seekrit-sdk 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: ba399e476a1d0cf22163313d57429d3e0755a0abe529a0d6753c5aa15b59d5f1
+  data.tar.gz: 5a4d6d97926a59c8d69dae239e5de3ad8ff3cba09918cc90c04acfcbc6b5766e
+SHA512:
+  metadata.gz: 7392e7806c33b25da0c2667c6fab4bee773d557dfac3865a2cb6cc0e65298e5138ad3bd10996fbfc9f423303d74447d108b3fabe5e762edf6155ac22512ba557
+  data.tar.gz: 413ce7dc3f15b63ad2d16e5baac4bdf5fa723f3f3375df590c3922da733302477493f5de8237fa39c7a92d7feef3011059bb9f9b84179a9ab1ef74856fa90fcd

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 seekrit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,96 @@
+# seekrit — Ruby SDK
+
+Read-path SDK for [seekrit](https://seekrit.dev). Authenticate with a service
+token, resolve your environment, and get **decrypted** secrets — the API only
+ever returns ciphertext; decryption happens in your process.
+
+> This repo is a **read-only mirror** published from seekrit's monorepo so the
+> code that holds your token and decrypts plaintext is auditable. Don't commit
+> here — it's overwritten on each sync. Issues and PRs welcome.
+
+## Install
+
+```sh
+gem install seekrit-sdk
+```
+
+Or in a Gemfile:
+
+```ruby
+gem "seekrit-sdk"
+```
+
+Requires Ruby 3.0+. **No runtime dependencies** — uses only the standard
+library (`openssl`, `net/http`, `json`).
+
+## Usage
+
+The gem is `seekrit-sdk`; the module is `Seekrit`. Require it as `seekrit/sdk`
+(or `seekrit` — both work):
+
+```ruby
+require "seekrit/sdk"
+
+client = Seekrit::Client.new       # token from ENV["SEEKRIT_TOKEN"]
+secrets = client.resolve           # { "DATABASE_URL" => "postgres://…", … }
+
+db_url = client.get("DATABASE_URL")
+api_key = client.get("API_KEY", "")
+```
+
+Load everything into `ENV`:
+
+```ruby
+Seekrit.load_env!                  # existing ENV vars win by default
+ENV["DATABASE_URL"]                # => "postgres://…"
+```
+
+### Rails
+
+The gem ships a Railtie. Opt in from `config/application.rb` or an initializer:
+
+```ruby
+config.seekrit.autoload = true     # load $SEEKRIT_TOKEN's secrets into ENV on boot
+config.seekrit.override = false    # keep existing ENV vars (default)
+```
+
+Nothing hits the network at boot unless `autoload` is set.
+
+### Configuration
+
+| Keyword | Env var | Default |
+| --- | --- | --- |
+| `token:` | `SEEKRIT_TOKEN` | — (required) |
+| `api_url:` | `SEEKRIT_API_URL` | `https://api.seekrit.dev` |
+| `with:` | — | `{}` |
+| `open_timeout:` / `read_timeout:` | — | `10` / `30` (seconds) |
+
+A service token binds to a single app environment (plus its composed group
+slices). Pass `with:` to pull a different environment slice of a composed group:
+
+```ruby
+Seekrit::Client.new(with: { "shared" => "dev" }).resolve
+```
+
+### Errors
+
+- `Seekrit::ApiError` — non-2xx from the API; has `#status` and `#code`
+  (`"unauthorized"`, `"forbidden"`, `"not_found"`, …).
+- `Seekrit::CryptoError` — a token or ciphertext could not be parsed/decrypted.
+- `Seekrit::Error` — base class (also covers network failures).
+
+`#resolve` is **fail-closed**: any resolve or decrypt failure raises rather than
+returning partial results.
+
+## Zero-knowledge
+
+`GET /v1/resolve` returns ciphertext plus a data-encryption key wrapped to your
+token's public key. This SDK recovers the token's private key, unwraps the DEK
+(ECDH P-256 → HKDF-SHA256 → AES-256-GCM), and decrypts each secret
+(AES-256-GCM, AAD-bound to `environmentId/NAME`) — the exact scheme used by the
+CLI, `seekrit run`, and every other seekrit client. See
+[seekrit.dev/docs](https://seekrit.dev/docs/concepts/encryption).
+
+## License
+
+MIT

