class EnvProvider
implements SecretProvider
Since 0.1.0

Environment-variable secret provider.

Constructors

EnvProvider(
env: Readonly<Record<string, string | undefined>>,
options?: { prefix?: string | undefined; }
)
Parameters
env: Readonly<Record<string, string | undefined>>

The runtime environment map (IRuntimeServices.env)

optional
options: { prefix?: string | undefined; }

Provider options

Methods

connect(): Promise<void>

Establishes any backing connection/client. No-op for stateless providers.

disconnect(): Promise<void>

Releases any backing connection/client. No-op for stateless providers.

get(name: string): Promise<string | null>

Reads the environment variable for a secret name.

Since 0.5.0
isHealthy(): Promise<boolean>

Lifecycle truth (M90b): environment variables are process state, so the only honest reachability answer is readiness.

isReady(): boolean

Reports whether the provider is ready to serve reads.

set(
_name: string,
_value: string
): Promise<void>

Always rejects — environment variables are immutable at runtime.

The rejection is branded with a 501 HTTP status hint (X20-2, M90f), so an application running errorHandler answers the write attempt with 501 Not Implemented in its configured format rather than the masked 500 an unbranded rejection from this depth would produce. It REJECTS — never throws synchronously — so a caller using .catch() observes it either way.

SecretsService.rotate() reaches this same site by delegating to set, which is what makes both public write operations answer identically.

Usage

import { EnvProvider } from "secrets-plugin/src/index.ts";