v0.3.5

0.3.5 (2026-09-12)

Grouped release for monosecret.

Fixes

Resolution no longer dies on SIGPIPE when a provider CLI exits without draining stdin

Packages: rust:monosecret

The CLI restores SIGPIPE's default disposition (monosecret check | head), but
every provider that pipes data into a child CLI — op item get batch reads,
op inject, pass insert, lpass add, pass-cli — spawned the child and then
wrote to its stdin. If the child rejected the input and exited without draining
stdin (exactly how op item get refuses a batch with an ambiguous title), the
write could land after the child's exit and terminate monosecret with SIGPIPE
mid-resolution: no error message, no inject fallback, exit by signal. The window
is normally won by the writer, so regular CI passed; the slower
coverage-instrumented build on Linux reliably lost it.

Child stdin writes now run with SIGPIPE blocked on the writing thread (the
process disposition stays untouched, so sibling batch threads and shell pipes
keep their semantics) and a broken pipe is treated as the child's verdict: the
child's exit status and stderr flow through the existing error classification,
so an ambiguous-title batch still defers to the inject fallback. A regression
test drives a child that closes its read end without draining an oversized
batch, which pins the fix deterministically.

Owner: @ifiokjr · Review: PR #64

Record the downloaded FFI payload as a hook build dependency

Packages: dart

The Dart build hook downloads the release's monosecret-ffi-* payload into a
shared cache and copies it into the build output, but never recorded the
payload as a hook dependency. Hook inputs do not change when a release
changes the downloaded artifact, so runners that cache by input could replay
the previous release's library: a Dart SDK upgrade from 0.3.3 to 0.3.4 kept
loading a cached 0.3.3 dylib and every resolve failed with
Native ABI version 0.3.3 does not match Dart package version 0.3.4 until
.dart_tool was deleted by hand.

The downloaded payload is now recorded through output.dependencies, keyed
under monosecret/<verified-sha256>/ in the shared output directory, so a
changed release artifact (or a cleared cache) re-runs the hook instead of
replaying stale output.

The failure modes of this bug class are now covered by end-to-end hook tests
(testBuildHook against a fake release fetcher): the copied asset and its
recorded dependency must track the served payload across runs with identical
hook inputs, a payload that violates its sidecar fails closed, and the
Native ABI version mismatch error now tells consumers how to recover
(delete .dart_tool and rebuild). Consumers recovering from an
already-cached stale library still need to do that once; the check keeps
failing closed.

Owner: @ifiokjr · Review: PR #61

v0.3.4

0.3.4 (2026-09-10)

Grouped release for monosecret.

Fixes

Cut 1Password service-account reads from one-per-secret to one-per-item

Packages: rust:monosecret

Every secret reference op inject resolves is an individually billed read
against the 1Password service-account rate limits. Manifests that pin a whole
profile to one shared item (op+token://Vault/Item, with path-routed
secrets) paid one request per secret on every resolve, run, and devenv
startup — the global dotfiles manifest (17 secrets) spent ~18 reads per run,
nifty's development profile ~20 — which drains the account-wide daily pool.

Field references are now served from batched op item get reads: one billed
read per item, however many secrets read fields of it, with section and
field matched client-side. The full-resolution budget for a shared-item
manifest is two requests per run (auth preflight + one item read), and op inject plus the per-secret read recovery remain as the correctness fallback
for references the item reads cannot serve (ambiguous titles, unusable
output, fields present but unservable).

Too many requests is also classified as a global failure alongside auth
errors. While throttled, every retried or fanned-out attempt is itself a
billed request that extends the lockout, so a rate-limited batch now surfaces
the error after its single failed request instead of cascading.

Owner: @ifiokjr · Review: PR #56

Other

Refresh toolchain, dependencies, and CI action pins

Packages: monosecret

Toolchain moves to nightly-2026-09-07 with the clippy fixes its newer lints
require, Rust workspace dependencies are upgraded (base64 0.23, sha2 0.11,
syn 3, reqwest 0.13 with its reworked rustls features, jsonschema 0.55), the
Node native addon moves to napi 3, and GitHub Actions pins advance to their
latest releases. No behavioral changes: the clippy fixes are test-only
assertions, and dead workspace dependency entries are removed.

Owner: @ifiokjr · Review: PR #58

v0.3.3

0.3.3 (2026-09-08)

Grouped release for monosecret.

Fixes

Fix keyring lookups and 1Password depends_on tokens broken in 0.3.2

Packages: rust:monosecret, rust:monosecret_derive, rust:monosecret_ffi, @monosecret/client

Two regressions broke every keyring-backed secret for specs whose providers
declare depends_on (e.g. an op+token provider bootstrapped from a
keyring-stored service account token):

• whoami compiled without its std feature: the workspace dependency
  whoami = { default-features = false } selected whoami's stub platform
  backend, which reports "anonymous" as the current username on every
  native platform. The keyring provider addresses convention entries by
  (service = monosecret/{project}/{profile}/{key}, account = username), so
  every lookup silently missed and every set would have written to a
  non-existent account. Default features are restored (the std feature is
  what compiles the real macOS/Windows/Linux backend), and a regression test
  asserts the resolved username is not the stub value.

