@testsmith/api-spector 0.7.3 → 0.7.5

package/out/main/chunks/{broker-client-VwFF9sbp.js → broker-client-D0wYVblb.js}

@@ -3,7 +3,7 @@ const promises = require("node:fs/promises");
 const path = require("node:path");
 const crypto = require("node:crypto");
 const undici = require("undici");
-const requestExec = require("./request-exec-CcLHtkwG.js");
+const requestExec = require("./request-exec-DHxjokyP.js");
 const Ajv = require("ajv");
 const jsYaml = require("js-yaml");
 require("node:http");

package/out/main/chunks/{flow-engine-DuO1iX7c.js → flow-engine-BVzjz4lJ.js}

@@ -197,6 +197,13 @@ function parseBody(body) {
     return body;
   }
 }
+const MAX_CAPTURED_BODY = 2e4;
+function clipBody(body) {
+  if (body == null) return { clipped: false };
+  if (body.length <= MAX_CAPTURED_BODY) return { text: body, clipped: false };
+  return { text: body.slice(0, MAX_CAPTURED_BODY) + `
+… [truncated ${body.length - MAX_CAPTURED_BODY} more chars]`, clipped: true };
+}
 async function runFlow(flow, deps, options = {}) {
   const startedAt = Date.now();
   const maxSteps = deps.maxSteps ?? 1e4;
@@ -396,6 +403,8 @@ async function runFlow(flow, deps, options = {}) {
           ctx.response = r.response;
           const ok = r.status === "passed" || r.status === "skipped";
           const reqStatus = r.status === "skipped" ? "done" : r.status === "pending" ? "running" : r.status;
+          const reqBody = clipBody(r.sentRequest?.body);
+          const resBody = clipBody(r.response?.body);
           record(block, reqStatus, {
             iteration,
             httpStatus: r.httpStatus,
@@ -403,7 +412,16 @@ async function runFlow(flow, deps, options = {}) {
             error: r.error,
             testResults: r.testResults,
             method: r.method,
-            resolvedUrl: r.resolvedUrl
+            resolvedUrl: r.resolvedUrl,
+            http: {
+              reqHeaders: r.sentRequest?.headers,
+              reqBody: reqBody.text,
+              statusText: r.response?.statusText,
+              resHeaders: r.response?.headers,
+              resBody: resBody.text,
+              bodySize: r.response?.bodySize,
+              truncated: reqBody.clipped || resBody.clipped
+            }
           });
           return [ok ? "success" : "fail"];
         }

