@testsmith/api-spector 0.4.7 → 0.4.9

package/out/main/chunks/{snapshots-CtYxkSLz.js → snapshots-8wLrfQcq.js}

@@ -3,9 +3,10 @@ const promises = require("fs/promises");
 const path = require("path");
 const crypto = require("crypto");
 const undici = require("undici");
-const requestExec = require("./request-exec-BH-M3KqZ.js");
+const requestExec = require("./request-exec-DeXgxps8.js");
 const Ajv = require("ajv");
 const jsYaml = require("js-yaml");
+require("http");
 const MATCH_KEY = "__match";
 function isMatcher$1(node) {
   return typeof node === "object" && node !== null && !Array.isArray(node) && typeof node[MATCH_KEY] === "string";
@@ -706,9 +707,23 @@ function validateBody(schema, bodyText) {
   }
   return violations;
 }
-async function executeContract(req, vars) {
-  const url = requestExec.buildUrl(req.url, req.params, vars);
+async function executeContract(req, vars, providerBaseUrl) {
+  const url = requestExec.rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), providerBaseUrl);
   const start = Date.now();
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(url)) {
+    return {
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url,
+      passed: false,
+      violations: [{
+        type: "status_mismatch",
+        message: `Request URL "${url}" has no host. Set a base URL to send it against, or set a {{baseUrl}} variable in the active environment.`
+      }],
+      durationMs: Date.now() - start
+    };
+  }
   try {
     const headers = new undici.Headers();
     for (const h of req.headers) {
@@ -759,11 +774,11 @@ async function executeContract(req, vars) {
     };
   }
 }
-async function runConsumerContracts(requests, envVars, collectionVars = {}) {
+async function runConsumerContracts(requests, envVars, collectionVars = {}, providerBaseUrl) {
   const vars = { ...envVars, ...collectionVars };
   const contractRequests = requests.filter((r) => !r.disabled && hasContract(r.contract));
   const start = Date.now();
-  const results = await Promise.all(contractRequests.map((r) => executeContract(r, vars)));
+  const results = await Promise.all(contractRequests.map((r) => executeContract(r, vars, providerBaseUrl)));
   const passed = results.filter((r) => r.passed).length;
   return {
     mode: "consumer",
@@ -937,19 +952,6 @@ async function runProviderVerification(requests, envVars, collectionVars = {}, s
     durationMs: Date.now() - start
   };
 }
-function rebaseUrl(fullUrl, providerBaseUrl) {
-  if (!providerBaseUrl) return fullUrl;
-  try {
-    const orig = new URL(fullUrl, "http://placeholder.invalid");
-    const base = new URL(providerBaseUrl);
-    const basePath = base.pathname.replace(/\/$/, "");
-    base.pathname = (basePath + orig.pathname).replace(/\/{2,}/g, "/");
-    base.search = orig.search;
-    return base.toString();
-  } catch {
-    return fullUrl;
-  }
-}
 async function setupState(stateHandlerUrl, state, action) {
   if (!stateHandlerUrl) {
     return {
@@ -982,7 +984,7 @@ async function setupState(stateHandlerUrl, state, action) {
   }
 }
 async function verifyInteraction(req, vars, providerBaseUrl, stateHandlerUrl) {
-  const url = rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), providerBaseUrl);
+  const url = requestExec.rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), providerBaseUrl);
   const start = Date.now();
   const violations = [];
   const states = req.contract?.providerStates ?? [];
@@ -1788,7 +1790,7 @@ async function runFuzz(opts) {
         params: c.params,
         body: c.bodyJson !== void 0 ? { mode: "json", json: c.bodyJson } : req.body
       };
-      const resolvedUrl = rebaseUrl(requestExec.buildUrl(fuzzReq.url, fuzzReq.params, vars), opts.providerBaseUrl);
+      const resolvedUrl = requestExec.rebaseUrl(requestExec.buildUrl(fuzzReq.url, fuzzReq.params, vars), opts.providerBaseUrl);