data/lib/seekrit/client.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "json"
+require "net/http"
+require "uri"
+
+require_relative "crypto"
+require_relative "errors"
+
+module Seekrit
+  # A read-only seekrit client bound to one service token. A service token
+  # selects exactly one app environment (plus its composed group slices).
+  #
+  #   client = Seekrit::Client.new           # token from ENV["SEEKRIT_TOKEN"]
+  #   secrets = client.resolve               # { "DATABASE_URL" => "...", ... }
+  class Client
+    DEFAULT_API_URL = "https://api.seekrit.dev"
+
+    # @param token [String, nil] skt_... service token; defaults to ENV["SEEKRIT_TOKEN"].
+    # @param api_url [String, nil] API base URL; defaults to ENV["SEEKRIT_API_URL"] or the hosted API.
+    # @param with [Hash] {group_slug => env_slug} overrides (the ?with= override).
+    # @param open_timeout [Numeric] connection timeout, seconds.
+    # @param read_timeout [Numeric] read timeout, seconds.
+    def initialize(token: nil, api_url: nil, with: {}, open_timeout: 10, read_timeout: 30)
+      @token = token || ENV["SEEKRIT_TOKEN"]
+      raise Error, "no service token: pass token: or set SEEKRIT_TOKEN" unless @token && !@token.empty?
+
+      @key = Crypto::TokenKey.parse(@token) # fail fast on a bad token
+      @api_url = (api_url || ENV["SEEKRIT_API_URL"] || DEFAULT_API_URL).sub(%r{/+\z}, "")
+      @with = with || {}
+      @open_timeout = open_timeout
+      @read_timeout = read_timeout
+    end
+
+    # Fetch, decrypt, and merge; returns { "NAME" => value }. Fail-closed.
+    # @return [Hash{String=>String}]
+    def resolve
+      Crypto.materialize(fetch, @key)
+    end
+
+    # Resolve and return a single secret's value, or +default+ if absent.
+    def get(name, default = nil)
+      resolve.fetch(name, default)
+    end
+
+    # Load resolved secrets into +env+ (default ENV). Existing keys are kept
+    # unless +override:+ is true. Returns the resolved secrets.
+    def into_env(env = ENV, override: false)
+      merged = resolve
+      merged.each do |name, value|
+        env[name] = value if override || !env.key?(name)
+      end
+      merged
+    end
+
+    private
+
+    def fetch
+      uri = URI("#{@api_url}/v1/resolve")
+      unless @with.empty?
+        uri.query = URI.encode_www_form(@with.sort.map { |group, env| ["with", "#{group}:#{env}"] })
+      end
+
+      request = Net::HTTP::Get.new(uri)
+      request["authorization"] = "Bearer #{@token}"
+      request["accept"] = "application/json"
+
+      response = Net::HTTP.start(
+        uri.host, uri.port,
+        use_ssl: uri.scheme == "https",
+        open_timeout: @open_timeout, read_timeout: @read_timeout
+      ) { |http| http.request(request) }
+
+      status = response.code.to_i
+      raise api_error(status, response.body) unless (200..299).cover?(status)
+
+      JSON.parse(response.body)
+    rescue SocketError, Timeout::Error, IOError => e
+      raise Error, "resolve request failed: #{e.message}"
+    end
+
+    def api_error(status, body)
+      code = "internal"
+      message = "HTTP #{status}"
+      begin
+        error = JSON.parse(body)["error"]
+        if error.is_a?(Hash) && error["code"]
+          code = error["code"]
+          message = error["message"] || message
+        end
+      rescue JSON::ParserError, TypeError
+        # non-JSON body — keep the fallback
+      end
+      ApiError.new(status, code, message)
+    end
+  end
+
+  # Convenience: load a token's secrets straight into ENV.
+  #   Seekrit.load_env!
+  def self.load_env!(**opts)
+    override = opts.delete(:override) { false }
+    Client.new(**opts).into_env(ENV, override: override)
+  end
+end

