secretspec 0.16.0-aarch64-linux → 0.17.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 776b23b5098306f53c300d556ae5921a2c61096e55c7c43fc4c3519c7870a962
-  data.tar.gz: 5ce2e9b49108d315d1d7588a70bf3d1f76311adf447d42b7cf8635f35751b724
+  metadata.gz: 81d946255f67745ea2b63e069ce1bf6e61dadb49e19f5cd035a9efeaceaa85f8
+  data.tar.gz: 56ddcddd4aea5769b86654226921aa6f20d4430573f4f190bf4aea54adf2a787
 SHA512:
-  metadata.gz: e384fd2b953f4f0179d2ea86507f381966c5be3fd2711cee32a79d5ba8f20ab0f64121af05d1fa511a1eb50dd2bf7f353ea1d322a1e1c7865099b039ff74739d
-  data.tar.gz: c3792261d7be630c3905a0046feb441d25b7d58382bc5374f7f63414ccc94e8720e0e2e1524e315902dc53f16f6855128e68b25d8ca07954ce9dd91282a3de1d
+  metadata.gz: d60a6f402c3131e1d67213cf5bbc8c72f482865f13ca8ffc6e7428542c9d1fed10ae7ffea2f5dd63a8b95e9d1d6d3c4a6b0b2aeff16289ffccd6bdb964db541a
+  data.tar.gz: 20a6d71f91633b1527354f86c9a918d7cbe614e214dd84c8ef827a61f4825c0bdbe732bd8448a2a51aab4e6657e2b86b36e4f5ed09b6c44ffbc5b40733088ebf

data/README.md

@@ -24,6 +24,15 @@ resolved.set_as_env!    # export everything into ENV
 A missing required secret raises `Secretspec::MissingRequiredError`; any other
 failure raises `Secretspec::Error` (with a stable `#kind`).
 
+## Scopes (0.17+)
+
+Use `.with_scope("api")` to resolve only a named `[scopes.api]` subset. Both
+`resolved.scope` and `report.scope` return the selected scope:
+
+```ruby
+resolved = Secretspec::SecretSpec.builder.with_scope("api").load
+```
+
 ## Cleanup
 
 `as_path` secrets are materialized to temp files that outlive the call. Pass a

data/ext/secretspec/extconf.rb

@@ -57,5 +57,9 @@ $INCFLAGS << " -I#{include_dir}"
 # for the referenced symbols) precedes the system libs it depends on.
 $LOCAL_LIBS << " #{staticlib}"
 $libs = "#{$libs} #{find_native_libs(vendor, repo_root)}"
+# The Windows gem bundles MinGW import libraries next to the staticlib
+# (libwindows.*.a / libwinapi_*.a ship inside cargo registry crates, so an
+# installing machine has them nowhere else); let the linker search vendor/.
+$LIBPATH << vendor if File.directory?(vendor)
 
 create_makefile("secretspec/secretspec_ext")

data/lib/secretspec.rb

@@ -54,7 +54,7 @@ module Secretspec
   end
 
   # A successful resolution, mirroring the Rust Resolved wrapper.
-  Resolved = Struct.new(:provider, :profile, :secrets, :missing_optional) do
+  Resolved = Struct.new(:provider, :profile, :secrets, :missing_optional, :scope) do
     # Export each resolved secret into ENV by its declared name. Secrets with no
     # usable value (e.g. under no_values) are skipped rather than deleted from
     # ENV (assigning nil would remove the variable).
@@ -97,7 +97,7 @@ module Secretspec
   # A value-free resolution snapshot. Unlike Resolved, a missing required secret
   # is a "missing_required" status here, not an error, so a report describes a
   # profile even when its secrets are not all available.
-  Report = Struct.new(:provider, :profile, :secrets)
+  Report = Struct.new(:provider, :profile, :secrets, :scope)
 
   # The narrow C ABI, statically linked into the secretspec_ext extension. The
   # Native.c_resolve / c_abi_version C functions are defined in
@@ -145,6 +145,12 @@ module Secretspec
       self
     end
 
+    # Limit resolution to a named manifest scope (SecretSpec 0.17+).
+    def with_scope(scope)
+      @request["scope"] = scope if scope
+      self
+    end
+
     def with_reason(reason)
       @request["reason"] = reason if reason
       self
@@ -178,7 +184,7 @@ module Secretspec
 
       resolved = Resolved.new(
         response["provider"], response["profile"], secrets,
-        response["missing_optional"] || []
+        response["missing_optional"] || [], response["scope"]
       )
       return resolved unless block_given?
 
@@ -202,7 +208,7 @@ module Secretspec
                          s["source_provider"], s["default_applied"],
                          s["generated"], s["as_path"])
       end
-      Report.new(response["provider"], response["profile"], secrets)
+      Report.new(response["provider"], response["profile"], secrets, response["scope"])
     end
 
     private

data/vendor/secretspec.h

@@ -7,8 +7,10 @@
  *
  * Request JSON (all fields optional):
  *   { "path": ".../secretspec.toml", "provider": "keyring://",
- *     "profile": "production", "reason": "boot", "no_values": false,
- *     "mode": "resolve" }
+ *     "profile": "production", "scope": "api", "reason": "boot",
+ *     "no_values": false, "mode": "resolve" }
+ *
+ * "scope" selects a named [scopes] subset of the active profile (0.17+).
  *
  * "mode" selects the response shape and defaults to "resolve":
  *

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secretspec
 version: !ruby/object:Gem::Version
-  version: 0.16.0
+  version: 0.17.0
 platform: aarch64-linux
 authors:
 - Cachix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-18 00:00:00.000000000 Z
+date: 2026-07-27 00:00:00.000000000 Z
 dependencies: []
 description: 'Ruby bindings for SecretSpec: a native extension that statically links
   the secretspec-ffi C ABI.'