secretspec 0.15.0-aarch64-linux → 0.16.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 484bf966477a3487bb050be087bf0698c47ea1b58dda9322d91810e50d40c6e7
-  data.tar.gz: c92791c8306b24552d7f3d10ab3f7e862fd35525298ec49f9e80996eedf71671
+  metadata.gz: 776b23b5098306f53c300d556ae5921a2c61096e55c7c43fc4c3519c7870a962
+  data.tar.gz: 5ce2e9b49108d315d1d7588a70bf3d1f76311adf447d42b7cf8635f35751b724
 SHA512:
-  metadata.gz: 39a5d5ba838d8e0d216f9649b3edd1b9076ae991172476d2282d437b3100bedcbf9f1edb6fa174bd807759282bf726d234c0ff57c840674c395baa5ced82623d
-  data.tar.gz: b516fa46336f3e1f90f3ab0fe25de7734ab6a02bcefafcb32d3bfa19c235f05d8221c9d37d6e882da73e08bd8d8fb10049a047836afc51bd0dddeb3d2557eb02
+  metadata.gz: e384fd2b953f4f0179d2ea86507f381966c5be3fd2711cee32a79d5ba8f20ab0f64121af05d1fa511a1eb50dd2bf7f353ea1d322a1e1c7865099b039ff74739d
+  data.tar.gz: c3792261d7be630c3905a0046feb441d25b7d58382bc5374f7f63414ccc94e8720e0e2e1524e315902dc53f16f6855128e68b25d8ca07954ce9dd91282a3de1d

data/lib/secretspec.rb

@@ -19,7 +19,7 @@ require "secretspec/secretspec_ext"
 module Secretspec
   # Response wire-format version this SDK understands. Tracks secretspec-ffi's
   # RESOLVE_SCHEMA_VERSION; a mismatch means the loaded library is incompatible.
-  RESOLVE_SCHEMA_VERSION = 1
+  RESOLVE_SCHEMA_VERSION = 2
 
   # Wire-format version of the value-free report. Tracks secretspec's
   # RESOLUTION_REPORT_SCHEMA_VERSION.

data/vendor/secretspec.h

@@ -7,14 +7,37 @@
  *
  * Request JSON (all fields optional):
  *   { "path": ".../secretspec.toml", "provider": "keyring://",
- *     "profile": "production", "reason": "boot", "no_values": false }
+ *     "profile": "production", "reason": "boot", "no_values": false,
+ *     "mode": "resolve" }
+ *
+ * "mode" selects the response shape and defaults to "resolve":
+ *
+ *   "resolve"  the value-carrying resolve response. Set "no_values" to strip
+ *              the values from it.
+ *   "report"   the value-free resolution report: the inventory/preflight view
+ *              the CLI exposes as `check --json`.
+ *
+ * Any other value is rejected with an "invalid_request" error.
+ *
+ * "no_values" is NOT the same as "mode": "report". A "no_values" resolve blanks
+ * the values but keeps the resolve shape: its "secrets" is an object keyed by
+ * name, it never says whether a secret is *declared* required, and when a
+ * required secret is missing that object is empty. A report's "secrets" is an
+ * ARRAY of per-secret entries carrying "name", "required", "status"
+ * ("resolved" / "missing_required" / "missing_optional") and provenance, and
+ * lists every declared secret whether or not it resolved. "required" is
+ * reachable only via "report".
  *
  * Response envelope:
- *   { "ok": true,  "response": { ...resolve response... } }
+ *   { "ok": true,  "response": { ...resolve response | resolution report... } }
  *   { "ok": false, "error": { "kind": "io", "message": "..." } }
  *
- * The response (when ok) carries secret values unless "no_values" was set.
- * Treat returned strings as sensitive and free them promptly.
+ * "ok": false means the call itself failed (bad manifest, provider error,
+ * unknown "mode"); a missing required secret is a domain result reported inside
+ * an "ok": true response.
+ *
+ * A resolve response carries secret values unless "no_values" was set; a report
+ * never does. Treat returned strings as sensitive and free them promptly.
  */
 #ifndef SECRETSPEC_H
 #define SECRETSPEC_H

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secretspec
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.16.0
 platform: aarch64-linux
 authors:
 - Cachix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-16 00:00:00.000000000 Z
+date: 2026-07-18 00:00:00.000000000 Z
 dependencies: []
 description: 'Ruby bindings for SecretSpec: a native extension that statically links
   the secretspec-ffi C ABI.'