norn-cli 2.2.2 → 2.3.0

package/.claude/settings.local.json

@@ -0,0 +1,18 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm run *)",
+      "WebSearch",
+      "Bash(git checkout *)",
+      "Bash(node ./dist/cli.js tests/Regression/nornenv-templates/extends-resolution.norn -s PrintResolvedValues -e prod_uk)",
+      "Bash(node ./dist/cli.js tests/Regression/nornenv-templates/extends-resolution.norn -s PrintResolvedValues -e prod_us)",
+      "Bash(node ./dist/cli.js tests/Regression/nornenv-templates/extends-resolution.norn -s PrintResolvedValues -e diamond)",
+      "Bash(node ./dist/cli.js tests/Regression/nornenv-templates/extends-resolution.norn -s PrintResolvedValues -e base)",
+      "Bash(mv .nornenv .nornenv.bak)",
+      "Bash(cp cycle.nornenv .nornenv)",
+      "Bash(timeout 10 node ../../../dist/cli.js extends-resolution.norn -s PrintResolvedValues -e c)",
+      "Bash(time node ../../../dist/cli.js extends-resolution.norn -s PrintResolvedValues -e c)",
+      "Bash(time node /Users/petercrest/Worktable/Projects/vsApi/dist/cli.js extends-resolution.norn -s PrintResolvedValues -e c)"
+    ]
+  }
+}

package/CHANGELOG.md

@@ -2,7 +2,22 @@
 
 All notable changes to the "Norn" extension will be documented in this file.
 
-## [Unreleased]
+## [2.3.0] - 2026-05-20
+
+### Added
+- **Inlay hints + hover across every Norn file type**:
+  - `.norn`: every `{{name}}` / `{{$env.name}}` token resolves under the active env, with three-scope precedence — sequence-local `var` declarations ← file-level `var` declarations ← active env's effective vars. Runtime values (`$1.body.x`, `run X()`, request captures) are intentionally not rendered inline; hover narrates them with source line.
+  - `.nornapi`: every `{{...}}` token in headers groups and endpoint definitions resolves under the active env.
+  - `.nornsql`: the `connection NAME` line shows the resolved `NAME_connectionString` from `.nornenv` (masked if a `secret connectionString`). Hover narrates the source. Any `{{...}}` in SQL bodies is handled for parity.
+  - Resolution and reference parsing live in `src/inlayHintResolver.ts` so every provider behaves identically.
+- **`.nornenv` Templates And Extends (Extension + CLI)**:
+  - Added `[template:NAME]` sections and multi-parent template `extends` on `[env:...]` / `[template:...]` headers.
+  - Resolved env values as `common <- template1 <- template2 <- self`; templates compose into envs but are not selectable in the status bar or CLI `-e`.
+  - Added `.nornenv` Activate/Deactivate and Peek inherited CodeLens actions, folding ranges, smart header decorations, hover resolution chains, inlay hints for `{{...}}`, and inherited-variable completions.
+  - Added diagnostics for unknown extends parents, invalid env parents, extends cycles, out-of-scope cross-section references, and typo-like override names.
+
+### Fixed
+- Endpoint path arguments now keep bare `.nornenv` names as literal path values unless the reference is explicit (`{{name}}` / `{{$env.name}}`), while declared file/sequence variables still resolve in endpoint calls.
 
 ## [2.2.0] - 2026-05-09
 

package/LICENSE

@@ -8,13 +8,17 @@ If you do not wish to be bound by the terms of this Agreement, you may not downl
 
 • DEFINITIONS
 
-"Authorized User" means any employee, independent contractor or other temporary worker authorized by Licensee to use the Software while performing duties within the scope of their employment or assignment.
+"Extension" means the Norn extension for Visual Studio Code.
+
+"CLI" means the Norn command-line interface.
 
-"License Key" means a unique key-code that enables a single Authorized User to use the Software at a time. Only Licensor and/or its representatives are permitted to produce License Keys for the Software.
+"Pipeline Use" means execution of the CLI within an automated build, test, integration, delivery or deployment pipeline, including but not limited to continuous integration and continuous delivery (CI/CD) systems, whether hosted or self-hosted, and whether or not triggered by a human.
 
-"Commercial Use" means any use of the Software in connection with a business, including but not limited to: (a) use by an employee or contractor during paid work hours, (b) use to develop, test, or maintain software or services that generate revenue, (c) use within a for-profit organisation, or (d) use in CI/CD pipelines for commercial projects.
+"Local Use" means execution of the CLI directly by an individual on a workstation or development machine, outside of any automated pipeline.
+
+"Authorized User" means any employee, independent contractor or other temporary worker authorized by Licensee to use the Software while performing duties within the scope of their employment or assignment.
 
-"Personal Use" means use by an individual for personal projects, learning, education, or open-source projects that do not generate revenue.
+"License Key" means a unique key-code that authorizes Pipeline Use of the CLI. Only Licensor and/or its representatives are permitted to produce License Keys for the Software.
 
 • OWNERSHIP
 
@@ -26,35 +30,22 @@ Upon your acceptance of this Agreement, Licensor grants you a limited, non-trans
 
 • INTENDED USERS OF THE SOFTWARE
 
-The Norn software is licensed to provide functionality to test APIs in Visual Studio Code as an Extension. The Norn CLI can be used locally on the user's computer for Personal Use without a license. A license is required to use the Software for Commercial Use, including use of the Norn CLI in CI/CD build pipelines.
-
-• FREE USE (PERSONAL USE)
-
-You may install and use the Software free of charge for Personal Use, including:
-- Personal projects and experimentation
-- Learning and educational purposes
-- Open-source projects that do not generate revenue
-- Academic research
-
-• COMMERCIAL EVALUATION
+The Extension is free to install and use for everyone, including individuals, businesses and organisations, for any purpose including commercial purposes, and never requires a License Key. The CLI is free for Local Use. A License Key is required only for Pipeline Use of the CLI. No License Key is required to use the Extension or to use the CLI for Local Use.
 
