@testsmith/api-spector 0.4.8 → 0.4.9

package/out/main/chunks/{handle-rimXXdJH.js → handle-CF2LjTGV.js}

@@ -75,6 +75,10 @@ const IPC = {
     startFlow: "oauth2:startFlow",
     refreshToken: "oauth2:refreshToken"
   },
+  // ─── HashiCorp Vault (interactive OIDC login) ──────────────────────────────
+  vault: {
+    oidcLogin: "vault:oidcLogin"
+  },
   // ─── Mock servers ──────────────────────────────────────────────────────────
   mock: {
     start: "mock:start",

package/out/main/chunks/{import-DcenB5Q_.js → import-ChCkdHOB.js}

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const uuid = require("uuid");
-const soapHandler = require("./soap-handler-BXx842MN.js");
-require("./handle-rimXXdJH.js");
+const soapHandler = require("./soap-handler-pOrJ625E.js");
+require("./handle-CF2LjTGV.js");
 require("https");
 require("http");
 require("@xmldom/xmldom");

package/out/main/chunks/{request-exec-BH-M3KqZ.js → request-exec-DeXgxps8.js}

@@ -24,7 +24,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 const undici = require("undici");
 const promises = require("fs/promises");
 const nodeTls = require("tls");
-const handle = require("./handle-rimXXdJH.js");
+const handle = require("./handle-CF2LjTGV.js");
+const node_fs = require("node:fs");
+const node_os = require("node:os");
+const node_path = require("node:path");
+const node_crypto = require("node:crypto");
 const crypto = require("crypto");
 const path = require("path");
 const dayjs = require("dayjs");
@@ -81,6 +85,463 @@ function setGlobals(next) {
 function patchGlobals(patch) {
   globals = { ...globals, ...patch };
 }
+const providers = /* @__PURE__ */ new Map();
+function registerSecretProvider(provider) {
+  providers.set(provider.scheme.toLowerCase(), provider);
+}
+function registeredSchemes() {
+  return [...providers.keys()];
+}
+function schemeOf(ref) {
+  const m = /^([a-z][a-z0-9+.-]*):/i.exec(ref);
+  if (!m) return null;
+  const scheme = m[1].toLowerCase();
+  return providers.has(scheme) ? scheme : null;
+}
+function hasSecretScheme(ref) {
+  return schemeOf(ref) !== null;
+}
+async function resolveExternalSecret(ref, ctx = {}) {
+  const scheme = schemeOf(ref);
+  if (!scheme) return null;
+  const provider = providers.get(scheme);
+  const refBody = ref.slice(scheme.length + 1);
+  return provider.resolve(refBody, ctx);
+}
+let current;
+function setSecretsConfig(settings) {
+  current = settings;
+}
+function getSecretsConfig() {
+  return current;
+}
+function env$3(...names) {
+  for (const n of names) {
+    const v = process.env[n];
+    if (v !== void 0 && v !== "") return v;
+  }
+  return void 0;
+}
+function readFileTrim(path2) {
+  try {
+    return node_fs.readFileSync(path2, "utf8").trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveConn$3() {
