secretspec 0.15.0-aarch64-linux → 0.17.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 484bf966477a3487bb050be087bf0698c47ea1b58dda9322d91810e50d40c6e7
-  data.tar.gz: c92791c8306b24552d7f3d10ab3f7e862fd35525298ec49f9e80996eedf71671
+  metadata.gz: 81d946255f67745ea2b63e069ce1bf6e61dadb49e19f5cd035a9efeaceaa85f8
+  data.tar.gz: 56ddcddd4aea5769b86654226921aa6f20d4430573f4f190bf4aea54adf2a787
 SHA512:
-  metadata.gz: 39a5d5ba838d8e0d216f9649b3edd1b9076ae991172476d2282d437b3100bedcbf9f1edb6fa174bd807759282bf726d234c0ff57c840674c395baa5ced82623d
-  data.tar.gz: b516fa46336f3e1f90f3ab0fe25de7734ab6a02bcefafcb32d3bfa19c235f05d8221c9d37d6e882da73e08bd8d8fb10049a047836afc51bd0dddeb3d2557eb02
+  metadata.gz: d60a6f402c3131e1d67213cf5bbc8c72f482865f13ca8ffc6e7428542c9d1fed10ae7ffea2f5dd63a8b95e9d1d6d3c4a6b0b2aeff16289ffccd6bdb964db541a
+  data.tar.gz: 20a6d71f91633b1527354f86c9a918d7cbe614e214dd84c8ef827a61f4825c0bdbe732bd8448a2a51aab4e6657e2b86b36e4f5ed09b6c44ffbc5b40733088ebf

data/README.md

@@ -24,6 +24,15 @@ resolved.set_as_env!    # export everything into ENV
 A missing required secret raises `Secretspec::MissingRequiredError`; any other
 failure raises `Secretspec::Error` (with a stable `#kind`).
 
+## Scopes (0.17+)
+
+Use `.with_scope("api")` to resolve only a named `[scopes.api]` subset. Both
+`resolved.scope` and `report.scope` return the selected scope:
+
+```ruby
+resolved = Secretspec::SecretSpec.builder.with_scope("api").load
+```
+
 ## Cleanup
 
 `as_path` secrets are materialized to temp files that outlive the call. Pass a

data/ext/secretspec/extconf.rb

@@ -57,5 +57,9 @@ $INCFLAGS << " -I#{include_dir}"
 # for the referenced symbols) precedes the system libs it depends on.
 $LOCAL_LIBS << " #{staticlib}"
 $libs = "#{$libs} #{find_native_libs(vendor, repo_root)}"
+# The Windows gem bundles MinGW import libraries next to the staticlib
+# (libwindows.*.a / libwinapi_*.a ship inside cargo registry crates, so an
+# installing machine has them nowhere else); let the linker search vendor/.
+$LIBPATH << vendor if File.directory?(vendor)
 
 create_makefile("secretspec/secretspec_ext")

data/lib/secretspec.rb

@@ -19,7 +19,7 @@ require "secretspec/secretspec_ext"
 module Secretspec
   # Response wire-format version this SDK understands. Tracks secretspec-ffi's
   # RESOLVE_SCHEMA_VERSION; a mismatch means the loaded library is incompatible.
-  RESOLVE_SCHEMA_VERSION = 1
+  RESOLVE_SCHEMA_VERSION = 2
 
   # Wire-format version of the value-free report. Tracks secretspec's
   # RESOLUTION_REPORT_SCHEMA_VERSION.
@@ -54,7 +54,7 @@ module Secretspec
   end
 
