("base64");
+}
+async function buildAuthHeaders(auth, vars) {
+  const headers = {};
+  if (auth.type === "bearer") {
+    let token = auth.token ?? "";
+    if (!token && auth.tokenSecretRef) token = await getSecret(auth.tokenSecretRef) ?? "";
+    token = interpolate(token, vars);
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+  }
+  if (auth.type === "basic") {
+    let password = auth.password ?? "";
+    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
+    password = interpolate(password, vars);
+    const username = interpolate(auth.username ?? "", vars);
+    headers["Authorization"] = `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
+  }
+  if (auth.type === "apikey" && auth.apiKeyIn === "header") {
+    let value = auth.apiKeyValue ?? "";
+    if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
+    value = interpolate(value, vars);
+    headers[auth.apiKeyName ?? "X-API-Key"] = value;
+  }
+  if (auth.type === "oauth2") {
+    const now = Date.now();
+    if (auth.oauth2CachedToken && auth.oauth2TokenExpiry && auth.oauth2TokenExpiry > now + 5e3) {
+      headers["Authorization"] = `Bearer ${auth.oauth2CachedToken}`;
+    }
+  }
+  return headers;
+}
+async function buildApiKeyParam(auth, vars) {
+  if (auth.type !== "apikey" || auth.apiKeyIn !== "query") return null;
+  let value = auth.apiKeyValue ?? "";
+  if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
+  value = interpolate(value, vars);
+  return { key: auth.apiKeyName ?? "apikey", value };
+}
+function parseDigestChallenge(wwwAuth) {
+  const extract = (key) => {
+    const m = new RegExp(`${key}="([^"]*)"`, "i").exec(wwwAuth);
+    return m ? m[1] : "";
+  };
+  const extractUnquoted = (key) => {
+    const m = new RegExp(`${key}=([^,\\s]+)`, "i").exec(wwwAuth);
+    return m ? m[1] : "";
+  };
+  return {
+    realm: extract("realm"),
+    nonce: extract("nonce"),
+    qop: extract("qop") || extractUnquoted("qop") || void 0,
+    algorithm: extract("algorithm") || extractUnquoted("algorithm") || "MD5",
+    opaque: extract("opaque") || void 0
+  };
+}
+function md5(s) {
+  return crypto.createHash("md5").update(s).digest("hex");
+}
+function buildDigestAuthHeader(challenge, username, password, method, uri) {
+  const { realm, nonce, qop, algorithm, opaque } = challenge;
+  const algo = (algorithm ?? "MD5").toUpperCase();
+  const ha1 = algo === "MD5-SESS" ? md5(`${md5(`${username}:${realm}:${password}`)}:${nonce}:`) : md5(`${username}:${realm}:${password}`);
+  const ha2 = md5(`${method}:${uri}`);
+  let response;
+  let nc;
+  let cnonce;
+  if (qop === "auth" || qop === "auth-int") {
+    nc = "00000001";
+    cnonce = crypto.randomBytes(8).toString("hex");
+    response = md5(`${ha1}:${nonce}:${nc}:${cnonce}:${qop}:${ha2}`);
+  } else {
+    response = md5(`${ha1}:${nonce}:${ha2}`);
+  }
+  let header = `Digest username="${username}", realm="${realm}", nonce="${nonce}", uri="${uri}", response="${response}"`;
+  if (qop) header += `, qop=${qop}`;
+  if (nc) header += `, nc=${nc}`;
+  if (cnonce) header += `, cnonce="${cnonce}"`;
+  if (opaque) header += `, opaque="${opaque}"`;
+  if (algo !== "MD5") header += `, algorithm=${algo}`;
+  return header;
+}
+async function performDigestAuth(url, method, auth, vars, fetchFn) {
+  const probeResp = await fetchFn(url, { method, headers: {} });
+  if (probeResp.status !== 401) return null;
+  const wwwAuth = probeResp.headers.get("www-authenticate") ?? "";
+  if (!wwwAuth.toLowerCase().startsWith("digest")) return null;
+  const challenge = parseDigestChallenge(wwwAuth);
+  let password = auth.password ?? "";
+  if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
+  password = interpolate(password, vars);
+  const username = interpolate(auth.username ?? "", vars);
+  let uri = "/";
+  try {
+    uri = new URL(url).pathname + (new URL(url).search ?? "");
+  } catch {
+  }
+  return buildDigestAuthHeader(challenge, username, password, method, uri);
+}
+function extractNtlmChallenge(value) {
