#4384 aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

The @swamp/aws-sm vault has no way to scope its secrets, unlike @swamp/gcp-sm and @swamp/azure-kv, which both take an optional secret_prefix.

Today: the swamp key is used as the secret name as is (SecretId and Name), ListSecrets is unfiltered, and the config accepts only region and profile. Every swamp vault of this type in one AWS account and region is therefore the same flat store. Two workspaces or serve instances sharing an account and region see each other's names and can overwrite or delete them, and vault list-keys returns every secret in the account and region.

This came up in swamp-club#4265: serve instances sharing an account and region collide on flat oauth-* secrets when those exist in Secrets Manager (from an older serve or from seeding). A new instance on an empty datastore adopts them and deletes them.

Request: add an optional secret_prefix to the vault config, matching gcp-sm: all reads, writes, lists and deletes are scoped to names starting with the prefix, and the prefix is stripped from returned names. The list should only return names under the prefix.

Compatibility: with no prefix set, behaviour must stay exactly as it is today, including the secret names. Setting a prefix on a vault that already has secrets hides the unprefixed ones, so the README should say that existing secrets are not moved.

To cover: every provider operation including annotations and tags (the describe and list paths as well as get and put), a shared secret_prefix validation consistent with AWS secret name rules, and README docs alongside the existing gcp-sm wording.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

• Extension: @swamp/aws-sm@2026.11.02.1
• swamp: 20261103.194535.0-sha.01cbe5cd
• OS: linux (x86_64)
• Deno: 2.9.8
• Shell: /nix/store/l9k32vj2aczxw62134j1x0dsh569jz2l-bash-5.2p37/bin/bash