       let sentSnapshot = { method: req.method, url: resolvedUrl, headers: {} };
       try {
         const ex = await requestExec.performHttpExchange({
@@ -1846,7 +1848,7 @@ async function runFuzz(opts) {
       requestId: req.id,
       requestName: req.name,
       method: req.method,
-      url: rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), opts.providerBaseUrl),
+      url: requestExec.rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), opts.providerBaseUrl),
       cases: cases.length,
       findings,
       trace

package/out/main/chunks/{soap-handler-BXx842MN.js → soap-handler-pOrJ625E.js}

@@ -1,5 +1,5 @@
 "use strict";
-const handle = require("./handle-rimXXdJH.js");
+const handle = require("./handle-CF2LjTGV.js");
 const https = require("https");
 const http = require("http");
 const xmldom = require("@xmldom/xmldom");
@@ -315,7 +315,7 @@ function registerSoapHandlers(ipc) {
   handle.handleIpc(ipc, handle.IPC.wsdl.import, async (_event, opts) => {
     const { validateWsdlImport } = await Promise.resolve().then(() => require("./ipc-validate-k6KI8adf.js"));
     validateWsdlImport(opts);
-    const { importWsdl } = await Promise.resolve().then(() => require("./import-DcenB5Q_.js"));
+    const { importWsdl } = await Promise.resolve().then(() => require("./import-ChCkdHOB.js"));
     const wsdlText = opts.xml ?? (opts.url ? await fetchUrl(opts.url) : "");
     if (!wsdlText) throw new Error("wsdl:import requires either `url` or `xml`");
     return importWsdl(wsdlText, { name: opts.name, existingMockPorts: opts.existingMockPorts });

package/out/main/contract.js

@@ -1,30 +1,8 @@
 #!/usr/bin/env node
 "use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 const promises = require("fs/promises");
 const path = require("path");
-const snapshots = require("./chunks/snapshots-CtYxkSLz.js");
+const snapshots = require("./chunks/snapshots-8wLrfQcq.js");
 const crypto = require("crypto");
 const undici = require("undici");
 const os = require("os");
@@ -32,9 +10,13 @@ const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
 const child_process = require("child_process");
 const jsYaml = require("js-yaml");
 const environments = require("./chunks/environments-iM3SUM-4.js");
-require("./chunks/request-exec-BH-M3KqZ.js");
+require("./chunks/request-exec-DeXgxps8.js");
 require("tls");
-require("./chunks/handle-rimXXdJH.js");
+require("./chunks/handle-CF2LjTGV.js");
+require("node:fs");
+require("node:os");
+require("node:path");
+require("node:crypto");
 require("dayjs");
 require("vm");
 require("tv4");
@@ -151,71 +133,6 @@ async function fireWebhooks(hooks, payload, env = process.env, log = console.log
     }
   }));
 }
-function snapshotState(results, envs) {
-  const state = { results: {}, deployments: {} };
-  for (const r of results) state.results[`${r.pacticipant}@@${r.version}`] = r.recordedAt;
-  for (const e of envs) {
-    for (const [p, d] of Object.entries(e.deployed)) {
-      state.deployments[`${e.name}@@${p}`] = `${d.version}@@${d.recordedAt}`;
-    }
-  }
-  return state;
-}
-function diffState(prev, next, results) {
-  const events = [];
-  for (const [key, recordedAt] of Object.entries(next.results)) {
-    if (prev.results[key] === recordedAt) continue;
-    const [pacticipant, version] = key.split("@@");
-    const rec = results.find((r) => r.pacticipant === pacticipant && r.version === version);
-    events.push({
-      event: "result-recorded",
-      pacticipant,
-      version,
-      passed: rec?.passed,
-      recordedAt
-    });
-  }
-  for (const [key, value] of Object.entries(next.deployments)) {
-    if (prev.deployments[key] === value) continue;
-    const [environment, pacticipant] = key.split("@@");
-    const [version, recordedAt] = value.split("@@");
-    events.push({
-      event: "deployment-recorded",
-      pacticipant,
-      version,
-      environment,
-      recordedAt
-    });
-  }
