merge main

.github/workflows/update-roadmap-released.yml

@@ -1,8 +1,9 @@
 name: Update Roadmap Released
 
 on:
-    pull_request:
+    push:
-        types: [closed]
+        branches:
+            - main
     workflow_dispatch:
     schedule:
         - cron: "0 */6 * * *"

CHANGELOG.md

@@ -15,6 +15,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fixed issue with GitHub app token tracking and refreshing. [#583](https://github.com/sourcebot-dev/sourcebot/pull/583)
 - Fixed "The account is already associated with another user" errors with GitLab oauth provider. [#584](https://github.com/sourcebot-dev/sourcebot/pull/584)
 - Fixed error when viewing a generic git connection in `/settings/connections`. [#588](https://github.com/sourcebot-dev/sourcebot/pull/588)
+- Fixed issue with an unbounded `Promise.allSettled(...)` when retrieving details from the GitHub API about a large number of repositories (or orgs or users). [#591](https://github.com/sourcebot-dev/sourcebot/pull/591)
+- Fixed resource exhaustion (EAGAIN errors) when syncing generic-git-host connections with thousands of repositories. [#593](https://github.com/sourcebot-dev/sourcebot/pull/593)
+
+## Removed
+- Removed built-in secret manager. [#592](https://github.com/sourcebot-dev/sourcebot/pull/592)
 
 ## Removed
 - Removed built-in secret manager. [#592](https://github.com/sourcebot-dev/sourcebot/pull/592)

docs/snippets/schemas/v3/app.schema.mdx

@@ -33,13 +33,26 @@
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -82,13 +95,26 @@
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }

docs/snippets/schemas/v3/azuredevops.schema.mdx

@@ -17,13 +17,26 @@
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

docs/snippets/schemas/v3/bitbucket.schema.mdx

@@ -21,13 +21,26 @@
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

docs/snippets/schemas/v3/connection.schema.mdx

@@ -21,13 +21,26 @@
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -216,13 +229,26 @@
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -405,13 +431,26 @@
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -659,13 +698,26 @@
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -814,13 +866,26 @@
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },

docs/snippets/schemas/v3/gitea.schema.mdx

@@ -17,13 +17,26 @@
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

docs/snippets/schemas/v3/github.schema.mdx

@@ -17,13 +17,26 @@
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

docs/snippets/schemas/v3/gitlab.schema.mdx

@@ -17,13 +17,26 @@
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

docs/snippets/schemas/v3/shared.schema.mdx

@@ -11,13 +11,26 @@
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },
@@ -78,13 +91,26 @@
                   "properties": {
                     "env": {
                       "type": "string",
-                      "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                      "description": "The name of the environment variable that contains the token."
                     }
                   },
                   "required": [
                     "env"
                   ],
                   "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "googleCloudSecret": {
+                      "type": "string",
+                      "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                    }
+                  },
+                  "required": [
+                    "googleCloudSecret"
+                  ],
+                  "additionalProperties": false
                 }
               ]
             }
@@ -109,13 +135,26 @@
                   "properties": {
                     "env": {
                       "type": "string",
-                      "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                      "description": "The name of the environment variable that contains the token."
                     }
                   },
                   "required": [
                     "env"
                   ],
                   "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "googleCloudSecret": {
+                      "type": "string",
+                      "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                    }
+                  },
+                  "required": [
+                    "googleCloudSecret"
+                  ],
+                  "additionalProperties": false
                 }
               ]
             }

packages/backend/package.json

@@ -51,6 +51,7 @@
         "ioredis": "^5.4.2",
         "lowdb": "^7.0.1",
         "micromatch": "^4.0.8",
+        "p-limit": "^7.2.0",
         "posthog-node": "^4.2.1",
         "prom-client": "^15.1.3",
         "simple-git": "^3.27.0",

packages/backend/src/github.ts

@@ -4,6 +4,7 @@ import { createLogger } from "@sourcebot/logger";
 import { GithubConnectionConfig } from "@sourcebot/schemas/v3/github.type";
 import { hasEntitlement } from "@sourcebot/shared";
 import micromatch from "micromatch";
+import pLimit from "p-limit";
 import { processPromiseResults, throwIfAnyFailed } from "./connectionUtils.js";
 import { GithubAppManager } from "./ee/githubAppManager.js";
 import { env } from "./env.js";
@@ -11,6 +12,10 @@ import { fetchWithRetry, measure } from "./utils.js";
 import { getTokenFromConfig } from "@sourcebot/crypto";
 
 export const GITHUB_CLOUD_HOSTNAME = "github.com";
+
+// Limit concurrent GitHub requests to avoid hitting rate limits and overwhelming installations.
+const MAX_CONCURRENT_GITHUB_QUERIES = 5;
+const githubQueryLimit = pLimit(MAX_CONCURRENT_GITHUB_QUERIES);
 const logger = createLogger('github');
 
 export type OctokitRepository = {
@@ -194,7 +199,7 @@ export const getReposForAuthenticatedUser = async (visibility: 'all' | 'private'
 }
 
 const getReposOwnedByUsers = async (users: string[], octokit: Octokit, signal: AbortSignal, url?: string) => {
-    const results = await Promise.allSettled(users.map(async (user) => {
+    const results = await Promise.allSettled(users.map((user) => githubQueryLimit(async () => {
         try {
             logger.debug(`Fetching repository info for user ${user}...`);
 
@@ -243,7 +248,7 @@ const getReposOwnedByUsers = async (users: string[], octokit: Octokit, signal: A
             }
             throw error;
         }
-    }));
+    })));
 
     throwIfAnyFailed(results);
     const { validItems: repos, warnings } = processPromiseResults<OctokitRepository>(results);
@@ -255,7 +260,7 @@ const getReposOwnedByUsers = async (users: string[], octokit: Octokit, signal: A
 }
 
 const getReposForOrgs = async (orgs: string[], octokit: Octokit, signal: AbortSignal, url?: string) => {
-    const results = await Promise.allSettled(orgs.map(async (org) => {
+    const results = await Promise.allSettled(orgs.map((org) => githubQueryLimit(async () => {
         try {
             logger.debug(`Fetching repository info for org ${org}...`);
 
