secretspec 0.16.0-x86_64-linux → 0.17.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 342614f94ce392512d32d2fc7beacce975deec8d27244057d3aea66925cb7fae
-  data.tar.gz: 8b616ea574c2179205056266443d2abd677aab57def093dd6154fa3677e7235b
+  metadata.gz: 16f774260680b4aaf85a35802b7108b4328a307e8e7863853e4b828358586c14
+  data.tar.gz: 23f6f008f3cadce06dbd1ae8b6b72cb18df2a3dbb1958db5b163293917cf3feb
 SHA512:
-  metadata.gz: 6dc3cb012db0d94d0cb2e87bf88177fd41a187b1236c81e7dc29e2f843f1d307f5e39ce64db8ab777d04454d064d061ecfd2539104d5ee3f9bf697cdcb237a62
-  data.tar.gz: ca4cdf988d107d5b1cd78aec16cae43831c7870aaae3a70bd294821e78d02ccd913e0b601b353966ccc9060e0cd9f42142d640acd2e56e790f0ba0ea858694ca
+  metadata.gz: 2fd38176d59beb97550ff0f7ae5558ae92b33fcd4c369aee17f4354aaa2b6c6c4290862aa1a7c810581d36961484be3e93add67997027c37c0190b22603c57a1
+  data.tar.gz: 3fbcfdac431b62f45b79582e15de2cdef499b73bea61b70a38080f8ebbfea8271e6c8f4fe7b221d78163879809e524e62e46a5cd9670e9eef2e6455d93c7da1e

data/README.md

@@ -24,6 +24,15 @@ resolved.set_as_env!    # export everything into ENV
 A missing required secret raises `Secretspec::MissingRequiredError`; any other
 failure raises `Secretspec::Error` (with a stable `#kind`).
 
+## Scopes (0.17+)
+
+Use `.with_scope("api")` to resolve only a named `[scopes.api]` subset. Both
+`resolved.scope` and `report.scope` return the selected scope:
+
+```ruby
+resolved = Secretspec::SecretSpec.builder.with_scope("api").load
+```
+
 ## Cleanup
 
 `as_path` secrets are materialized to temp files that outlive the call. Pass a

data/ext/secretspec/extconf.rb

@@ -57,5 +57,9 @@ $INCFLAGS << " -I#{include_dir}"
 # for the referenced symbols) precedes the system libs it depends on.
 $LOCAL_LIBS << " #{staticlib}"
 $libs = "#{$libs} #{find_native_libs(vendor, repo_root)}"
+# The Windows gem bundles MinGW import libraries next to the staticlib
+# (libwindows.*.a / libwinapi_*.a ship inside cargo registry crates, so an
+# installing machine has them nowhere else); let the linker search vendor/.
+$LIBPATH << vendor if File.directory?(vendor)
 
 create_makefile("secretspec/secretspec_ext")

data/lib/secretspec.rb

@@ -54,7 +54,7 @@ module Secretspec
   end
 
   # A successful resolution, mirroring the Rust Resolved wrapper.
-  Resolved = Struct.new(:provider, :profile, :secrets, :missing_optional) do
+  Resolved = Struct.new(:provider, :profile, :secrets, :missing_optional, :scope) do
     # Export each resolved secret into ENV by its declared name. Secrets with no
     # usable value (e.g. under no_values) are skipped rather than deleted from
     # ENV (assigning nil would remove the variable).
@@ -97,7 +97,7 @@ module Secretspec
   # A value-free resolution snapshot. Unlike Resolved, a missing required secret
   # is a "missing_required" status here, not an error, so a report describes a
   # profile even when its secrets are not all available.
-  Report = Struct.new(:provider, :profile, :secrets)
+  Report = Struct.new(:provider, :profile, :secrets, :scope)
 
   # The narrow C ABI, statically linked into the secretspec_ext extension. The
   # Native.c_resolve / c_abi_version C functions are defined in
@@ -145,6 +145,12 @@ module Secretspec
       self
     end
 
+    # Limit resolution to a named manifest scope (SecretSpec 0.17+).
+    def with_scope(scope)
+      @request["scope"] = scope if scope
+      self
+    end
+
     def with_reason(reason)
       @request["reason"] = reason if reason
       self
@@ -178,7 +184,7 @@ module Secretspec
 
       resolved = Resolved.new(
         response["provider"], response["profile"], secrets,
-        response["missing_optional"] || []
+        response["missing_optional"] || [], response["scope"]
       )
       return resolved unless block_given?
 
@@ -202,7 +208,7 @@ module Secretspec
                          s["source_provider"], s["default_applied"],
                          s["generated"], s["as_path"])
       end
-      Report.new(response["provider"], response["profile"], secrets)
+      Report.new(response["provider"], response["profile"], secrets, response["scope"])
     end
 
     private

data/vendor/secretspec.h

@@ -7,8 +7,10 @@
  *
  * Request JSON (all fields optional):
  *   { "path": ".../secretspec.toml", "provider": "keyring://",
- *     "profile": "production", "reason": "boot", "no_values": false,
- *     "mode": "resolve" }
+ *     "profile": "production", "scope": "api", "reason": "boot",
+ *     "no_values": false, "mode": "resolve" }
+ *
+ * "scope" selects a named [scopes] subset of the active profile (0.17+).
  *
  * "mode" selects the response shape and defaults to "resolve":
  *

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secretspec
 version: !ruby/object:Gem::Version
-  version: 0.16.0
+  version: 0.17.0
 platform: x86_64-linux
 authors:
 - Cachix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-18 00:00:00.000000000 Z
+date: 2026-07-27 00:00:00.000000000 Z
 dependencies: []
 description: 'Ruby bindings for SecretSpec: a native extension that statically links
   the secretspec-ffi C ABI.'