Skip to main content

Class: Secret<T>

Defined in: packages/secrets/src/secret.ts:22

A credential that cannot be leaked by accident.

Redaction is by type: JSON.stringify, template literals, String() and util.inspect (and therefore console.log and every logger that inspects) all print REDACTED. The value leaves only through Secret.reveal, an explicit call that is easy to find in a review and easy to grep for.

The value is held in a #private field, so it is absent from Object.keys, from structured clone and from a heap-snapshot walk of enumerable properties. This is a guard against accident, not against code running in the same process: such code can call reveal().

Does not zero memory on disposal, and does not make a secret safe to put in a log line once revealed: the caller owns the revealed string.

Type Parameters​

T​

T = string

Constructors​

Constructor​

new Secret<T>(value, source?): Secret<T>

Defined in: packages/secrets/src/secret.ts:32

Parameters​

value​

T

The credential. Wrapped as given and never copied or logged.

source?​

string

Where it came from, such as secret://oktoid/smtp/password. A reference is not a secret, so it is exposed by Secret.source to make resolved configuration introspectable.

Returns​

Secret<T>

Accessors​

source​

Get Signature​

get source(): string | undefined

Defined in: packages/secrets/src/secret.ts:43

The reference this secret was resolved from, when it was resolved from one.

Returns​

string | undefined

Methods​

[custom]()​

[custom](): string

Defined in: packages/secrets/src/secret.ts:58

Always REDACTED; the hook util.inspect and console.log call.

Returns​

string

[toPrimitive]()​

[toPrimitive](): string

Defined in: packages/secrets/src/secret.ts:63

Always REDACTED, so `${secret}` and secret + '' cannot leak.

Returns​

string

reveal()​

reveal(): T

Defined in: packages/secrets/src/secret.ts:38

The credential itself. Call it at the point of use, never earlier.

Returns​

T

toJSON()​

toJSON(): string

Defined in: packages/secrets/src/secret.ts:48

Always REDACTED.

Returns​

string

toString()​

toString(): string

Defined in: packages/secrets/src/secret.ts:53

Always REDACTED.

Returns​

string