+  const cfg = getSecretsConfig()?.vault ?? {};
+  const address = env$3("VAULT_ADDR", "API_SPECTOR_VAULT_ADDR") ?? cfg.address;
+  if (!address) {
+    throw new Error("Vault is not configured: set VAULT_ADDR (or settings.secrets.vault.address)");
+  }
+  const token = env$3("VAULT_TOKEN", "API_SPECTOR_VAULT_TOKEN") ?? readFileTrim(node_path.join(node_os.homedir(), ".vault-token"));
+  const roleId = env$3("VAULT_ROLE_ID", "API_SPECTOR_VAULT_ROLE_ID") ?? cfg.roleId;
+  const secretId = env$3("VAULT_SECRET_ID", "API_SPECTOR_VAULT_SECRET_ID");
+  const jwt = env$3("VAULT_JWT", "API_SPECTOR_VAULT_JWT") ?? (env$3("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH") ? readFileTrim(env$3("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH")) : void 0);
+  const jwtRole = env$3("VAULT_JWT_ROLE", "API_SPECTOR_VAULT_JWT_ROLE") ?? cfg.jwtRole;
+  const explicit = env$3("VAULT_AUTH_METHOD", "API_SPECTOR_VAULT_AUTH_METHOD") ?? cfg.authMethod;
+  const authMethod = explicit ?? (token ? "token" : roleId ? "approle" : jwt ? "jwt" : "token");
+  return {
+    address: address.replace(/\/+$/, ""),
+    namespace: env$3("VAULT_NAMESPACE", "API_SPECTOR_VAULT_NAMESPACE") ?? cfg.namespace,
+    authMethod,
+    token,
+    roleId,
+    secretId,
+    jwt,
+    jwtRole,
+    loginMount: cfg.loginMount,
+    kvVersion: env$3("VAULT_KV_VERSION", "API_SPECTOR_VAULT_KV_VERSION") ?? cfg.kvVersion ?? "auto",
+    skipVerify: (env$3("VAULT_SKIP_VERIFY", "API_SPECTOR_VAULT_SKIP_VERIFY") ?? "").toLowerCase() === "true" || cfg.skipVerify === true,
+    caPath: env$3("VAULT_CACERT", "API_SPECTOR_VAULT_CACERT")
+  };
+}
+let cachedToken$1 = null;
+const secretCache$1 = /* @__PURE__ */ new Map();
+let _dispatcher;
+let _dispatcherKey = "";
+async function dispatcherFor(conn) {
+  if (!conn.skipVerify && !conn.caPath) return void 0;
+  const key = `${conn.skipVerify}|${conn.caPath ?? ""}`;
+  if (_dispatcher && _dispatcherKey === key) return _dispatcher;
+  const { Agent } = await import("undici");
+  const connect = {};
+  if (conn.skipVerify) connect.rejectUnauthorized = false;
+  if (conn.caPath) {
+    const ca = readFileTrim(conn.caPath);
+    if (ca) connect.ca = ca;
+  }
+  _dispatcher = new Agent({ connect });
+  _dispatcherKey = key;
+  return _dispatcher;
+}
+async function vaultFetch(conn, path2, init = {}) {
+  const headers = { ...init.headers };
+  if (conn.namespace) headers["X-Vault-Namespace"] = conn.namespace;
+  if (init.token) headers["X-Vault-Token"] = init.token;
+  const dispatcher = await dispatcherFor(conn);
+  const res = await fetch(`${conn.address}/v1/${path2}`, {
+    ...init,
+    headers,
+    // undici honours `dispatcher`; the field is not in the DOM RequestInit type.