-  return events;
-}
-function watchContractEvents(dir, hooks, intervalMs = 1e4, log = console.log) {
-  let prev = null;
-  let running = false;
-  const tick = async () => {
-    if (running) return;
-    running = true;
-    try {
-      const [results, envs] = await Promise.all([snapshots.listResults(dir), snapshots.listEnvironments(dir)]);
-      const next = snapshotState(results, envs);
-      if (prev !== null) {
-        for (const payload of diffState(prev, next, results)) {
-          await fireWebhooks(hooks, payload, process.env, log);
-        }
-      }
-      prev = next;
-    } catch (e) {
-      log(`  [webhook] scan failed: ${e instanceof Error ? e.message : String(e)}`);
-    } finally {
-      running = false;
-    }
-  };
-  void tick();
-  const timer = setInterval(() => {
-    void tick();
-  }, intervalMs);
-  return () => clearInterval(timer);
-}
 function brokerConfigFromEnv() {
   return {
     endpoint: (process.env["API_SPECTOR_CLOUD_ENDPOINT"] || "https://api-spector.dev").replace(/\/+$/, ""),
@@ -288,6 +205,30 @@ async function recordDeployment(cfg, input) {
   const r = await brokerFetch(cfg, path2, "POST", {});
   if (!r.ok) fail(r, "record-deployment failed");
 }
+async function checkCompatibility(cfg, input) {
+  const q = new URLSearchParams({ consumer: input.consumer, consumerVersion: input.consumerVersion, provider: input.provider, providerVersion: input.providerVersion }).toString();
+  const r = await brokerFetch(cfg, "/api/compatibility?" + q, "GET");
+  if (r.status !== 200 && r.status !== 409) fail(r, "Compatibility check failed");
+  return { compatible: r.json?.compatible === true, checks: r.json?.checks ?? [] };
+}
+async function fetchContracts(cfg, input = {}) {
+  const q = new URLSearchParams();
+  if (input.consumer) q.set("consumer", input.consumer);
+  if (input.provider) q.set("provider", input.provider);
+  const suffix = q.toString() ? "?" + q.toString() : "";
+  const r = await brokerFetch(cfg, "/api/contracts" + suffix, "GET");
+  if (!r.ok) fail(r, "Fetch contracts failed");
+  return r.json?.contracts ?? [];
+}
+async function publishVerification(cfg, input) {
+  const r = await brokerFetch(cfg, "/api/verifications", "POST", {
+    contractId: input.contractId,
+    providerVersion: input.providerVersion,
+    success: input.success,
+    ...input.buildUrl ? { buildUrl: input.buildUrl } : {}
+  });
+  if (!r.ok) fail(r, "Publish verification failed");
+}
 function resolveVersion(override) {
   if (override) return override;
   const env = process.env["GITHUB_SHA"] || process.env["CI_COMMIT_SHA"] || process.env["GIT_COMMIT"] || process.env["CIRCLE_SHA1"] || process.env["BUILD_SOURCEVERSION"] || process.env["BITBUCKET_COMMIT"];
@@ -467,7 +408,7 @@ async function cmdRun(args) {
   const modeValue = mode;
   switch (modeValue) {
     case "consumer":
-      report = await snapshots.runConsumerContracts(contractRequests, envVars, collectionVars);
+      report = await snapshots.runConsumerContracts(contractRequests, envVars, collectionVars, providerBaseUrl);
       break;
     case "provider":
       report = await snapshots.runProviderVerification(allRequests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
@@ -740,8 +681,8 @@ async function cmdWebhooks(args) {
     console.log("      ]");
     console.log("    }");
     console.log("");
-    console.log("  $NAME tokens are replaced from the serving process environment.");
-    console.log("  The dashboard (`contract report --serve`) fires them when new results appear.");
+    console.log("  $NAME tokens are replaced from the process environment.");
+    console.log("  Run `contract webhooks --test` to send a sample event to each configured URL.");
     return;
   }
   console.log("");
@@ -769,60 +710,6 @@ async function cmdReport(args) {
     process.exit(2);
   }
   const { dir } = await cliCommon.loadWorkspace(wsArg);