data/lib/seekrit/crypto.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "base64"
+
+module Seekrit
+  # Zero-knowledge read path, byte-compatible with @seekrit/crypto and
+  # crates/seekrit-core. Three steps:
+  #
+  #   1. Recover the service token's P-256 private key  (TokenKey.parse).
+  #   2. Unwrap each environment DEK                     (TokenKey#unwrap_dek).
+  #   3. Decrypt each secret                             (Crypto.decrypt_secret).
+  #
+  # Blob formats (all segments base64url, no padding):
+  #   token       skt_<id>_<pkcs8 private key>
+  #   wrapped DEK wd1.<ephemeral pub (raw SEC1)>.<hkdf salt>.<iv>.<ciphertext||tag>
+  #   secret      sc1.<iv>.<ciphertext||tag>
+  module Crypto
+    HKDF_INFO = "seekrit/wrap-dek/v1"
+    CURVE = "prime256v1" # NIST P-256 / secp256r1
+    # Only the first two underscores are separators; the key segment may contain "_".
+    TOKEN_RE = /\A(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)\z/.freeze
+
+    module_function
+
+    def b64url_decode(text)
+      Base64.urlsafe_decode64(text + ("=" * ((4 - (text.length % 4)) % 4)))
+    end
+
+    def split_blob(blob, prefix, segments)
+      parts = blob.split(".")
+      unless parts[0] == prefix
+        raise CryptoError, %(expected a "#{prefix}" blob, got "#{parts[0]}")
+      end
+      if parts.length != segments + 1 || parts.any?(&:empty?)
+        raise CryptoError, %(malformed "#{prefix}" blob)
+      end
+
+      parts[1..]
+    end
+
+    # AAD binding a secret ciphertext to its environment and name.
+    def secret_aad(environment_id, name)
+      "#{environment_id}/#{name}"
+    end
+
+    # HKDF-SHA256 (RFC 5869), implemented with HMAC so it works on every Ruby /
+    # OpenSSL / LibreSSL build regardless of OpenSSL::KDF.hkdf availability.
+    def hkdf_sha256(ikm, salt, info, length)
+      prk = OpenSSL::HMAC.digest("SHA256", salt, ikm)
+      okm = +""
+      block = +""
+      counter = 0
+      while okm.bytesize < length
+        counter += 1
+        block = OpenSSL::HMAC.digest("SHA256", prk, block + info + [counter].pack("C"))
+        okm << block
+      end
+      okm[0, length]
+    end
+
+    def aes_gcm_decrypt(key, iv, ciphertext_and_tag, aad)
+      raise CryptoError, "ciphertext too short" if ciphertext_and_tag.bytesize < 16
+
+      tag = ciphertext_and_tag[-16, 16]
+      ciphertext = ciphertext_and_tag[0...-16]
+      cipher = OpenSSL::Cipher.new("aes-256-gcm")
+      cipher.decrypt
+      cipher.key = key
+      cipher.iv = iv
+      cipher.auth_tag = tag
+      # GCM with no AAD == empty AAD; skip the call so a zero-length AAD never
+      # trips broken bindings (e.g. some LibreSSL builds).
+      cipher.auth_data = aad unless aad.nil? || aad.empty?
+      cipher.update(ciphertext) + cipher.final
+    end
+
+    # The P-256 private key recovered from a skt_... service token.
+    class TokenKey
+      attr_reader :token_id
