@testsmith/api-spector-agent 0.7.4 → 0.7.5

package/dist/index.cjs

@@ -7472,9 +7472,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve4, reject) => {
+          return new Promise((resolve5, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve4(data);
+              return err ? reject(err) : resolve5(data);
             });
           });
         }
@@ -7512,9 +7512,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve4, reject) => {
+          return new Promise((resolve5, reject) => {
             this.destroy(err, (err2, data) => {
-              return err2 ? reject(err2) : resolve4(data);
+              return err2 ? reject(err2) : resolve5(data);
             });
           });
         }
@@ -10991,8 +10991,8 @@ var require_promise = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve4, reject) => {
-        res = resolve4;
+      const promise = new Promise((resolve5, reject) => {
+        res = resolve5;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -12293,12 +12293,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve4, reject) => {
+      const waitForDrain = () => new Promise((resolve5, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve4;
+          callback = resolve5;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -13143,12 +13143,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve4, reject) => {
+      const waitForDrain = () => new Promise((resolve5, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve4;
+          callback = resolve5;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -13459,16 +13459,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve4) => {
+        return new Promise((resolve5) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve4;
+            this[kClosedResolve] = resolve5;
           } else {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve4) => {
+        return new Promise((resolve5) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i68 = 0; i68 < requests.length; i68++) {
             const request = requests[i68];
@@ -13479,7 +13479,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve4(null);
+            resolve5(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -13879,8 +13879,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve4) => {
-            this[kClosedResolve] = resolve4;
+          return new Promise((resolve5) => {
+            this[kClosedResolve] = resolve5;
           });
         }
       }
@@ -14972,10 +14972,10 @@ var require_socks5_proxy_agent = __commonJS({
         const proxyHost = this[kProxyUrl].hostname;
         const proxyPort = parseInt(this[kProxyUrl].port) || 1080;
         debug("creating SOCKS5 connection to", proxyHost, proxyPort);
-        const socket = await new Promise((resolve4, reject) => {
+        const socket = await new Promise((resolve5, reject) => {
           const onConnect = () => {
             socket2.removeListener("error", onError);
-            resolve4(socket2);
+            resolve5(socket2);
           };
           const onError = (err) => {
             socket2.removeListener("connect", onConnect);
@@ -14994,14 +14994,14 @@ var require_socks5_proxy_agent = __commonJS({
           socket.destroy();
         });
         await socks5Client.handshake();
-        await new Promise((resolve4, reject) => {
+        await new Promise((resolve5, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 authentication timeout"));
           }, 5e3);
           const onAuthenticated = () => {
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve4();
+            resolve5();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -15010,14 +15010,14 @@ var require_socks5_proxy_agent = __commonJS({
           };
           if (socks5Client.state === "authenticated") {
             clearTimeout(timeout);
-            resolve4();
+            resolve5();
           } else {
             socks5Client.once("authenticated", onAuthenticated);
             socks5Client.once("error", onError);
           }
         });
         await socks5Client.connect(targetHost, targetPort);
-        await new Promise((resolve4, reject) => {
+        await new Promise((resolve5, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 connection timeout"));
           }, 5e3);
@@ -15025,7 +15025,7 @@ var require_socks5_proxy_agent = __commonJS({
             debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve4();
+            resolve5();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -15066,8 +15066,8 @@ var require_socks5_proxy_agent = __commonJS({