+  if (!value) return null;
+  const values = Array.isArray(value) ? value : [value];
+  for (const v of values) {
+    for (const part of v.split(",")) {
+      const m = /^\s*NTLM\s+(.+)\s*$/i.exec(part);
+      if (m) return m[1].trim();
+    }
+  }
+  return null;
+}
+async function buildNtlmConnectOpts(tls) {
+  if (!tls) return void 0;
+  const connect = {};
+  if (tls.rejectUnauthorized !== void 0) connect["rejectUnauthorized"] = tls.rejectUnauthorized;
+  if (tls.caCertPath) {
+    try {
+      connect["ca"] = await promises.readFile(tls.caCertPath);
+    } catch {
+    }
+  }
+  if (tls.clientCertPath) {
+    try {
+      connect["cert"] = await promises.readFile(tls.clientCertPath);
+    } catch {
+    }
+  }
+  if (tls.clientKeyPath) {
+    try {
+      connect["key"] = await promises.readFile(tls.clientKeyPath);
+    } catch {
+    }
+  }
+  return Object.keys(connect).length ? connect : void 0;
+}
+async function performNtlmRequest(opts) {
+  if (opts.proxy?.url) {
+    throw new Error("NTLM authentication through a proxy is not supported. Disable the proxy for this request, or target the server directly.");
+  }
+  const { Client } = await import("undici");
+  let password = opts.auth.password ?? "";
+  if (!password && opts.auth.passwordSecretRef) password = await getSecret(opts.auth.passwordSecretRef) ?? "";
+  password = interpolate(password, opts.vars);
+  const username = interpolate(opts.auth.username ?? "", opts.vars);
+  const domain = interpolate(opts.auth.ntlmDomain ?? "", opts.vars);
+  const workstation = interpolate(opts.auth.ntlmWorkstation ?? "", opts.vars);
+  const parsed = new URL(opts.url);
+  const origin = `${parsed.protocol}//${parsed.host}`;
+  const path2 = parsed.pathname + parsed.search;
+  const connect = await buildNtlmConnectOpts(opts.tls);
+  const client = new Client(origin, { pipelining: 1, ...connect ? { connect } : {} });
+  const toAdapter = (statusCode, headers, bodyText) => {
+    const entries = [];
+    for (const [k, v] of Object.entries(headers)) {
+      if (v === void 0) continue;
+      entries.push([k, Array.isArray(v) ? v.join(", ") : String(v)]);
+    }
+    return {
+      status: statusCode,
+      statusText: http.STATUS_CODES[statusCode] ?? "",
+      headers: { forEach: (cb) => entries.forEach(([k, v]) => cb(v, k)) },
+      text: () => Promise.resolve(bodyText)
+    };
+  };
+  try {
+    const negotiate = await client.request({
+      path: path2,
+      method: opts.method,
+      headers: { authorization: `NTLM ${createType1Message()}` }
+    });
+    await negotiate.body.text();
+    const challengeToken = extractNtlmChallenge(negotiate.headers["www-authenticate"]);
+    if (negotiate.statusCode !== 401 || !challengeToken) {
+      const second = await client.request({ path: path2, method: opts.method, headers: opts.baseHeaders, body: opts.body });
+      const bodyText2 = await second.body.text();
+      return toAdapter(second.statusCode, second.headers, bodyText2);
+    }
+    const challenge = decodeType2Message(challengeToken);
+    const type3 = createType3Message({ user: username, password, domain, workstation, challenge });
+    const authed = await client.request({
+      path: path2,
+      method: opts.method,
+      headers: { ...opts.baseHeaders, authorization: `NTLM ${type3}` },
+      body: opts.body
+    });
+    const bodyText = await authed.body.text();
+    return toAdapter(authed.statusCode, authed.headers, bodyText);
+  } finally {
+    await client.close().catch(() => {
+    });
+  }
+}
+async function fetchOAuth2Token(auth, vars) {
+  const flow = auth.oauth2Flow ?? "client_credentials";
+  if (flow === "authorization_code") {
+    throw new Error("authorization_code flow requires the oauth2:startFlow IPC call from the renderer.");
+  }
+  if (flow === "implicit") {
+    throw new Error("implicit flow cannot be performed server-side - tokens must be obtained via the browser redirect.");
+  }
+  const tokenUrl = interpolate(auth.oauth2TokenUrl ?? "", vars);