+
+      def initialize(token_id, ec_key)
+        @token_id = token_id
+        @ec_key = ec_key
+      end
+
+      def self.parse(token)
+        match = Crypto::TOKEN_RE.match(token)
+        raise CryptoError, "not a valid seekrit service token" unless match
+
+        der = Crypto.b64url_decode(match[2])
+        ec_key = begin
+          key = OpenSSL::PKey.read(der)
+          raise CryptoError, "service token key is not an EC private key" unless key.is_a?(OpenSSL::PKey::EC)
+
+          key
+        rescue OpenSSL::PKey::PKeyError, ArgumentError
+          begin
+            OpenSSL::PKey::EC.new(der)
+          rescue StandardError
+            raise CryptoError, "service token private key is corrupted"
+          end
+        end
+        new(match[1], ec_key)
+      end
+
+      # Recover a 32-byte environment DEK from a wd1. blob.
+      def unwrap_dek(wrapped)
+        eph_b64, salt_b64, iv_b64, ct_b64 = Crypto.split_blob(wrapped, "wd1", 4)
+        eph = Crypto.b64url_decode(eph_b64)
+        salt = Crypto.b64url_decode(salt_b64)
+        iv = Crypto.b64url_decode(iv_b64)
+        ct = Crypto.b64url_decode(ct_b64)
+
+        group = OpenSSL::PKey::EC::Group.new(Crypto::CURVE)
+        peer_point = OpenSSL::PKey::EC::Point.new(group, OpenSSL::BN.new(eph, 2))
+        shared = @ec_key.dh_compute_key(peer_point)
+        wrapping_key = Crypto.hkdf_sha256(shared, salt, Crypto::HKDF_INFO, 32)
+
+        dek = begin
+          Crypto.aes_gcm_decrypt(wrapping_key, iv, ct, "")
+        rescue OpenSSL::Cipher::CipherError
+          raise CryptoError, "DEK unwrap failed: wrong private key or tampered grant"
+        end
+        raise CryptoError, "unwrapped DEK has wrong length" unless dek.bytesize == 32
+
+        dek
+      end
+    end
+
+    # Decrypt an sc1. secret ciphertext to its UTF-8 plaintext.
+    def decrypt_secret(dek, blob, aad)
+      iv_b64, ct_b64 = split_blob(blob, "sc1", 2)
+      iv = b64url_decode(iv_b64)
+      ct = b64url_decode(ct_b64)
+      plaintext = begin
+        aes_gcm_decrypt(dek, iv, ct, aad)
+      rescue OpenSSL::Cipher::CipherError
+        raise CryptoError, "secret decryption failed: wrong key, tampered data, or mismatched context"
+      end
+      plaintext.force_encoding(Encoding::UTF_8)
+    end
+
+    # Decrypt every layer and merge by precedence. Layers arrive lowest
+    # precedence first (composed groups, then the app environment); later layers
+    # overwrite earlier ones on a name collision.
+    def materialize(resolve_response, key)
+      merged = {}
+      resolve_response["layers"].each do |layer|
+        dek = key.unwrap_dek(layer["wrappedDek"])
+        env_id = layer["environmentId"]
+        layer["secrets"].each do |secret|
+          merged[secret["name"]] = decrypt_secret(dek, secret["ciphertext"], secret_aad(env_id, secret["name"]))
+        end
+      end
+      merged
+    end
+  end
+end