                       servername: targetHost,
                       ...connectOpts.tls || {}
                     });
-                    await new Promise((resolve4, reject) => {
-                      finalSocket.once("secureConnect", resolve4);
+                    await new Promise((resolve5, reject) => {
+                      finalSocket.once("secureConnect", resolve5);
                       finalSocket.once("error", reject);
                     });
                   }
@@ -16092,7 +16092,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit || this[kBytesRead] > limit) {
             this.destroy(new AbortError());
           }
@@ -16106,11 +16106,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError());
               } else {
-                resolve4(null);
+                resolve5(null);
               }
             });
           } else {
-            this.on("close", resolve4);
+            this.on("close", resolve5);
           }
           this.on("error", noop).on("data", () => {
             if (this[kBytesRead] > limit) {
@@ -16138,7 +16138,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve4, reject) => {
+      return new Promise((resolve5, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -16153,7 +16153,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve: resolve4,
+              resolve: resolve5,
               reject,
               length: 0,
               body: []
@@ -16227,18 +16227,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve: resolve4, stream, length } = consume2;
+      const { type, body, resolve: resolve5, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve4(chunksDecode(body, length, encoding));
+          resolve5(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve4(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve5(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve4(chunksConcat(body, length).buffer);
+          resolve5(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve4(new Blob(body, { type: stream[kContentType] }));
+          resolve5(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve4(chunksConcat(body, length));
+          resolve5(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -16428,9 +16428,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve4(data);
+            return err ? reject(err) : resolve5(data);
           });
         });
       }
@@ -16642,9 +16642,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve4(data);
+            return err ? reject(err) : resolve5(data);
           });
         });
       }
@@ -16932,9 +16932,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve4(data);
+            return err ? reject(err) : resolve5(data);
           });
         });
       }
@@ -17027,9 +17027,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve4(data);
+            return err ? reject(err) : resolve5(data);
           });
         });
       }
@@ -18297,7 +18297,7 @@ var require_snapshot_recorder = __commonJS({
   "node_modules/undici/lib/mock/snapshot-recorder.js"(exports2, module2) {
     "use strict";
     var { writeFile: writeFile2, readFile: readFile4, mkdir } = require("node:fs/promises");
-    var { dirname, resolve: resolve4 } = require("node:path");
+    var { dirname, resolve: resolve5 } = require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -18498,7 +18498,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile4(resolve4(path), "utf8");
+          const data = await readFile4(resolve5(path), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -18527,7 +18527,7 @@ var require_snapshot_recorder = __commonJS({
         if (!path) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve4(path);
+        const resolvedPath = resolve5(path);
         await mkdir(dirname(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
@@ -25365,7 +25365,7 @@ var require_fetch = __commonJS({
         const agent = fetchParams.controller.dispatcher;
         const path = url.pathname + url.search;
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
-        return new Promise((resolve4, reject) => agent.dispatch(
+        return new Promise((resolve5, reject) => agent.dispatch(
           {
             path: hasTrailingQuestionMark ? `${path}?` : path,
             origin: url.origin,
@@ -25445,7 +25445,7 @@ var require_fetch = __commonJS({
                 }
               }
               const onError = this.onError.bind(this);
-              resolve4({
+              resolve5({
                 status,