package/out/main/chunks/{request-exec-CcLHtkwG.js → request-exec-DHxjokyP.js}

@@ -114,7 +114,7 @@ function setSecretsConfig(settings) {
 function getSecretsConfig() {
   return current;
 }
-function env$3(...names) {
+function env$4(...names) {
   for (const n of names) {
     const v = process.env[n];
     if (v !== void 0 && v !== "") return v;
@@ -128,22 +128,22 @@ function readFileTrim(path2) {
     return void 0;
   }
 }
-function resolveConn$3() {
+function resolveConn$4() {
   const cfg = getSecretsConfig()?.vault ?? {};
-  const address = env$3("VAULT_ADDR", "API_SPECTOR_VAULT_ADDR") ?? cfg.address;
+  const address = env$4("VAULT_ADDR", "API_SPECTOR_VAULT_ADDR") ?? cfg.address;
   if (!address) {
     throw new Error("Vault is not configured: set VAULT_ADDR (or settings.secrets.vault.address)");
   }
-  const token = env$3("VAULT_TOKEN", "API_SPECTOR_VAULT_TOKEN") ?? readFileTrim(path.join(os.homedir(), ".vault-token"));
-  const roleId = env$3("VAULT_ROLE_ID", "API_SPECTOR_VAULT_ROLE_ID") ?? cfg.roleId;
-  const secretId = env$3("VAULT_SECRET_ID", "API_SPECTOR_VAULT_SECRET_ID");
-  const jwt = env$3("VAULT_JWT", "API_SPECTOR_VAULT_JWT") ?? (env$3("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH") ? readFileTrim(env$3("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH")) : void 0);
-  const jwtRole = env$3("VAULT_JWT_ROLE", "API_SPECTOR_VAULT_JWT_ROLE") ?? cfg.jwtRole;
-  const explicit = env$3("VAULT_AUTH_METHOD", "API_SPECTOR_VAULT_AUTH_METHOD") ?? cfg.authMethod;
+  const token = env$4("VAULT_TOKEN", "API_SPECTOR_VAULT_TOKEN") ?? readFileTrim(path.join(os.homedir(), ".vault-token"));
+  const roleId = env$4("VAULT_ROLE_ID", "API_SPECTOR_VAULT_ROLE_ID") ?? cfg.roleId;
+  const secretId = env$4("VAULT_SECRET_ID", "API_SPECTOR_VAULT_SECRET_ID");
+  const jwt = env$4("VAULT_JWT", "API_SPECTOR_VAULT_JWT") ?? (env$4("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH") ? readFileTrim(env$4("VAULT_JWT_PATH", "API_SPECTOR_VAULT_JWT_PATH")) : void 0);
+  const jwtRole = env$4("VAULT_JWT_ROLE", "API_SPECTOR_VAULT_JWT_ROLE") ?? cfg.jwtRole;
+  const explicit = env$4("VAULT_AUTH_METHOD", "API_SPECTOR_VAULT_AUTH_METHOD") ?? cfg.authMethod;
   const authMethod = explicit ?? (token ? "token" : roleId ? "approle" : jwt ? "jwt" : "token");
   return {
     address: address.replace(/\/+$/, ""),
-    namespace: env$3("VAULT_NAMESPACE", "API_SPECTOR_VAULT_NAMESPACE") ?? cfg.namespace,
+    namespace: env$4("VAULT_NAMESPACE", "API_SPECTOR_VAULT_NAMESPACE") ?? cfg.namespace,
     authMethod,
     token,
     roleId,
@@ -151,13 +151,13 @@ function resolveConn$3() {
     jwt,
     jwtRole,
     loginMount: cfg.loginMount,
-    kvVersion: env$3("VAULT_KV_VERSION", "API_SPECTOR_VAULT_KV_VERSION") ?? cfg.kvVersion ?? "auto",
-    skipVerify: (env$3("VAULT_SKIP_VERIFY", "API_SPECTOR_VAULT_SKIP_VERIFY") ?? "").toLowerCase() === "true" || cfg.skipVerify === true,
-    caPath: env$3("VAULT_CACERT", "API_SPECTOR_VAULT_CACERT")
+    kvVersion: env$4("VAULT_KV_VERSION", "API_SPECTOR_VAULT_KV_VERSION") ?? cfg.kvVersion ?? "auto",
+    skipVerify: (env$4("VAULT_SKIP_VERIFY", "API_SPECTOR_VAULT_SKIP_VERIFY") ?? "").toLowerCase() === "true" || cfg.skipVerify === true,
+    caPath: env$4("VAULT_CACERT", "API_SPECTOR_VAULT_CACERT")
   };
 }
-let cachedToken$1 = null;
-const secretCache$1 = /* @__PURE__ */ new Map();
+let cachedToken$2 = null;
+const secretCache$2 = /* @__PURE__ */ new Map();
 let _dispatcher;
 let _dispatcherKey = "";
 async function dispatcherFor(conn) {
@@ -200,7 +200,7 @@ async function clientToken(conn) {
     return conn.token;
   }
   const now = Date.now();
-  if (cachedToken$1 && cachedToken$1.expiresAt > now + 5e3) return cachedToken$1.value;
+  if (cachedToken$2 && cachedToken$2.expiresAt > now + 5e3) return cachedToken$2.value;
   let mount;
   let body;
   if (conn.authMethod === "approle") {