+    ...dispatcher ? { dispatcher } : {}
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`Vault ${res.status} on /v1/${path2}: ${body.slice(0, 300)}`);
+  }
+  return res.json();
+}
+async function clientToken(conn) {
+  if (conn.authMethod === "token") {
+    if (!conn.token) {
+      throw new Error("Vault token auth selected but no token found (set VAULT_TOKEN or run `vault login`)");
+    }
+    return conn.token;
+  }
+  const now = Date.now();
+  if (cachedToken$1 && cachedToken$1.expiresAt > now + 5e3) return cachedToken$1.value;
+  let mount;
+  let body;
+  if (conn.authMethod === "approle") {
+    if (!conn.roleId || !conn.secretId) {
+      throw new Error("Vault AppRole auth needs VAULT_ROLE_ID and VAULT_SECRET_ID");
+    }
+    mount = conn.loginMount ?? "approle";
+    body = { role_id: conn.roleId, secret_id: conn.secretId };
+  } else {
+    if (!conn.jwt || !conn.jwtRole) {
+      throw new Error("Vault JWT/OIDC auth needs a JWT (VAULT_JWT or VAULT_JWT_PATH) and a role (VAULT_JWT_ROLE)");
+    }
+    mount = conn.loginMount ?? "jwt";
+    body = { role: conn.jwtRole, jwt: conn.jwt };
+  }
+  const json = await vaultFetch(conn, `auth/${mount}/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const token = json?.auth?.client_token;
+  if (!token) throw new Error("Vault login did not return a client token");
+  const ttl = Number(json?.auth?.lease_duration ?? 0);
+  cachedToken$1 = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  return token;
+}
+async function readSecret(refBody) {
+  const hash = refBody.lastIndexOf("#");
+  if (hash < 0) {
+    throw new Error(`Vault reference must be 'vault:<path>#<key>' (got 'vault:${refBody}')`);
+  }
+  const path2 = refBody.slice(0, hash).replace(/^\/+/, "");
+  const key = refBody.slice(hash + 1);
+  if (!path2 || !key) {
+    throw new Error(`Vault reference must be 'vault:<path>#<key>' (got 'vault:${refBody}')`);
+  }
+  const conn = resolveConn$3();
+  const cacheKey = `${conn.address}|${conn.namespace ?? ""}|${path2}`;
+  const now = Date.now();
+  let bag;
+  const hit = secretCache$1.get(cacheKey);
+  if (hit && hit.expiresAt > now) {
+    bag = hit.bag;
+  } else {
+    const json = await vaultFetch(conn, path2, { token: await clientToken(conn) });
+    const isV2 = conn.kvVersion === "2" || conn.kvVersion === "auto" && json?.data?.data !== void 0 && json?.data?.metadata !== void 0;
+    bag = isV2 ? json?.data?.data : json?.data;
+    const lease = Number(json?.lease_duration ?? 0);
+    if (bag) {
+      secretCache$1.set(cacheKey, { bag, expiresAt: lease > 0 ? now + lease * 1e3 : now + 5 * 6e4 });
+    }
+  }
+  if (!bag || !(key in bag)) {
+    throw new Error(`Vault secret at '${path2}' has no key '${key}'`);
+  }
+  return String(bag[key]);
+}
+const vaultProvider = {
+  scheme: "vault",
+  resolve: (refBody) => readSecret(refBody)
+};
+function hmac(key, data) {
+  return node_crypto.createHmac("sha256", key).update(data, "utf8").digest();
+}
+function sha256hex(data) {
+  return node_crypto.createHash("sha256").update(data, "utf8").digest("hex");
+}
+function signSigV4(input) {
+  const amzDate = input.now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const dateStamp = amzDate.slice(0, 8);
+  const headers = { ...input.headers, host: input.host, "x-amz-date": amzDate };
+  if (input.sessionToken) headers["x-amz-security-token"] = input.sessionToken;
+  const lower = {};
+  for (const k of Object.keys(headers)) lower[k.toLowerCase()] = headers[k].trim().replace(/\s+/g, " ");
+  const sortedKeys = Object.keys(lower).sort();