+  if (!tokenUrl) throw new Error("OAuth 2.0: tokenUrl is required.");
+  const clientId = interpolate(auth.oauth2ClientId ?? "", vars);
+  let clientSecret = auth.oauth2ClientSecret ?? "";
+  if (!clientSecret && auth.oauth2ClientSecretRef) {
+    clientSecret = await getSecret(auth.oauth2ClientSecretRef) ?? "";
+  }
+  clientSecret = interpolate(clientSecret, vars);
+  const params = new URLSearchParams();
+  params.set("grant_type", flow === "password" ? "password" : "client_credentials");
+  params.set("client_id", clientId);
+  params.set("client_secret", clientSecret);
+  if (auth.oauth2Scopes) params.set("scope", auth.oauth2Scopes);
+  if (flow === "password") {
+    let password = auth.password ?? "";
+    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
+    password = interpolate(password, vars);
+    params.set("username", interpolate(auth.username ?? "", vars));
+    params.set("password", password);
+  }
+  const { fetch: nodeFetch } = await import("undici");
+  const resp = await nodeFetch(tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  if (!resp.ok) {
+    const body = await resp.text();
+    throw new Error(`OAuth 2.0 token request failed (${resp.status}): ${body}`);
+  }
+  const json = await resp.json();
+  const accessToken = String(json["access_token"] ?? "");
+  if (!accessToken) throw new Error("OAuth 2.0: token response missing access_token.");
+  const expiresIn = Number(json["expires_in"] ?? 3600);
+  const expiresAt = Date.now() + expiresIn * 1e3;
+  return {
+    accessToken,
+    expiresAt,
+    refreshToken: json["refresh_token"] ? String(json["refresh_token"]) : void 0
+  };
+}
 function maskPii(data, patterns) {
   if (!patterns.length) return data;
   try {
@@ -529,7 +1093,7 @@ function buildSchemaTestResults(schemaText, body) {
     return [{
       name: "[schema] body matches schema",
       passed: false,
-      error: "Response body is not valid JSON — cannot validate against schema"
+      error: "Response body is not valid JSON - cannot validate against schema"
     }];
   }
   let validate;
@@ -633,21 +1197,21 @@ async function buildDispatcher(proxy, tls) {
 function buildBodyAndApplyHeaders(req, vars, headers) {
   let body;
   if (req.body.mode === "json" && req.body.json) {
-    body = authBuilder.interpolate(req.body.json, vars);
+    body = interpolate(req.body.json, vars);
     if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
   } else if (req.body.mode === "form" && req.body.form) {
-    body = req.body.form.filter((p) => p.enabled && p.key).map((p) => `${encodeURIComponent(authBuilder.interpolate(p.key, vars))}=${encodeURIComponent(authBuilder.interpolate(p.value, vars))}`).join("&");
+    body = req.body.form.filter((p) => p.enabled && p.key).map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");
     if (!headers.has("content-type")) headers.set("Content-Type", "application/x-www-form-urlencoded");
   } else if (req.body.mode === "raw" && req.body.raw) {
-    body = authBuilder.interpolate(req.body.raw, vars);
+    body = interpolate(req.body.raw, vars);
     if (!headers.has("content-type")) headers.set("Content-Type", req.body.rawContentType ?? "text/plain");
   } else if (req.body.mode === "graphql" && req.body.graphql) {
     const gql = req.body.graphql;
-    const gqlBody = { query: authBuilder.interpolate(gql.query, vars) };
+    const gqlBody = { query: interpolate(gql.query, vars) };
     const rawVars = gql.variables?.trim();
     if (rawVars) {
       try {
-        gqlBody.variables = JSON.parse(authBuilder.interpolate(rawVars, vars));
+        gqlBody.variables = JSON.parse(interpolate(rawVars, vars));
       } catch {
       }
     }
@@ -655,7 +1219,7 @@ function buildBodyAndApplyHeaders(req, vars, headers) {
     body = JSON.stringify(gqlBody);
     if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
   } else if (req.body.mode === "soap" && req.body.soap) {
-    body = authBuilder.interpolate(req.body.soap.envelope, vars);