• PreflightGuard dropped depends_on bootstrap secrets: the guard
  wrapping providers with auth preflights forwarded set_reason,
  set_profile, and with_base_dir, but not
  Provider::configure_dependency_secrets — so the trait's no-op default
  swallowed every resolved dependency. A provider declared with
  depends_on = [{ secret = "OP_SERVICE_ACCOUNT_TOKEN" }] resolved the token
  correctly and then discarded it, running every op child tokenless (which
  fails with "<vault>" isn't a vault in this account or account is not signed in). The guard now forwards the call, and the onepassword provider
  (op+token://) implements it: a delivered OP_SERVICE_ACCOUNT_TOKEN is
  exported to every op child process, ranked after an explicitly supplied
  provider credential and ahead of the ambient environment variable, matching
  onepassword+env's existing behavior. Forwarding and token-precedence
  regression tests included.

• Arc wrapping dropped the same hook one layer deeper (caught by the
  new end-to-end regression tests): providers registered with a preflight are
  built as Box<Arc<P>>, and the blanket impl Provider for Arc<T> cannot
  forward a &mut self hook — an Arc gives no &mut access — so the
  delivery died at that layer even with the guard fixed.
  configure_dependency_secrets is now a &self hook with interior
  mutability (matching set_reason/set_profile), forwarded explicitly by
  the Arc blanket impl and PreflightGuard. This also fixes the
  onepassword+env provider, whose pre-existing implementation was silently
  swallowed by the same wrapper stack.

Owner: @ifiokjr · Review: PR #50

Other

End-to-end regression tests for provider depends_on delivery

Packages: rust:monosecret, rust:monosecret_derive, rust:monosecret_ffi, @monosecret/client

Adds crates/monosecret/tests/provider_dependency_token.rs, two integration
tests that run the real CLI binary against a temporary manifest mirroring the
dotfiles setup that broke in 0.3.2: an op+token provider alias bootstrapped
from a depends_on secret stored in another provider, with the op CLI
replaced by a stub that records the OP_SERVICE_ACCOUNT_TOKEN it was
exported.

• depends_on_token_reaches_op_child_through_full_resolution resolves a
  secret through the full pipeline (manifest parsing, fallback planning,
  PreflightGuard, the Arc-wrapped concrete provider, child-process
  environment) and asserts every op child ran with the delivered token and
  the value resolved. This test caught the Arc layer of the 0.3.2
  regression after the isolated unit tests all passed — a refactor that
  builds providers through a path that skips dependency delivery fails here
  even when wrapper-level tests stay green.
• missing_dependency_secret_fails_resolution_loudly asserts a missing
  bootstrap secret fails resolution hard with the
  requires secret '<name>' error, rather than silently continuing
  tokenless.

Together with the wrapper-level unit tests on PR #50 (guard forwarding,
Arc forwarding, child-env export, precedence), every layer of the delivery
path is pinned so the regression cannot return unnoticed on a future release.

Owner: @ifiokjr · Review: PR #51 · Related issues: #50

v0.3.2

0.3.2 (2026-09-05)

Grouped release for monosecret.

Features

Sync upstream SecretSpec through 0.20.0 + 0.21-era main

Packages: monosecret

Merge cachix/secretspec from 671de322 (the recorded 0.19.1-era merge base) through upstream main @ 5ea68378 (2026-09-04), rebranded into the crates/monosecret, crates/monosecret_derive, crates/monosecret_ffi, and per-language monosecret_* SDK layout.

New providers

• EJSON (ejson://): encrypted JSON key/value files through ejson, with preflight discovery of the secrets directory (0.20+).

New features

• Project default provider chains (0.21+): a project-level [defaults] table with a providers chain applied to every provider-backed secret that neither its profile nor a secret selects. Resolution order: secret → profile [defaults].providers → project [defaults].providers → user-global default. The inline-spec envelope moves to v2 with optional inline defaults.
• OpenPGP and OpenSSH private-key generation (0.21+): type = "openpgp_private_key" (ed25519 default, configurable RSA, user ID, sign/encrypt capability profiles) and type = "ssh_private_key" (ed25519 default, configurable RSA and comments), generated entirely in Rust via rPGP and ssh-key.
• Claude Code credential integration (0.21+): monosecret claude configure/unconfigure/login/logout wire Anthropic API and LLM gateway credentials through Claude Code's apiKeyHelper, with settings-scope isolation, worktree handling, and CLAUDE_CONFIG_DIR support.
• Providers disabled at compile time now report clearly: a secret routed at a feature-gated provider whose Cargo feature is off returns a stable provider_feature_disabled error naming the provider and the feature.