-Businesses and organisations may evaluate the Software for Commercial Use without a license for a period of thirty (30) days from first use ("Evaluation Period"). The Evaluation Period is:
-- Limited to one (1) evaluation period per organisation
-- Intended for genuine evaluation purposes only
-- Not to be used for production workloads or client projects
-- Not extendable or renewable without written permission from the Licensor
+• FREE USE
 
-After the Evaluation Period, continued Commercial Use requires a valid license. Abuse of the Evaluation Period, including but not limited to repeated evaluations by the same organisation, rotating users to extend evaluation, or using evaluation for production purposes, constitutes a breach of this Agreement.
+You may install and use the following free of charge, without a License Key:
+- The Extension, for any use, including commercial use within a for-profit company or organisation
+- The CLI for Local Use, including personal projects and experimentation, learning and education, academic research, and open-source projects
 
-• COMMERCIAL USE
+• LICENSED USE (PIPELINE USE OF THE CLI)
 
-A license is required for Commercial Use of the Software after the Evaluation Period. Commercial Use includes but is not limited to:
-- Use within a for-profit company or organisation
-- Use by employees or contractors during paid work
-- Use in CI/CD pipelines for commercial projects
-- Use to develop, test, or maintain revenue-generating software or services
+A valid License Key is required for any Pipeline Use of the CLI. For the avoidance of doubt:
+- The Extension never requires a License Key, including when used commercially within a for-profit company or organisation
+- Local Use of the CLI never requires a License Key
+- Only Pipeline Use of the CLI (for example, running the CLI in a CI/CD build, test, or deployment pipeline) requires a License Key
 
-Please contact the Licensor for commercial licensing options.
+Please contact the Licensor for licensing options.
 
 • RESTRICTIONS ON USE OF THE SOFTWARE
 
@@ -64,7 +55,7 @@ b) Decompile, disassemble or reverse engineer the Software or attempt to do any
 c) Reproduce, copy, distribute, resell or otherwise use the whole or any part of the Software's code for any commercial purpose.
 d) Disable, modify or hide notifications sent by the Software.
 e) Distribute, resell, or share License Keys.
-f) Misrepresent your use as Personal Use when it constitutes Commercial Use.
+f) Misrepresent Pipeline Use of the CLI as Local Use, or otherwise circumvent the License Key requirement for Pipeline Use.
 g) Use older versions of the Software to circumvent licensing requirements.
 
 • LIMITED WARRANTY AND DISCLAIMER OF WARRANTY

package/README.md

@@ -1,6 +1,6 @@
 # Norn
 
-Norn is a REST client for VS Code that keeps ad hoc requests, reusable API flows, and test automation in the same files. Write a request once, turn it into a sequence, debug it in the editor, and run the same `.norn` files from the CLI in CI.
+Norn turns API requests into version-controlled tests your whole team can keep — authored and debugged in VS Code, run on every PR in CI. Write a request once, turn it into a tested sequence, debug it with breakpoints in the editor, and run the exact same `.norn` files from the CLI in your pipeline.
 