+  const canonicalHeaders = sortedKeys.map((k) => `${k}:${lower[k]}
+`).join("");
+  const signedHeaders = sortedKeys.join(";");
+  const payloadHash = sha256hex(input.body);
+  const canonicalRequest = [input.method, input.path, input.query ?? "", canonicalHeaders, signedHeaders, payloadHash].join("\n");
+  const scope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(canonicalRequest)].join("\n");
+  const kDate = hmac(`AWS4${input.secretAccessKey}`, dateStamp);
+  const kRegion = hmac(kDate, input.region);
+  const kService = hmac(kRegion, input.service);
+  const kSigning = hmac(kService, "aws4_request");
+  const signature = node_crypto.createHmac("sha256", kSigning).update(stringToSign, "utf8").digest("hex");
+  return {
+    ...headers,
+    Authorization: `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+  };
+}
+function env$2(...names) {
+  for (const n of names) {
+    const v = process.env[n];
+    if (v !== void 0 && v !== "") return v;
+  }
+  return void 0;
+}
+function resolveConn$2() {
+  const cfg = getSecretsConfig()?.aws ?? {};
+  const region = env$2("AWS_REGION", "AWS_DEFAULT_REGION", "API_SPECTOR_AWS_REGION") ?? cfg.region;
+  const accessKeyId = env$2("AWS_ACCESS_KEY_ID");
+  const secretAccessKey = env$2("AWS_SECRET_ACCESS_KEY");
+  if (!region) throw new Error("AWS Secrets Manager: no region (set AWS_REGION or settings.secrets.aws.region)");
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("AWS Secrets Manager: no credentials (set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY)");
+  }
+  return { region, accessKeyId, secretAccessKey, sessionToken: env$2("AWS_SESSION_TOKEN") };
+}
+const cache = /* @__PURE__ */ new Map();
+async function getSecretString(conn, secretId) {
+  const cacheKey = `${conn.region}|${secretId}`;
+  const now = Date.now();
+  const hit = cache.get(cacheKey);
+  if (hit && hit.expiresAt > now) return hit.raw;
+  const host = `secretsmanager.${conn.region}.amazonaws.com`;
+  const body = JSON.stringify({ SecretId: secretId });
+  const headers = signSigV4({
+    method: "POST",
+    host,
+    path: "/",
+    headers: {
+      "content-type": "application/x-amz-json-1.1",
+      "x-amz-target": "secretsmanager.GetSecretValue"
+    },
+    body,
+    service: "secretsmanager",
+    region: conn.region,
+    accessKeyId: conn.accessKeyId,
+    secretAccessKey: conn.secretAccessKey,
+    sessionToken: conn.sessionToken,
+    now: new Date(now)
+  });
+  const res = await fetch(`https://${host}/`, { method: "POST", headers, body });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`AWS Secrets Manager ${res.status} for '${secretId}': ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const raw = json?.SecretString;
+  if (raw === void 0) throw new Error(`AWS secret '${secretId}' has no SecretString (binary secrets are not supported)`);
+  cache.set(cacheKey, { raw, expiresAt: now + 5 * 6e4 });
+  return raw;
+}
+async function resolve$2(refBody) {
+  const hash = refBody.lastIndexOf("#");
+  const secretId = hash < 0 ? refBody : refBody.slice(0, hash);
+  const key = hash < 0 ? null : refBody.slice(hash + 1);
+  if (!secretId) throw new Error(`AWS reference must be 'aws:<secretId>[#<key>]' (got 'aws:${refBody}')`);
+  const raw = await getSecretString(resolveConn$2(), secretId);
+  if (key === null) return raw;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`AWS secret '${secretId}' is not JSON, so key '${key}' cannot be read (drop the '#${key}')`);
+  }
+  if (!(key in parsed)) throw new Error(`AWS secret '${secretId}' has no key '${key}'`);
