v0.2.2 — PHPStan level 10, and the secrets/ subfolder

Released 2026-10-07. Both changes come from review on the core patch,
#66187. The public API has the same signatures and
the same behavior as 0.2.1, and the core patch carries the same src/.

Changed

• Everything passes PHPStan at level 10. A reviewer ran the core patch through PHPStan at its
  strictest level and reported 85 findings in src/ and 400 in the tests. src/, plugin/, cli/,
  and the plugin bootstrap are now clean at level 10, and make analyse runs there instead of at
  level 5. Most of the fixes are docblocks that now say what an array holds. A few are code:
  • A decrypt result is checked with is_string() rather than against false, so a result that is
    neither is treated as a failure.
  • The request's cached root key is only served once it is known to be set.
  • Demoting a slot keeps created only when it is an integer, and stores needs_rotation as a
    boolean.
  • A stored option name that is not a string is skipped when listing.
• The tests are typed too. They are checked at level 10 inside wordpress-develop, where the
  WordPress test classes are available. A test that passes a wrong type on purpose, to prove the
  runtime check behind it, says so on that line. The error-code test is now one case per constant,
  which is why the suite reports six more tests.
• The 13 class and interface files live in src/wp-includes/secrets/, following abilities-api/
  and ai-client/ in core. The functions file stays at src/wp-includes/secrets.php. Nothing was
  renamed, and a drop-in is unaffected.

Fixed

• wp secret set --stdin stored an empty secret when STDIN could not be read. It now stops with
  an error.
• A WP-CLI option given without its value, such as a bare --format, was passed along as
  true. It is now treated as not given.

Documentation

• New pages for the platform examples and for host-managed keys.
• The CI reference describes the static analysis setup.

Changelog: https://secretsapi.dev/changelog/0-2-2/