Module auth 

Auth material resolution for remote MCP endpoints.

An crate::config::McpServerSpec carries secret-free header templates (e.g. Authorization: Bearer {{secret:MCP_TOKEN}}); this materializes them to real request headers at connect time — so the manifest/spawn-payload never holds a credential and a rotated {{secret-file:…}} is picked up on the next (re)connect. Bearer / API-key auth rides here; mutual-TLS (a client cert) and OAuth 2.1 client-credentials are separate axes threaded in alongside.

Functions

headers_resolvable

Pre-flight (for --validate-config / startup): every header template must resolve, without retaining the bytes. Same diagnostics as resolve_headers.

resolve_headers

Resolve every {{secret:NAME}} / {{secret-file:PATH}} ref in each header VALUE against the process environment + filesystem, returning materialized (name, value) headers ready for the wire. Header names pass through as-is. An unresolved ref is an Err that names the ref but never any resolved value: diagnostics travel to logs and operators, so a credential must never ride along in one.