                 statusText,
                 headersList,
@@ -25498,7 +25498,7 @@ var require_fetch = __commonJS({
                   headersList.append(headerName, String(value), true);
                 }
               }
-              resolve4({
+              resolve5({
                 status,
                 statusText: STATUS_CODES2[status],
                 headersList,
@@ -25514,7 +25514,7 @@ var require_fetch = __commonJS({
               for (let i68 = 0; i68 < rawHeaders.length; i68 += 2) {
                 headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i68]), rawHeaders[i68 + 1].toString("latin1"), true);
               }
-              resolve4({
+              resolve5({
                 status,
                 statusText: STATUS_CODES2[status],
                 headersList,
@@ -40543,20 +40543,20 @@ var require_compile = __commonJS({
     var util_1 = require_util7();
     var validate_1 = require_validate();
     var SchemaEnv = class {
-      constructor(env5) {
+      constructor(env6) {
         var _a3;
         this.refs = {};
         this.dynamicAnchors = {};
         let schema;
-        if (typeof env5.schema == "object")
-          schema = env5.schema;
-        this.schema = env5.schema;
-        this.schemaId = env5.schemaId;
-        this.root = env5.root || this;
-        this.baseId = (_a3 = env5.baseId) !== null && _a3 !== void 0 ? _a3 : (0, resolve_1.normalizeId)(schema === null || schema === void 0 ? void 0 : schema[env5.schemaId || "$id"]);
-        this.schemaPath = env5.schemaPath;
-        this.localRefs = env5.localRefs;
-        this.meta = env5.meta;
+        if (typeof env6.schema == "object")
+          schema = env6.schema;
+        this.schema = env6.schema;
+        this.schemaId = env6.schemaId;
+        this.root = env6.root || this;
+        this.baseId = (_a3 = env6.baseId) !== null && _a3 !== void 0 ? _a3 : (0, resolve_1.normalizeId)(schema === null || schema === void 0 ? void 0 : schema[env6.schemaId || "$id"]);
+        this.schemaPath = env6.schemaPath;
+        this.localRefs = env6.localRefs;
+        this.meta = env6.meta;
         this.$async = schema === null || schema === void 0 ? void 0 : schema.$async;
         this.refs = {};
       }
@@ -40654,7 +40654,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve4.call(this, root, ref);
+      let _sch = resolve5.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -40681,7 +40681,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s210) {
       return s1.schema === s210.schema && s1.root === s210.root && s1.baseId === s210.baseId;
     }
-    function resolve4(root, ref) {
+    function resolve5(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -40740,15 +40740,15 @@ var require_compile = __commonJS({
           baseId = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schId);
         }
       }
-      let env5;
+      let env6;
       if (typeof schema != "boolean" && schema.$ref && !(0, util_1.schemaHasRulesButRef)(schema, this.RULES)) {
         const $ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schema.$ref);
-        env5 = resolveSchema.call(this, root, $ref);
+        env6 = resolveSchema.call(this, root, $ref);
       }
       const { schemaId } = this.opts;
-      env5 = env5 || new SchemaEnv({ schema, schemaId, root, baseId });
-      if (env5.schema !== env5.root.schema)
-        return env5;
+      env6 = env6 || new SchemaEnv({ schema, schemaId, root, baseId });
+      if (env6.schema !== env6.root.schema)
+        return env6;
       return void 0;
     }
   }
@@ -41256,7 +41256,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve4(baseURI, relativeURI, options) {
+    function resolve5(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -41483,7 +41483,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve4,
+      resolve: resolve5,
       resolveComponent,
       equal,
       serialize,
@@ -42149,8 +42149,8 @@ var require_ref = __commonJS({
       schemaType: "string",
       code(cxt) {
         const { gen, schema: $ref, it: it4 } = cxt;
-        const { baseId, schemaEnv: env5, validateName, opts, self: self2 } = it4;
-        const { root } = env5;
+        const { baseId, schemaEnv: env6, validateName, opts, self: self2 } = it4;
+        const { root } = env6;
         if (($ref === "#" || $ref === "#/") && baseId === root.baseId)
           return callRootRef();
         const schOrEnv = compile_1.resolveRef.call(self2, root, baseId, $ref);
@@ -42160,8 +42160,8 @@ var require_ref = __commonJS({