+    body = interpolate(req.body.soap.envelope, vars);
     if (!headers.has("content-type")) headers.set("Content-Type", "text/xml; charset=utf-8");
     if (req.body.soap.soapAction && !headers.has("soapaction")) {
       headers.set("SOAPAction", req.body.soap.soapAction);
@@ -671,13 +1235,13 @@ async function performHttpExchange(opts) {
     const tokenMissing = !req.auth.oauth2CachedToken;
     const tokenExpired = req.auth.oauth2TokenExpiry ? req.auth.oauth2TokenExpiry <= now + 5e3 : true;
     if (tokenMissing || tokenExpired) {
-      const result = await authBuilder.fetchOAuth2Token(req.auth, vars);
+      const result = await fetchOAuth2Token(req.auth, vars);
       req.auth.oauth2CachedToken = result.accessToken;
       req.auth.oauth2TokenExpiry = result.expiresAt;
     }
   }
-  const authHeaders = await authBuilder.buildAuthHeaders(req.auth, vars);
-  const apiKeyParam = await authBuilder.buildApiKeyParam(req.auth, vars);
+  const authHeaders = await buildAuthHeaders(req.auth, vars);
+  const apiKeyParam = await buildApiKeyParam(req.auth, vars);
   let finalUrl = resolvedUrl;
   if (apiKeyParam) {
     const sep = finalUrl.includes("?") ? "&" : "?";
@@ -685,7 +1249,7 @@ async function performHttpExchange(opts) {
   }
   const headers = new undici.Headers();
   for (const h of req.headers) {
-    if (h.enabled && h.key) headers.set(authBuilder.interpolate(h.key, vars), authBuilder.interpolate(h.value, vars));
+    if (h.enabled && h.key) headers.set(interpolate(h.key, vars), interpolate(h.value, vars));
   }
   for (const [k, v] of Object.entries(authHeaders)) headers.set(k, v);
   const body = buildBodyAndApplyHeaders(req, vars, headers);
@@ -709,7 +1273,7 @@ async function performHttpExchange(opts) {
   let fetchResp;
   if (req.auth.type === "ntlm") {
     sentHeaders = captureSent(headers);
-    fetchResp = await authBuilder.performNtlmRequest({
+    fetchResp = await performNtlmRequest({
       url: finalUrl,
       method: req.method,
       auth: req.auth,
@@ -724,7 +1288,7 @@ async function performHttpExchange(opts) {
       ...init,
       dispatcher
     });
-    const digestHeader = await authBuilder.performDigestAuth(finalUrl, req.method, req.auth, vars, probeFetch);
+    const digestHeader = await performDigestAuth(finalUrl, req.method, req.auth, vars, probeFetch);
     if (digestHeader) headers.set("Authorization", digestHeader);
     sentHeaders = captureSent(headers);
     fetchResp = await doFetch(headers);
@@ -758,7 +1322,7 @@ function syntheticHttpFailure(status, statusText) {
   return {
     name: `HTTP status ${status} ${statusText}`.trim(),
     passed: false,
-    error: `Request returned ${status} — no assertion was defined to verify the status code.`
+    error: `Request returned ${status} - no assertion was defined to verify the status code.`
   };
 }
 async function executeRunnerRequest(opts) {
@@ -772,14 +1336,14 @@ async function executeRunnerRequest(opts) {
     resolvedUrl: req.url,
     status: "running"
   };
-  const dynamicVars = await authBuilder.buildDynamicVars();
-  let vars = authBuilder.mergeVars(envVars, collectionVars, globals2, localVars, dynamicVars);
+  const dynamicVars = await buildDynamicVars();
+  let vars = mergeVars(envVars, collectionVars, globals2, localVars, dynamicVars);
   let updatedEnvVars = { ...envVars };
   let updatedCollectionVars = { ...collectionVars };
   let updatedGlobals = { ...globals2 };
   let preScriptError;
   if (req.preRequestScript?.trim()) {
-    const r = await runScript(authBuilder.interpolate(req.preRequestScript, vars), {
+    const r = await runScript(interpolate(req.preRequestScript, vars), {
       envVars: { ...envVars },
       collectionVars: { ...collectionVars },
       globals: { ...globals2 },
@@ -794,9 +1358,9 @@ async function executeRunnerRequest(opts) {
     patchGlobals(r.updatedGlobals);
     await persistGlobals();
     onScriptOutput?.("pre", r.consoleOutput, r.error);
-    vars = authBuilder.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