@@ -291,7 +296,7 @@ const getReposForOrgs = async (orgs: string[], octokit: Octokit, signal: AbortSi
             }
             throw error;
         }
-    }));
+    })));
 
     throwIfAnyFailed(results);
     const { validItems: repos, warnings } = processPromiseResults<OctokitRepository>(results);
@@ -303,7 +308,7 @@ const getReposForOrgs = async (orgs: string[], octokit: Octokit, signal: AbortSi
 }
 
 const getRepos = async (repoList: string[], octokit: Octokit, signal: AbortSignal, url?: string) => {
-    const results = await Promise.allSettled(repoList.map(async (repo) => {
+    const results = await Promise.allSettled(repoList.map((repo) => githubQueryLimit(async () => {
         try {
             const [owner, repoName] = repo.split('/');
             logger.debug(`Fetching repository info for ${repo}...`);
@@ -341,7 +346,7 @@ const getRepos = async (repoList: string[], octokit: Octokit, signal: AbortSigna
             }
             throw error;
         }
-    }));
+    })));
 
     throwIfAnyFailed(results);
     const { validItems: repos, warnings } = processPromiseResults<OctokitRepository>(results);

packages/backend/src/repoCompileUtils.ts

@@ -20,11 +20,20 @@ import assert from 'assert';
 import GitUrlParse from 'git-url-parse';
 import { RepoMetadata } from '@sourcebot/shared';
 import { SINGLE_TENANT_ORG_ID } from './constants.js';
+<<<<<<< HEAD
+=======
+import pLimit from 'p-limit';
+>>>>>>> main
 
 export type RepoData = WithRequired<Prisma.RepoCreateInput, 'connections'>;
 
 const logger = createLogger('repo-compile-utils');
 
+// Limit concurrent git operations to prevent resource exhaustion (EAGAIN errors)
+// when processing thousands of repositories simultaneously
+const MAX_CONCURRENT_GIT_OPERATIONS = 100;
+const gitOperationLimit = pLimit(MAX_CONCURRENT_GIT_OPERATIONS);
+
 type CompileResult = {
     repoData: RepoData[],
     warnings: string[],
@@ -472,7 +481,11 @@ export const compileGenericGitHostConfig_file = async (
     const repos: RepoData[] = [];
     const warnings: string[] = [];
 
+<<<<<<< HEAD
     await Promise.all(repoPaths.map(async (repoPath) => {
+=======
+    await Promise.all(repoPaths.map((repoPath) => gitOperationLimit(async () => {
+>>>>>>> main
         const isGitRepo = await isPathAValidGitRepoRoot({
             path: repoPath,
         });
@@ -526,7 +539,7 @@ export const compileGenericGitHostConfig_file = async (
         }
 
         repos.push(repo);
-    }));
+    })));
 
     return {
         repoData: repos,

packages/crypto/package.json

@@ -8,6 +8,7 @@
     "postinstall": "yarn build"
   },
   "dependencies": {
+    "@google-cloud/secret-manager": "^6.1.1",
     "@sourcebot/db": "*",
     "@sourcebot/schemas": "*",
     "dotenv": "^16.4.5"

packages/crypto/src/tokenUtils.ts

@@ -1,6 +1,7 @@
+import { SecretManagerServiceClient } from "@google-cloud/secret-manager";
 import { Token } from "@sourcebot/schemas/v3/shared.type";
 
-export const getTokenFromConfig = async (token: Token) => {
+export const getTokenFromConfig = async (token: Token): Promise<string> => {
     if ('env' in token) {
         const envToken = process.env[token.env];
         if (!envToken) {
@@ -8,6 +9,21 @@ export const getTokenFromConfig = async (token: Token) => {
         }
 
         return envToken;
+    } else if ('googleCloudSecret' in token) {
+        try {
+            const client = new SecretManagerServiceClient();
+            const [response] = await client.accessSecretVersion({
+                name: token.googleCloudSecret,
+            });
+
+            if (!response.payload?.data) {
+                throw new Error(`Secret ${token.googleCloudSecret} not found.`);
+            }
+
+            return response.payload.data.toString();
+        } catch (error) {
+            throw new Error(`Failed to access Google Cloud secret ${token.googleCloudSecret}: ${error instanceof Error ? error.message : String(error)}`);
+        }
     } else {
         throw new Error('Invalid token configuration');
     }

packages/schemas/src/v3/app.schema.ts

@@ -32,13 +32,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -81,13 +94,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }

packages/schemas/src/v3/app.type.ts

@@ -18,10 +18,17 @@ export interface GitHubAppConfig {
   /**
    * The private key of the GitHub App.
    */
-  privateKey: {
+  privateKey:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
 }

packages/schemas/src/v3/azuredevops.schema.ts

@@ -16,13 +16,26 @@ const schema = {
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

packages/schemas/src/v3/azuredevops.type.ts

@@ -8,11 +8,18 @@ export interface AzureDevOpsConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token: {
+  token:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the Azure DevOps host. For Azure DevOps Cloud, use https://dev.azure.com. For Azure DevOps Server, use your server URL.

packages/schemas/src/v3/bitbucket.schema.ts

@@ -20,13 +20,26 @@ const schema = {
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

packages/schemas/src/v3/bitbucket.type.ts

@@ -12,11 +12,18 @@ export interface BitbucketConnectionConfig {
   /**
    * An authentication token.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Bitbucket URL

packages/schemas/src/v3/connection.schema.ts

@@ -20,13 +20,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -215,13 +228,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -404,13 +430,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -658,13 +697,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -813,13 +865,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },

packages/schemas/src/v3/connection.type.ts

@@ -17,11 +17,18 @@ export interface GithubConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the GitHub host. Defaults to https://github.com
@@ -99,11 +106,18 @@ export interface GitlabConnectionConfig {
   /**
    * An authentication token.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the GitLab host. Defaults to https://gitlab.com
@@ -163,11 +177,18 @@ export interface GiteaConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the Gitea host. Defaults to https://gitea.com
@@ -242,11 +263,18 @@ export interface BitbucketConnectionConfig {
   /**
    * An authentication token.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Bitbucket URL
@@ -292,11 +320,18 @@ export interface AzureDevOpsConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token: {
+  token:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the Azure DevOps host. For Azure DevOps Cloud, use https://dev.azure.com. For Azure DevOps Server, use your server URL.

