feat: support nested ref+ expressions

[aditmeno]

Summary

Resolves #794 — adds support for nested ref+ expressions like ref+echo://ref+envsubst://$VAR/path, where inner expressions resolve first (inside-out) before the outer expression uses the resolved value.

This enables dynamic parameterization of provider URIs — e.g., resolving a Vault path from an environment variable before fetching the secret.

Approach

A pre-processing step (resolveInnerRefs) runs before InString and InValue:

1. Scan the input for all ref+/secretref+ prefix positions
2. If 0 or 1 found → return immediately (zero overhead for the common non-nested case)
3. Identify truly nested refs by checking that no separator character (space, newline, tab, comma, quote) exists between adjacent ref+ prefixes
4. Resolve the innermost (rightmost) nested ref via Lookup, substitute into the string
5. Recurse (depth-limited to 10) until no nesting remains
6. Return to the normal InString/InValue flow

Example trace

Input:  ref+echo://ref+envsubst://$TEST_VAR/path   (TEST_VAR=resolved)
Step 1: resolve inner → ref+envsubst://$TEST_VAR/path → "resolved/path"
Step 2: string becomes  ref+echo://resolved/path
Step 3: normal expansion → "resolved/path"

What does NOT change

• DefaultRefRegexp — unchanged
• Lookup signature — still func(string) (interface{}, error)
• InValue type preservation — full-match detection intact
• InMap — unchanged (delegates to InValue)
• vals.go — no changes at all
• shouldExpand / Only filter — respected in nested resolution

Files changed

File	Change
pkg/expansion/expand_match.go	Add resolveInnerRefs, integrate into InString and InValue
pkg/expansion/expand_match_test.go	Add nested expression unit tests + depth limit test
vals_test.go	Add TestGetNested and TestEvalNested integration tests

Test plan

• All existing unit tests pass (backward compatibility)
• All existing integration tests pass (TestGet, TestExec, TestEvalNodes, etc.)
• New unit tests: basic nesting, triple nesting, mixed nested/independent, surrounding text
• New unit tests: TestResolveInnerRefs (direct resolver tests), TestResolveInnerRefsDepthLimit
• New integration tests: TestGetNested (echo, triple echo, envsubst-in-echo), TestEvalNested (map path via Eval())

[Copilot]

Pull request overview

This PR adds support for nested ref+ expressions, allowing inner expressions to be resolved before outer ones. For example, ref+echo://ref+envsubst://$VAR/path will first resolve the inner ref+envsubst expression, then use the result in the outer ref+echo expression. This enables dynamic parameterization of provider URIs, addressing issue #794.

Changes:

• Added resolveInnerRefs function to detect and resolve nested expressions inside-out before normal expansion
• Integrated nested resolution into InString and InValue methods with zero-overhead fast path for non-nested cases
• Added comprehensive unit and integration tests covering basic nesting, triple nesting, and practical use cases

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
pkg/expansion/expand_match.go	Core implementation: added resolveInnerRefs function with depth-limited recursion and integration into existing expansion methods
pkg/expansion/expand_match_test.go	Added unit tests for nested expressions including depth limit protection and direct resolver testing
vals_test.go	Added integration tests TestGetNested and TestEvalNested covering practical nested expression scenarios

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[aditmeno]

@yxxhero PR ready for review

[yxxhero]

@aditmeno please rebase the code.

[aditmeno]

@aditmeno please rebase the code.

Rebased