+    vars = mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
   }
-  const resolvedUrl = authBuilder.buildUrl(req.url, req.params, vars);
+  const resolvedUrl = buildUrl(req.url, req.params, vars);
   base.resolvedUrl = resolvedUrl;
   const start = Date.now();
   try {
@@ -817,7 +1381,7 @@ async function executeRunnerRequest(opts) {
     let consoleOutput = [];
     let postScriptError;
     if (req.postRequestScript?.trim()) {
-      const r = await runScript(authBuilder.interpolate(req.postRequestScript, vars), {
+      const r = await runScript(interpolate(req.postRequestScript, vars), {
         envVars: updatedEnvVars,
         collectionVars: updatedCollectionVars,
         globals: updatedGlobals,
@@ -890,25 +1454,25 @@ class HookSkipTracker {
     if (isHook) {
       if (hookType === "beforeAll") {
         if ((scopeAncestors ?? []).some((id) => this.failedScopes.has(id))) {
-          return "Skipped — outer scope hook failed";
+          return "Skipped - outer scope hook failed";
         }
       } else if (hookType === "before") {
         const allScopes2 = [...scopeAncestors ?? [], scopeId].filter(Boolean);
         if (allScopes2.some((id) => this.failedScopes.has(id))) {
-          return "Skipped — scope hook failed";
+          return "Skipped - scope hook failed";
         }
         if (mainRequestId && this.skipRequests.has(mainRequestId)) {
-          return "Skipped — before hook failed";
+          return "Skipped - before hook failed";
         }
       }
       return void 0;
     }
     const allScopes = [...scopeAncestors ?? [], scopeId].filter(Boolean);
     if (allScopes.some((id) => this.failedScopes.has(id))) {
-      return "Skipped — beforeAll hook failed";
+      return "Skipped - beforeAll hook failed";
     }
     if (this.skipRequests.has(item.request.id)) {
-      return "Skipped — before hook failed";
+      return "Skipped - before hook failed";
     }
     return void 0;
   }
@@ -925,135 +1489,27 @@ class HookSkipTracker {
     }
   }
 }
-function makeHook(req, collectionVars, hookType, scopeId, scopeAncestors, scopePath, mainRequestId) {
-  return { request: req, collectionVars, isHook: true, hookType, scopeId, scopeAncestors, scopePath, mainRequestId };
-}
-function buildFolderPlan(folder, requests, collectionVars, filterTags, scopeId, ancestorIds, parentPath, wrappers, isRoot) {
-  const result = [];
-  const scopePath = isRoot ? [] : [...parentPath, folder.name];
-  const folderReqs = folder.requestIds.map((id) => requests[id]).filter((r) => r && !r.disabled);
-  const beforeAllHooks = folderReqs.filter((r) => r.hookType === "beforeAll");
-  const beforeHooks = folderReqs.filter((r) => r.hookType === "before");
-  const afterHooks = folderReqs.filter((r) => r.hookType === "after");
-  const afterAllHooks = folderReqs.filter((r) => r.hookType === "afterAll");
-  const regularReqs = folderReqs.filter((r) => !r.hookType);
-  const myWrapper = { scopeId, ancestors: ancestorIds, scopePath, before: beforeHooks, after: afterHooks };
-  const allWrappers = [...wrappers, myWrapper];
-  for (const req of beforeAllHooks) {
-    result.push(makeHook(req, collectionVars, "beforeAll", scopeId, ancestorIds, scopePath));
-  }
-  for (const req of regularReqs) {
-    const tags = req.meta?.tags ?? [];
-    if (filterTags.length > 0 && !filterTags.some((t) => tags.includes(t))) continue;
-    for (const w of allWrappers) {
-      for (const hookReq of w.before) {
-        result.push(makeHook(hookReq, collectionVars, "before", w.scopeId, w.ancestors, w.scopePath, req.id));
-      }
-    }
-    result.push({ request: req, collectionVars, scopeId, scopeAncestors: ancestorIds, scopePath });
-    for (const w of [...allWrappers].reverse()) {
-      for (const hookReq of w.after) {
-        result.push(makeHook(hookReq, collectionVars, "after", w.scopeId, w.ancestors, w.scopePath, req.id));
-      }
-    }
-  }
-  for (const sub of folder.folders) {
-    const folderTags = sub.tags ?? [];