packages/schemas/src/v3/gitea.schema.ts

@@ -16,13 +16,26 @@ const schema = {
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

packages/schemas/src/v3/gitea.type.ts

@@ -8,11 +8,18 @@ export interface GiteaConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the Gitea host. Defaults to https://gitea.com

packages/schemas/src/v3/github.schema.ts

@@ -16,13 +16,26 @@ const schema = {
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

packages/schemas/src/v3/github.type.ts

@@ -8,11 +8,18 @@ export interface GithubConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the GitHub host. Defaults to https://github.com

packages/schemas/src/v3/gitlab.schema.ts

@@ -16,13 +16,26 @@ const schema = {
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },

packages/schemas/src/v3/gitlab.type.ts

@@ -8,11 +8,18 @@ export interface GitlabConnectionConfig {
   /**
    * An authentication token.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the GitLab host. Defaults to https://gitlab.com

packages/schemas/src/v3/identityProvider.schema.ts

@@ -22,13 +22,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -39,13 +52,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -56,13 +82,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -97,13 +136,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -114,13 +166,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -131,13 +196,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -167,13 +245,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -184,13 +275,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -214,13 +318,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -231,13 +348,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -248,13 +378,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -279,13 +422,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -296,13 +452,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -313,13 +482,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -344,13 +526,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -361,13 +556,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -378,13 +586,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -409,13 +630,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -446,13 +680,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -463,13 +710,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -480,13 +740,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -521,13 +794,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -538,13 +824,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -555,13 +854,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -591,13 +903,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -608,13 +933,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -638,13 +976,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -655,13 +1006,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -672,13 +1036,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -703,13 +1080,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -720,13 +1110,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -737,13 +1140,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -768,13 +1184,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -785,13 +1214,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -802,13 +1244,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }
@@ -833,13 +1288,26 @@ const schema = {
               "properties": {
                 "env": {
                   "type": "string",
-                  "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                  "description": "The name of the environment variable that contains the token."
                 }
               },
               "required": [
                 "env"
               ],
               "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "properties": {
+                "googleCloudSecret": {
+                  "type": "string",
+                  "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                }
+              },
+              "required": [
+                "googleCloudSecret"
+              ],
+              "additionalProperties": false
             }
           ]
         }

packages/schemas/src/v3/identityProvider.type.ts

@@ -12,23 +12,44 @@ export type IdentityProviderConfig =
 export interface GitHubIdentityProviderConfig {
   provider: "github";
   purpose: "sso" | "integration";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  baseUrl?: {
+  baseUrl?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   required?: boolean;
   [k: string]: unknown;
@@ -36,116 +57,221 @@ export interface GitHubIdentityProviderConfig {
 export interface GitLabIdentityProviderConfig {
   provider: "gitlab";
   purpose: "sso" | "integration";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  baseUrl: {
+  baseUrl:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   required?: boolean;
   [k: string]: unknown;
 }
 export interface GoogleIdentityProviderConfig {
   provider: "google";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface OktaIdentityProviderConfig {
   provider: "okta";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  issuer: {
+  issuer:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface KeycloakIdentityProviderConfig {
   provider: "keycloak";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  issuer: {
+  issuer:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface MicrosoftEntraIDIdentityProviderConfig {
   provider: "microsoft-entra-id";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  issuer: {
+  issuer:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface GCPIAPIdentityProviderConfig {
   provider: "gcp-iap";
-  audience: {
+  audience:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }

