The configuration resolver should substitute only secret names explicitly allowed for the request. Implement traversal over the supplied synthetic values without reading the machine's environment or credentials.
Build the implementation in TypeScript under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has config (any JSON tree), secrets mapping names to synthetic string values, and allowed names. An object containing exactly one key $secret must hold a string name that is both allowed and present in secrets; replace that object with the corresponding value. Other objects and lists are traversed recursively. Reject denied/missing references or nonstring secret values. Never read environment variables, files or network services; only supplied synthetic data is used.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.