           return callValidate(schOrEnv);
         return inlineRefSchema(schOrEnv);
         function callRootRef() {
-          if (env5 === root)
-            return callRef(cxt, validateName, env5, env5.$async);
+          if (env6 === root)
+            return callRef(cxt, validateName, env6, env6.$async);
           const rootName = gen.scopeValue("root", { ref: root });
           return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root, root.$async);
         }
@@ -42191,14 +42191,14 @@ var require_ref = __commonJS({
     exports2.getValidate = getValidate;
     function callRef(cxt, v60, sch, $async) {
       const { gen, it: it4 } = cxt;
-      const { allErrors, schemaEnv: env5, opts } = it4;
+      const { allErrors, schemaEnv: env6, opts } = it4;
       const passCxt = opts.passContext ? names_1.default.this : codegen_1.nil;
       if ($async)
         callAsyncRef();
       else
         callSyncRef();
       function callAsyncRef() {
-        if (!env5.$async)
+        if (!env6.$async)
           throw new Error("async schema referenced by sync schema");
         const valid = gen.let("valid");
         gen.try(() => {
@@ -44805,11 +44805,161 @@ var onePasswordProvider = {
   resolve: (refBody) => resolve3(refBody)
 };
 
+// src/main/secrets/providers/gcp.ts
+var import_node_fs2 = require("node:fs");
+var import_node_crypto2 = require("node:crypto");
+var TOKEN_URI = "https://oauth2.googleapis.com/token";
+var SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+var API_BASE = "https://secretmanager.googleapis.com/v1";
+function env5(...names) {
+  for (const n63 of names) {
+    const v60 = process.env[n63];
+    if (v60 !== void 0 && v60 !== "") return v60;
+  }
+  return void 0;
+}
+function loadServiceAccount() {
+  const inline = env5("GCP_SERVICE_ACCOUNT_KEY", "GOOGLE_APPLICATION_CREDENTIALS_JSON");
+  const path = env5("GOOGLE_APPLICATION_CREDENTIALS");
+  let raw;
+  if (inline) {
+    raw = inline;
+  } else if (path) {
+    try {
+      raw = (0, import_node_fs2.readFileSync)(path, "utf8");
+    } catch (e20) {
+      throw new Error(`GCP Secret Manager: cannot read GOOGLE_APPLICATION_CREDENTIALS '${path}': ${e20.message}`);
+    }
+  }
+  if (!raw) return void 0;
+  let key;
+  try {
+    key = JSON.parse(raw);
+  } catch {
+    throw new Error("GCP Secret Manager: the service-account key is not valid JSON");
+  }
+  if (!key.client_email || !key.private_key) {
+    throw new Error("GCP Secret Manager: the service-account key is missing client_email or private_key");
+  }
+  return key;
+}
+function resolveConn5() {
+  const cfg = getSecretsConfig()?.gcp ?? {};
+  const accessToken3 = env5("GCP_ACCESS_TOKEN", "GOOGLE_OAUTH_ACCESS_TOKEN");
+  const serviceAccount = loadServiceAccount();
+  if (!accessToken3 && !serviceAccount) {
+    throw new Error(
+      "GCP Secret Manager: no credentials (set GCP_ACCESS_TOKEN, or GOOGLE_APPLICATION_CREDENTIALS / GOOGLE_APPLICATION_CREDENTIALS_JSON to a service-account key)"
+    );
+  }
+  const defaultProject = env5("GCP_PROJECT", "GOOGLE_CLOUD_PROJECT", "CLOUDSDK_CORE_PROJECT") ?? cfg.project ?? serviceAccount?.project_id;
+  return { accessToken: accessToken3, serviceAccount, defaultProject };
+}
+var cachedToken3 = null;
+var secretCache3 = /* @__PURE__ */ new Map();
+var b64url = (b69) => (Buffer.isBuffer(b69) ? b69 : Buffer.from(b69)).toString("base64url");
+async function mintAccessToken(sa11) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const aud = sa11.token_uri || TOKEN_URI;
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const claims = b64url(JSON.stringify({ iss: sa11.client_email, scope: SCOPE, aud, iat, exp: iat + 3600 }));
+  const signingInput = `${header}.${claims}`;
+  const signature = b64url((0, import_node_crypto2.createSign)("RSA-SHA256").update(signingInput).sign(sa11.private_key));
+  const assertion = `${signingInput}.${signature}`;
+  const body = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    assertion
+  });
+  const res = await fetch(aud, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`GCP token exchange ${res.status}: ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const token = json?.access_token;
+  if (!token) throw new Error("GCP token endpoint did not return an access_token");
+  return { token, ttl: Number(json?.expires_in ?? 3600) };
+}
+async function accessToken2(conn) {
+  if (conn.accessToken) return conn.accessToken;
+  const now = Date.now();
+  if (cachedToken3 && cachedToken3.expiresAt > now + 3e4) return cachedToken3.value;