-  if (args["serve"]) {
-    const port = typeof args["port"] === "string" ? Number(args["port"]) : 8080;
-    if (!Number.isInteger(port) || port < 1 || port > 65535) {
-      console.error("  [error] --port must be a number between 1 and 65535");
-      process.exit(2);
-    }
-    const { createServer } = await import("http");
-    const server = createServer(async (req, res) => {
-      try {
-        const url = req.url ?? "/";
-        if (url === "/healthz") {
-          res.writeHead(200, { "Content-Type": "text/plain" });
-          res.end("ok");
-          return;
-        }
-        const records2 = await snapshots.listResults(dir);
-        const runMatch = /^\/run\/([^/]+)\/([^/]+)$/.exec(url);
-        if (runMatch) {
-          const pacticipant = decodeURIComponent(runMatch[1]);
-          const version = decodeURIComponent(runMatch[2]);
-          const rec = records2.find((r) => r.pacticipant === pacticipant && r.version === version);
-          if (!rec) {
-            res.writeHead(404, { "Content-Type": "text/plain" });
-            res.end("No recorded result for that pacticipant/version");
-            return;
-          }
-          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(snapshots.reportToHtml(rec.report, {
-            title: `${pacticipant} @ ${version}`,
-            generatedAt: rec.recordedAt
-          }));
-          return;
-        }
-        const environments22 = await snapshots.listEnvironments(dir);
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(snapshots.dashboardToHtml(records2, (/* @__PURE__ */ new Date()).toISOString(), { runLinkBase: "/run", environments: environments22 }));
-      } catch (e) {
-        res.writeHead(500, { "Content-Type": "text/plain" });
-        res.end(e instanceof Error ? e.message : String(e));
-      }
-    });
-    server.listen(port, () => {
-      console.log(`  Contract dashboard serving at http://localhost:${port}`);
-      console.log(`  Workspace: ${wsArg} (results re-read on every request)`);
-      console.log("  Read-only: record new results via `contract run --record`, then refresh.");
-    });
-    const hooks = await loadWebhookConfig(dir);
-    if (hooks.length > 0) {
-      const intervalMs = typeof args["webhook-interval"] === "string" ? Math.max(2, Number(args["webhook-interval"])) * 1e3 : 1e4;
-      watchContractEvents(dir, hooks, intervalMs);
-      console.log(`  Webhooks: ${hooks.length} configured (polling every ${intervalMs / 1e3}s)`);
-    }
-    return;
-  }
   const out = typeof args["html"] === "string" ? args["html"] : "contract-dashboard.html";
   const records = await snapshots.listResults(dir);
   const environments2 = await snapshots.listEnvironments(dir);
@@ -981,6 +868,40 @@ async function cmdCloudRecordDeployment(args) {
   await recordDeployment(brokerConfigFromEnv(), { pacticipant, version, environment });
   console.log(`  Recorded ${pacticipant}@${version.slice(0, 7)} deployed to ${environment}`);
 }
+async function cmdCheck(args) {
+  const consumer = str(args["consumer"]) ?? die("--consumer <name> is required");
+  const consumerVersion = str(args["consumer-version"]) ?? die("--consumer-version <ver> is required");
+  const provider = str(args["provider"]) ?? die("--provider <name> is required");
+  const providerVersion = str(args["provider-version"]) ?? die("--provider-version <ver> is required");
+  const { compatible, checks } = await checkCompatibility(brokerConfigFromEnv(), { consumer, consumerVersion, provider, providerVersion });
+  if (compatible) {
+    console.log(`  ✓ ${consumer}@${consumerVersion} is compatible with ${provider}@${providerVersion}`);
+    return;
+  }
+  console.error(`  ✗ ${consumer}@${consumerVersion} is INCOMPATIBLE with ${provider}@${providerVersion}`);
+  for (const c of checks.filter((c2) => !c2.passed)) {
+    console.error(`    ${c.interaction}`);
