Squashed commit of the following:

commit 27fb5382d80d9bcfb4c65974bbae20c5e7b8ccbc
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 22 00:57:34 2024 -0400

    feat: Vault environment vars

commit 69f13e43dfdd8069459800ccc3039f45fc884814
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 15 22:04:43 2024 -0400

    fix: #3 Defer vault loading until a secret actually needs it

commit c848787d4830a73e9ba93898897282be2f3752f2
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 15 22:02:02 2024 -0400

    package updates

commit 21c6c85f540740ac29536a7091346a731aa85148
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 15 22:01:16 2024 -0400

    fix: #3 Error raised when managed password type disposed

commit 8e77289041349b16536497f48f0c0a4ec6fe30f5
Author: vnugent <public@vaughnnugent.com>
Date:   Thu May 2 15:44:42 2024 -0400

    feat: #2 Middleware helpers, proj cleanup, fix sync secrets, vault client

commit e0a5c85297516188e57b54d9b530b2482cb03eb0
Merge: a977dab 5ad520e
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Apr 27 17:44:09 2024 -0400

    Merge branch 'master' into develop

commit a977dabef1dec915e00f755cb3ee3363aa9985f1
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Apr 27 17:26:35 2024 -0400

    chore: package updates

commit a2e2c3c4152d000b8df25c3c3fee14d491aab2c6
Merge: f03b727 87bfa83
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Apr 20 12:11:45 2024 -0400

    Merge branch 'master' into develop

commit f03b727d8f8e52f1dbd6293ea5c5a492c6d8e2da
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Apr 20 12:02:07 2024 -0400

    chore: Package updates

1 files changed, 11 insertions, 4 deletions

diff --git a/lib/VNLib.Plugins.Extensions.Loading/src/Secrets/OnDemandSecret.cs b/lib/VNLib.Plugins.Extensions.Loading/src/Secrets/OnDemandSecret.cs
index 6e6d560..edbef8c 100644
--- a/lib/VNLib.Plugins.Extensions.Loading/src/Secrets/OnDemandSecret.cs
+++ b/lib/VNLib.Plugins.Extensions.Loading/src/Secrets/OnDemandSecret.cs
@@ -35,13 +35,20 @@ using System.Collections.Generic;
 using VNLib.Utils.Memory;
 using VNLib.Utils.Logging;
 using VNLib.Utils.Extensions;
+using VNLib.Utils.Resources;
 
 using static VNLib.Plugins.Extensions.Loading.PluginSecretConstants;
 
 namespace VNLib.Plugins.Extensions.Loading
 {
-    internal sealed class OnDemandSecret(PluginBase plugin, string secretName, IHCVaultClient? vault) : IOnDemandSecret
+    internal sealed class OnDemandSecret(PluginBase plugin, string secretName, Func<IKvVaultClient?> vaultCb) : IOnDemandSecret
     {
+        /*
+         * Defer loading vault until needed by a vault secret. This avoids loading the vault client
+         * if no secrets are needed from the vault.
+         */
+        private readonly LazyInitializer<IKvVaultClient?> vault = new(vaultCb);
+
         public string SecretName { get; } = secretName ?? throw new ArgumentNullException(nameof(secretName));
 
         ///<inheritdoc/>
@@ -175,16 +182,16 @@ namespace VNLib.Plugins.Extensions.Loading
             string secret = path[(lastSep + 1)..].ToString();
 
             //Try load client
-            _ = vault ?? throw new KeyNotFoundException("Vault client not found");
+            _ = vault.Instance ?? throw new KeyNotFoundException("Vault client not found");
 
             if (async)
             {
-                Task<ISecretResult?> asTask = Task.Run(() => vault.ReadSecretAsync(secret, mount, secretTableKey));
+                Task<ISecretResult?> asTask = Task.Run(() => vault.Instance.ReadSecretAsync(secret, mount, secretTableKey));
                 return new ValueTask<ISecretResult?>(asTask);
             }
             else
             {
-                ISecretResult? result = vault.ReadSecret(secret, mount, secretTableKey);
+                ISecretResult? result = vault.Instance.ReadSecret(secret, mount, secretTableKey);
                 return new ValueTask<ISecretResult?>(result);
             }
         }