+  const { token, ttl } = await mintAccessToken(conn.serviceAccount);
+  cachedToken3 = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  return token;
+}
+function accessUrl(refPath, defaultProject) {
+  if (refPath.startsWith("projects/")) {
+    const hasVersion = /\/versions\/[^/]+$/.test(refPath);
+    const full = hasVersion ? refPath : `${refPath.replace(/\/+$/, "")}/versions/latest`;
+    return `${API_BASE}/${full}:access`;
+  }
+  const parts = refPath.replace(/^\/+/, "").split("/").filter(Boolean);
+  let project;
+  let secret;
+  let version = "latest";
+  if (parts.length >= 2) {
+    [project, secret, version = "latest"] = parts;
+  } else if (parts.length === 1) {
+    project = defaultProject;
+    secret = parts[0];
+  } else {
+    throw new Error(`GCP reference must be 'gcp:<project>/<secret>[/<version>]' (got 'gcp:${refPath}')`);
+  }
+  if (!project) {
+    throw new Error(
+      `GCP reference 'gcp:${refPath}' has no project and no default is set (set GCP_PROJECT or settings.secrets.gcp.project, or write 'gcp:<project>/<secret>')`
+    );
+  }
+  return `${API_BASE}/projects/${project}/secrets/${secret}/versions/${version}:access`;
+}
+async function resolve4(refBody) {
+  const hash = refBody.lastIndexOf("#");
+  const refPath = hash < 0 ? refBody : refBody.slice(0, hash);
+  const key = hash < 0 ? null : refBody.slice(hash + 1);
+  const conn = resolveConn5();
+  const url = accessUrl(refPath, conn.defaultProject);
+  const now = Date.now();
+  const hit = secretCache3.get(url);
+  const rawPayload = hit && hit.expiresAt > now ? hit.value : await fetchPayload(conn, url, refBody);
+  if (key === null) return rawPayload;
+  let parsed;
+  try {
+    parsed = JSON.parse(rawPayload);
+  } catch {
+    throw new Error(`GCP secret '${refPath}' is not JSON, so key '${key}' cannot be read (drop the '#${key}')`);
+  }
+  if (!(key in parsed)) throw new Error(`GCP secret '${refPath}' has no key '${key}'`);
+  return String(parsed[key]);
+}
+async function fetchPayload(conn, url, refBody) {
+  const res = await fetch(url, { headers: { authorization: `Bearer ${await accessToken2(conn)}` } });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`GCP Secret Manager ${res.status} for '${refBody}': ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const data = json?.payload?.data;
+  if (data === void 0) throw new Error(`GCP secret '${refBody}' returned no payload data`);
+  const value = Buffer.from(data, "base64").toString("utf8");
+  secretCache3.set(url, { value, expiresAt: Date.now() + 5 * 6e4 });
+  return value;
+}
+var gcpSecretManagerProvider = {
+  scheme: "gcp",
+  resolve: (refBody) => resolve4(refBody)
+};
+
 // src/main/secrets/index.ts
 registerSecretProvider(vaultProvider);
 registerSecretProvider(awsSecretsProvider);
 registerSecretProvider(azureKeyVaultProvider);
 registerSecretProvider(onePasswordProvider);
+registerSecretProvider(gcpSecretManagerProvider);
 
 // src/main/ipc/secret-handler.ts
 var secretStore = {};
@@ -44916,7 +45066,14 @@ function buildUrl(baseUrl, params, vars) {
   return url + sep + qs;
 }
 function mergeVars(envVars, collectionVars, globals2, localVars = {}, dynamicVars = {}) {
-  return { ...dynamicVars, ...globals2, ...collectionVars, ...envVars, ...localVars };
+  const out = {};
+  for (const src of [dynamicVars, globals2, collectionVars, envVars, localVars]) {
+    for (const [k68, v60] of Object.entries(src ?? {})) {
+      if (v60 == null) continue;
+      out[k68] = v60;
+    }
+  }
+  return out;
 }
 
 // src/main/script-runner.ts
@@ -44969,10 +45126,10 @@ var Hooks = class {
    * @param {Object<string, any>} env The environment variables of the hook passed to all callbacks registered.
    * @public
    */
-  run(name, env5) {
+  run(name, env6) {
     this[name] = this[name] || [];
     this[name].forEach(function(callback) {
-      callback.call(env5 && env5.context ? env5.context : env5, env5);
+      callback.call(env6 && env6.context ? env6.context : env6, env6);
     });
   }
 };
@@ -45225,12 +45382,12 @@ var Jsep = class _Jsep {
    */
   runHook(name, node) {
     if (_Jsep.hooks[name]) {
-      const env5 = {
+      const env6 = {
         context: this,
         node
       };
-      _Jsep.hooks.run(name, env5);
-      return env5.node;
+      _Jsep.hooks.run(name, env6);
+      return env6.node;
     }
     return node;
   }
@@ -45241,14 +45398,14 @@ var Jsep = class _Jsep {
    */
   searchHook(name) {
     if (_Jsep.hooks[name]) {
-      const env5 = {
+      const env6 = {
         context: this
