Add Rust-first Spec API

[domenkozar]

What changed

• Add a public, Rust-first Spec API with builders for profiles, secrets, typed generation, and password character sets.
• Route TOML loading, runtime secret loading, derive-time code generation, CLI code generation, and shell-completion metadata through the same validated semantic CompiledSpec model.
• Expose Secrets::from_spec while keeping Config as an internal TOML wire format.
• Add a runnable Rust-first example, SDK documentation marked for 0.20+, tests, and an Unreleased changelog entry.

Why

Rust callers should be able to describe secrets directly without constructing a TOML-shaped configuration type or serializing and reparsing TOML. Making every frontend lower through Spec gives Rust-first and file-backed projects identical validation, inheritance, generation, and provider behavior.

Developer impact

New integrations can build a Spec and pass it directly to Secrets::from_spec. Existing TOML projects continue to use the same syntax, but parsing now crosses the public Spec abstraction. The old crate-root Config export is removed because it represented the storage format rather than the supported semantic API.

Validation

• devenv shell cargo check --workspace --all-targets
• commit hooks: Clippy and Rustfmt
• devenv shell cargo test -p secretspec spec:: (6 passed)
• devenv shell cargo test -p secretspec cli::completion::tests (12 passed)
• devenv shell cargo test -p secretspec --lib (1,223 passed, 4 ignored)
• devenv shell cargo test -p secretspec-derive --test compile_tests
• devenv shell npm --prefix docs run build

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	secretspec	b0a748e	Commit Preview URL Branch Preview URL	Aug 13 2026, 07:38 PM