The runtime environment map (IRuntimeServices.env)
Optionaloptions: { config?: Pick<IConfig, "get">; prefix?: string }
Provider options
Optionalconfig?: Pick<IConfig, "get">Config snapshot consulted only when env lacks a string value
Optionalprefix?: stringPrefix prepended to the derived env key
Establishes any backing connection/client. No-op for stateless providers.
Releases any backing connection/client. No-op for stateless providers.
Reads the derived key from the environment first, then config. Environment
strings are returned unchanged, including empty strings and ${NAME}
references. Config values must be strings; no coercion is performed.
Secret name/path
The string value, or null when neither source supplies a string
Reports whether the provider is ready to serve reads.
Always rejects — this provider is read-only.
The rejection is branded with a 501 HTTP status hint (X20-2, M90f), so
an application running errorHandler answers the write attempt with
501 Not Implemented in its configured format rather than the masked
500 an unbranded rejection from this depth would produce. It
REJECTS — never throws synchronously — so a caller using .catch()
observes it either way.
SecretsService.rotate() reaches this same site by delegating to set,
which is what makes both public write operations answer identically.
Secret name (unused)
New value (unused)
A rejected promise carrying ReadOnlySecretProviderError
Environment-first secret provider with an optional config fallback.
Since
0.1.0