       };
       _Jsep.hooks[name].find(function(callback) {
-        callback.call(env5.context, env5);
-        return env5.node;
+        callback.call(env6.context, env6);
+        return env6.node;
       });
-      return env5.node;
+      return env6.node;
     }
   }
   /**
@@ -45846,10 +46003,10 @@ var CONDITIONAL_EXP = "ConditionalExpression";
 var ternary = {
   name: "ternary",
   init(jsep2) {
-    jsep2.hooks.add("after-expression", function gobbleTernary(env5) {
-      if (env5.node && this.code === jsep2.QUMARK_CODE) {
+    jsep2.hooks.add("after-expression", function gobbleTernary(env6) {
+      if (env6.node && this.code === jsep2.QUMARK_CODE) {
         this.index++;
-        const test = env5.node;
+        const test = env6.node;
         const consequent = this.gobbleExpression();
         if (!consequent) {
           this.throwError("Expected expression");
@@ -45861,7 +46018,7 @@ var ternary = {
           if (!alternate) {
             this.throwError("Expected expression");
           }
-          env5.node = {
+          env6.node = {
             type: CONDITIONAL_EXP,
             test,
             consequent,
@@ -45872,9 +46029,9 @@ var ternary = {
             while (newTest.right.operator && jsep2.binary_ops[newTest.right.operator] <= 0.9) {
               newTest = newTest.right;
             }
-            env5.node.test = newTest.right;
-            newTest.right = env5.node;
-            env5.node = test;
+            env6.node.test = newTest.right;
+            newTest.right = env6.node;
+            env6.node = test;
           }
         } else {
           this.throwError("Expected :");
@@ -45889,7 +46046,7 @@ var BSLASH_CODE = 92;
 var index = {
   name: "regex",
   init(jsep2) {
-    jsep2.hooks.add("gobble-token", function gobbleRegexLiteral(env5) {
+    jsep2.hooks.add("gobble-token", function gobbleRegexLiteral(env6) {
       if (this.code === FSLASH_CODE) {
         const patternIndex = ++this.index;
         let inCharSet = false;
@@ -45911,13 +46068,13 @@ var index = {
             } catch (e20) {
               this.throwError(e20.message);
             }
-            env5.node = {
+            env6.node = {
               type: jsep2.LITERAL,
               value,
               raw: this.expr.slice(patternIndex - 1, this.index)
             };
-            env5.node = this.gobbleTokenProperty(env5.node);
-            return env5.node;
+            env6.node = this.gobbleTokenProperty(env6.node);
+            return env6.node;
           }
           if (this.code === jsep2.OBRACK_CODE) {
             inCharSet = true;
@@ -45941,41 +46098,41 @@ var plugin = {
   init(jsep2) {
     const updateNodeTypes = [jsep2.IDENTIFIER, jsep2.MEMBER_EXP];
     plugin.assignmentOperators.forEach((op) => jsep2.addBinaryOp(op, plugin.assignmentPrecedence, true));
-    jsep2.hooks.add("gobble-token", function gobbleUpdatePrefix(env5) {
+    jsep2.hooks.add("gobble-token", function gobbleUpdatePrefix(env6) {
       const code = this.code;
       if (plugin.updateOperators.some((c70) => c70 === code && c70 === this.expr.charCodeAt(this.index + 1))) {
         this.index += 2;
-        env5.node = {
+        env6.node = {
           type: "UpdateExpression",
           operator: code === PLUS_CODE ? "++" : "--",
           argument: this.gobbleTokenProperty(this.gobbleIdentifier()),
           prefix: true
         };
-        if (!env5.node.argument || !updateNodeTypes.includes(env5.node.argument.type)) {
-          this.throwError(`Unexpected ${env5.node.operator}`);
+        if (!env6.node.argument || !updateNodeTypes.includes(env6.node.argument.type)) {
+          this.throwError(`Unexpected ${env6.node.operator}`);
         }
       }
     });
-    jsep2.hooks.add("after-token", function gobbleUpdatePostfix(env5) {
-      if (env5.node) {
+    jsep2.hooks.add("after-token", function gobbleUpdatePostfix(env6) {
+      if (env6.node) {
         const code = this.code;
         if (plugin.updateOperators.some((c70) => c70 === code && c70 === this.expr.charCodeAt(this.index + 1))) {
-          if (!updateNodeTypes.includes(env5.node.type)) {
-            this.throwError(`Unexpected ${env5.node.operator}`);
+          if (!updateNodeTypes.includes(env6.node.type)) {
+            this.throwError(`Unexpected ${env6.node.operator}`);
           }
           this.index += 2;
-          env5.node = {
+          env6.node = {
             type: "UpdateExpression",
             operator: code === PLUS_CODE ? "++" : "--",
