Contracts / SecretProvider

Contract

SecretProvider

KeymasterKeymaster

Maps a secret’s name to the vault that holds it. One provider per landing zone.

Signature

type SecretProvider
// one implementation per landing zone:
// vault, file, environment, HTTP

packages/secrets-bind/src/index.ts ↗

Rules

Names only travel; values stay in the vault.
Writes are through a writable provider, write-only.

Where it appears

Check out a credential for one callKeymaster
Onboard a secret (write-only)Keymaster