+    for (const m of c.mismatches ?? []) console.error(`      ${m.location}: consumer requires ${m.consumer}, provider ${m.provider}`);
+    if ((!c.mismatches || !c.mismatches.length) && c.error) console.error(`      ${c.error}`);
+  }
+  process.exit(1);
+}
+async function cmdPublishVerification(args) {
+  const consumer = str(args["consumer"]) ?? die("--consumer <name> is required");
+  const provider = str(args["provider"]) ?? die("--provider <name> is required");
+  const providerVersion = resolveVersion(str(args["provider-version"]) ?? str(args["version"]));
+  const successArg = str(args["success"]);
+  if (successArg === void 0) die("--success <true|false> is required");
+  const success = successArg === "true" || successArg === "1";
+  const buildUrl = str(args["build-url"]);
+  const consumerVersion = str(args["consumer-version"]);
+  const cfg = brokerConfigFromEnv();
+  const contracts = await fetchContracts(cfg, { consumer, provider });
+  const match = consumerVersion ? contracts.find((c) => c.consumerVersion === consumerVersion) : contracts[contracts.length - 1];
+  if (!match) die(`No published contract for ${consumer} -> ${provider}${consumerVersion ? "@" + consumerVersion : ""}.`);
+  await publishVerification(cfg, { contractId: match.id, providerVersion, success, buildUrl });
+  console.log(`  Published verification: ${provider}@${providerVersion.slice(0, 7)} -> ${consumer}@${match.consumerVersion} = ${success ? "passed" : "FAILED"}`);
+}
 async function main() {
   const [, , sub, ...rest] = process.argv;
   const args = cliCommon.parseArgs(rest);
@@ -991,6 +912,8 @@ async function main() {
   if (sub === "publish-spec") return wantsCloud(args) ? cmdPublishSpec(args) : cmdPublishSpecLocal(args);
   if (sub === "preview") return cmdPreview(args);
   if (sub === "deploy-check" || sub === "can-i-deploy") return wantsCloud(args) ? cmdCloudCanIDeploy(args) : cmdCanIDeploy(args);
+  if (sub === "check") return cmdCheck(args);
+  if (sub === "publish-verification") return cmdPublishVerification(args);
   if (sub === "record-deployment") return wantsCloud(args) ? cmdCloudRecordDeployment(args) : cmdRecordDeployment(args);
   if (sub === "environments") return cmdEnvironments(args);
   if (sub === "webhooks") return cmdWebhooks(args);
@@ -1003,7 +926,7 @@ async function main() {
   api-spector contract list          --workspace <path>
   api-spector contract pin           --workspace <path> --spec-url <url> | --spec-path <file> [--name <label>]
   api-spector contract run           --workspace <path> --mode <consumer|provider|provider-live|bidirectional> [options]
-  api-spector contract report        --workspace <path> [--html <path>] [--serve [--port <n>]]
+  api-spector contract report        --workspace <path> [--html <path>]
   api-spector contract deploy-check  --workspace <path> --pacticipant <name> --app-version <ver> [--to <env>]
   api-spector contract record-deployment --workspace <path> --pacticipant <name> --app-version <ver> --env <name>
   api-spector contract environments  --workspace <path>
@@ -1033,7 +956,8 @@ async function main() {
     --collection <name>       Filter to one collection
     --environment <name>      Environment for {{var}} resolution
     --request-base-url <url>  Strip this host before matching spec paths
-    --provider-base-url <url> (provider-live) rebase requests onto this origin
+    --provider-base-url <url> (provider-live, consumer) rebase requests onto
+                              this origin (lets host-less design contracts run)
     --states-url <url>        (provider-live) provider state handler endpoint
     --output <path>           Write ContractReport JSON here
     --junit <path>            Write JUnit XML here (for CI test reporters)

package/out/main/index.js

@@ -22,12 +22,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 const electron = require("electron");