-            argument: env5.node,
+            argument: env6.node,
             prefix: false
           };
         }
       }
     });
-    jsep2.hooks.add("after-expression", function gobbleAssignment(env5) {
-      if (env5.node) {
-        updateBinariesToAssignments(env5.node);
+    jsep2.hooks.add("after-expression", function gobbleAssignment(env6) {
+      if (env6.node) {
+        updateBinariesToAssignments(env6.node);
       }
     });
     function updateBinariesToAssignments(node) {
@@ -47004,12 +47161,12 @@ function patchGlobals(patch) {
 }
 
 // src/main/auth-builder.ts
-var import_node_crypto3 = __toESM(require("node:crypto"));
+var import_node_crypto4 = __toESM(require("node:crypto"));
 var import_node_http = require("node:http");
 var import_promises2 = require("node:fs/promises");
 
 // src/main/ntlm.ts
-var import_node_crypto2 = __toESM(require("node:crypto"));
+var import_node_crypto3 = __toESM(require("node:crypto"));
 var SIGNATURE = Buffer.from("NTLMSSP\0", "latin1");
 var F_UNICODE = 1;
 var F_OEM = 2;
@@ -47075,7 +47232,7 @@ function md4(msg) {
   return out;
 }
 var utf16le = (s71) => Buffer.from(s71, "utf16le");
-var hmacMd5 = (key, data) => import_node_crypto2.default.createHmac("md5", key).update(data).digest();
+var hmacMd5 = (key, data) => import_node_crypto3.default.createHmac("md5", key).update(data).digest();
 function ntowfv2(user, domain, password) {
   const ntHash = md4(utf16le(password));
   return hmacMd5(ntHash, utf16le(user.toUpperCase() + domain));
@@ -47133,7 +47290,7 @@ function computeNtlmV2Response(opts) {
 function createType3Message(opts) {
   const domain = opts.domain ?? "";
   const workstation = opts.workstation ?? "";
-  const clientChallenge = opts.clientChallenge ?? import_node_crypto2.default.randomBytes(8);
+  const clientChallenge = opts.clientChallenge ?? import_node_crypto3.default.randomBytes(8);
   const timestamp = filetime(opts.timestamp ?? Date.now());
   const { ntResponse, lmResponse } = computeNtlmV2Response({
     user: opts.user,
@@ -47227,7 +47384,7 @@ function parseDigestChallenge(wwwAuth) {
   };
 }
 function md5(s71) {
-  return import_node_crypto3.default.createHash("md5").update(s71).digest("hex");
+  return import_node_crypto4.default.createHash("md5").update(s71).digest("hex");
 }
 function buildDigestAuthHeader(challenge, username, password, method, uri) {
   const { realm, nonce, qop, algorithm, opaque } = challenge;
@@ -47239,7 +47396,7 @@ function buildDigestAuthHeader(challenge, username, password, method, uri) {
   let cnonce;
   if (qop === "auth" || qop === "auth-int") {
     nc = "00000001";
-    cnonce = import_node_crypto3.default.randomBytes(8).toString("hex");
+    cnonce = import_node_crypto4.default.randomBytes(8).toString("hex");
     response = md5(`${ha1}:${nonce}:${nc}:${cnonce}:${qop}:${ha22}`);
   } else {
     response = md5(`${ha1}:${nonce}:${ha22}`);
@@ -47400,12 +47557,12 @@ async function fetchOAuth2Token(auth, vars) {
     throw new Error(`OAuth 2.0 token request failed (${resp.status}): ${body}`);
   }
   const json = await resp.json();
-  const accessToken2 = String(json["access_token"] ?? "");
-  if (!accessToken2) throw new Error("OAuth 2.0: token response missing access_token.");
+  const accessToken3 = String(json["access_token"] ?? "");
+  if (!accessToken3) throw new Error("OAuth 2.0: token response missing access_token.");
   const expiresIn = Number(json["expires_in"] ?? 3600);
   const expiresAt = Date.now() + expiresIn * 1e3;
   return {
-    accessToken: accessToken2,
+    accessToken: accessToken3,
     expiresAt,
     refreshToken: json["refresh_token"] ? String(json["refresh_token"]) : void 0
   };
@@ -48130,7 +48287,7 @@ var APP_URL = (process.env.APP_URL || "").replace(/\/+$/, "");
 var AGENT_TOKEN = process.env.AGENT_TOKEN || "";
 var RUNTIME_TOKEN = process.env.RUNTIME_TOKEN || "";
 var POLL_MS = Number(process.env.POLL_INTERVAL_MS || 5e3);
-var VERSION = true ? "0.7.4" : "";
+var VERSION = true ? "0.7.5" : "";
 var authHeaders = AGENT_TOKEN ? { Authorization: `Bearer ${AGENT_TOKEN}` } : RUNTIME_TOKEN ? { "X-Runtime-Token": RUNTIME_TOKEN } : {};
 async function postResult(m75, fields) {
   await fetch(`${APP_URL}/api/monitor-runtime/${m75.id}/result`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testsmith/api-spector-agent",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "API Spector private runner: monitor internal/local APIs the cloud cannot reach, with no inbound connections.",
   "license": "MIT",
   "homepage": "https://api-spector.dev",