Skip to content
reaatech

@reaatech/secret-rotation-types

npm v0.1.0

Type definitions, abstract interfaces, and error classes for the Secret Rotation Kit ecosystem, providing shared types like `SecretKey`, `RotationState`, `SecretProvider`, and `RotationConfig` as zero-dependency TypeScript exports.

npm →source →

@reaatech/secret-rotation-types

npm version License: MIT CI

Status: Pre-1.0 — APIs may change in minor versions. Pin to a specific version in production.

Type definitions, abstract interfaces, and error classes for Secret Rotation Kit. This package is the single source of truth for all shared types used throughout the @reaatech/secret-rotation-* ecosystem.

Installation

terminal
npm install @reaatech/secret-rotation-types
# or
pnpm add @reaatech/secret-rotation-types

Feature Overview

  • Core types — SecretKey, KeyStatus, RotationState, RotationEvent, and all event payloads
  • Verification types — Consumer, VerificationResult, RetryPolicy, VerificationOptions
  • Config types — RotationConfig, SchedulingConfig, VerificationConfig, KeyWindowConfig
  • Provider types — ProviderConfig, AWSProviderConfig, GCPProviderConfig, VaultProviderConfig
  • Abstract interfaces — SecretProvider, KeyStore, KeyGenerator, Logger, EventEmitter, PropagationVerifier, ConsumerRegistry
  • Error hierarchy — RotationError, ProviderError, PropagationError, VerificationError, TimeoutError, ConfigurationError
  • Provider registry — registerProvider, createProvider, getRegisteredTypes for dynamic provider selection
  • Zero runtime dependencies — pure type definitions, lightweight and tree-shakeable

Quick Start

typescript
import type {
  SecretKey,
  KeyStatus,
  SecretProvider,
  RotationConfig,
} from '@reaatech/secret-rotation-types';

Exports

Core Types

ExportDescription
KeyStatusString union: pending, active, expired, revoked, failed
KeyFormatEncoding format: base64, hex, pem, raw
RotationStageWorkflow stage: generation, propagation, verification, activation, revocation
SecretKeyFull key object: keyId, secretName, encryptedMaterial, format, validFrom, validUntil, status, timestamps, metadata
ProviderStateProvider-specific version identifier states
RotationStateComplete rotation snapshot per secret: active/pending/expired/revoked/failed keys
RotationSessionIn-progress provider rotation session

Events

ExportDescription
RotationEventDiscriminated union of all event types
KeyGeneratedEventEmitted when new key material is created
KeyPropagatedEventEmitted when key is stored in the provider
KeyVerifiedEventEmitted when propagation is confirmed
KeyActivatedEventEmitted when new key becomes active
KeyRevokedEventEmitted when old key is revoked
RotationFailedEventEmitted on rotation failure with retry info

Verification Types

ExportDescription
ConsumerRegistered consumer with endpoint, capabilities, and auth config
ConsumerCapabilitiessupportsVersionCheck, supportsHealthCheck, supportsCallback
ConsumerAuthConfigAuth type: bearer, mtls, api-key
VerificationResultAggregated verification result with coverage ratio
ConsumerVerificationResultPer-consumer result with version and error info
VerificationOptionsTimeout, coverage threshold, retry policy
VerificationStatusIn-flight verification progress
RetryPolicymaxRetries, backoffMultiplier, initialDelayMs, maxDelayMs

Config Types

ExportDescription
RotationConfigTop-level configuration assembling all sub-configs
KeyGenerationConfigAlgorithm, key length, format
SchedulingConfigInterval or cron-based rotation scheduling
VerificationConfigStrategy (active, passive, hybrid), timeout, coverage
KeyWindowConfigOverlap period, grace period, max valid keys
ObservabilityConfigLogging, metrics, and tracing settings
SidecarConfigHTTP server port and gRPC toggle

Error Classes

All errors extend RotationError which carries the rotation stage and retry hint:

ClassBaseDescription
RotationErrorErrorBase class: stage?: string, canRetry: boolean
ProviderErrorRotationErrorProvider-level failure with provider name
PropagationErrorRotationErrorSecret not reaching consumers (retryable)
VerificationErrorRotationErrorConsumers not using new key (retryable)
TimeoutErrorRotationErrorOperation exceeded deadline (retryable)
ConfigurationErrorErrorInvalid configuration — not retryable

Interfaces

ExportDescription
SecretProviderProvider adapter contract: CRUD, versions, rotation sessions, health
KeyStoreKey storage contract: save, get, update, delete, list
KeyGeneratorKey generation contract: generate, validate, encrypt, decrypt
PropagationVerifierVerification contract: verify, getStatus, cancel
EventEmitterEvent bus contract: emit, on, off, replay
LoggerStructured logging interface: debug, info, warn, error
ConsumerRegistryConsumer tracking contract: register, deregister, query

Related Packages

License

MIT

All packagessecret-rotation-kit overview