-const handle = require("./chunks/handle-rimXXdJH.js");
+const handle = require("./chunks/handle-CF2LjTGV.js");
 const path = require("path");
 const fs = require("fs");
 const promises = require("fs/promises");
 const crypto = require("crypto");
-const requestExec = require("./chunks/request-exec-BH-M3KqZ.js");
+const requestExec = require("./chunks/request-exec-DeXgxps8.js");
 const ipcValidate = require("./chunks/ipc-validate-k6KI8adf.js");
 const uuid = require("uuid");
 const jsYaml = require("js-yaml");
@@ -37,12 +37,16 @@ const requestCollection = require("./chunks/request-collection-CJoXpvOw.js");
 const mockServer = require("./chunks/mock-server-BxiXhP1m.js");
 const http = require("http");
 const WebSocket = require("ws");
-const soapHandler = require("./chunks/soap-handler-BXx842MN.js");
+const soapHandler = require("./chunks/soap-handler-pOrJ625E.js");
 const os = require("os");
-const snapshots = require("./chunks/snapshots-CtYxkSLz.js");
+const snapshots = require("./chunks/snapshots-8wLrfQcq.js");
 const simpleGit = require("simple-git");
 const recorder = require("./chunks/recorder-0Ij921El.js");
 require("tls");
+require("node:fs");
+require("node:os");
+require("node:path");
+require("node:crypto");
 require("dayjs");
 require("vm");
 require("tv4");
@@ -266,6 +270,7 @@ Create a workspace in this folder and add "${path.basename(wsPath)}" to it? The
     workspaceFile = wsPath;
     await requestExec.loadGlobals(workspaceDir);
     await saveLastWorkspacePath(wsPath);
+    requestExec.setSecretsConfig(parsed.settings?.secrets);
     return { workspace: parsed, workspacePath: wsPath };
   });
   handle.handleIpc(ipc, handle.IPC.file.newWorkspace, async () => {
@@ -297,6 +302,7 @@ Create a workspace in this folder and add "${path.basename(wsPath)}" to it? The
   });
   handle.handleIpc(ipc, handle.IPC.file.saveWorkspace, async (_e, ws) => {
     if (!workspaceFile) return;
+    requestExec.setSecretsConfig(ws.settings?.secrets);
     await atomicWrite(workspaceFile, JSON.stringify(ws, null, 2));
     if (workspaceDir) await ensureVscodeFileAssociation(workspaceDir);
   });
@@ -397,6 +403,7 @@ Create a workspace in this folder and add "${path.basename(wsPath)}" to it? The
       workspaceDir = path.dirname(wsPath);
       workspaceFile = wsPath;
       await requestExec.loadGlobals(workspaceDir);
+      requestExec.setSecretsConfig(workspace.settings?.secrets);
       return { workspace, workspacePath: wsPath };
     } catch {
       return null;
@@ -427,6 +434,7 @@ Create a workspace in this folder and add "${path.basename(wsPath)}" to it? The
     workspaceFile = wsPath;
     await requestExec.loadGlobals(workspaceDir);
     await saveLastWorkspacePath(wsPath);
+    requestExec.setSecretsConfig(parsed.settings?.secrets);
     return { workspace: parsed, workspacePath: wsPath };
   });
 }
@@ -446,6 +454,7 @@ async function tryOpenWorkspaceInDir(dir) {
     workspaceDir = dir;
     workspaceFile = wsPath;
     await requestExec.loadGlobals(workspaceDir);
+    requestExec.setSecretsConfig(workspace.settings?.secrets);
     return { workspace, workspacePath: wsPath };
   } catch {
     return null;
@@ -4637,6 +4646,79 @@ function registerOAuth2Handlers(ipc) {
     };
   });
 }
+const CALLBACK_PORT = 8250;
+const CALLBACK_PATH = "/oidc/callback";
+function registerVaultHandlers(ipc) {
+  handle.handleIpc(ipc, handle.IPC.vault.oidcLogin, async (_e, opts) => {
+    const address = (opts.address ?? "").replace(/\/+$/, "");
+    if (!address) throw new Error("Vault OIDC: address is required.");
+    const mount = opts.mount?.trim() || "oidc";
+    const redirectUri = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+    const clientNonce = Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+    const { fetch: nodeFetch, Agent } = await import("undici");
