v0.3.0 — native types, and a breaking change for drop-ins

Released 2026-10-09. More from review on the core patch,
#66187. This release breaks a provider, store, or
keyring written against 0.2.3: see "If you have written a drop-in" below.

Changed

• Parameters and return values carry native PHP 7.4 types. This covers the public functions,
  the three interfaces and everything that implements them, the internal classes, the plugin-only
  code, and the WP-CLI command. A return that needs a union type, such as
  WP_Secret|null|WP_Error, stays in the docblock. See
  ADR 0013.
• A wrong argument type is no longer reported as a WP_Error. null, an array, or an object
  throws a TypeError. A scalar is converted, so wp_get_secret( 123 ) looks up the name '123'.
  The runtime checks the declarations replace are removed.
• A plaintext value stays untyped, and is still checked. wp_set_secret() with a value that is
  not a string returns WP_SECRETS_ERROR_INVALID_VALUE as before. Declared as string, PHP would
  turn false into an empty secret and report success.
• Static types are narrower where that holds. A version or slot is one of the two
  WP_Secret_Version constants, a scope is 'site'|'network', a protection boundary is one of the
  BOUNDARY_* constants, a Site Health status is one of its three values, and a count is
  int<0, max>. A secret's name stays string.
• Comments and messages no longer use -- as a dash. Comments use an en dash. Three messages
  were reworded: the Site Health description for secrets that cannot be decrypted, the key source
  label for a legacy WP_SECRETS_KEY, and the legacy reader's unwrap error.

Fixed

• Ten docblock continuation lines were indented one column too far.

If you have written a drop-in

The interfaces now declare return types, and PHP refuses a class that implements an interface
without a compatible one. That is a fatal error at class load, and it cannot be caught. Add these
before upgrading:

Interface	Method	Return type
WP_Secrets_Provider	get_label()	string
WP_Secrets_Provider	get_protection_boundary()	string
WP_Secrets_Provider	is_writable()	bool
WP_Secrets_Keyring	get_key_source()	string

Parameter types are optional in an implementation, since PHP lets it leave its own parameters
untyped. The three examples and the reference drop-in show the
change.

Full changelog: https://secretsapi.dev/changelog/0-3-0/