-    const effectiveFilter = filterTags.length === 0 ? filterTags : folderTags.some((t) => filterTags.includes(t)) ? [] : filterTags;
-    result.push(...buildFolderPlan(
-      sub,
-      requests,
-      collectionVars,
-      effectiveFilter,
-      sub.id,
-      [...ancestorIds, scopeId],
-      scopePath,
-      allWrappers,
-      false
-    ));
-  }
-  for (const req of afterAllHooks) {
-    result.push(makeHook(req, collectionVars, "afterAll", scopeId, ancestorIds, scopePath));
-  }
-  return result;
-}
-function folderPathTo(root, requestId) {
-  if (root.requestIds.includes(requestId)) return [root];
-  for (const sub of root.folders) {
-    const path2 = folderPathTo(sub, requestId);
-    if (path2.length > 0) return [root, ...path2];
-  }
-  return [];
-}
-function getAllApplicableHooks(folderId, collection) {
-  function chainToFolder(root, targetId) {
-    if (root.id === targetId) return [root];
-    for (const sub of root.folders) {
-      const chain2 = chainToFolder(sub, targetId);
-      if (chain2.length) return [root, ...chain2];
-    }
-    return [];
-  }
-  const chain = chainToFolder(collection.rootFolder, folderId);
-  const beforeAll = [];
-  const before = [];
-  const after = [];
-  const afterAll = [];
-  for (const folder of chain) {
-    const reqs = folder.requestIds.map((id) => collection.requests[id]).filter((r) => r && !r.disabled);
-    beforeAll.push(...reqs.filter((r) => r.hookType === "beforeAll"));
-    before.push(...reqs.filter((r) => r.hookType === "before"));
-  }
-  for (const folder of [...chain].reverse()) {
-    const reqs = folder.requestIds.map((id) => collection.requests[id]).filter((r) => r && !r.disabled);
-    after.push(...reqs.filter((r) => r.hookType === "after"));
-    afterAll.push(...reqs.filter((r) => r.hookType === "afterAll"));
-  }
-  return { beforeAll, before, after, afterAll };
-}
-function resolveInheritedAuthAndHeaders(requestId, collection) {
-  let inheritedAuth = collection.auth && collection.auth.type !== "none" ? collection.auth : null;
-  let inheritedHeaders = collection.headers?.filter((h) => h.enabled && h.key) ?? [];
-  const path2 = folderPathTo(collection.rootFolder, requestId);
-  for (const folder of path2) {
-    if (folder.auth && folder.auth.type !== "none") inheritedAuth = folder.auth;
-    if (folder.headers?.length) {
-      inheritedHeaders = [...inheritedHeaders, ...folder.headers.filter((h) => h.enabled && h.key)];
-    }
-  }
-  return { auth: inheritedAuth, headers: inheritedHeaders };
-}
-function buildRunPlan(collection, folderId, filterTags) {
-  const collectionVars = collection.collectionVariables ?? {};
-  {
-    return buildFolderPlan(
-      collection.rootFolder,
-      collection.requests,
-      collectionVars,
-      filterTags,
-      collection.rootFolder.id,
-      [],
-      [],
-      [],
-      true
-    );
-  }
-}
 exports.HookSkipTracker = HookSkipTracker;
 exports.applyRequestDefaults = applyRequestDefaults;
+exports.buildAuthHeaders = buildAuthHeaders;
 exports.buildDispatcher = buildDispatcher;
+exports.buildDynamicVars = buildDynamicVars;
+exports.buildEnvVars = buildEnvVars;
 exports.buildProxyUri = buildProxyUri;
-exports.buildRunPlan = buildRunPlan;
 exports.buildSchemaTestResults = buildSchemaTestResults;
+exports.buildUrl = buildUrl;
 exports.executeRunnerRequest = executeRunnerRequest;
-exports.getAllApplicableHooks = getAllApplicableHooks;
 exports.getGlobals = getGlobals;
+exports.getSecret = getSecret;
+exports.initSecretStore = initSecretStore;
+exports.interpolate = interpolate;
 exports.loadGlobals = loadGlobals;
 exports.maskHeaders = maskHeaders;
 exports.maskPii = maskPii;
+exports.mergeVars = mergeVars;
 exports.patchGlobals = patchGlobals;
 exports.performHttpExchange = performHttpExchange;
 exports.persistGlobals = persistGlobals;
-exports.resolveInheritedAuthAndHeaders = resolveInheritedAuthAndHeaders;
+exports.registerSecretHandlers = registerSecretHandlers;
 exports.runScript = runScript;
 exports.setGlobals = setGlobals;