+    const dispatcher = opts.skipVerify ? new Agent({ connect: { rejectUnauthorized: false } }) : void 0;
+    const nsHeaders = opts.namespace ? { "X-Vault-Namespace": opts.namespace } : {};
+    const vault = async (path2, init = {}) => {
+      const res = await nodeFetch(`${address}/v1/${path2}`, {
+        ...init,
+        headers: { ...nsHeaders, ...init.headers },
+        ...dispatcher ? { dispatcher } : {}
+      });
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`Vault ${res.status} on /v1/${path2}: ${body.slice(0, 300)}`);
+      }
+      return res.json();
+    };
+    const authUrlResp = await vault(`auth/${mount}/oidc/auth_url`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ redirect_uri: redirectUri, role: opts.role || void 0, client_nonce: clientNonce })
+    });
+    const authUrl = authUrlResp?.data?.auth_url;
+    if (!authUrl) throw new Error("Vault OIDC: no auth_url returned (check the mount, role, and allowed redirect URIs).");
+    const params = await new Promise((resolve2, reject) => {
+      const server = http.createServer((req, res) => {
+        const reqUrl = new URL(req.url ?? "/", `http://localhost:${CALLBACK_PORT}`);
+        if (!reqUrl.pathname.startsWith(CALLBACK_PATH)) {
+          res.writeHead(404);
+          res.end();
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end("<html><body><p>Vault sign-in complete. You may close this tab.</p></body></html>");
+        server.close();
+        const error = reqUrl.searchParams.get("error");
+        if (error) {
+          reject(new Error(`Vault OIDC error: ${error}`));
+          return;
+        }
+        resolve2(reqUrl.searchParams);
+      });
+      server.on("error", reject);
+      server.listen(CALLBACK_PORT, "127.0.0.1", () => {
+        electron.shell.openExternal(authUrl).catch(reject);
+      });
+      setTimeout(() => {
+        server.close();
+        reject(new Error("Vault OIDC sign-in timed out (5 min)."));
+      }, 5 * 60 * 1e3);
+    });
+    const code = params.get("code");
+    const state = params.get("state");
+    if (!code || !state) throw new Error("Vault OIDC: callback missing code/state.");
+    const cb = new URLSearchParams({ state, code, client_nonce: clientNonce });
+    const login = await vault(`auth/${mount}/oidc/callback?${cb.toString()}`);
+    const token = login?.auth?.client_token;
+    if (!token) throw new Error("Vault OIDC: callback did not return a client token.");
+    process.env.VAULT_TOKEN = token;
+    return {
+      ok: true,
+      expiresInSeconds: Number(login?.auth?.lease_duration ?? 0),
+      entityId: login?.auth?.entity_id ? String(login.auth.entity_id) : void 0
+    };
+  });
+}
 const connections = /* @__PURE__ */ new Map();
 function closeAllWsConnections() {
   for (const [, ws] of connections) {
@@ -5051,7 +5133,7 @@ function registerContractHandlers(ipc) {
     }
     switch (mode) {
       case "consumer":
-        return snapshots.runConsumerContracts(requests, envVars, collectionVars);
+        return snapshots.runConsumerContracts(requests, envVars, collectionVars, providerBaseUrl);
       case "provider":
         return snapshots.runProviderVerification(requests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
       case "provider-live":
@@ -5520,7 +5602,7 @@ function isNewer(a, b) {
   return a2 > b2;
 }
 async function checkForUpdate() {
-  const current = "0.4.7";
+  const current = "0.4.9";
   try {
     const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(4e3) });
     if (!res.ok) return null;
@@ -5634,6 +5716,7 @@ electron.app.whenReady().then(async () => {
   registerRunnerHandler(electron.ipcMain);
   registerMockHandlers(electron.ipcMain);
   registerOAuth2Handlers(electron.ipcMain);
+  registerVaultHandlers(electron.ipcMain);
   registerWsHandlers(electron.ipcMain);
   soapHandler.registerSoapHandlers(electron.ipcMain);
   registerDocsHandlers(electron.ipcMain);