 ### Simple API Requests
 
@@ -72,6 +72,37 @@ npm install -g norn-cli
 norn ./tests/smoke.norn -e dev
 ```
 
+## `.nornenv` Templates And Extends
+
+Use `[template:name]` sections for reusable environment building blocks, then compose selectable `[env:name]` sections with `extends`. Only templates can be extended. Templates are not selectable from the status bar or CLI; only `[env:...]` names can be used with `-e`.
+
+```nornenv
+var timeout = 30000
+
+[template:prod]
+var baseUrl = https://api.example.com
+secret apiKey = prod-key-789
+
+[template:uk]
+var dbHost = db.uk.example.com
+var bucket = data-uk
+
+[env:prod_uk extends prod, uk]
+var failoverHost = api-failover.uk.example.com
+```
+
+Resolution order is `common <- template1 <- template2 <- self`, so later templates win on collisions and the env section itself wins over everything. The VS Code editor also shows Activate CodeLens actions, inherited-variable peeks, hover resolution chains, and inlay hints for `{{name}}` / `{{$env.name}}` references.
+
+## Inlay Hints Across Every File Type
+
+Every `{{...}}` reference in any Norn file shows its resolved value as a gray inline hint under the active env, with the same masking-for-secrets rules as `.nornenv`. The three scopes available in `.norn` resolve in precedence order:
+
+1. **Sequence-local** `var` declarations inside the current `test sequence ... end sequence` block
+2. **File-level** `var` declarations at the top of the file (above any sequence)
+3. **Active env** effective vars (`common` ← ancestor templates ← self)
+
+`{{$env.name}}` always reads from scope 3, skipping local/file vars. Runtime values (`$1.body.id`, request captures, `run X()` returns) render no hint inline; hover narrates them with source line. `.nornapi` and `.nornsql` use env scope only; `.nornsql` additionally shows the resolved connection string after `connection NAME`.
+
 ## Deterministic MCP Tools
 
 Norn can call MCP tools from sequences without leaving the `.norn` runtime. MCP sessions are deterministic and shared across the full sequence run, so nested sequences reuse the same connection for the same resolved server alias.

package/demos/nornenv-showcase/README.md

@@ -0,0 +1,62 @@
+# `.nornenv` Feature Showcase
+
+A single `.nornenv` that touches every feature we've shipped — templates, multi-parent `extends`, diamond inheritance, secrets, connection-string templates, imports, plus every diagnostic. Open [.nornenv](./.nornenv) in VS Code and the editor experience does most of the talking.
+
+## What to try, in order
+
+1. **Open the file.** Non-active sections auto-collapse to one line; the smart header chips show `extends X, Y · N vars · K inherited · M overrides` plus any warning pills.
+2. **Click `▶ Activate` on `[env:prod_eu]`.** It's the most feature-dense env. Watch the file change:
+   - The `ACTIVE` pill appears on its header
+   - A brand-gradient marker shows up in the gutter on its line
+   - A teal tick appears on the right-side overview ruler
+   - Every `{{...}}` reference in the file gets an inlay hint with the now-resolved value
+   - Secrets render as `(secret)` rather than the raw value
+3. **Hover anything** — a variable name on the left side of a `=`, or a `{{ref}}`. The hover shows the resolution chain: where it's defined, whether it was inherited, and the current resolved value.
+4. **Try `▶ Peek inherited`** on a leaf env like `[env:prod_eu]` — a quick-pick lists all 8+ inherited variables with their source templates and resolved values.
+5. **Type `var ` inside `[env:prod_eu]`** — IntelliSense suggests every inherited variable name, so you can pick one to override without retyping.
+6. **Start a new section header `[`** — completion offers both `[env:` and `[template:`. After typing `[env:foo `, completion offers `extends`, then suggests every available template as a parent.
+7. **Scroll to the bottom** — the diagnostics-only block deliberately triggers every linter check:
+   - `[env:bad_unknown_parent extends prdo, us]` — `prdo` squiggles as `unknown-extends-parent` with a quick-fix suggesting `prod`
+   - `var apiKy = oops-typo` — squiggles as `unknown-override-target` with a suggestion
+   - `var dangling = {{kmsKey}}` — squiggles as `unresolved-cross-section-ref`
+   - `[env:bad_env_parent extends prod_us]` — `prod_us` squiggles as `extends-env-parent`
+   - `[template:loop_a]` / `[template:loop_b]` — both squiggle as `extends-cycle`
+
+## What to try at the CLI
+
+After `npm run compile`, run [showcase.norn](./showcase.norn) which prints every resolved value.
+
+> **Heads-up about `{{…}}` inside `.nornenv` values:** the IDE's inlay hints show the **fully recursively resolved** form (e.g. `apiBase → "https://api.prod.example.com/v2"` under `prod_eu`). The `.norn` runtime substitution is single-level — when you print `{{apiBase}}` from a `.norn` file, you'll see the literal `https://api.{{stageHost}}.example.com/{{apiVersion}}` because `apiBase`'s *value* still contains template tokens. That's standard Norn behavior — switch to the IDE for the deep view, or use leaf vars (stageHost, region, dbHost, …) for clean CLI prints.
+
+```bash
+# Most feature-dense env (self-override + diamond touchpoints).
+node ./dist/cli.js demos/nornenv-showcase/showcase.norn -e prod_eu
+
+# Right-most-wins demo — prod_strict (rightmost prod-chain template) wins on collisions.
+node ./dist/cli.js demos/nornenv-showcase/showcase.norn -e prod_eu_strict
+
+# Diamond inheritance — shared ancestor merged once.
+node ./dist/cli.js demos/nornenv-showcase/showcase.norn -e diamond
+
+# Templates are not selectable — this should error and list only env names.
+node ./dist/cli.js demos/nornenv-showcase/showcase.norn -e prod
+```
+
+## What each section demonstrates
+
+| Section | Feature |
+| --- | --- |
+| `import "./shared/.nornenv"` | Multi-file composition; chained imports merge into common |
+| top-of-file `var ...` | Common variables (shared by every env) |
+| `var apiBase = https://api.{{stageHost}}…` | Common values may reference any name — resolves under the active env |
+| `[template:dev/staging/prod]` | Stage building blocks (not selectable) |