@@ -224,7 +224,7 @@ async function clientToken(conn) {
   const token = json?.auth?.client_token;
   if (!token) throw new Error("Vault login did not return a client token");
   const ttl = Number(json?.auth?.lease_duration ?? 0);
-  cachedToken$1 = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  cachedToken$2 = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
   return token;
 }
 async function readSecret(refBody) {
@@ -237,11 +237,11 @@ async function readSecret(refBody) {
   if (!path2 || !key) {
     throw new Error(`Vault reference must be 'vault:<path>#<key>' (got 'vault:${refBody}')`);
   }
-  const conn = resolveConn$3();
+  const conn = resolveConn$4();
   const cacheKey = `${conn.address}|${conn.namespace ?? ""}|${path2}`;
   const now = Date.now();
   let bag;
-  const hit = secretCache$1.get(cacheKey);
+  const hit = secretCache$2.get(cacheKey);
   if (hit && hit.expiresAt > now) {
     bag = hit.bag;
   } else {
@@ -250,7 +250,7 @@ async function readSecret(refBody) {
     bag = isV2 ? json?.data?.data : json?.data;
     const lease = Number(json?.lease_duration ?? 0);
     if (bag) {
-      secretCache$1.set(cacheKey, { bag, expiresAt: lease > 0 ? now + lease * 1e3 : now + 5 * 6e4 });
+      secretCache$2.set(cacheKey, { bag, expiresAt: lease > 0 ? now + lease * 1e3 : now + 5 * 6e4 });
     }
   }
   if (!bag || !(key in bag)) {
@@ -293,23 +293,23 @@ function signSigV4(input) {
     Authorization: `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
   };
 }
-function env$2(...names) {
+function env$3(...names) {
   for (const n of names) {
     const v = process.env[n];
     if (v !== void 0 && v !== "") return v;
   }
   return void 0;
 }
-function resolveConn$2() {
+function resolveConn$3() {
   const cfg = getSecretsConfig()?.aws ?? {};
-  const region = env$2("AWS_REGION", "AWS_DEFAULT_REGION", "API_SPECTOR_AWS_REGION") ?? cfg.region;
-  const accessKeyId = env$2("AWS_ACCESS_KEY_ID");
-  const secretAccessKey = env$2("AWS_SECRET_ACCESS_KEY");
+  const region = env$3("AWS_REGION", "AWS_DEFAULT_REGION", "API_SPECTOR_AWS_REGION") ?? cfg.region;
+  const accessKeyId = env$3("AWS_ACCESS_KEY_ID");
+  const secretAccessKey = env$3("AWS_SECRET_ACCESS_KEY");
   if (!region) throw new Error("AWS Secrets Manager: no region (set AWS_REGION or settings.secrets.aws.region)");
   if (!accessKeyId || !secretAccessKey) {
     throw new Error("AWS Secrets Manager: no credentials (set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY)");
   }
-  return { region, accessKeyId, secretAccessKey, sessionToken: env$2("AWS_SESSION_TOKEN") };
+  return { region, accessKeyId, secretAccessKey, sessionToken: env$3("AWS_SESSION_TOKEN") };
 }
 const cache = /* @__PURE__ */ new Map();
 async function getSecretString(conn, secretId) {
@@ -346,12 +346,12 @@ async function getSecretString(conn, secretId) {
   cache.set(cacheKey, { raw, expiresAt: now + 5 * 6e4 });
   return raw;
 }
-async function resolve$2(refBody) {
+async function resolve$3(refBody) {
   const hash = refBody.lastIndexOf("#");
   const secretId = hash < 0 ? refBody : refBody.slice(0, hash);
   const key = hash < 0 ? null : refBody.slice(hash + 1);
   if (!secretId) throw new Error(`AWS reference must be 'aws:<secretId>[#<key>]' (got 'aws:${refBody}')`);
-  const raw = await getSecretString(resolveConn$2(), secretId);
+  const raw = await getSecretString(resolveConn$3(), secretId);
   if (key === null) return raw;
   let parsed;
   try {
@@ -364,30 +364,30 @@ async function resolve$2(refBody) {
 }
 const awsSecretsProvider = {
   scheme: "aws",
-  resolve: (refBody) => resolve$2(refBody)
+  resolve: (refBody) => resolve$3(refBody)
 };
-function env$1(...names) {
+function env$2(...names) {
   for (const n of names) {
     const v = process.env[n];
     if (v !== void 0 && v !== "") return v;
   }
   return void 0;
 }
-function resolveConn$1() {