+  return String(parsed[key]);
+}
+const awsSecretsProvider = {
+  scheme: "aws",
+  resolve: (refBody) => resolve$2(refBody)
+};
+function env$1(...names) {
+  for (const n of names) {
+    const v = process.env[n];
+    if (v !== void 0 && v !== "") return v;
+  }
+  return void 0;
+}
+function resolveConn$1() {
+  const cfg = getSecretsConfig()?.azure ?? {};
+  const tenantId = env$1("AZURE_TENANT_ID", "API_SPECTOR_AZURE_TENANT_ID") ?? cfg.tenantId;
+  const clientId = env$1("AZURE_CLIENT_ID", "API_SPECTOR_AZURE_CLIENT_ID") ?? cfg.clientId;
+  const clientSecret = env$1("AZURE_CLIENT_SECRET", "API_SPECTOR_AZURE_CLIENT_SECRET");
+  if (!tenantId || !clientId || !clientSecret) {
+    throw new Error("Azure Key Vault: set AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET");
+  }
+  return { tenantId, clientId, clientSecret, defaultVault: cfg.vault };
+}
+let cachedToken = null;
+const secretCache = /* @__PURE__ */ new Map();
+async function accessToken(conn) {
+  const now = Date.now();
+  if (cachedToken && cachedToken.expiresAt > now + 3e4) return cachedToken.value;
+  const form = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: conn.clientId,
+    client_secret: conn.clientSecret,
+    scope: "https://vault.azure.net/.default"
+  });
+  const res = await fetch(`https://login.microsoftonline.com/${conn.tenantId}/oauth2/v2.0/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Azure AD token ${res.status}: ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const token = json?.access_token;
+  if (!token) throw new Error("Azure AD did not return an access token");
+  const ttl = Number(json?.expires_in ?? 0);
+  cachedToken = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  return token;
+}
+function secretUrl(refBody, defaultVault) {
+  if (/^https?:\/\//i.test(refBody)) {
+    return refBody.split("#")[0];
+  }
+  const parts = refBody.replace(/^\/+/, "").split("/");
+  let vault;
+  let name;
+  let version = "";
+  if (parts.length >= 2) {
+    [vault, name, version = ""] = parts;
+  } else if (parts.length === 1 && defaultVault) {
+    vault = defaultVault;
+    name = parts[0];
+  } else {
+    throw new Error(`Azure reference must be 'azure:<vault>/<secret>[/<version>]' (got 'azure:${refBody}')`);
+  }
+  const base = /^https?:\/\//i.test(vault) ? vault.replace(/\/+$/, "") : `https://${vault}.vault.azure.net`;
+  const path2 = version ? `secrets/${name}/${version}` : `secrets/${name}`;
+  return `${base}/${path2}?api-version=7.4`;
+}
+async function resolve$1(refBody) {
+  const conn = resolveConn$1();
+  const url = secretUrl(refBody, conn.defaultVault);
+  const now = Date.now();
+  const hit = secretCache.get(url);
+  if (hit && hit.expiresAt > now) return hit.value;
+  const res = await fetch(url, { headers: { authorization: `Bearer ${await accessToken(conn)}` } });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Azure Key Vault ${res.status} for '${refBody}': ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const value = json?.value;
+  if (value === void 0) throw new Error(`Azure Key Vault secret '${refBody}' has no value`);
+  secretCache.set(url, { value, expiresAt: now + 5 * 6e4 });
+  return value;
+}
+const azureKeyVaultProvider = {
+  scheme: "azure",
+  resolve: (refBody) => resolve$1(refBody)
+};
+function env(...names) {
+  for (const n of names) {
+    const v = process.env[n];
+    if (v !== void 0 && v !== "") return v;
+  }
+  return void 0;
+}
+function resolveConn() {
+  const cfg = getSecretsConfig()?.onePassword ?? {};