+| `[template:prod_strict extends prod]` | Template extending another template (chained) |
+| `[template:us/eu]` | Region building blocks |
+| `[template:db_main]` with `connectionString` + `secret connectionString` | Connection-string templates, plain and secret |
+| `[env:dev_us extends dev, us, db_main]` | Composing 3 templates into one selectable env |
+| `[env:prod_eu] ... var logLevel = error` | Self-override wins over every parent |
+| `[env:prod_eu_strict extends prod_strict, eu, db_main]` | Right-most parent wins on collisions |
+| `[env:diamond extends dev, prod_strict]` | Diamond: shared ancestor merged once |
+| `[env:bad_unknown_parent ...]` | Unknown parent + typo override + dangling ref diagnostics |
+| `[env:bad_env_parent extends prod_us]` | Env-as-parent diagnostic |
+| `[template:loop_a/loop_b]` | Cycle diagnostic |

package/demos/nornenv-showcase/norn.config.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "sql": {
+    "connections": {
+      "main": {
+        "adapter": "showcase-fake-adapter",
+        "profile": "main"
+      }
+    },
+    "adapters": {
+      "showcase-fake-adapter": {
+        "command": ["node", "-e", "process.stderr.write('showcase: SQL adapter not wired; this file is a visual demo only.\\n'); process.exit(1);"]
+      }
+    }
+  }
+}

package/demos/nornenv-showcase/showcase.norn

@@ -0,0 +1,70 @@
+# Showcase .norn — exercises the inlay hints + hover from src/nornInlayHintsProvider
+# and src/nornHoverProvider across all three scopes:
+#   1. Sequence-local `var` declarations inside a `test sequence ... end sequence` block
+#   2. File-level `var` declarations (above any sequence)
+#   3. Active .nornenv environment (common + ancestor templates + self)
+#
+# Open this file with [env:prod_eu] active to watch every {{...}} reference
+# resolve inline; hover any reference for the source + value resolution chain.
+#
+# CLI verification:
+#   node ./dist/cli.js demos/nornenv-showcase/showcase.norn -s ShowcaseResolvedValues -e prod_eu
+#   node ./dist/cli.js demos/nornenv-showcase/showcase.norn -s ShowcaseResolvedValues -e prod_eu_strict
+#   node ./dist/cli.js demos/nornenv-showcase/showcase.norn -s ShowcaseResolvedValues -e diamond
+
+# ─── File-level vars (scope 2) ──────────────────────────────────────────────
+# These reference env vars defined in showcase.nornenv ({{region}}, {{apiVersion}}).
+# Inlay hints should resolve them recursively under the active env.
+var siteTag        = "showcase-{{region}}"
+var docsHomepage   = "{{apiBase}}/help"
+
+# ─── Sequence 1: print every resolved env-level value ───────────────────────
+test sequence ShowcaseResolvedValues
+    print "apiBase"        | "{{apiBase}}"
+    print "dataBucket"     | "{{dataBucket}}"
+    print "docsUrl"        | "{{docsUrl}}"
+    print "stageHost"      | "{{stageHost}}"
+    print "region"         | "{{region}}"
+    print "dbHost"         | "{{dbHost}}"
+    print "logLevel"       | "{{logLevel}}"
+    print "retries"        | "{{retries}}"
+    print "orgName"        | "{{orgName}}"
+    print "main_connectionString"    | "{{main_connectionString}}"
+    print "reports_connectionString" | "{{reports_connectionString}}"
+    print "apiKey"         | "{{apiKey}}"
+end sequence
+
+# ─── Sequence 2: demonstrate all three scopes in one place ──────────────────
+test sequence ShowcaseScopeLayers
+    # File-level var (scope 2) referenced from inside a sequence
+    print "siteTag"        | "{{siteTag}}"
+    print "docsHomepage"   | "{{docsHomepage}}"
+
+    # Sequence-local var (scope 1) — static value
+    var greeting           = "Hello from {{stageHost}}"
+    print "greeting"       | "{{greeting}}"
+
+    # Sequence-local var (scope 1) — composes env + region
+    var fullUserUrl        = "{{apiBase}}/{{region}}/users"
+    print "fullUserUrl"    | "{{fullUserUrl}}"
+
+    # Sequence-local var (scope 1) — overrides a file-level name within this sequence
+    var siteTag            = "scoped-override-{{stageHost}}"
+    print "siteTag (local override)" | "{{siteTag}}"
+
+    # Explicit env-only reference — bypasses local/file scope, reads directly from env
+    print "env-only region" | "{{$env.region}}"
+end sequence
+
+# ─── Sequence 3: runtime vars are intentionally NOT shown by inlay hints ────
+test sequence ShowcaseRuntimeRefs
+    # Sequence-local but RUNTIME (response capture) — no inlay hint expected on {{traceId}}.
+    # Hover on the reference will narrate "runtime expression" with source line.
+    GET https://httpbin.org/uuid
+    assert $1.status == 200
+    var traceId            = $1.body.uuid
+    print "traceId"        | "{{traceId}}"
+
+    # Response refs like {{$1.body.uuid}} are also runtime-only — no inlay hint.
+    print "uuid"           | "{{$1.body.uuid}}"
+end sequence

package/demos/nornenv-showcase/showcase.nornapi

@@ -0,0 +1,26 @@
+# Showcase .nornapi — every {{...}} on this file resolves under the active env via
+# the inlay hints from src/nornapiInlayHintsProvider.ts. Hover any reference for
+# the resolution chain.
+#
+# Try: activate [env:prod_eu] from showcase.nornenv and watch the URLs/headers
+# below resolve to prod_eu's effective values.
+
+headers Standard
+Content-Type: application/json
+Accept: application/json
+end headers
+
+headers AuthHeaders
+Authorization: Bearer {{apiKey}}
+X-Region: {{region}}
+X-Stage: {{stageHost}}
+X-Api-Version: {{apiVersion}}
+end headers
+
+endpoints
+    HealthCheck:    GET {{apiBase}}/health
+    ListCustomers:  GET {{apiBase}}/customers?region={{region}}
+    GetCustomer:    GET {{apiBase}}/customers/{customerId}
+    CreateOrder:    POST {{apiBase}}/orders
+    Failover:       GET {{failoverHost}}/status
+end endpoints

package/demos/nornenv-showcase/showcase.nornsql

@@ -0,0 +1,20 @@
+# Showcase .nornsql — the `connection main` line below is resolved by
+# src/nornsqlInlayHintsProvider.ts to `main_connectionString` from the
+# nearest .nornenv. Hover the identifier `main` to see where it's defined
+# in [template:db_main] and what it resolves to under the active env.
+#
+# Try: activate [env:prod_eu] and watch the inlay after `main` show the
+# resolved Server=tcp:db.eu.example.com,1433;... connection string.