packages/schemas/src/v3/index.type.ts

@@ -167,11 +167,18 @@ export interface GithubConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the GitHub host. Defaults to https://github.com
@@ -249,11 +256,18 @@ export interface GitlabConnectionConfig {
   /**
    * An authentication token.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the GitLab host. Defaults to https://gitlab.com
@@ -313,11 +327,18 @@ export interface GiteaConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the Gitea host. Defaults to https://gitea.com
@@ -392,11 +413,18 @@ export interface BitbucketConnectionConfig {
   /**
    * An authentication token.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Bitbucket URL
@@ -442,11 +470,18 @@ export interface AzureDevOpsConnectionConfig {
   /**
    * A Personal Access Token (PAT).
    */
-  token: {
+  token:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The URL of the Azure DevOps host. For Azure DevOps Cloud, use https://dev.azure.com. For Azure DevOps Server, use your server URL.
@@ -528,29 +563,50 @@ export interface AmazonBedrockLanguageModel {
   /**
    * Optional access key ID to use with the model. Defaults to the `AWS_ACCESS_KEY_ID` environment variable.
    */
-  accessKeyId?: {
+  accessKeyId?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional secret access key to use with the model. Defaults to the `AWS_SECRET_ACCESS_KEY` environment variable.
    */
-  accessKeySecret?: {
+  accessKeySecret?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional session token to use with the model. Defaults to the `AWS_SESSION_TOKEN` environment variable.
    */
-  sessionToken?: {
+  sessionToken?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The AWS region. Defaults to the `AWS_REGION` environment variable.
@@ -572,12 +628,20 @@ export interface LanguageModelHeaders {
    */
   [k: string]:
     | string
+    | (
         | {
             /**
-         * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+             * The name of the environment variable that contains the token.
              */
             env: string;
-      };
+          }
+        | {
+            /**
+             * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+             */
+            googleCloudSecret: string;
+          }
+      );
 }
 export interface AnthropicLanguageModel {
   /**
@@ -595,11 +659,18 @@ export interface AnthropicLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `ANTHROPIC_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -627,11 +698,18 @@ export interface AzureLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `AZURE_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Sets a custom api version. Defaults to `preview`.
@@ -659,11 +737,18 @@ export interface DeepSeekLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `DEEPSEEK_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -687,11 +772,18 @@ export interface GoogleGenerativeAILanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `GOOGLE_GENERATIVE_AI_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -723,11 +815,18 @@ export interface GoogleVertexAnthropicLanguageModel {
   /**
    * Optional file path to service account credentials JSON. Defaults to the `GOOGLE_APPLICATION_CREDENTIALS` environment variable or application default credentials.
    */
-  credentials?: {
+  credentials?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -759,11 +858,18 @@ export interface GoogleVertexLanguageModel {
   /**
    * Optional file path to service account credentials JSON. Defaults to the `GOOGLE_APPLICATION_CREDENTIALS` environment variable or application default credentials.
    */
-  credentials?: {
+  credentials?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -787,11 +893,18 @@ export interface MistralLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `MISTRAL_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -815,11 +928,18 @@ export interface OpenAILanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `OPENAI_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -847,11 +967,18 @@ export interface OpenAICompatibleLanguageModel {
   /**
    * Optional API key. If specified, adds an `Authorization` header to request headers with the value Bearer <token>.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Base URL of the OpenAI-compatible chat completions API endpoint.
@@ -874,12 +1001,20 @@ export interface LanguageModelQueryParams {
    */
   [k: string]:
     | string
+    | (
         | {
             /**
-         * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+             * The name of the environment variable that contains the token.
              */
             env: string;
-      };
+          }
+        | {
+            /**
+             * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+             */
+            googleCloudSecret: string;
+          }
+      );
 }
 export interface OpenRouterLanguageModel {
   /**
@@ -897,11 +1032,18 @@ export interface OpenRouterLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `OPENROUTER_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -925,11 +1067,18 @@ export interface XaiLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `XAI_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -953,33 +1102,61 @@ export interface GitHubAppConfig {
   /**
    * The private key of the GitHub App.
    */
-  privateKey: {
+  privateKey:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
 }
 export interface GitHubIdentityProviderConfig {
   provider: "github";
   purpose: "sso" | "integration";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  baseUrl?: {
+  baseUrl?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   required?: boolean;
   [k: string]: unknown;
@@ -987,116 +1164,221 @@ export interface GitHubIdentityProviderConfig {
 export interface GitLabIdentityProviderConfig {
   provider: "gitlab";
   purpose: "sso" | "integration";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  baseUrl: {
+  baseUrl:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   required?: boolean;
   [k: string]: unknown;
 }
 export interface GoogleIdentityProviderConfig {
   provider: "google";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface OktaIdentityProviderConfig {
   provider: "okta";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  issuer: {
+  issuer:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface KeycloakIdentityProviderConfig {
   provider: "keycloak";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  issuer: {
+  issuer:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface MicrosoftEntraIDIdentityProviderConfig {
   provider: "microsoft-entra-id";
-  clientId: {
+  clientId:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  clientSecret: {
+  clientSecret:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
-  issuer: {
+  issuer:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }
 export interface GCPIAPIdentityProviderConfig {
   provider: "gcp-iap";
-  audience: {
+  audience:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   [k: string]: unknown;
 }

packages/schemas/src/v3/languageModel.type.ts

@@ -30,29 +30,50 @@ export interface AmazonBedrockLanguageModel {
   /**
    * Optional access key ID to use with the model. Defaults to the `AWS_ACCESS_KEY_ID` environment variable.
    */
-  accessKeyId?: {
+  accessKeyId?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional secret access key to use with the model. Defaults to the `AWS_SECRET_ACCESS_KEY` environment variable.
    */
-  accessKeySecret?: {
+  accessKeySecret?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional session token to use with the model. Defaults to the `AWS_SESSION_TOKEN` environment variable.
    */
-  sessionToken?: {
+  sessionToken?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * The AWS region. Defaults to the `AWS_REGION` environment variable.
@@ -74,12 +95,20 @@ export interface LanguageModelHeaders {
    */
   [k: string]:
     | string
+    | (
         | {
             /**
-         * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+             * The name of the environment variable that contains the token.
              */
             env: string;
-      };
+          }
+        | {
+            /**
+             * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+             */
+            googleCloudSecret: string;
+          }
+      );
 }
 export interface AnthropicLanguageModel {
   /**
@@ -97,11 +126,18 @@ export interface AnthropicLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `ANTHROPIC_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -129,11 +165,18 @@ export interface AzureLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `AZURE_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Sets a custom api version. Defaults to `preview`.
@@ -161,11 +204,18 @@ export interface DeepSeekLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `DEEPSEEK_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -189,11 +239,18 @@ export interface GoogleGenerativeAILanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `GOOGLE_GENERATIVE_AI_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -225,11 +282,18 @@ export interface GoogleVertexAnthropicLanguageModel {
   /**
    * Optional file path to service account credentials JSON. Defaults to the `GOOGLE_APPLICATION_CREDENTIALS` environment variable or application default credentials.
    */
-  credentials?: {
+  credentials?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -261,11 +325,18 @@ export interface GoogleVertexLanguageModel {
   /**
    * Optional file path to service account credentials JSON. Defaults to the `GOOGLE_APPLICATION_CREDENTIALS` environment variable or application default credentials.
    */
-  credentials?: {
+  credentials?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -289,11 +360,18 @@ export interface MistralLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `MISTRAL_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -317,11 +395,18 @@ export interface OpenAILanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `OPENAI_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -349,11 +434,18 @@ export interface OpenAICompatibleLanguageModel {
   /**
    * Optional API key. If specified, adds an `Authorization` header to request headers with the value Bearer <token>.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Base URL of the OpenAI-compatible chat completions API endpoint.
@@ -376,12 +468,20 @@ export interface LanguageModelQueryParams {
    */
   [k: string]:
     | string
+    | (
         | {
             /**
-         * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+             * The name of the environment variable that contains the token.
              */
             env: string;
-      };
+          }
+        | {
+            /**
+             * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+             */
+            googleCloudSecret: string;
+          }
+      );
 }
 export interface OpenRouterLanguageModel {
   /**
@@ -399,11 +499,18 @@ export interface OpenRouterLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `OPENROUTER_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.
@@ -427,11 +534,18 @@ export interface XaiLanguageModel {
   /**
    * Optional API key to use with the model. Defaults to the `XAI_API_KEY` environment variable.
    */
-  token?: {
+  token?:
+    | {
         /**
-     * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+         * The name of the environment variable that contains the token.
          */
         env: string;
+      }
+    | {
+        /**
+         * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+         */
+        googleCloudSecret: string;
       };
   /**
    * Optional base URL.