data/lib/seekrit/errors.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Seekrit
+  # Base class for every error raised by this SDK.
+  class Error < StandardError; end
+
+  # A token, wrapped DEK, or secret ciphertext could not be parsed or decrypted.
+  # Deliberately unspecific: a decrypt failure does not distinguish "wrong key"
+  # from "tampered data" from "mismatched context".
+  class CryptoError < Error; end
+
+  # The resolve API returned a non-2xx response.
+  class ApiError < Error
+    # @return [Integer] HTTP status code.
+    attr_reader :status
+    # @return [String] error.code from the API body (e.g. "unauthorized",
+    #   "forbidden", "not_found"), or "internal" if the body did not parse.
+    attr_reader :code
+
+    def initialize(status, code, message)
+      @status = status
+      @code = code
+      super("#{status} #{code}: #{message}")
+    end
+  end
+end

data/lib/seekrit/railtie.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative "client"
+
+module Seekrit
+  # Optional Rails integration. Loaded automatically when Rails is present
+  # (see lib/seekrit.rb). Opt-in: resolved secrets are only loaded into ENV if
+  # you enable it, so nothing hits the network at boot unless you ask.
+  #
+  #   # config/application.rb (or an initializer)
+  #   config.seekrit.autoload = true      # load $SEEKRIT_TOKEN's secrets into ENV on boot
+  #   config.seekrit.override = false     # keep existing ENV vars (default)
+  #
+  # Or call it yourself whenever you like:
+  #
+  #   Seekrit.load_env!
+  class Railtie < ::Rails::Railtie
+    config.seekrit = ActiveSupport::OrderedOptions.new
+    config.seekrit.autoload = false
+    config.seekrit.override = false
+
+    initializer "seekrit.load_env", before: :load_environment_config do |app|
+      cfg = app.config.seekrit
+      Seekrit.load_env!(override: cfg.override) if cfg.autoload && ENV["SEEKRIT_TOKEN"]
+    end
+  end
+end

data/lib/seekrit/sdk.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Entrypoint matching the `seekrit-sdk` gem name, so `require "seekrit/sdk"`
+# and Bundler's auto-require of `gem "seekrit-sdk"` both work. `require "seekrit"`
+# works too — both load the same code, and the module is `Seekrit`.
+require_relative "../seekrit"

data/lib/seekrit/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Seekrit
+  VERSION = "0.1.0"
+end

data/lib/seekrit.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require_relative "seekrit/version"
+require_relative "seekrit/errors"
+require_relative "seekrit/crypto"
+require_relative "seekrit/client"
+
+# seekrit — read-path SDK for the zero-knowledge secrets manager.
+#
+#   require "seekrit"
+#
+#   client = Seekrit::Client.new     # token from ENV["SEEKRIT_TOKEN"]
+#   secrets = client.resolve         # { "DATABASE_URL" => "...", ... }
+#
+# Secrets are decrypted in-process; the API only ever sees ciphertext.
+module Seekrit
+  # Load the Rails integration only when Rails is present.
+  require_relative "seekrit/railtie" if defined?(::Rails::Railtie)
+end