+
+connection main
+
+query ListBuyers(region)
+select Id, Company, Email
+from Buyers
+where Region = :region
+end query
+
+command RecordAuditEntry(actor, action)
+insert into Audit (Actor, Action, At)
+values (:actor, :action, current_timestamp)
+end command

package/dist/cli.js

@@ -127575,12 +127575,20 @@ function stringifyRequestValue(value) {
   }
   return String(value);
 }
+function shouldResolveBareRequestValue(value, variables) {
+  if (!Object.prototype.hasOwnProperty.call(variables, value)) {
+    return false;
+  }
+  const envScope = variables["$env"];
+  const isEnvOnlyValue = envScope && typeof envScope === "object" && Object.prototype.hasOwnProperty.call(envScope, value) && variables[value] === envScope[value];
+  return !isEnvOnlyValue;
+}
 function resolveRequestValueExpression(value, variables) {
-  if (variables[value] !== void 0) {
+  if (shouldResolveBareRequestValue(value, variables)) {
     return stringifyRequestValue(variables[value]);
   }
   const pathMatch2 = value.match(/^([a-zA-Z_][a-zA-Z0-9_]*)(\.\w[\w-]*(?:\.\w[\w-]*|\[\d+\])*|\[\d+\](?:\.\w[\w-]*|\[\d+\])*)$/);
-  if (pathMatch2 && variables[pathMatch2[1]] !== void 0) {
+  if (pathMatch2 && shouldResolveBareRequestValue(pathMatch2[1], variables)) {
     const nestedValue = getNestedPathValue(variables[pathMatch2[1]], pathMatch2[2].replace(/^\./, ""));
     if (nestedValue !== void 0) {
       return stringifyRequestValue(nestedValue);
@@ -127832,7 +127840,7 @@ function resolveEnvironmentTemplateValue(variableName, variables, secretNames =
           kind: "scope",
           variableName: name,
           reference: referenceName,
-          message: `.nornenv template reference '${referenceName}' is environment-specific. Values inside [env:...] sections can only reference common variables.`
+          message: `.nornenv template reference '${referenceName}' is not in scope. Values inside [env:...] sections can reference common variables and inherited ancestor variables only.`
         });
       }
       if (resolved.secret) {
@@ -132675,24 +132683,58 @@ function listCachedSecretKeyIds(targetPath) {
 // src/environmentParser.ts
 var ENV_FILENAME = ".nornenv";
 var importRegex = /^import\s+["']?(.+?)["']?\s*$/;
-var envRegex = /^\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]$/;
+var sectionHeaderRegex = /^\[(env|template):([a-zA-Z_][a-zA-Z0-9_-]*)(?:\s+extends\s+([^\]]+?))?\]\s*$/;
+var identifierRegex = /^[a-zA-Z_][a-zA-Z0-9_-]*$/;
 var varRegex = /^var\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
 var connectionStringRegex = /^connectionString\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
 var secretRegex = /^secret\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
 var secretConnectionStringRegex = /^secret\s+connectionString\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
+function parseExtendsClause(clause) {
+  if (!clause) {
+    return [];
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const names = [];
+  for (const raw of clause.split(",")) {
+    const name = raw.trim();
+    if (!name || !identifierRegex.test(name) || seen.has(name)) {
+      continue;
+    }
+    seen.add(name);
+    names.push(name);
+  }
+  return names;
+}
 function parseEnvFile(content, sourceFilePath) {
   const lines = content.split("\n");
   const config2 = {
     common: {},
     environments: [],
+    templates: [],
     secretNames: /* @__PURE__ */ new Set(),
     secretValues: /* @__PURE__ */ new Map(),
     imports: [],
     misplacedImports: [],
     secretDeclarations: []
   };
-  let currentEnv = null;
+  let currentSection = null;
+  let currentKind = null;
   let seenContent = false;
+  const assignVariable = (varName, varValue) => {
+    if (currentSection) {
+      currentSection.variables[varName] = varValue;
+    } else {
+      config2.common[varName] = varValue;
+    }
+  };
+  const buildSecretDeclaration = (varName, varValue, lineNumber) => ({
+    name: varName,
+    value: varValue,
+    envName: currentKind === "env" ? currentSection?.name : void 0,
+    templateName: currentKind === "template" ? currentSection?.name : void 0,
+    lineNumber,
+    filePath: sourceFilePath
+  });
   for (let i = 0; i < lines.length; i++) {
     const trimmed = lines[i].trim();
     if (!trimmed || trimmed.startsWith("#")) {
@@ -132711,13 +132753,21 @@ function parseEnvFile(content, sourceFilePath) {
       continue;
     }
     seenContent = true;
-    const envMatch = trimmed.match(envRegex);
-    if (envMatch) {
-      currentEnv = {
-        name: envMatch[1],
-        variables: {}
-      };
-      config2.environments.push(currentEnv);
+    const sectionMatch = trimmed.match(sectionHeaderRegex);
+    if (sectionMatch) {
+      const kind = sectionMatch[1];
+      const name = sectionMatch[2];
+      const parents = parseExtendsClause(sectionMatch[3]);
+      if (kind === "env") {
+        const env3 = { name, variables: {}, parents };
+        config2.environments.push(env3);
+        currentSection = env3;
+      } else {
+        const template = { name, variables: {}, parents };
+        config2.templates.push(template);
+        currentSection = template;
+      }
+      currentKind = kind;
       continue;
     }
     const secretConnectionStringMatch = trimmed.match(secretConnectionStringRegex);
@@ -132725,40 +132775,20 @@ function parseEnvFile(content, sourceFilePath) {
       const profileName = secretConnectionStringMatch[1];
       const varName = `${profileName}_connectionString`;
       const varValue = secretConnectionStringMatch[2].trim();
-      config2.secretDeclarations.push({
-        name: varName,
-        value: varValue,
-        envName: currentEnv?.name,
-        lineNumber: i,
-        filePath: sourceFilePath
-      });
+      config2.secretDeclarations.push(buildSecretDeclaration(varName, varValue, i));
       config2.secretNames.add(varName);
       config2.secretValues.set(varName, varValue);
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
       continue;
     }
     const secretMatch = trimmed.match(secretRegex);
     if (secretMatch) {
       const varName = secretMatch[1];
