From f7bbacda0601e62a778be282a803502ce9855847 Mon Sep 17 00:00:00 2001 From: Daniel JB Clark Date: Sat, 15 Aug 2026 19:59:30 -0400 Subject: [PATCH] feat(sdk): expose Secrets::config() publicly (hidden) config() was pub(crate), gated behind #[cfg(any(feature = "cli", test))], for secretspec codegen's use. Any other embedder needing the manifest without a provider -- an out-of-tree plugin inspecting declared secrets, for instance -- had no way to reach it short of taking the whole cli feature or re-parsing the manifest itself. Changed to #[doc(hidden)] pub: additive, so it cannot break the C ABI the FFI bindings expose, and hidden from the public SDK surface since ordinary callers resolve secrets rather than manifests. --- CHANGELOG.md | 4 ++++ secretspec/src/secrets.rs | 15 +++++++++++---- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e4f176f2..19543bee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added +- `Secrets::config()` is now `#[doc(hidden)] pub` instead of `pub(crate)` + behind the `cli` feature. Any embedder that needs the manifest without a + provider — an out-of-tree plugin inspecting declared secrets, for + instance — can now reach it without taking the whole `cli` feature. - Structured caller context lets CLI and SDK integrations identify the invoking software, version, operation, and non-secret resource independently of the user-supplied access reason. Audit records and providers receive the context, diff --git a/secretspec/src/secrets.rs b/secretspec/src/secrets.rs index d7de1116..7b4c145d 100644 --- a/secretspec/src/secrets.rs +++ b/secretspec/src/secrets.rs @@ -1883,10 +1883,17 @@ impl Secrets { Ok(()) } - /// Get a reference to the project configuration. Used by `secretspec - /// codegen` (which needs the manifest, not a provider) and by tests. - #[cfg(any(feature = "cli", test))] - pub(crate) fn config(&self) -> &Config { + /// Get a reference to the project configuration. + /// + /// Used by `secretspec codegen`, which needs the manifest rather than a + /// provider. `pub(crate)` behind the `cli` feature meant any other + /// embedder needing the manifest without a provider — an out-of-tree + /// plugin (#64) inspecting declared secrets, for instance — had no way to + /// reach it short of taking the whole `cli` feature or re-parsing the + /// manifest itself. Hidden from the public SDK surface: ordinary callers + /// resolve secrets, not manifests. + #[doc(hidden)] + pub fn config(&self) -> &Config { &self.config }