+  const host = env("OP_CONNECT_HOST", "API_SPECTOR_OP_CONNECT_HOST") ?? cfg.connectHost;
+  const token = env("OP_CONNECT_TOKEN", "API_SPECTOR_OP_CONNECT_TOKEN");
+  if (!host || !token) {
+    throw new Error("1Password: set OP_CONNECT_HOST and OP_CONNECT_TOKEN (1Password Connect)");
+  }
+  return { host: host.replace(/\/+$/, ""), token };
+}
+const itemCache = /* @__PURE__ */ new Map();
+const idCache = /* @__PURE__ */ new Map();
+async function opGet(conn, path2) {
+  const res = await fetch(`${conn.host}${path2}`, { headers: { authorization: `Bearer ${conn.token}` } });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`1Password Connect ${res.status} on ${path2}: ${text.slice(0, 300)}`);
+  }
+  return res.json();
+}
+const isId = (s) => /^[a-z0-9]{26}$/i.test(s);
+async function vaultId(conn, vault) {
+  if (isId(vault)) return vault;
+  const cacheKey = `vaults:${vault}`;
+  const cached = idCache.get(cacheKey);
+  if (cached) return cached;
+  const list = await opGet(conn, `/v1/vaults?filter=${encodeURIComponent(`name eq "${vault}"`)}`);
+  const id = Array.isArray(list) && list[0]?.id;
+  if (!id) throw new Error(`1Password: vault '${vault}' not found`);
+  idCache.set(cacheKey, id);
+  return id;
+}
+async function itemId(conn, vid, item) {
+  if (isId(item)) return item;
+  const cacheKey = `items:${vid}:${item}`;
+  const cached = idCache.get(cacheKey);
+  if (cached) return cached;
+  const list = await opGet(conn, `/v1/vaults/${vid}/items?filter=${encodeURIComponent(`title eq "${item}"`)}`);
+  const id = Array.isArray(list) && list[0]?.id;
+  if (!id) throw new Error(`1Password: item '${item}' not found in vault`);
+  idCache.set(cacheKey, id);
+  return id;
+}
+async function resolve(refBody) {
+  const parts = refBody.replace(/^\/\//, "").replace(/^\/+/, "").split("/").filter(Boolean);
+  if (parts.length < 3) {
+    throw new Error(`1Password reference must be 'op://<vault>/<item>/<field>' (got 'op:${refBody}')`);
+  }
+  const [vault, item, ...rest] = parts;
+  const sectionLabel = rest.length >= 2 ? rest[0] : null;
+  const fieldLabel = rest[rest.length - 1];
+  const conn = resolveConn();
+  const vid = await vaultId(conn, vault);
+  const iid = await itemId(conn, vid, item);
+  const cacheKey = `${vid}/${iid}`;
+  const now = Date.now();
+  let fields;
+  const hit = itemCache.get(cacheKey);
+  if (hit && hit.expiresAt > now) {
+    fields = hit.fields;
+  } else {
+    const doc = await opGet(conn, `/v1/vaults/${vid}/items/${iid}`);
+    fields = Array.isArray(doc?.fields) ? doc.fields : [];
+    itemCache.set(cacheKey, { fields, expiresAt: now + 5 * 6e4 });
+  }
+  const match = fields.find((f) => {
+    const labelOk = String(f?.label ?? "").toLowerCase() === fieldLabel.toLowerCase() || f?.id === fieldLabel;
+    if (!labelOk) return false;
+    if (!sectionLabel) return true;
+    return String(f?.section?.label ?? "").toLowerCase() === sectionLabel.toLowerCase();
+  });
+  if (!match || match.value === void 0) {
+    throw new Error(`1Password: field '${fieldLabel}' not found on item '${item}'`);
+  }
+  return String(match.value);
+}
+const onePasswordProvider = {
+  scheme: "op",
+  resolve: (refBody) => resolve(refBody)
+};
+registerSecretProvider(vaultProvider);
+registerSecretProvider(awsSecretsProvider);
+registerSecretProvider(azureKeyVaultProvider);
+registerSecretProvider(onePasswordProvider);
 const MASTER_KEY_ENV = "API_SPECTOR_MASTER_KEY";
 let secretStore = {};
 let secretStorePath = null;
@@ -134,6 +595,9 @@ function decryptSecret(encrypted, salt, iv, password) {