packages/schemas/src/v3/shared.schema.ts

@@ -10,13 +10,26 @@ const schema = {
           "properties": {
             "env": {
               "type": "string",
-              "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+              "description": "The name of the environment variable that contains the token."
             }
           },
           "required": [
             "env"
           ],
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "googleCloudSecret": {
+              "type": "string",
+              "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+            }
+          },
+          "required": [
+            "googleCloudSecret"
+          ],
+          "additionalProperties": false
         }
       ]
     },
@@ -77,13 +90,26 @@ const schema = {
                   "properties": {
                     "env": {
                       "type": "string",
-                      "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                      "description": "The name of the environment variable that contains the token."
                     }
                   },
                   "required": [
                     "env"
                   ],
                   "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "googleCloudSecret": {
+                      "type": "string",
+                      "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                    }
+                  },
+                  "required": [
+                    "googleCloudSecret"
+                  ],
+                  "additionalProperties": false
                 }
               ]
             }
@@ -108,13 +134,26 @@ const schema = {
                   "properties": {
                     "env": {
                       "type": "string",
-                      "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                      "description": "The name of the environment variable that contains the token."
                     }
                   },
                   "required": [
                     "env"
                   ],
                   "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "googleCloudSecret": {
+                      "type": "string",
+                      "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                    }
+                  },
+                  "required": [
+                    "googleCloudSecret"
+                  ],
+                  "additionalProperties": false
                 }
               ]
             }

packages/schemas/src/v3/shared.type.ts

@@ -4,11 +4,18 @@
  * This interface was referenced by `Shared`'s JSON-Schema
  * via the `definition` "Token".
  */
-export type Token = {
+export type Token =
+  | {
       /**
-   * The name of the environment variable that contains the token. Only supported in declarative connection configs.
+       * The name of the environment variable that contains the token.
        */
       env: string;
+    }
+  | {
+      /**
+       * The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets
+       */
+      googleCloudSecret: string;
     };
 
 export interface Shared {

schemas/v3/shared.json

@@ -9,13 +9,26 @@
                     "properties": {
                         "env": {
                             "type": "string",
-                            "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                            "description": "The name of the environment variable that contains the token."
                         }
                     },
                     "required": [
                         "env"
                     ],
                     "additionalProperties": false
+                },
+                {
+                    "type": "object",
+                    "properties": {
+                        "googleCloudSecret": {
+                            "type": "string",
+                            "description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
+                        }
+                    },
+                    "required": [
+                        "googleCloudSecret"
+                    ],
+                    "additionalProperties": false
                 }
             ]
         },