+function resolveConn$2() {
   const cfg = getSecretsConfig()?.azure ?? {};
-  const tenantId = env$1("AZURE_TENANT_ID", "API_SPECTOR_AZURE_TENANT_ID") ?? cfg.tenantId;
-  const clientId = env$1("AZURE_CLIENT_ID", "API_SPECTOR_AZURE_CLIENT_ID") ?? cfg.clientId;
-  const clientSecret = env$1("AZURE_CLIENT_SECRET", "API_SPECTOR_AZURE_CLIENT_SECRET");
+  const tenantId = env$2("AZURE_TENANT_ID", "API_SPECTOR_AZURE_TENANT_ID") ?? cfg.tenantId;
+  const clientId = env$2("AZURE_CLIENT_ID", "API_SPECTOR_AZURE_CLIENT_ID") ?? cfg.clientId;
+  const clientSecret = env$2("AZURE_CLIENT_SECRET", "API_SPECTOR_AZURE_CLIENT_SECRET");
   if (!tenantId || !clientId || !clientSecret) {
     throw new Error("Azure Key Vault: set AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET");
   }
   return { tenantId, clientId, clientSecret, defaultVault: cfg.vault };
 }
-let cachedToken = null;
-const secretCache = /* @__PURE__ */ new Map();
-async function accessToken(conn) {
+let cachedToken$1 = null;
+const secretCache$1 = /* @__PURE__ */ new Map();
+async function accessToken$1(conn) {
   const now = Date.now();
-  if (cachedToken && cachedToken.expiresAt > now + 3e4) return cachedToken.value;
+  if (cachedToken$1 && cachedToken$1.expiresAt > now + 3e4) return cachedToken$1.value;
   const form = new URLSearchParams({
     grant_type: "client_credentials",
     client_id: conn.clientId,
@@ -407,7 +407,7 @@ async function accessToken(conn) {
   const token = json?.access_token;
   if (!token) throw new Error("Azure AD did not return an access token");
   const ttl = Number(json?.expires_in ?? 0);
-  cachedToken = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  cachedToken$1 = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
   return token;
 }
 function secretUrl(refBody, defaultVault) {
@@ -430,13 +430,13 @@ function secretUrl(refBody, defaultVault) {
   const path2 = version ? `secrets/${name}/${version}` : `secrets/${name}`;
   return `${base}/${path2}?api-version=7.4`;
 }
-async function resolve$1(refBody) {
-  const conn = resolveConn$1();
+async function resolve$2(refBody) {
+  const conn = resolveConn$2();
   const url = secretUrl(refBody, conn.defaultVault);
   const now = Date.now();
-  const hit = secretCache.get(url);
+  const hit = secretCache$1.get(url);
   if (hit && hit.expiresAt > now) return hit.value;
-  const res = await fetch(url, { headers: { authorization: `Bearer ${await accessToken(conn)}` } });
+  const res = await fetch(url, { headers: { authorization: `Bearer ${await accessToken$1(conn)}` } });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
     throw new Error(`Azure Key Vault ${res.status} for '${refBody}': ${text.slice(0, 300)}`);
@@ -444,24 +444,24 @@ async function resolve$1(refBody) {
   const json = await res.json();
   const value = json?.value;
   if (value === void 0) throw new Error(`Azure Key Vault secret '${refBody}' has no value`);
-  secretCache.set(url, { value, expiresAt: now + 5 * 6e4 });
+  secretCache$1.set(url, { value, expiresAt: now + 5 * 6e4 });
   return value;
 }
 const azureKeyVaultProvider = {
   scheme: "azure",
-  resolve: (refBody) => resolve$1(refBody)
+  resolve: (refBody) => resolve$2(refBody)
 };
-function env(...names) {
+function env$1(...names) {
   for (const n of names) {
     const v = process.env[n];
     if (v !== void 0 && v !== "") return v;
   }
   return void 0;
 }
-function resolveConn() {
+function resolveConn$1() {
   const cfg = getSecretsConfig()?.onePassword ?? {};
-  const host = env("OP_CONNECT_HOST", "API_SPECTOR_OP_CONNECT_HOST") ?? cfg.connectHost;
-  const token = env("OP_CONNECT_TOKEN", "API_SPECTOR_OP_CONNECT_TOKEN");
+  const host = env$1("OP_CONNECT_HOST", "API_SPECTOR_OP_CONNECT_HOST") ?? cfg.connectHost;
+  const token = env$1("OP_CONNECT_TOKEN", "API_SPECTOR_OP_CONNECT_TOKEN");
   if (!host || !token) {