       const varValue = secretMatch[2].trim();
-      config2.secretDeclarations.push({
-        name: varName,
-        value: varValue,
-        envName: currentEnv?.name,
-        lineNumber: i,
-        filePath: sourceFilePath
-      });
+      config2.secretDeclarations.push(buildSecretDeclaration(varName, varValue, i));
       config2.secretNames.add(varName);
       config2.secretValues.set(varName, varValue);
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
       continue;
     }
     const connectionStringMatch = trimmed.match(connectionStringRegex);
@@ -132766,22 +132796,14 @@ function parseEnvFile(content, sourceFilePath) {
       const profileName = connectionStringMatch[1];
       const varName = `${profileName}_connectionString`;
       const varValue = connectionStringMatch[2].trim();
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
       continue;
     }
     const varMatch = trimmed.match(varRegex);
     if (varMatch) {
       const varName = varMatch[1];
       const varValue = varMatch[2].trim();
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
     }
   }
   return config2;
@@ -132910,6 +132932,11 @@ function registerVariableOrigins(config2, filePath, origins) {
       origins.set(`env:${env3.name}:${varName}`, { filePath, line: -1, varName });
     }
   }
+  for (const template of config2.templates) {
+    for (const varName of Object.keys(template.variables)) {
+      origins.set(`template:${template.name}:${varName}`, { filePath, line: -1, varName });
+    }
+  }
 }
 function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOrigins, errors) {
   for (const [varName, varValue] of Object.entries(source.common)) {
@@ -132932,8 +132959,14 @@ function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOr
   for (const sourceEnv of source.environments) {
     let targetEnv = target.environments.find((e) => e.name === sourceEnv.name);
     if (!targetEnv) {
-      targetEnv = { name: sourceEnv.name, variables: {} };
+      targetEnv = { name: sourceEnv.name, variables: {}, parents: [...sourceEnv.parents] };
       target.environments.push(targetEnv);
+    } else {
+      for (const parent of sourceEnv.parents) {
+        if (!targetEnv.parents.includes(parent)) {
+          targetEnv.parents.push(parent);
+        }
+      }
     }
     for (const [varName, varValue] of Object.entries(sourceEnv.variables)) {
       const key = `env:${sourceEnv.name}:${varName}`;
@@ -132952,6 +132985,35 @@ function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOr
       }
     }
   }
+  for (const sourceTemplate of source.templates) {
+    let targetTemplate = target.templates.find((t) => t.name === sourceTemplate.name);
+    if (!targetTemplate) {
+      targetTemplate = { name: sourceTemplate.name, variables: {}, parents: [...sourceTemplate.parents] };
+      target.templates.push(targetTemplate);
+    } else {
+      for (const parent of sourceTemplate.parents) {
+        if (!targetTemplate.parents.includes(parent)) {
+          targetTemplate.parents.push(parent);
+        }
+      }
+    }
+    for (const [varName, varValue] of Object.entries(sourceTemplate.variables)) {
+      const key = `template:${sourceTemplate.name}:${varName}`;
+      const existing = variableOrigins.get(key);
+      if (existing) {
+        const sourceLabel = toDisplayPath(sourceFilePath, targetFilePath);
+        const existingLabel = toDisplayPath(existing.filePath, targetFilePath);
+        errors.push({
+          message: `Duplicate variable '${varName}' in [template:${sourceTemplate.name}] section. Found in '${existingLabel}' and '${sourceLabel}'.`,
+          filePath: sourceFilePath,
+          line: -1
+        });
+      } else {
+        targetTemplate.variables[varName] = varValue;
+        variableOrigins.set(key, { filePath: sourceFilePath, line: -1, varName });
+      }
+    }
+  }
   for (const name of source.secretNames) {
     target.secretNames.add(name);
   }
@@ -132983,6 +133045,90 @@ function loadAndResolveEnvFile(filePath) {
   result.secretErrors.push(...resolveEncryptedSecretValues(result.config, filePath));
   return result;
 }
+function findExtendsNode(name, config2) {
+  const env3 = config2.environments.find((e) => e.name === name);
+  if (env3) {
+    return { node: env3, kind: "env" };
+  }
+  const template = config2.templates.find((t) => t.name === name);
+  if (template) {
+    return { node: template, kind: "template" };
+  }
+  return void 0;
+}
+function findExtendsTemplate(name, config2) {
+  const template = config2.templates.find((t) => t.name === name);
+  return template ? { node: template, kind: "template" } : void 0;
+}
+function resolveEffectiveEnvVariables(envName, config2) {
+  return Object.fromEntries(
+    Array.from(resolveEffectiveEnvVariableDetails(envName, config2).entries()).map(([name, detail]) => [name, detail.value])
+  );
+}
+function resolveInheritedVariableDetails(nodeName, config2) {
+  const inherited = /* @__PURE__ */ new Map();
+  const visited = /* @__PURE__ */ new Set();
+  const stack = /* @__PURE__ */ new Set();
+  const self2 = findExtendsNode(nodeName, config2);
+  if (!self2) {
+    return inherited;
+  }
+  const walk = (name) => {
+    if (visited.has(name) || stack.has(name)) {
+      return;
+    }
+    const found = findExtendsTemplate(name, config2);
+    if (!found) {
+      return;
+    }
+    stack.add(name);
+    for (const parent of found.node.parents) {
+      walk(parent);
+    }
+    for (const [varName, value] of Object.entries(found.node.variables)) {
+      inherited.set(varName, {
+        name: varName,
+        value,
+        sourceKind: found.kind,
+        sourceName: found.node.name,
+        inherited: true
+      });
+    }
+    visited.add(name);
+    stack.delete(name);
+  };
+  for (const parent of self2.node.parents) {
+    walk(parent);
+  }
+  return inherited;
+}
+function resolveEffectiveEnvVariableDetails(envName, config2) {
+  const details = /* @__PURE__ */ new Map();
+  for (const [name, value] of Object.entries(config2.common)) {
+    details.set(name, {
+      name,
+      value,
+      sourceKind: "common",
+      inherited: true
+    });