yarn.lock

@@ -2319,6 +2319,39 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@google-cloud/secret-manager@npm:^6.1.1":
+  version: 6.1.1
+  resolution: "@google-cloud/secret-manager@npm:6.1.1"
+  dependencies:
+    google-gax: "npm:^5.0.0"
+  checksum: 10c0/89554c2205106ad765db2fcfb4202c54b824fce74ccb237c9c38c2e431b20d7f04de09db00f92d68ae217b011667e9bcfa0824199103a4498251a1a4b16f9b9b
+  languageName: node
+  linkType: hard
+
+"@grpc/grpc-js@npm:^1.12.6":
+  version: 1.14.0
+  resolution: "@grpc/grpc-js@npm:1.14.0"
+  dependencies:
+    "@grpc/proto-loader": "npm:^0.8.0"
+    "@js-sdsl/ordered-map": "npm:^4.4.2"
+  checksum: 10c0/51e0eb32f6dac68c49502b227e565c4244f53983d2efab8ef3fd2cc923999751c059f6c77fec4941a93c44eaa58cbc321ce1e9868e1ec226fba5a6c93722c3b1
+  languageName: node
+  linkType: hard
+
+"@grpc/proto-loader@npm:^0.8.0":
+  version: 0.8.0
+  resolution: "@grpc/proto-loader@npm:0.8.0"
+  dependencies:
+    lodash.camelcase: "npm:^4.3.0"
+    long: "npm:^5.0.0"
+    protobufjs: "npm:^7.5.3"
+    yargs: "npm:^17.7.2"
+  bin:
+    proto-loader-gen-types: build/bin/proto-loader-gen-types.js
+  checksum: 10c0/a27da3b85d5d17bab956d536786c717287eae46ca264ea9ec774db90ff571955bae2705809f431b4622fbf3be9951d7c7bbb1360b2015ee88abe1587cf3d6fe0
+  languageName: node
+  linkType: hard
+
 "@hookform/resolvers@npm:^3.9.0":
   version: 3.10.0
   resolution: "@hookform/resolvers@npm:3.10.0"
@@ -2831,6 +2864,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@js-sdsl/ordered-map@npm:^4.4.2":
+  version: 4.4.2
+  resolution: "@js-sdsl/ordered-map@npm:4.4.2"
+  checksum: 10c0/cc7e15dc4acf6d9ef663757279600bab70533d847dcc1ab01332e9e680bd30b77cdf9ad885cc774276f51d98b05a013571c940e5b360985af5eb798dc1a2ee2b
+  languageName: node
+  linkType: hard
+
 "@jsdevtools/ono@npm:^7.1.3":
   version: 7.1.3
   resolution: "@jsdevtools/ono@npm:7.1.3"
@@ -4588,6 +4628,79 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@protobufjs/aspromise@npm:^1.1.1, @protobufjs/aspromise@npm:^1.1.2":
+  version: 1.1.2
+  resolution: "@protobufjs/aspromise@npm:1.1.2"
+  checksum: 10c0/a83343a468ff5b5ec6bff36fd788a64c839e48a07ff9f4f813564f58caf44d011cd6504ed2147bf34835bd7a7dd2107052af755961c6b098fd8902b4f6500d0f
+  languageName: node
+  linkType: hard
+
+"@protobufjs/base64@npm:^1.1.2":
+  version: 1.1.2
+  resolution: "@protobufjs/base64@npm:1.1.2"
+  checksum: 10c0/eec925e681081af190b8ee231f9bad3101e189abbc182ff279da6b531e7dbd2a56f1f306f37a80b1be9e00aa2d271690d08dcc5f326f71c9eed8546675c8caf6
+  languageName: node
+  linkType: hard
+
+"@protobufjs/codegen@npm:^2.0.4":
+  version: 2.0.4
+  resolution: "@protobufjs/codegen@npm:2.0.4"
+  checksum: 10c0/26ae337c5659e41f091606d16465bbcc1df1f37cc1ed462438b1f67be0c1e28dfb2ca9f294f39100c52161aef82edf758c95d6d75650a1ddf31f7ddee1440b43
+  languageName: node
+  linkType: hard
+
+"@protobufjs/eventemitter@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@protobufjs/eventemitter@npm:1.1.0"
+  checksum: 10c0/1eb0a75180e5206d1033e4138212a8c7089a3d418c6dfa5a6ce42e593a4ae2e5892c4ef7421f38092badba4040ea6a45f0928869989411001d8c1018ea9a6e70
+  languageName: node
+  linkType: hard
+
+"@protobufjs/fetch@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@protobufjs/fetch@npm:1.1.0"
+  dependencies:
+    "@protobufjs/aspromise": "npm:^1.1.1"
+    "@protobufjs/inquire": "npm:^1.1.0"
+  checksum: 10c0/cda6a3dc2d50a182c5865b160f72077aac197046600091dbb005dd0a66db9cce3c5eaed6d470ac8ed49d7bcbeef6ee5f0bc288db5ff9a70cbd003e5909065233
+  languageName: node
+  linkType: hard
+
+"@protobufjs/float@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "@protobufjs/float@npm:1.0.2"
+  checksum: 10c0/18f2bdede76ffcf0170708af15c9c9db6259b771e6b84c51b06df34a9c339dbbeec267d14ce0bddd20acc142b1d980d983d31434398df7f98eb0c94a0eb79069
+  languageName: node
+  linkType: hard
+
+"@protobufjs/inquire@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@protobufjs/inquire@npm:1.1.0"
+  checksum: 10c0/64372482efcba1fb4d166a2664a6395fa978b557803857c9c03500e0ac1013eb4b1aacc9ed851dd5fc22f81583670b4f4431bae186f3373fedcfde863ef5921a
+  languageName: node
+  linkType: hard
+
+"@protobufjs/path@npm:^1.1.2":
+  version: 1.1.2
+  resolution: "@protobufjs/path@npm:1.1.2"
+  checksum: 10c0/cece0a938e7f5dfd2fa03f8c14f2f1cf8b0d6e13ac7326ff4c96ea311effd5fb7ae0bba754fbf505312af2e38500250c90e68506b97c02360a43793d88a0d8b4
+  languageName: node
+  linkType: hard
+
+"@protobufjs/pool@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@protobufjs/pool@npm:1.1.0"
+  checksum: 10c0/eda2718b7f222ac6e6ad36f758a92ef90d26526026a19f4f17f668f45e0306a5bd734def3f48f51f8134ae0978b6262a5c517c08b115a551756d1a3aadfcf038
+  languageName: node
+  linkType: hard
+
+"@protobufjs/utf8@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@protobufjs/utf8@npm:1.1.0"
+  checksum: 10c0/a3fe31fe3fa29aa3349e2e04ee13dc170cc6af7c23d92ad49e3eeaf79b9766264544d3da824dba93b7855bd6a2982fb40032ef40693da98a136d835752beb487
+  languageName: node
+  linkType: hard
+
 "@radix-ui/number@npm:1.1.0":
   version: 1.1.0
   resolution: "@radix-ui/number@npm:1.1.0"
@@ -7807,6 +7920,7 @@ __metadata:
     json-schema-to-typescript: "npm:^15.0.4"
     lowdb: "npm:^7.0.1"
     micromatch: "npm:^4.0.8"
+    p-limit: "npm:^7.2.0"
     posthog-node: "npm:^4.2.1"
     prom-client: "npm:^15.1.3"
     simple-git: "npm:^3.27.0"
@@ -7836,6 +7950,7 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "@sourcebot/crypto@workspace:packages/crypto"