     throw new Error("1Password: set OP_CONNECT_HOST and OP_CONNECT_TOKEN (1Password Connect)");
   }
@@ -500,7 +500,7 @@ async function itemId(conn, vid, item) {
   idCache.set(cacheKey, id);
   return id;
 }
-async function resolve(refBody) {
+async function resolve$1(refBody) {
   const parts = refBody.replace(/^\/\//, "").replace(/^\/+/, "").split("/").filter(Boolean);
   if (parts.length < 3) {
     throw new Error(`1Password reference must be 'op://<vault>/<item>/<field>' (got 'op:${refBody}')`);
@@ -508,7 +508,7 @@ async function resolve(refBody) {
   const [vault, item, ...rest] = parts;
   const sectionLabel = rest.length >= 2 ? rest[0] : null;
   const fieldLabel = rest[rest.length - 1];
-  const conn = resolveConn();
+  const conn = resolveConn$1();
   const vid = await vaultId(conn, vault);
   const iid = await itemId(conn, vid, item);
   const cacheKey = `${vid}/${iid}`;
@@ -535,12 +535,158 @@ async function resolve(refBody) {
 }
 const onePasswordProvider = {
   scheme: "op",
+  resolve: (refBody) => resolve$1(refBody)
+};
+const TOKEN_URI = "https://oauth2.googleapis.com/token";
+const SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const API_BASE = "https://secretmanager.googleapis.com/v1";
+function env(...names) {
+  for (const n of names) {
+    const v = process.env[n];
+    if (v !== void 0 && v !== "") return v;
+  }
+  return void 0;
+}
+function loadServiceAccount() {
+  const inline = env("GCP_SERVICE_ACCOUNT_KEY", "GOOGLE_APPLICATION_CREDENTIALS_JSON");
+  const path2 = env("GOOGLE_APPLICATION_CREDENTIALS");
+  let raw;
+  if (inline) {
+    raw = inline;
+  } else if (path2) {
+    try {
+      raw = fs.readFileSync(path2, "utf8");
+    } catch (e) {
+      throw new Error(`GCP Secret Manager: cannot read GOOGLE_APPLICATION_CREDENTIALS '${path2}': ${e.message}`);
+    }
+  }
+  if (!raw) return void 0;
+  let key;
+  try {
+    key = JSON.parse(raw);
+  } catch {
+    throw new Error("GCP Secret Manager: the service-account key is not valid JSON");
+  }
+  if (!key.client_email || !key.private_key) {
+    throw new Error("GCP Secret Manager: the service-account key is missing client_email or private_key");
+  }
+  return key;
+}
+function resolveConn() {
+  const cfg = getSecretsConfig()?.gcp ?? {};
+  const accessToken2 = env("GCP_ACCESS_TOKEN", "GOOGLE_OAUTH_ACCESS_TOKEN");
+  const serviceAccount = loadServiceAccount();
+  if (!accessToken2 && !serviceAccount) {
+    throw new Error(
+      "GCP Secret Manager: no credentials (set GCP_ACCESS_TOKEN, or GOOGLE_APPLICATION_CREDENTIALS / GOOGLE_APPLICATION_CREDENTIALS_JSON to a service-account key)"
+    );
+  }
+  const defaultProject = env("GCP_PROJECT", "GOOGLE_CLOUD_PROJECT", "CLOUDSDK_CORE_PROJECT") ?? cfg.project ?? serviceAccount?.project_id;
+  return { accessToken: accessToken2, serviceAccount, defaultProject };
+}
+let cachedToken = null;
+const secretCache = /* @__PURE__ */ new Map();
+const b64url = (b) => (Buffer.isBuffer(b) ? b : Buffer.from(b)).toString("base64url");
+async function mintAccessToken(sa) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const aud = sa.token_uri || TOKEN_URI;
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const claims = b64url(JSON.stringify({ iss: sa.client_email, scope: SCOPE, aud, iat, exp: iat + 3600 }));
+  const signingInput = `${header}.${claims}`;
+  const signature = b64url(crypto.createSign("RSA-SHA256").update(signingInput).sign(sa.private_key));
+  const assertion = `${signingInput}.${signature}`;
+  const body = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    assertion
+  });
+  const res = await fetch(aud, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`GCP token exchange ${res.status}: ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const token = json?.access_token;
+  if (!token) throw new Error("GCP token endpoint did not return an access_token");