   # A successful resolution, mirroring the Rust Resolved wrapper.
-  Resolved = Struct.new(:provider, :profile, :secrets, :missing_optional) do
+  Resolved = Struct.new(:provider, :profile, :secrets, :missing_optional, :scope) do
     # Export each resolved secret into ENV by its declared name. Secrets with no
     # usable value (e.g. under no_values) are skipped rather than deleted from
     # ENV (assigning nil would remove the variable).
@@ -97,7 +97,7 @@ module Secretspec
   # A value-free resolution snapshot. Unlike Resolved, a missing required secret
   # is a "missing_required" status here, not an error, so a report describes a
   # profile even when its secrets are not all available.
-  Report = Struct.new(:provider, :profile, :secrets)
+  Report = Struct.new(:provider, :profile, :secrets, :scope)
 
   # The narrow C ABI, statically linked into the secretspec_ext extension. The
   # Native.c_resolve / c_abi_version C functions are defined in
@@ -145,6 +145,12 @@ module Secretspec
       self
     end
 
+    # Limit resolution to a named manifest scope (SecretSpec 0.17+).
+    def with_scope(scope)
+      @request["scope"] = scope if scope
+      self
+    end
+
     def with_reason(reason)
       @request["reason"] = reason if reason
       self
@@ -178,7 +184,7 @@ module Secretspec
 
       resolved = Resolved.new(
         response["provider"], response["profile"], secrets,
-        response["missing_optional"] || []
+        response["missing_optional"] || [], response["scope"]
       )
       return resolved unless block_given?
 
@@ -202,7 +208,7 @@ module Secretspec
                          s["source_provider"], s["default_applied"],
                          s["generated"], s["as_path"])
       end
-      Report.new(response["provider"], response["profile"], secrets)
+      Report.new(response["provider"], response["profile"], secrets, response["scope"])
     end
 
     private

data/vendor/secretspec.h

@@ -7,14 +7,39 @@
  *
  * Request JSON (all fields optional):
  *   { "path": ".../secretspec.toml", "provider": "keyring://",
- *     "profile": "production", "reason": "boot", "no_values": false }
+ *     "profile": "production", "scope": "api", "reason": "boot",
+ *     "no_values": false, "mode": "resolve" }
+ *
+ * "scope" selects a named [scopes] subset of the active profile (0.17+).
+ *
+ * "mode" selects the response shape and defaults to "resolve":
+ *
+ *   "resolve"  the value-carrying resolve response. Set "no_values" to strip
+ *              the values from it.
+ *   "report"   the value-free resolution report: the inventory/preflight view
+ *              the CLI exposes as `check --json`.
+ *
+ * Any other value is rejected with an "invalid_request" error.
+ *
+ * "no_values" is NOT the same as "mode": "report". A "no_values" resolve blanks
+ * the values but keeps the resolve shape: its "secrets" is an object keyed by
+ * name, it never says whether a secret is *declared* required, and when a
+ * required secret is missing that object is empty. A report's "secrets" is an
+ * ARRAY of per-secret entries carrying "name", "required", "status"
+ * ("resolved" / "missing_required" / "missing_optional") and provenance, and
+ * lists every declared secret whether or not it resolved. "required" is
+ * reachable only via "report".
  *
  * Response envelope:
- *   { "ok": true,  "response": { ...resolve response... } }
+ *   { "ok": true,  "response": { ...resolve response | resolution report... } }
  *   { "ok": false, "error": { "kind": "io", "message": "..." } }
  *
- * The response (when ok) carries secret values unless "no_values" was set.
- * Treat returned strings as sensitive and free them promptly.
+ * "ok": false means the call itself failed (bad manifest, provider error,
+ * unknown "mode"); a missing required secret is a domain result reported inside
+ * an "ok": true response.
+ *
+ * A resolve response carries secret values unless "no_values" was set; a report
+ * never does. Treat returned strings as sensitive and free them promptly.
  */
 #ifndef SECRETSPEC_H
 #define SECRETSPEC_H

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secretspec
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.17.0
 platform: aarch64-linux
 authors:
 - Cachix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-16 00:00:00.000000000 Z
+date: 2026-07-27 00:00:00.000000000 Z
 dependencies: []
 description: 'Ruby bindings for SecretSpec: a native extension that statically links
   the secretspec-ffi C ABI.'