feat: Add AWS Secrets Manager adapter

Summary

Add AWS Secrets Manager as a secret source adapter for project-aware secrets.

Context

The SourceAdapter interface exists in internal/adapters/adapter.go. Vercel is implemented as reference.

Implementation

Files to create

• internal/adapters/awssm/awssm.go
• internal/adapters/awssm/awssm_test.go

Spec

type AWSSecretsManagerAdapter struct {
    // Uses AWS SDK, not CLI
}

func New() *AWSSecretsManagerAdapter
func (a *AWSSecretsManagerAdapter) Pull(project, scope string) (map[string]string, error)
func (a *AWSSecretsManagerAdapter) Name() string // returns "aws-sm"

SDK approach

import "github.com/aws/aws-sdk-go-v2/service/secretsmanager"

// project = secret name prefix, scope = stage/env tag
// List secrets with prefix, get values, parse JSON

Register in cmd/secrets/adapter.go

case "aws-sm":
    return awssm.New(), nil

Test pattern

Use localstack or mock the SDK client.

.secrets.json example

{
  "source": "aws-sm",
  "project": "myapp",
  "scope": "production",
  "ttl": "1h"
}

Acceptance

• secrets env works with "source": "aws-sm"
• Tests pass with mocked AWS SDK
• Respects AWS credentials from environment/config

Start with internal/adapters/adapter.go and the existing Vercel adapter, then inspect cmd/secrets/adapter.go for registration. Create internal/adapters/awssm/awssm.go and awssm_test.go using the AWS SDK and a mocked client. Done means secrets env supports source aws-sm, parses project-prefixed secrets by scope, respects AWS credentials, and the tests pass.