+  return { token, ttl: Number(json?.expires_in ?? 3600) };
+}
+async function accessToken(conn) {
+  if (conn.accessToken) return conn.accessToken;
+  const now = Date.now();
+  if (cachedToken && cachedToken.expiresAt > now + 3e4) return cachedToken.value;
+  const { token, ttl } = await mintAccessToken(conn.serviceAccount);
+  cachedToken = { value: token, expiresAt: ttl > 0 ? now + ttl * 1e3 : now + 5 * 6e4 };
+  return token;
+}
+function accessUrl(refPath, defaultProject) {
+  if (refPath.startsWith("projects/")) {
+    const hasVersion = /\/versions\/[^/]+$/.test(refPath);
+    const full = hasVersion ? refPath : `${refPath.replace(/\/+$/, "")}/versions/latest`;
+    return `${API_BASE}/${full}:access`;
+  }
+  const parts = refPath.replace(/^\/+/, "").split("/").filter(Boolean);
+  let project;
+  let secret;
+  let version = "latest";
+  if (parts.length >= 2) {
+    [project, secret, version = "latest"] = parts;
+  } else if (parts.length === 1) {
+    project = defaultProject;
+    secret = parts[0];
+  } else {
+    throw new Error(`GCP reference must be 'gcp:<project>/<secret>[/<version>]' (got 'gcp:${refPath}')`);
+  }
+  if (!project) {
+    throw new Error(
+      `GCP reference 'gcp:${refPath}' has no project and no default is set (set GCP_PROJECT or settings.secrets.gcp.project, or write 'gcp:<project>/<secret>')`
+    );
+  }
+  return `${API_BASE}/projects/${project}/secrets/${secret}/versions/${version}:access`;
+}
+async function resolve(refBody) {
+  const hash = refBody.lastIndexOf("#");
+  const refPath = hash < 0 ? refBody : refBody.slice(0, hash);
+  const key = hash < 0 ? null : refBody.slice(hash + 1);
+  const conn = resolveConn();
+  const url = accessUrl(refPath, conn.defaultProject);
+  const now = Date.now();
+  const hit = secretCache.get(url);
+  const rawPayload = hit && hit.expiresAt > now ? hit.value : await fetchPayload(conn, url, refBody);
+  if (key === null) return rawPayload;
+  let parsed;
+  try {
+    parsed = JSON.parse(rawPayload);
+  } catch {
+    throw new Error(`GCP secret '${refPath}' is not JSON, so key '${key}' cannot be read (drop the '#${key}')`);
+  }
+  if (!(key in parsed)) throw new Error(`GCP secret '${refPath}' has no key '${key}'`);
+  return String(parsed[key]);
+}
+async function fetchPayload(conn, url, refBody) {
+  const res = await fetch(url, { headers: { authorization: `Bearer ${await accessToken(conn)}` } });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`GCP Secret Manager ${res.status} for '${refBody}': ${text.slice(0, 300)}`);
+  }
+  const json = await res.json();
+  const data = json?.payload?.data;
+  if (data === void 0) throw new Error(`GCP secret '${refBody}' returned no payload data`);
+  const value = Buffer.from(data, "base64").toString("utf8");
+  secretCache.set(url, { value, expiresAt: Date.now() + 5 * 6e4 });
+  return value;
+}
+const gcpSecretManagerProvider = {
+  scheme: "gcp",
   resolve: (refBody) => resolve(refBody)
 };
 registerSecretProvider(vaultProvider);
 registerSecretProvider(awsSecretsProvider);
 registerSecretProvider(azureKeyVaultProvider);
 registerSecretProvider(onePasswordProvider);
+registerSecretProvider(gcpSecretManagerProvider);
 const MASTER_KEY_ENV = "API_SPECTOR_MASTER_KEY";
 let secretStore = {};
 let secretStorePath = null;
@@ -741,7 +887,14 @@ async function buildEnvVars(environment) {
   return vars;
 }
 function mergeVars(envVars, collectionVars, globals2, localVars = {}, dynamicVars = {}) {
-  return { ...dynamicVars, ...globals2, ...collectionVars, ...envVars, ...localVars };
+  const out = {};
+  for (const src of [dynamicVars, globals2, collectionVars, envVars, localVars]) {
+    for (const [k, v] of Object.entries(src ?? {})) {
+      if (v == null) continue;
+      out[k] = v;
+    }
+  }
+  return out;
 }
 function xmlFindAll(node, tag, nth) {
   const results = [];