data/testdata/vectors.json

@@ -0,0 +1,65 @@
+{
+  "token": "skt_r36AUXMxoX0xkQoH8vimHN_MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg1bTaK96XZQzEUpfGe5dlc-sp3n7mF8WpZNVJweEJZ06hRANCAATgUoWLRDgyG0qsUzdQXzr1VSL-p9kSp_zhAULqF2qHUAWDPcuoX-f4JTUX6lyzPEs_0chQ9nKvgmEJUpXx9_q5",
+  "tokenId": "skt_r36AUXMxoX0xkQoH8vimHN",
+  "publicKeyJwk": "{\"key_ops\":[],\"ext\":true,\"kty\":\"EC\",\"x\":\"4FKFi0Q4MhtKrFM3UF869VUi_qfZEqf84QFC6hdqh1A\",\"y\":\"BYM9y6hf5_glNRfqXLM8Sz_RyFD2cq-CYQlSlfH3-rk\",\"crv\":\"P-256\"}",
+  "resolve": {
+    "scope": {
+      "orgId": "org_test",
+      "orgSlug": "acme",
+      "appId": "app_test",
+      "appSlug": "web",
+      "envId": "env_apptest0000000000001",
+      "envSlug": "production"
+    },
+    "layers": [
+      {
+        "source": "group",
+        "environmentId": "env_grouptest0000000001",
+        "slug": "production",
+        "groupSlug": "shared",
+        "wrappedDek": "wd1.BEoGSn3SoICO6tA13EjveZHvxTTRVijE0OUpBkzVkFU28q_jfgY4P9IkyrpjMVJK27zogh61rwC_NUBjoe2TKhY.5EI1On9xCtVuntRHMA6xFA.JNqiqNRxDpNN3hkP.8RxEujnGaEIUIVq9VVcOZlpC07-gxgyz25VCtffNZWSRh8J8iFfMA6p-_ubXSfv5",
+        "secrets": [
+          {
+            "name": "SHARED",
+            "ciphertext": "sc1.4XNyaS_ilRPDTlIg.LhAGzqP_cm4fx_dKeST8_3NITle_77x0Qjo"
+          },
+          {
+            "name": "DATABASE_URL",
+            "ciphertext": "sc1.-THIwVQA7yVq6SWt.1RaVPddl8QDuhc2wValcmtArCxafHBCAk24Fv00gB_FNc6k"
+          },
+          {
+            "name": "UNICODE",
+            "ciphertext": "sc1.7qB3RU8qhHKpqwbB.BsKeZYWDv4Qp9cWIB0I684pLazslk2nFtIq-OvgDjIaTaw3Pbw"
+          }
+        ]
+      },
+      {
+        "source": "app",
+        "environmentId": "env_apptest0000000000001",
+        "slug": "production",
+        "wrappedDek": "wd1.BMywXqAVq3Ee3XX7mGBt2KLcRRwPLQn9FjlXc19Z8HNdDPsg-KyKLwg_uz4tgQ8MdVevMgtjfBkOiqmAi7ENI2Y.FLBNZ3z8-8CnYoBN-Azr9g.2x8wkp6BSw9QjnG2.3b32qenHIHC92eCehRW6QGWNFTlIe3nTKPje0WsRFWSHkjV6PYIxCXmlQaAJJkp3",
+        "secrets": [
+          {
+            "name": "SHARED",
+            "ciphertext": "sc1.QF697pJ61KM9Xqj2.HH9PNlW7aIIWZvpLm6yc8ZCRRemlxoOS"
+          },
+          {
+            "name": "API_KEY",
+            "ciphertext": "sc1.x4G_KqJP7ags8SBf.obw89lhKqcMAy1vzjdTjch88R7Trx9JtFWS2Rw"
+          },
+          {
+            "name": "EMPTY",
+            "ciphertext": "sc1.qdub6o6QejpKH97e.KFe1fiDvtHF3agstKhL5ng"
+          }
+        ]
+      }
+    ]
+  },
+  "expectedManagedValues": {
+    "SHARED": "from-app",
+    "DATABASE_URL": "postgres://group/db",
+    "UNICODE": "héllo-🌍-\n-tab\tend",
+    "API_KEY": "sk-app-12345",
+    "EMPTY": ""
+  }
+}

metadata

@@ -0,0 +1,63 @@
+--- !ruby/object:Gem::Specification
+name: seekrit-sdk
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- seekrit
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-07-19 00:00:00.000000000 Z
+dependencies: []
+description: |
+  Read-path SDK for seekrit, the zero-knowledge secrets manager. Authenticate
+  with a service token, resolve your environment, and get decrypted secrets —
+  the API only ever returns ciphertext; decryption happens in your process.
+  Uses only the Ruby standard library (openssl, net/http, json). Optional Rails
+  integration included. Require as "seekrit" or "seekrit/sdk"; the module is
+  Seekrit.
+email:
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/seekrit.rb
+- lib/seekrit/client.rb
+- lib/seekrit/crypto.rb
+- lib/seekrit/errors.rb
+- lib/seekrit/railtie.rb
+- lib/seekrit/sdk.rb
+- lib/seekrit/version.rb
+- testdata/vectors.json
+homepage: https://seekrit.dev
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://seekrit.dev
+  documentation_uri: https://seekrit.dev/docs
+  source_code_uri: https://github.com/seekritdev/ruby-sdk
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Read-path SDK for seekrit — resolve and decrypt secrets client-side with
+  a service token.
+test_files: []