AWS Secrets Manager provider.
-
connect(): Promise<void>
Establishes any backing connection/client. No-op for stateless providers.
-
disconnect(): Promise<void>
Releases any backing connection/client. No-op for stateless providers.
-
get(name: string): Promise<string | null>
Reads a secret from AWS Secrets Manager.
-
isHealthy: () => Promise<boolean>
Reachability probe, present only when the resolved client supplies one (M90b). The AWS SDK facade has no non-mutating probe of its own, so the adapted (lazy) path stays
undefinedand the indicator reportsreachable: 'unknown'; an injected facade that exposesisHealthypublishes real reachability. -
isReady(): boolean
Reports whether the provider is ready to serve reads.
-
set(): Promise<void>name: string,value: string
Writes a new value for a secret.
Azure Key Vault provider.
-
connect(): Promise<void>
Establishes any backing connection/client. No-op for stateless providers.
-
disconnect(): Promise<void>
Releases any backing connection/client. No-op for stateless providers.
-
get(name: string): Promise<string | null>
Reads a secret from Azure Key Vault.
-
isHealthy: () => Promise<boolean>
Reachability probe, present only when the resolved client supplies one (M90b). The Azure SDK facade has no non-mutating probe of its own, so the adapted (lazy) path stays
undefinedand the indicator reportsreachable: 'unknown'; an injected facade that exposesisHealthypublishes real reachability. -
isReady(): boolean
Reports whether the provider is ready to serve reads.
-
set(): Promise<void>name: string,value: string
Sets a secret's value.
Environment-variable secret provider.
-
connect(): Promise<void>
Establishes any backing connection/client. No-op for stateless providers.
-
disconnect(): Promise<void>
Releases any backing connection/client. No-op for stateless providers.
-
get(name: string): Promise<string | null>
Reads the environment variable for a secret name.
-
isHealthy(): Promise<boolean>
Lifecycle truth (M90b): environment variables are process state, so the only honest reachability answer is readiness.
-
isReady(): boolean
Reports whether the provider is ready to serve reads.
-
set(): Promise<void>_name: string,_value: string
Always rejects — environment variables are immutable at runtime.
GCP Secret Manager provider.
-
connect(): Promise<void>
Establishes any backing connection/client. No-op for stateless providers.
-
disconnect(): Promise<void>
Releases any backing connection/client. No-op for stateless providers.
-
get(name: string): Promise<string | null>
Reads a secret from GCP Secret Manager.
-
isHealthy: () => Promise<boolean>
Reachability probe, present only when the resolved client supplies one (M90b). The GCP SDK facade has no non-mutating probe of its own, so the adapted (lazy) path stays
undefinedand the indicator reportsreachable: 'unknown'; an injected facade that exposesisHealthypublishes real reachability. -
isReady(): boolean
Reports whether the provider is ready to serve reads.
-
set(): Promise<void>name: string,value: string
Adds a new secret version.
HashiCorp Vault (KV v2) provider.
-
connect(): Promise<void>
Establishes any backing connection/client. No-op for stateless providers.
-
disconnect(): Promise<void>
Releases any backing connection/client. No-op for stateless providers.
-
get(name: string): Promise<string | null>
Reads a secret from Vault's KV v2 engine.
-
isHealthy(): Promise<boolean>
Probes Vault's unauthenticated
/v1/sys/health(M90b). Any HTTP response proves the server answered — Vault reports its standby and sealing states through STATUS CODES on this endpoint, all of which mean "reachable" — and a network failure does not. No secret is read and the auth token is not sent: the health endpoint is unauthenticated by design, and a read is not a probe. -
isReady(): boolean
Reports whether the provider is ready to serve reads.
-
set(): Promise<void>name: string,value: string
Writes a new secret version to Vault's KV v2 engine.
Thrown when a secret is written through a provider that cannot store.
-
name: string
Discriminant for consumers that cannot use
instanceofacross realms. -
provider: string
The provider that refused the write (e.g.
'EnvProvider').
Secret manager backed by a pluggable provider with a read-through cache.
-
get(name: string): Promise<string>
Retrieves a secret, serving a fresh cache entry when present.
-
has(name: string): Promise<boolean>
Reports whether a secret exists and is accessible.
-
rotate(): Promise<void>name: string,value: string
Rotates a secret to a new value and refreshes the cache entry.
Creates the SecretsPlugin.
Options for AwsKmsProvider.
-
accessKeyId: string | undefined
AWS access key id for the lazily-loaded client.
-
client: IAwsSecretsClient | undefined
Injected client facade; bypasses the lazy SDK import.
-
region: string | undefined
AWS region for the lazily-loaded client.
-
secretAccessKey: string | undefined
AWS secret access key for the lazily-loaded client.
Options for AzureKeyVaultProvider.
-
client: IAzureSecretsClient | undefined
Injected client facade; bypasses the lazy SDK import.