+  }
+  for (const [name, detail] of resolveInheritedVariableDetails(envName, config2)) {
+    details.set(name, detail);
+  }
+  const env3 = config2.environments.find((e) => e.name === envName);
+  if (env3) {
+    for (const [name, value] of Object.entries(env3.variables)) {
+      details.set(name, {
+        name,
+        value,
+        sourceKind: "env",
+        sourceName: env3.name,
+        inherited: false
+      });
+    }
+  }
+  return details;
+}
 function resolveEncryptedSecretValues(config2, entryFilePath) {
   const errors = [];
   for (const declaration of config2.secretDeclarations) {
@@ -133035,6 +133181,11 @@ function resolveEncryptedSecretValues(config2, entryFilePath) {
       if (env3) {
         env3.variables[declaration.name] = plaintext;
       }
+    } else if (declaration.templateName) {
+      const template = config2.templates.find((t) => t.name === declaration.templateName);
+      if (template) {
+        template.variables[declaration.name] = plaintext;
+      }
     } else {
       config2.common[declaration.name] = plaintext;
     }
@@ -133052,7 +133203,7 @@ var import_process = require("process");
 // src/secrets/envFileSecrets.ts
 var fs16 = __toESM(require("fs"));
 var path16 = __toESM(require("path"));
-var envRegex2 = /^\s*\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]\s*$/;
+var envRegex = /^\s*\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]\s*$/;
 var secretConnectionStringRegex2 = /^(\s*secret\s+connectionString\s+)([a-zA-Z_][a-zA-Z0-9_]*)(\s*=\s*)(.+)$/;
 var secretRegex2 = /^(\s*secret\s+)([a-zA-Z_][a-zA-Z0-9_]*)(\s*=\s*)(.+)$/;
 function splitContentLines(content) {
@@ -133074,7 +133225,7 @@ function extractSecretLines(content, filePath) {
     if (!trimmed || trimmed.startsWith("#")) {
       continue;
     }
-    const envMatch = trimmed.match(envRegex2);
+    const envMatch = trimmed.match(envRegex);
     if (envMatch) {
       currentEnv = envMatch[1];
       continue;
@@ -133653,7 +133804,7 @@ function resolveEnvironmentForPath(targetPath, selectedEnv) {
     console.error(`Fix .nornenv import errors before running tests.`);
     process.exit(1);
   }
-  const variables = { ...envConfig.common };
+  let variables = { ...envConfig.common };
   const secretNames = new Set(envConfig.secretNames);
   const secretValues = new Map(envConfig.secretValues);
   const availableEnvironments = envConfig.environments.map((e) => e.name);
@@ -133672,9 +133823,9 @@ function resolveEnvironmentForPath(targetPath, selectedEnv) {
       };
     }
     targetEnvVariables = targetEnv.variables;
-    Object.assign(variables, targetEnvVariables);
-    for (const [name, value] of Object.entries(targetEnvVariables)) {
-      if (secretNames.has(name)) {
+    variables = resolveEffectiveEnvVariables(selectedEnv, envConfig);
+    for (const [name, value] of Object.entries(variables)) {
+      if (secretNames.has(name) && !secretValues.has(name)) {
         secretValues.set(name, value);
       }
     }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "norn-cli",
-  "displayName": "Norn - REST Client",
-  "description": "A powerful REST client for making HTTP requests with sequences, variables, scripts, and cookie support",
-  "version": "2.2.2",
+  "displayName": "Norn — API Tests in Your Repo",
+  "description": "Version-controlled API tests your team can keep. Author and debug HTTP sequences in VS Code, then run the same files in CI.",
+  "version": "2.3.0",
   "publisher": "Norn-PeterKrustanov",
   "author": {
     "name": "Peter Krastanov"
@@ -22,21 +22,22 @@
     "theme": "dark"
   },
   "keywords": [
-    "rest",
-    "api",
+    "api testing",
+    "integration testing",
+    "ci",
+    "regression testing",
+    "api automation",
+    "openapi",
     "http",
-    "request",
-    "client",
-    "rest client",
-    "api testing"
+    "test automation"
   ],
   "engines": {
     "vscode": "^1.108.1"
   },
   "categories": [
+    "Testing",
     "Programming Languages",
-    "Snippets",
-    "Other"
+    "Snippets"
   ],
   "activationEvents": [
     "onLanguage:norn",
@@ -87,6 +88,21 @@
         "title": "Select Environment",
         "category": "Norn"
       },
+      {
+        "command": "norn.nornenv.activate",
+        "title": "Activate Norn Environment",
+        "category": "Norn"
+      },
+      {
+        "command": "norn.nornenv.deactivate",
+        "title": "Deactivate Norn Environment",
+        "category": "Norn"
+      },
+      {
+        "command": "norn.nornenv.peekInherited",
+        "title": "Peek Inherited Norn Environment Variables",
+        "category": "Norn"
+      },
       {
         "command": "norn.showCoverage",
         "title": "Show API Coverage",
@@ -344,6 +360,12 @@
         "key": "ctr+alt+r",
         "mac": "ctr+alt+r",
         "when": "editorLangId == norn"
+      },
+      {
+        "command": "norn.nornenv.enter",
+        "key": "enter",
+        "mac": "enter",
+        "when": "editorTextFocus && editorLangId == nornenv && !suggestWidgetVisible"
       }
     ],
     "chatParticipants": [

package/.kanbn/index.md

@@ -1,31 +0,0 @@
----
-startedColumns:
-  - 'In Progress'
-completedColumns:
-  - Done
----
-
-# Norn
-
-## Backlog
-
-- [do-5-customer-conversations](tasks/do-5-customer-conversations.md)
-- [write-down-repeated-wording](tasks/write-down-repeated-wording.md)
-- [refine-your-pitch](tasks/refine-your-pitch.md)
-- [recruit-2–3-pilot-users](tasks/recruit-2–3-pilot-users.md)
-- [decide-what-success-in-a-pilot-looks-like](tasks/decide-what-success-in-a-pilot-looks-like.md)
-- [interview-script](tasks/interview-script.md)
-
-## Todo
-
-- [finalise-the-one-line-pitch](tasks/finalise-the-one-line-pitch.md)
-- [make-a-list-of-10-people-to-speak-to](tasks/make-a-list-of-10-people-to-speak-to.md)
-- [prepare-your-customer-interview-questions](tasks/prepare-your-customer-interview-questions.md)
-- [use-the-shiplight-website-as-a-template-to-improve-norn-website](tasks/use-the-shiplight-website-as-a-template-to-improve-norn-website.md)
-
-## In Progress
-
-## Done
-
-- [book-first-mentor-session](tasks/book-first-mentor-session.md)
-- [write-the-one-pager](tasks/write-the-one-pager.md)