package/out/main/contract.js

@@ -2,7 +2,7 @@
 "use strict";
 const promises = require("node:fs/promises");
 const path = require("node:path");
-const brokerClient = require("./chunks/broker-client-VwFF9sbp.js");
+const brokerClient = require("./chunks/broker-client-D0wYVblb.js");
 const escape = require("./chunks/escape-DDVAlOvZ.js");
 const crypto = require("node:crypto");
 const undici = require("undici");
@@ -11,7 +11,7 @@ const cliCommon = require("./chunks/cli-common-GnihVSjU.js");
 const node_child_process = require("node:child_process");
 const jsYaml = require("js-yaml");
 const environments = require("./chunks/environments-iM3SUM-4.js");
-require("./chunks/request-exec-CcLHtkwG.js");
+require("./chunks/request-exec-DHxjokyP.js");
 require("fs/promises");
 require("tls");
 require("./chunks/handle-BY_jaVBT.js");

package/out/main/flow.js

@@ -2,10 +2,10 @@
 "use strict";
 const promises = require("node:fs/promises");
 const path = require("node:path");
-const requestExec = require("./chunks/request-exec-CcLHtkwG.js");
+const requestExec = require("./chunks/request-exec-DHxjokyP.js");
 const requestCollection = require("./chunks/request-collection-KGPuvN7o.js");
 const environments = require("./chunks/environments-iM3SUM-4.js");
-const flowEngine = require("./chunks/flow-engine-DuO1iX7c.js");
+const flowEngine = require("./chunks/flow-engine-BVzjz4lJ.js");
 const cliCommon = require("./chunks/cli-common-GnihVSjU.js");
 require("undici");
 require("fs/promises");
@@ -265,7 +265,7 @@ async function main() {
   const envName = args.environment ?? args.env;
   const env = environments.selectEnvironment(workspace, environments$1, envName);
   const verbose = Boolean(args.verbose);
-  const version = `v${"0.7.3"}`;
+  const version = `v${"0.7.5"}`;
   console.log("");
   console.log(cliCommon.color("  API Flow Runner" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Flow:        ${flow.name}`, cliCommon.C.gray));

package/out/main/index.js

@@ -29,13 +29,13 @@ const promises = require("node:fs/promises");
 const crypto = require("node:crypto");
 const JSZip = require("jszip");
 const dataFiles = require("./chunks/data-files-BYqhsoPe.js");
-const requestExec = require("./chunks/request-exec-CcLHtkwG.js");
+const requestExec = require("./chunks/request-exec-DHxjokyP.js");
 const ipcValidate = require("./chunks/ipc-validate-sqUFqRmE.js");
 const uuid = require("uuid");
 const jsYaml = require("js-yaml");
 const undici = require("undici");
 const requestCollection = require("./chunks/request-collection-KGPuvN7o.js");
-const flowEngine = require("./chunks/flow-engine-DuO1iX7c.js");
+const flowEngine = require("./chunks/flow-engine-BVzjz4lJ.js");
 const mockServer = require("./chunks/mock-server-C4kTFkod.js");
 const http = require("node:http");
 const WebSocket = require("ws");
@@ -44,7 +44,7 @@ const grpc = require("@grpc/grpc-js");
 const protoLoader = require("@grpc/proto-loader");
 const soapHandler = require("./chunks/soap-handler-CkoLJHoI.js");
 const escape = require("./chunks/escape-DDVAlOvZ.js");
-const brokerClient = require("./chunks/broker-client-VwFF9sbp.js");
+const brokerClient = require("./chunks/broker-client-D0wYVblb.js");
 const simpleGit = require("simple-git");
 const recorder = require("./chunks/recorder-BkO8G_mB.js");
 const electronUpdater = require("electron-updater");
@@ -5877,7 +5877,19 @@ async function buildFlowDefinition(input) {
       requests[`${ref.collectionId}:${ref.requestId}`] = cloned;
     }
   }
-  return { flow: input.flow, flows: input.flows ?? [], requests, envVars, collectionVars, globals: input.globals ?? {} };
+  return {
+    flow: input.flow,
+    flows: input.flows ?? [],
+    requests,
+    envVars,
+    collectionVars,
+    globals: input.globals ?? {},
+    // Record which environment's values were baked (for the cloud UI). null when
+    // no environment was active at push time — a common cause of "works locally,
+    // fails in the cloud" when requests rely on environment variables.
+    environmentName: input.environment?.name ?? null,
+    envVarCount: Object.keys(envVars).length
+  };
 }
 const CLOUD_TOKEN_REF = "cloud:token";
 const CLOUD_ENDPOINT = brokerClient.resolveCloudEndpoint();
@@ -6098,7 +6110,7 @@ function isNewer(a, b) {
   return a2 > b2;
 }
 async function checkForUpdate() {
-  const current = "0.7.3";
+  const current = "0.7.5";
   try {
     const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(4e3) });
     if (!res.ok) return null;

