Secrets

Secrets are configured by name; tests and the agent pass secret(name) and never see the value, and records never hold it. A secret only goes into a field its purpose allows.

SessionSecretCopy Anchor Link

type

| SecretValue | { readonly value: SecretValue readonly purpose?: SecretPurpose /** The kinds of field it may go into instead of its purpose's, or `"any"`. */ readonly fields?: readonly FieldKind[] | "any" /** For a `totp` secret: how its codes are made (default 6 digits every 30 s, SHA-1). */ readonly totp?: TotpSettings }

How a session is given a secret: its value alone, or with what it is for.

SecretPurposeCopy Anchor Link

type

"password" | "otp" | "totp" | "generic-secret"

What a secret is for, which decides the fields it may be typed into (see fields.ts): a password only into password fields, an otp into one-time-code or text fields, a generic-secret (the default) into any field but a password one. A totp secret's value is an authenticator key (base32); what is typed is the code for that moment, into the fields an otp goes into.

FieldKindCopy Anchor Link

type

"password" | "one-time-code" | "text" | "other"

What kind of field an element is, as far as secrets go.

SecretCopy Anchor Link

interface

An opaque handle on a session's secret; it carries the name, never the value.

totpCopy Anchor Link

function

totp(key: string, settings: TotpSettings = {}, atMs = Date.now()): string

The time-based code for the base32 key at atMs (default now).