-
vaultUrl: string | undefined
Key Vault URL for the lazily-loaded client.
Options for GcpSecretManagerProvider.
-
client: IGcpSecretsClient | undefined
Injected client facade; bypasses the lazy SDK import.
-
projectId: string | undefined
GCP project id used to build secret resource paths.
Options for HashiCorpVaultProvider.
-
address: string | undefined
Vault server address, e.g.
https://vault.example.com. -
http: IVaultHttp | undefined
Injected
fetch-shaped function; defaults to globalfetch. -
mount: string | undefined
KV v2 mount path. Default
secret. -
token: string | undefined
Vault auth token sent as
X-Vault-Token.
Structural shape of an AWS Secrets Manager facade. The plugin never
hard-depends on @aws-sdk/client-secrets-manager; inject this shape, or the
provider lazily loads the SDK and adapts it to this facade.
-
getSecretValue(secretId: string): Promise<string | null>
Retrieves a secret string by id.
-
isHealthy(): Promise<boolean>
Optional non-mutating reachability probe (M90b). When the injected facade exposes it, the provider's health indicator reports real reachability; when omitted, the indicator reports
reachable: 'unknown'rather than reading a secret as a probe — a read is not a health check and would alter the plugin's cache and billing profile. -
putSecretValue(): Promise<void>secretId: string,value: string
Stores a new value for a secret.
Structural shape of an Azure Key Vault facade (injected or SDK-adapted).
-
getSecret(name: string): Promise<string | null>
Gets a secret's current value.
-
isHealthy(): Promise<boolean>
Optional non-mutating reachability probe (M90b). See
IAwsSecretsClient.isHealthyfor the contract. -
setSecret(): Promise<void>name: string,value: string
Sets a secret's value.
Structural shape of a GCP Secret Manager facade (injected or SDK-adapted).
-
accessSecretVersion(name: string): Promise<string | null>
Accesses the latest enabled version of a secret.
-
addSecretVersion(): Promise<void>name: string,value: string
Adds a new version to a secret.
-
isHealthy(): Promise<boolean>
Optional non-mutating reachability probe (M90b). See
IAwsSecretsClient.isHealthyfor the contract.
Secret manager backed by a provider (AWS KMS, GCP Secret Manager, Azure Key Vault, HashiCorp Vault, or environment variables in development).
-
get(name: string): Promise<string>
Retrieves a secret.
-
has(name: string): Promise<boolean>
Reports whether a secret exists.
-
rotate(): Promise<void>name: string,value: string
Rotates a secret to a new value.
Options for the SecretsPlugin factory.
-
options: SecretsProviderOptions
Provider-specific options.
-
provider: SecretsProviderType
Provider backend. Defaults to
'env'.
Provider-specific options. Fields are consumed only by the matching provider; unrelated fields are ignored.
-
accessKeyId: string
(
aws-kms) AWS access key id for the lazily-loaded client. -
address: string
(
vault) Vault server address, e.g.https://vault.example.com. -
cacheTtl: number
Read-cache TTL in seconds.
0disables caching. Default300. -
client: IAwsSecretsClient | IGcpSecretsClient | IAzureSecretsClient
(
aws-kms|gcp|azure) Injected client facade; bypasses the lazy SDK import. Typed as the union of the three facades — each provider validates the shape it needs. -
http: IVaultHttp
(
vault) Injectedfetch-shaped function; defaults to globalfetch. -
mount: string
(
vault) KV v2 mount path. Defaultsecret. -
prefix: string
(
env) Prefix prepended to the derived environment key. -
projectId: string
(
gcp) GCP project id used to build secret resource paths. -
region: string
(
aws-kms) AWS region for the lazily-loaded client. -
secretAccessKey: string
(
aws-kms) AWS secret access key for the lazily-loaded client. -
token: string
(
vault) Vault auth token sent asX-Vault-Token. -
vaultUrl: string
(
azure) Key Vault URL for the lazily-loaded client.
Options for SecretsService.
-
cacheTtlSeconds: number
Read-cache TTL in seconds.
0disables caching. Default300. -
clock: () => number
Monotonic clock in milliseconds (e.g.
runtime.hrtime). Defaults to a monotonicperformance.now-free stub returning0, which — combined with a non-zero TTL — still caches within a request but never mixes wall-clock.
A fetch-shaped function used by SecretsProviderOptions.http so
the HashiCorp Vault provider stays runtime-agnostic and testable.
Supported secret provider backends.
Usage
import * as Secret_management_plugin_with_environment__AWS_Secrets_Manager__KMS_backed___GCP_Secret_Manager__Azure_Key_Vault__and_HashiCorp_Vault_providers___Exports_the_plugin_factory__service__provider_implementations__structural_client_interfaces__and_option_types_ from "secrets-plugin/src/index.ts";