secretspec 0.15.0-x86_64-linux → 0.16.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d0a15ec8f8274206ece98d5a6b46c416a0318f74e941475552a14a60773bd984
-  data.tar.gz: 062dbfaae336037c2243cbda124ff5923d2b2eea3e9b6e7bbc0100ae7be32b2e
+  metadata.gz: 342614f94ce392512d32d2fc7beacce975deec8d27244057d3aea66925cb7fae
+  data.tar.gz: 8b616ea574c2179205056266443d2abd677aab57def093dd6154fa3677e7235b
 SHA512:
-  metadata.gz: 8c072b3b9252033632a6c2cc2d84ec04a30be9791b56ab9c391610396de0805a29ccd30f275a5a607a967786b51843988436b1f763aa8623547d7ca5d3e73a57
-  data.tar.gz: c5ab26829a963fec52587cf44cfa8b065fff7e4b6e3c44b65dd3a7f62775e389fb9268eabc8030f9181a946ca6b8588a9d6c4a6c989db1504ffa02a8965f2e0c
+  metadata.gz: 6dc3cb012db0d94d0cb2e87bf88177fd41a187b1236c81e7dc29e2f843f1d307f5e39ce64db8ab777d04454d064d061ecfd2539104d5ee3f9bf697cdcb237a62
+  data.tar.gz: ca4cdf988d107d5b1cd78aec16cae43831c7870aaae3a70bd294821e78d02ccd913e0b601b353966ccc9060e0cd9f42142d640acd2e56e790f0ba0ea858694ca

data/lib/secretspec.rb

@@ -19,7 +19,7 @@ require "secretspec/secretspec_ext"
 module Secretspec
   # Response wire-format version this SDK understands. Tracks secretspec-ffi's
   # RESOLVE_SCHEMA_VERSION; a mismatch means the loaded library is incompatible.
-  RESOLVE_SCHEMA_VERSION = 1
+  RESOLVE_SCHEMA_VERSION = 2
 
   # Wire-format version of the value-free report. Tracks secretspec's
   # RESOLUTION_REPORT_SCHEMA_VERSION.

data/vendor/secretspec.h

@@ -7,14 +7,37 @@
  *
  * Request JSON (all fields optional):
  *   { "path": ".../secretspec.toml", "provider": "keyring://",
- *     "profile": "production", "reason": "boot", "no_values": false }
+ *     "profile": "production", "reason": "boot", "no_values": false,
+ *     "mode": "resolve" }
+ *
+ * "mode" selects the response shape and defaults to "resolve":
+ *
+ *   "resolve"  the value-carrying resolve response. Set "no_values" to strip
+ *              the values from it.
+ *   "report"   the value-free resolution report: the inventory/preflight view
+ *              the CLI exposes as `check --json`.
+ *
+ * Any other value is rejected with an "invalid_request" error.
+ *
+ * "no_values" is NOT the same as "mode": "report". A "no_values" resolve blanks
+ * the values but keeps the resolve shape: its "secrets" is an object keyed by
+ * name, it never says whether a secret is *declared* required, and when a
+ * required secret is missing that object is empty. A report's "secrets" is an
+ * ARRAY of per-secret entries carrying "name", "required", "status"
+ * ("resolved" / "missing_required" / "missing_optional") and provenance, and
+ * lists every declared secret whether or not it resolved. "required" is
+ * reachable only via "report".
  *
  * Response envelope:
- *   { "ok": true,  "response": { ...resolve response... } }
+ *   { "ok": true,  "response": { ...resolve response | resolution report... } }
  *   { "ok": false, "error": { "kind": "io", "message": "..." } }
  *
- * The response (when ok) carries secret values unless "no_values" was set.
- * Treat returned strings as sensitive and free them promptly.
+ * "ok": false means the call itself failed (bad manifest, provider error,
+ * unknown "mode"); a missing required secret is a domain result reported inside
+ * an "ok": true response.
+ *
+ * A resolve response carries secret values unless "no_values" was set; a report
+ * never does. Treat returned strings as sensitive and free them promptly.
  */
 #ifndef SECRETSPEC_H
 #define SECRETSPEC_H

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secretspec
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.16.0
 platform: x86_64-linux
 authors:
 - Cachix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-16 00:00:00.000000000 Z
+date: 2026-07-18 00:00:00.000000000 Z
 dependencies: []
 description: 'Ruby bindings for SecretSpec: a native extension that statically links
   the secretspec-ffi C ABI.'