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
 async function getSecret(ref) {
+  if (hasSecretScheme(ref)) {
+    return resolveExternalSecret(ref);
+  }
   const stored = secretStore[ref];
   if (stored) {
     const ss = getSafeStorage();
@@ -214,13 +678,33 @@ function buildUrl(baseUrl, params, vars) {
   const qs = queryRows.map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");
   return url + sep + qs;
 }
+function rebaseUrl(fullUrl, baseUrl) {
+  if (!baseUrl) return fullUrl;
+  try {
+    const orig = new URL(fullUrl, "http://placeholder.invalid");
+    const base = new URL(baseUrl);
+    const basePath = base.pathname.replace(/\/$/, "");
+    base.pathname = (basePath + orig.pathname).replace(/\/{2,}/g, "/");
+    base.search = orig.search;
+    return base.toString();
+  } catch {
+    return fullUrl;
+  }
+}
 async function buildEnvVars(environment) {
   const vars = {};
   if (!environment) return vars;
   const masterKey = process.env["API_SPECTOR_MASTER_KEY"];
   for (const v of environment.variables) {
     if (!v.enabled) continue;
-    if (v.envRef) {
+    if (v.secretRef && hasSecretScheme(v.secretRef)) {
+      try {
+        const resolved = await resolveExternalSecret(v.secretRef);
+        if (resolved !== null) vars[v.key] = resolved;
+      } catch (err) {
+        console.warn(`[secrets] could not resolve ${v.key} (${v.secretRef}): ${err.message}`);
+      }
+    } else if (v.envRef) {
       const envValue = process.env[v.envRef];
       if (envValue !== void 0) vars[v.key] = envValue;
     } else if (v.secret && v.secretEncrypted && v.secretSalt && v.secretIv) {
@@ -499,9 +983,9 @@ function buildAt(ctx, testResults, consoleOutput) {
       const counterBuf = Buffer.alloc(8);
       counterBuf.writeUInt32BE(Math.floor(counter / 4294967296), 0);
       counterBuf.writeUInt32BE(counter >>> 0, 4);
-      const hmac = crypto__namespace.createHmac(algorithm, keyBytes).update(counterBuf).digest();
-      const offset = hmac[hmac.length - 1] & 15;
-      const binCode = (hmac[offset] & 127) << 24 | (hmac[offset + 1] & 255) << 16 | (hmac[offset + 2] & 255) << 8 | hmac[offset + 3] & 255;
+      const hmac2 = crypto__namespace.createHmac(algorithm, keyBytes).update(counterBuf).digest();
+      const offset = hmac2[hmac2.length - 1] & 15;
+      const binCode = (hmac2[offset] & 127) << 24 | (hmac2[offset + 1] & 255) << 16 | (hmac2[offset + 2] & 255) << 8 | hmac2[offset + 3] & 255;
       return String(binCode % 10 ** digits).padStart(digits, "0");
     }
   };
@@ -1197,12 +1681,12 @@ async function fetchOAuth2Token(auth, vars) {
     throw new Error(`OAuth 2.0 token request failed (${resp.status}): ${body}`);
   }
   const json = await resp.json();
-  const accessToken = String(json["access_token"] ?? "");
-  if (!accessToken) throw new Error("OAuth 2.0: token response missing access_token.");
+  const accessToken2 = String(json["access_token"] ?? "");
+  if (!accessToken2) throw new Error("OAuth 2.0: token response missing access_token.");
   const expiresIn = Number(json["expires_in"] ?? 3600);
   const expiresAt = Date.now() + expiresIn * 1e3;
   return {
-    accessToken,
+    accessToken: accessToken2,
     expiresAt,
     refreshToken: json["refresh_token"] ? String(json["refresh_token"]) : void 0
   };
@@ -1433,7 +1917,10 @@ function buildBodyAndApplyHeaders(req, vars, headers) {
   return body;
 }
 async function performHttpExchange(opts) {
-  const { req, vars, resolvedUrl, dispatcher, proxy, tls, onSent } = opts;
+  const { req, resolvedUrl, dispatcher, proxy, tls, onSent } = opts;