   dependencies:
+    "@google-cloud/secret-manager": "npm:^6.1.1"
     "@sourcebot/db": "npm:*"
     "@sourcebot/schemas": "npm:*"
     "@types/node": "npm:^22.7.5"
@@ -8382,6 +8497,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@tootallnate/once@npm:2":
+  version: 2.0.0
+  resolution: "@tootallnate/once@npm:2.0.0"
+  checksum: 10c0/073bfa548026b1ebaf1659eb8961e526be22fa77139b10d60e712f46d2f0f05f4e6c8bec62a087d41088ee9e29faa7f54838568e475ab2f776171003c3920858
+  languageName: node
+  linkType: hard
+
 "@tybys/wasm-util@npm:^0.9.0":
   version: 0.9.0
   resolution: "@tybys/wasm-util@npm:0.9.0"
@@ -8668,6 +8790,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/node@npm:>=13.7.0":
+  version: 24.9.2
+  resolution: "@types/node@npm:24.9.2"
+  dependencies:
+    undici-types: "npm:~7.16.0"
+  checksum: 10c0/7905d43f65cee72ef475fe76316e10bbf6ac5d08a7f0f6c38f2b6285d7ca3009e8fcafc8f8a1d2bf3f55889c9c278dbb203a9081fd0cf2d6d62161703924c6fa
+  languageName: node
+  linkType: hard
+
 "@types/node@npm:^18.11.18":
   version: 18.19.100
   resolution: "@types/node@npm:18.19.100"
@@ -11371,6 +11502,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"duplexify@npm:^4.1.3":
+  version: 4.1.3
+  resolution: "duplexify@npm:4.1.3"
+  dependencies:
+    end-of-stream: "npm:^1.4.1"
+    inherits: "npm:^2.0.3"
+    readable-stream: "npm:^3.1.1"
+    stream-shift: "npm:^1.0.2"
+  checksum: 10c0/8a7621ae95c89f3937f982fe36d72ea997836a708471a75bb2a0eecde3330311b1e128a6dad510e0fd64ace0c56bff3484ed2e82af0e465600c82117eadfbda5
+  languageName: node
+  linkType: hard
+
 "eastasianwidth@npm:^0.2.0":
   version: 0.2.0
   resolution: "eastasianwidth@npm:0.2.0"
@@ -11498,6 +11641,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"end-of-stream@npm:^1.4.1":
+  version: 1.4.5
+  resolution: "end-of-stream@npm:1.4.5"
+  dependencies:
+    once: "npm:^1.4.0"
+  checksum: 10c0/b0701c92a10b89afb1cb45bf54a5292c6f008d744eb4382fa559d54775ff31617d1d7bc3ef617575f552e24fad2c7c1a1835948c66b3f3a4be0a6c1f35c883d8
+  languageName: node
+  linkType: hard
+
 "engine.io-parser@npm:~5.2.1":
   version: 5.2.3
   resolution: "engine.io-parser@npm:5.2.3"
@@ -13240,6 +13392,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"google-gax@npm:^5.0.0":
+  version: 5.0.5
+  resolution: "google-gax@npm:5.0.5"
+  dependencies:
+    "@grpc/grpc-js": "npm:^1.12.6"
+    "@grpc/proto-loader": "npm:^0.8.0"
+    duplexify: "npm:^4.1.3"
+    google-auth-library: "npm:^10.1.0"
+    google-logging-utils: "npm:^1.1.1"
+    node-fetch: "npm:^3.3.2"
+    object-hash: "npm:^3.0.0"
+    proto3-json-serializer: "npm:^3.0.0"
+    protobufjs: "npm:^7.5.3"
+    retry-request: "npm:^8.0.0"
+    rimraf: "npm:^5.0.1"
+  checksum: 10c0/fccac5987bf4e7d6361564e14abddc7e51567f0af386bb34967369b2a27c281da2b0b891242de0670ae443ff328968499dd0ec0faee671ea0068f7b05aaa8d04
+  languageName: node
+  linkType: hard
+
 "google-logging-utils@npm:^0.0.2":
   version: 0.0.2
   resolution: "google-logging-utils@npm:0.0.2"
@@ -13254,6 +13425,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"google-logging-utils@npm:^1.1.1":
+  version: 1.1.2
+  resolution: "google-logging-utils@npm:1.1.2"
+  checksum: 10c0/c589d469045e49073913ae0e25c53058584e47298b6178910f2395cb2790f102681ba0e61be5ee6db7726b4745a57110b1d75441a225a7c58c3f1081101f2444
+  languageName: node
+  linkType: hard
+
 "gopd@npm:^1.0.1, gopd@npm:^1.2.0":
   version: 1.2.0
   resolution: "gopd@npm:1.2.0"
@@ -13612,6 +13790,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"http-proxy-agent@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "http-proxy-agent@npm:5.0.0"
+  dependencies:
+    "@tootallnate/once": "npm:2"
+    agent-base: "npm:6"
+    debug: "npm:4"
+  checksum: 10c0/32a05e413430b2c1e542e5c74b38a9f14865301dd69dff2e53ddb684989440e3d2ce0c4b64d25eb63cf6283e6265ff979a61cf93e3ca3d23047ddfdc8df34a32
+  languageName: node
+  linkType: hard
+
 "http-proxy-agent@npm:^7.0.0, http-proxy-agent@npm:^7.0.2":
   version: 7.0.2
   resolution: "http-proxy-agent@npm:7.0.2"
@@ -14660,6 +14849,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lodash.camelcase@npm:^4.3.0":
+  version: 4.3.0
+  resolution: "lodash.camelcase@npm:4.3.0"
+  checksum: 10c0/fcba15d21a458076dd309fce6b1b4bf611d84a0ec252cb92447c948c533ac250b95d2e00955801ebc367e5af5ed288b996d75d37d2035260a937008e14eaf432
+  languageName: node
+  linkType: hard
+
 "lodash.castarray@npm:^4.4.0":
   version: 4.4.0
   resolution: "lodash.castarray@npm:4.4.0"
@@ -14740,6 +14936,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"long@npm:^5.0.0":
+  version: 5.3.2
+  resolution: "long@npm:5.3.2"
+  checksum: 10c0/7130fe1cbce2dca06734b35b70d380ca3f70271c7f8852c922a7c62c86c4e35f0c39290565eca7133c625908d40e126ac57c02b1b1a4636b9457d77e1e60b981
+  languageName: node
+  linkType: hard
+
 "longest-streak@npm:^3.0.0":
   version: 3.1.0
   resolution: "longest-streak@npm:3.1.0"
@@ -16463,6 +16666,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"p-limit@npm:^7.2.0":
+  version: 7.2.0
+  resolution: "p-limit@npm:7.2.0"
+  dependencies:
+    yocto-queue: "npm:^1.2.1"
+  checksum: 10c0/18e5ea305c31fdc0cf5260da7b63adfd46748cd72d4b40a31a13bd23eeece729c9308047fb5d848d7fa006d1b2fc2f36bb0d9dd173a300c38cd6dc1ed3355382
+  languageName: node
+  linkType: hard
+
 "p-locate@npm:^5.0.0":
   version: 5.0.0
   resolution: "p-locate@npm:5.0.0"
@@ -17152,6 +17364,35 @@ __metadata:
   languageName: node
   linkType: hard
 