package/.kanbn/tasks/book-first-mentor-session.md

@@ -1,13 +0,0 @@
----
-created: 2026-04-09T22:55:34.350Z
-updated: 2026-04-12T12:19:50.345Z
-assigned: ""
-progress: 0
-tags:
-  - 'Week One'
-due: 2026-04-12T00:00:00.000Z
-started: 2026-04-12T09:08:33.269Z
-completed: 2026-04-12T12:19:50.345Z
----
-
-# Book first mentor session

package/.kanbn/tasks/decide-what-success-in-a-pilot-looks-like.md

@@ -1,9 +0,0 @@
----
-created: 2026-04-09T23:04:43.339Z
-updated: 2026-04-09T23:04:43.337Z
-assigned: ""
-progress: 0
-tags: []
----
-
-# Decide what success in a pilot looks like

package/.kanbn/tasks/do-5-customer-conversations.md

@@ -1,9 +0,0 @@
----
-created: 2026-04-09T23:03:31.570Z
-updated: 2026-04-09T23:03:31.569Z
-assigned: ""
-progress: 0
-tags: []
----
-
-# Do 5 customer conversations

package/.kanbn/tasks/finalise-the-one-line-pitch.md

@@ -1,11 +0,0 @@
----
-created: 2026-04-09T22:59:46.277Z
-updated: 2026-04-09T23:03:00.808Z
-assigned: ""
-progress: 0
-tags:
-  - 'Week One'
-due: 2026-04-12T00:00:00.000Z
----
-
-# Finalise the one-line pitch

package/.kanbn/tasks/interview-script.md

@@ -1,49 +0,0 @@
----
-created: 2026-04-09T23:25:42.568Z
-updated: 2026-04-09T23:25:42.565Z
-assigned: ""
-progress: 0
-tags: []
----
-
-# Interview Script
-
-This is the important bit. You are not trying to impress them. You are trying to learn where the pain is.
-Opening
-“Thanks for taking the time. I’m working on a VS Code-native API testing and automation tool called Norn. I’m speaking to people to understand how teams currently handle API testing, bug reproduction, and automation. I’m not here to hard-sell you anything — I mainly want to learn how you do things today and where the pain is.”
-Warm-up
-“Can you tell me a bit about your role and how involved you are with API testing or debugging?”
-Current workflow
-“How do you currently test APIs day to day?”
-“What tools do you use for exploratory API work?”
-“What tools do you use for repeatable automated API tests?”
-“Are those the same tools, or different?”
-“Who usually owns API regression coverage in your team?”
-“When there’s a bug, how do developers usually reproduce it?”
-Pain discovery
-“What’s the most annoying part of your current setup?”
-“Where does the process break down?”
-“Do developers and QA use the same tools or mostly different ones?”
-“Have you ever had useful API tests or requests trapped in one place where other people don’t really use them?”
-“What becomes hard to maintain as the project grows?”
-“If you could magically remove one frustration from your API workflow, what would it be?”
-Team and buying context
-“If a new tool genuinely improved this, who would care most?”
-“Who would likely use it first?”
-“Who would need to approve it?”
-“Would this be more of a team decision, an engineering decision, or something individuals would adopt first?”
-Reaction to the concept
-After you’ve listened first, say this:
-“I’m building something that lets developers and QA write readable requests, reusable definitions, environments, assertions, and multi-step sequences directly in VS Code, with the aim of reducing the gap between exploratory work and automation. Based on what you’ve said, what parts of that sound useful and what parts don’t?”
-Then ask:
-“What would make you want to try something like that?”
-“What would make you ignore it?”
-“What would you compare it against immediately?”
-“What would it need to do well before you’d take it seriously?”
-Pilot questions
-“If I gave you access to try this on a real workflow, what would be the best use case to test first?”
-“What would success look like for you in a pilot?”
-“What would need to happen for you to keep using it after the trial?”
-“If it worked well, would you see this as something for just you, or for your wider team?”
-Close
-“This has been really useful. Would you be open to a follow-up once I’ve tightened the product and pilot setup?”

package/.kanbn/tasks/make-a-list-of-10-people-to-speak-to.md

@@ -1,11 +0,0 @@
----
-created: 2026-04-09T23:00:11.428Z
-updated: 2026-04-09T23:02:58.760Z
-assigned: ""
-progress: 0
-tags:
-  - 'Week One'
-due: 2026-04-12T00:00:00.000Z
----
-
-# Make a list of 10 people to speak to

package/.kanbn/tasks/prepare-your-customer-interview-questions.md

@@ -1,11 +0,0 @@
----
-created: 2026-04-09T23:00:42.150Z
-updated: 2026-04-09T23:02:55.974Z
-assigned: ""
-progress: 0
-tags:
-  - 'Week One'
-due: 2026-04-12T00:00:00.000Z
----
-
-# Prepare your customer interview questions

package/.kanbn/tasks/recruit-2/342/200/2233-pilot-users.md

@@ -1,9 +0,0 @@
----
-created: 2026-04-09T23:04:26.660Z
-updated: 2026-04-09T23:04:26.657Z
-assigned: ""
-progress: 0
-tags: []
----
-
-# Recruit 2–3 pilot users

package/.kanbn/tasks/refine-your-pitch.md

@@ -1,9 +0,0 @@
----
-created: 2026-04-09T23:04:09.931Z
-updated: 2026-04-09T23:04:09.930Z
-assigned: ""
-progress: 0
-tags: []
----
-
-# Refine your pitch

package/.kanbn/tasks/use-the-shiplight-website-as-a-template-to-improve-norn-website.md

@@ -1,9 +0,0 @@
----
-created: 2026-04-30T21:13:26.675Z
-updated: 2026-04-30T21:13:26.669Z
-assigned: ""
-progress: 0
-tags: []
----
-
-# Use the shiplight website as a template to improve norn website

package/.kanbn/tasks/write-down-repeated-wording.md

@@ -1,9 +0,0 @@
----
-created: 2026-04-09T23:03:51.949Z
-updated: 2026-04-09T23:03:51.947Z
-assigned: ""
-progress: 0
-tags: []
----
-
-# Write down repeated wording

package/.kanbn/tasks/write-the-one-pager.md

@@ -1,27 +0,0 @@
----
-created: 2026-04-09T22:56:55.687Z
-updated: 2026-04-09T23:14:25.954Z
-assigned: ""
-progress: 1
-tags:
-  - 'Week One'
-due: 2026-04-12T00:00:00.000Z
-completed: 2026-04-10T00:00:00.000Z
----
-
-# Write the one pager
-
-Before your first mentor call, write one page with only these headings:
-What Norn is
-Who it is for
-What problem it solves
-What people use today instead
-Why those alternatives are painful
-What is already built
-What proof you have so far
-What you need help deciding next
-
-## Comments
-
-- date: 2026-04-09T23:11:55.306Z
-  https://docs.google.com/document/d/10L0HINdu6bvcKK5FhMBthPHUQYFKo7ix8OBFo-CcodU/edit?usp=sharing