+  let vars = opts.vars;
+  const inlineSecrets = await resolveInlineSecrets(req);
+  if (Object.keys(inlineSecrets).length) vars = { ...vars, ...inlineSecrets };
   const start = Date.now();
   if (req.auth.type === "oauth2") {
     const now = Date.now();
@@ -1547,6 +2034,29 @@ function syntheticHttpFailure(status, statusText) {
     error: `Request returned ${status} - no assertion was defined to verify the status code.`
   };
 }
+async function resolveInlineSecrets(req) {
+  const haystack = [
+    req.url ?? "",
+    JSON.stringify(req.params ?? []),
+    JSON.stringify(req.headers ?? []),
+    JSON.stringify(req.body ?? {}),
+    JSON.stringify(req.auth ?? {}),
+    req.preRequestScript ?? "",
+    req.postRequestScript ?? ""
+  ].join("\n");
+  const refs = /* @__PURE__ */ new Set();
+  for (const m of haystack.matchAll(/\{\{\s*([^}]+?)\s*\}\}/g)) {
+    const inner = m[1].trim();
+    if (hasSecretScheme(inner)) refs.add(inner);
+  }
+  if (refs.size === 0) return {};
+  const out = {};
+  await Promise.all([...refs].map(async (ref) => {
+    const value = await resolveExternalSecret(ref);
+    if (value !== null) out[ref] = value;
+  }));
+  return out;
+}
 async function executeRunnerRequest(opts) {
   const { req, collectionVars, envVars, globals: globals2, dispatcher, piiMaskPatterns, proxy, tls, onScriptOutput } = opts;
   let { localVars } = opts;
@@ -1564,6 +2074,24 @@ async function executeRunnerRequest(opts) {
   let updatedCollectionVars = { ...collectionVars };
   let updatedGlobals = { ...globals2 };
   let preScriptError;
+  let inlineSecrets = {};
+  try {
+    inlineSecrets = await resolveInlineSecrets(req);
+  } catch (err) {
+    return {
+      result: {
+        ...base,
+        status: "error",
+        durationMs: 0,
+        error: err instanceof Error ? err.message : String(err)
+      },
+      updatedEnvVars,
+      updatedCollectionVars,
+      updatedGlobals,
+      updatedLocalVars: localVars
+    };
+  }
+  if (Object.keys(inlineSecrets).length) vars = { ...vars, ...inlineSecrets };
   if (req.preRequestScript?.trim()) {
     const r = await runScript(interpolate(req.preRequestScript, vars), {
       envVars: { ...envVars },
@@ -1581,6 +2109,7 @@ async function executeRunnerRequest(opts) {
     await persistGlobals();
     onScriptOutput?.("pre", r.consoleOutput, r.error);
     vars = mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
+    if (Object.keys(inlineSecrets).length) vars = { ...vars, ...inlineSecrets };
   }
   const resolvedUrl = buildUrl(req.url, req.params, vars);
   base.resolvedUrl = resolvedUrl;
@@ -1725,6 +2254,7 @@ exports.deriveRunStatus = deriveRunStatus;
 exports.executeRunnerRequest = executeRunnerRequest;
 exports.getGlobals = getGlobals;
 exports.getSecret = getSecret;
+exports.hasSecretScheme = hasSecretScheme;
 exports.initSecretStore = initSecretStore;
 exports.interpolate = interpolate;
 exports.loadGlobals = loadGlobals;
@@ -1734,7 +2264,12 @@ exports.mergeVars = mergeVars;
 exports.patchGlobals = patchGlobals;
 exports.performHttpExchange = performHttpExchange;
 exports.persistGlobals = persistGlobals;
+exports.rebaseUrl = rebaseUrl;
 exports.registerSecretHandlers = registerSecretHandlers;
+exports.registerSecretProvider = registerSecretProvider;
+exports.registeredSchemes = registeredSchemes;
+exports.resolveExternalSecret = resolveExternalSecret;
 exports.runScript = runScript;
 exports.setGlobals = setGlobals;
+exports.setSecretsConfig = setSecretsConfig;
 exports.syntheticHttpFailure = syntheticHttpFailure;