+"proto3-json-serializer@npm:^3.0.0":
+  version: 3.0.4
+  resolution: "proto3-json-serializer@npm:3.0.4"
+  dependencies:
+    protobufjs: "npm:^7.4.0"
+  checksum: 10c0/59150d5e6b396e00c0374e71eb4ebd6f33acd4212c0ad2acdda12181b08f923b733559d74ad78455085223efe24168d4d42887a8b8f15f7663f20debe5796081
+  languageName: node
+  linkType: hard
+
+"protobufjs@npm:^7.4.0, protobufjs@npm:^7.5.3":
+  version: 7.5.4
+  resolution: "protobufjs@npm:7.5.4"
+  dependencies:
+    "@protobufjs/aspromise": "npm:^1.1.2"
+    "@protobufjs/base64": "npm:^1.1.2"
+    "@protobufjs/codegen": "npm:^2.0.4"
+    "@protobufjs/eventemitter": "npm:^1.1.0"
+    "@protobufjs/fetch": "npm:^1.1.0"
+    "@protobufjs/float": "npm:^1.0.2"
+    "@protobufjs/inquire": "npm:^1.1.0"
+    "@protobufjs/path": "npm:^1.1.2"
+    "@protobufjs/pool": "npm:^1.1.0"
+    "@protobufjs/utf8": "npm:^1.1.0"
+    "@types/node": "npm:>=13.7.0"
+    long: "npm:^5.0.0"
+  checksum: 10c0/913b676109ffb3c05d3d31e03a684e569be91f3bba8613da4a683d69d9dba948daa2afd7d2e7944d1aa6c417890c35d9d9a8883c1160affafb0f9670d59ef722
+  languageName: node
+  linkType: hard
+
 "protocols@npm:^2.0.0, protocols@npm:^2.0.1":
   version: 2.0.2
   resolution: "protocols@npm:2.0.2"
@@ -17560,7 +17801,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.2":
+"readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.2":
   version: 3.6.2
   resolution: "readable-stream@npm:3.6.2"
   dependencies:
@@ -17906,6 +18147,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"retry-request@npm:^8.0.0":
+  version: 8.0.2
+  resolution: "retry-request@npm:8.0.2"
+  dependencies:
+    extend: "npm:^3.0.2"
+    teeny-request: "npm:^10.0.0"
+  checksum: 10c0/e0b44950d69fe8f51d4e808650cd0d06383cd711adcc71e7764b28b2f10a9ac3b2209f0c9ac0547df0745031810a259730b9d13b0070d69df9806c37432456a9
+  languageName: node
+  linkType: hard
+
 "retry@npm:^0.12.0":
   version: 0.12.0
   resolution: "retry@npm:0.12.0"
@@ -17931,7 +18182,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"rimraf@npm:^5.0.5":
+"rimraf@npm:^5.0.1, rimraf@npm:^5.0.5":
   version: 5.0.10
   resolution: "rimraf@npm:5.0.10"
   dependencies:
@@ -19028,6 +19279,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"stream-events@npm:^1.0.5":
+  version: 1.0.5
+  resolution: "stream-events@npm:1.0.5"
+  dependencies:
+    stubs: "npm:^3.0.0"
+  checksum: 10c0/5d235a5799a483e94ea8829526fe9d95d76460032d5e78555fe4f801949ac6a27ea2212e4e0827c55f78726b3242701768adf2d33789465f51b31ed8ebd6b086
+  languageName: node
+  linkType: hard
+
+"stream-shift@npm:^1.0.2":
+  version: 1.0.3
+  resolution: "stream-shift@npm:1.0.3"
+  checksum: 10c0/939cd1051ca750d240a0625b106a2b988c45fb5a3be0cebe9a9858cb01bc1955e8c7b9fac17a9462976bea4a7b704e317c5c2200c70f0ca715a3363b9aa4fd3b
+  languageName: node
+  linkType: hard
+
 "streamsearch@npm:^1.1.0":
   version: 1.1.0
   resolution: "streamsearch@npm:1.1.0"
@@ -19231,6 +19498,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"stubs@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "stubs@npm:3.0.0"
+  checksum: 10c0/841a4ab8c76795d34aefe129185763b55fbf2e4693208215627caea4dd62e1299423dcd96f708d3128e3dfa0e669bae2cb912e6e906d7d81eaf6493196570923
+  languageName: node
+  linkType: hard
+
 "style-mod@npm:^4.0.0, style-mod@npm:^4.1.0":
   version: 4.1.2
   resolution: "style-mod@npm:4.1.2"
@@ -19438,6 +19712,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"teeny-request@npm:^10.0.0":
+  version: 10.1.0
+  resolution: "teeny-request@npm:10.1.0"
+  dependencies:
+    http-proxy-agent: "npm:^5.0.0"
+    https-proxy-agent: "npm:^5.0.0"
+    node-fetch: "npm:^3.3.2"
+    stream-events: "npm:^1.0.5"
+  checksum: 10c0/bbb95683c0a4ac5b0da5128f1d731f7b59d74910368b1ec12a435f39e37b37726e87d4a658f090308bb6adea935aec6e2dfc557a8510e89f2833b64d3adcfdfc
+  languageName: node
+  linkType: hard
+
 "text-hex@npm:1.0.x":
   version: 1.0.0
   resolution: "text-hex@npm:1.0.0"
@@ -19984,6 +20270,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"undici-types@npm:~7.16.0":
+  version: 7.16.0
+  resolution: "undici-types@npm:7.16.0"
+  checksum: 10c0/3033e2f2b5c9f1504bdc5934646cb54e37ecaca0f9249c983f7b1fc2e87c6d18399ebb05dc7fd5419e02b2e915f734d872a65da2e3eeed1813951c427d33cc9a
+  languageName: node
+  linkType: hard
+
 "unified@npm:^11.0.0":
   version: 11.0.5
   resolution: "unified@npm:11.0.5"
@@ -20814,7 +21107,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yargs@npm:17.7.2":
+"yargs@npm:17.7.2, yargs@npm:^17.7.2":
   version: 17.7.2
   resolution: "yargs@npm:17.7.2"
   dependencies:
@@ -20836,6 +21129,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"yocto-queue@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "yocto-queue@npm:1.2.1"
+  checksum: 10c0/5762caa3d0b421f4bdb7a1926b2ae2189fc6e4a14469258f183600028eb16db3e9e0306f46e8ebf5a52ff4b81a881f22637afefbef5399d6ad440824e9b27f9f
+  languageName: node
+  linkType: hard
+
 "zod-to-json-schema@npm:^3.24.1, zod-to-json-schema@npm:^3.24.5":
   version: 3.24.5
   resolution: "zod-to-json-schema@npm:3.24.5"