package/out/main/lib.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const mockServer = require("./chunks/mock-server-BxiXhP1m.js");
-const requestExec = require("./chunks/request-exec-BH-M3KqZ.js");
+const requestExec = require("./chunks/request-exec-DeXgxps8.js");
 require("http");
 require("crypto");
 require("vm");
@@ -10,7 +10,11 @@ require("@xmldom/xmldom");
 require("undici");
 require("fs/promises");
 require("tls");
-require("./chunks/handle-rimXXdJH.js");
+require("./chunks/handle-CF2LjTGV.js");
+require("node:fs");
+require("node:os");
+require("node:path");
+require("node:crypto");
 require("path");
 require("tv4");
 require("jsonpath-plus");
@@ -31,7 +35,12 @@ exports.buildProtocolFaultTests = requestExec.buildProtocolFaultTests;
 exports.buildSchemaTestResults = requestExec.buildSchemaTestResults;
 exports.deriveRunStatus = requestExec.deriveRunStatus;
 exports.executeRunnerRequest = requestExec.executeRunnerRequest;
+exports.hasSecretScheme = requestExec.hasSecretScheme;
 exports.maskHeaders = requestExec.maskHeaders;
 exports.maskPii = requestExec.maskPii;
 exports.performHttpExchange = requestExec.performHttpExchange;
+exports.registerSecretProvider = requestExec.registerSecretProvider;
+exports.registeredSchemes = requestExec.registeredSchemes;
+exports.resolveExternalSecret = requestExec.resolveExternalSecret;
+exports.setSecretsConfig = requestExec.setSecretsConfig;
 exports.syntheticHttpFailure = requestExec.syntheticHttpFailure;

package/out/main/runner.js

@@ -2,13 +2,17 @@
 "use strict";
 const promises = require("fs/promises");
 const path = require("path");
-const requestExec = require("./chunks/request-exec-BH-M3KqZ.js");
+const requestExec = require("./chunks/request-exec-DeXgxps8.js");
 const requestCollection = require("./chunks/request-collection-CJoXpvOw.js");
 const environments = require("./chunks/environments-iM3SUM-4.js");
 const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
 require("undici");
 require("tls");
-require("./chunks/handle-rimXXdJH.js");
+require("./chunks/handle-CF2LjTGV.js");
+require("node:fs");
+require("node:os");
+require("node:path");
+require("node:crypto");
 require("crypto");
 require("dayjs");
 require("vm");
@@ -387,6 +391,7 @@ async function main() {
     process.exit(1);
   }
   await requestExec.loadGlobals(wsDir);
+  requestExec.setSecretsConfig(workspace.settings?.secrets);
   const collections = await cliCommon.loadCollections(workspace, wsDir, {
     onError: (relPath) => console.error(cliCommon.color(`  [warn] Could not load collection: ${relPath}`, cliCommon.C.yellow))
   });
@@ -397,7 +402,7 @@ async function main() {
   } else if (!envName && workspace.settings?.defaultEnvironment && !env) {
     console.warn(cliCommon.color(`Warning: default environment "${workspace.settings.defaultEnvironment}" not found. Running without environment.`, cliCommon.C.yellow));
   }
-  const version = `v${"0.4.7"}`;
+  const version = `v${"0.4.9"}`;
   console.log("");
   console.log(cliCommon.color("  API Test Runner" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Workspace:   ${wsPath}`, cliCommon.C.gray));
@@ -405,7 +410,7 @@ async function main() {
   if (filterTags.length) console.log(cliCommon.color(`  Tags:        ${filterTags.join(", ")}`, cliCommon.C.gray));
   console.log("");
   const envVarsSnapshot = await requestExec.buildEnvVars(env);
-  const secretValuesToMask = (env?.variables ?? []).filter((v) => v.secret && v.enabled).map((v) => envVarsSnapshot[v.key]).filter((v) => typeof v === "string" && v.length > 0);
+  const secretValuesToMask = (env?.variables ?? []).filter((v) => (v.secret || v.secretRef) && v.enabled).map((v) => envVarsSnapshot[v.key]).filter((v) => typeof v === "string" && v.length > 0);
   function redact(s) {
     let out = s;
     for (const secret of secretValuesToMask) out = out.split(secret).join("***");