package/out/main/lib.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const mockServer = require("./chunks/mock-server-C4kTFkod.js");
-const requestExec = require("./chunks/request-exec-CcLHtkwG.js");
-const flowEngine = require("./chunks/flow-engine-DuO1iX7c.js");
+const requestExec = require("./chunks/request-exec-DHxjokyP.js");
+const flowEngine = require("./chunks/flow-engine-BVzjz4lJ.js");
 require("node:http");
 require("node:crypto");
 require("node:vm");
@@ -56,7 +56,13 @@ async function runFlowHeadless(input) {
         testResults: result.testResults,
         name: result.name,
         method: result.method,
-        resolvedUrl: result.resolvedUrl
+        resolvedUrl: result.resolvedUrl,
+        sentRequest: {
+          method: result.method,
+          url: result.resolvedUrl,
+          headers: result.sentRequest?.headers ?? {},
+          body: result.sentRequest?.body
+        }
       };
     },
     runScript: async (code, i) => {

package/out/main/runner.js

@@ -2,7 +2,7 @@
 "use strict";
 const promises = require("node:fs/promises");
 const path = require("node:path");
-const requestExec = require("./chunks/request-exec-CcLHtkwG.js");
+const requestExec = require("./chunks/request-exec-DHxjokyP.js");
 const escape = require("./chunks/escape-DDVAlOvZ.js");
 const requestCollection = require("./chunks/request-collection-KGPuvN7o.js");
 const environments = require("./chunks/environments-iM3SUM-4.js");
@@ -495,7 +495,7 @@ async function main() {
   } else if (!envName && workspace.settings?.defaultEnvironment && !env) {
     console.warn(cliCommon.color(`Warning: default environment "${workspace.settings.defaultEnvironment}" not found. Running without environment.`, cliCommon.C.yellow));
   }
-  const version = `v${"0.7.3"}`;
+  const version = `v${"0.7.5"}`;
   console.log("");
   console.log(cliCommon.color("  API Test Runner" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Workspace:   ${wsPath}`, cliCommon.C.gray));

package/out/renderer/assets/{GraphQLEditor-jCEopi26.js → GraphQLEditor-CWJMEqny.js}

@@ -1,5 +1,5 @@
 import { l as linter, E as EditorView, L as LanguageSupport, e as LRLanguage, s as styleTags, i as indentNodeProp, f as delimitedIndent, m as foldNodeProp, n as foldInside, S as StateField, p as LRParser, q as StateEffect, u as tags, r as reactExports, j as jsxRuntimeExports, c as ReactCodeMirror, o as oneDark, b as json } from "./codemirror-F6m3Hm1M.js";
-import { u as useT, a as useStore, b as useActiveEnvironment } from "./index-aKbixApk.js";
+import { u as useT, a as useStore, b as useActiveEnvironment } from "./index-CUCX3V01.js";
 import "./ajv-2MAg6kGF.js";
 function devAssert(condition, message) {
   const booleanCondition = Boolean(condition);

package/out/renderer/assets/{SoapEditor-PGdehf_W.js → SoapEditor-C01AJQ38.js}

@@ -1,5 +1,5 @@
 import { r as reactExports, j as jsxRuntimeExports, c as ReactCodeMirror, o as oneDark, x as xml } from "./codemirror-F6m3Hm1M.js";
-import { u as useT, c as btnPrimaryCls, d as commentKeymap } from "./index-aKbixApk.js";
+import { u as useT, c as btnPrimaryCls, d as commentKeymap } from "./index-CUCX3V01.js";
 import "./ajv-2MAg6kGF.js";
 const SOAP_11_CONTENT_TYPE = "text/xml; charset=utf-8";
 const SOAP_12_CONTENT_TYPE = "application/soap+xml; charset=utf-8";