Fixes

• Provider metadata centralized into a shared catalog shared by enabled and disabled registrations, so discovery and error metadata stay identical in every build.
• Inline-spec resolution gains the v2 envelope across the FFI and every SDK (monosecret_call sources now advertise spec_version 2).
• Docs: EJSON provider guide, Claude Code integration guide, OpenPGP/SSH key-generation reference, project-defaults configuration reference, and a dotenv discouragement notice; the Claude OAuth security post is rebranded for the fork.

Default cargo builds to the CLI crate

Packages: monosecret

Plain cargo build, cargo check, and cargo test now operate on the CLI crate only via workspace default-members. The language SDK members (FFI, npm, PHP, Python, and examples) require the php, python, and node interpreters at build time and are now selected explicitly with --workspace / -p in CI, devenv tasks, and publish workflows. Sandboxed CLI-only builds — such as Nix packaging, which installs monosecret without those interpreters — work again with a bare cargo build.

Owner: @ifiokjr · Review: PR #44

Dart SDK: inline specs and caller context via the versioned call ABI

Packages: dart

The Dart SDK now binds the versioned monosecret_call native entry point,
matching the other language SDKs:

• MonosecretBuilder.withInlineSpec(spec, baseDir) resolves strict
  inline-spec v1 declarations through the versioned call envelope; inline
  resolution never falls back to a filesystem manifest, and withPath
  clears the inline spec.
• CallerContext and MonosecretBuilder.withCaller record the invoking
  integration in audit records (they never satisfy a require_reason
  policy); MonosecretClient.resolve/report accept an optional caller.
• The bundled native library is probed for the call entry point and the
  result is cached; older libraries raise a capability
MonosecretException on inline requests instead of an opaque ffi error.

Owner: @ifiokjr · Review: PR #48

Fixes

Refresh cargo, pnpm, dart, and devenv dependencies

Packages: rust:monosecret, rust:monosecret_derive, rust:monosecret_ffi, @monosecret/client, dart

cargo update, pnpm update --latest (vitest 4 → 5, tsdown 0.22 → 0.23,
oxfmt 0.63 → 0.66, oxlint 1.78 → 1.81), dart pub upgrade, and
devenv update (devenv CLI, git-hooks.nix, custom nixpkgs inputs).

keepass is pinned to =0.13.17: the 0.13.25 release depends on a
cipher/cbc combination that aes 0.8 does not implement, which broke the
kdbx provider's build.

Owner: @ifiokjr · Review: PR #49

Eliminate every clippy warning and promote lint groups to deny

Packages: rust:monosecret, rust:monosecret_derive, rust:monosecret_ffi, @monosecret/client

Fixed ~1330 clippy warnings across the workspace (format-arg inlining,
doc-comment backticks, digit-separated literals, redundant
qualifications/closures, needless borrows, let … else, internal
pass-by-value → references, #[must_use] additions, unnecessary Result
wraps, dead code) and converted indexing_slicing in production parsers to
bounds-checked access with error propagation, so malformed provider responses
can no longer panic. Fixed a latent cached_route panic (inline-URI alias
caching into its own store), a pre-existing flaky Infisical TCP test, and
reverted a clippy --fix regression that flipped the vault missing-tls
default.

All clippy groups (complexity, pedantic, perf, style, suspicious)
are now deny, the ffi/node/php/python crates inherit the workspace lints,
and CI clippy runs with -D warnings.

Owner: @ifiokjr · Review: PR #45

v0.3.1

0.3.1 (2026-08-28)

Grouped release for monosecret.

Features

Sync upstream SecretSpec (v0.19.1 → upstream main)

Packages: monosecret

Merges cachix/secretspec from v0.19.0 (the previous sync in #25) through upstream main @ 671de322 (2026-08-28), rebranded into the crates/monosecret, crates/monosecret_derive, crates/monosecret_ffi, and per-language monosecret_* SDK layout. Also records the upstream v0.19.0 merge ancestry that PR #25 lost to GitHub's squash button, so future syncs diff against the correct base.

New providers

• Fly.io (fly://): write-only application secrets via flyctl, with rename compatibility for older stores.
• Azure App Configuration (aac://): connection-string auth reusing Azure Core's HMAC, reversible discovery, HTTP-redirect rejection, and operational setup docs.
• Cloudflare Secrets Store (cloudflare://): write-only secrets in a Cloudflare account-level store.
• Kubernetes (kubernetes://): read/write/delete secrets in a cluster via JSON patch, with patch authorization enforcement, early address resolution in check_writable, and a reserved delimiter for namespaced coordinates.

New features

• Rust-first Spec API (0.20+): Spec / SpecBuilder let applications declare secrets directly in Rust; spec_edit preserves TOML formatting through builder edits and spec_edit-backed add writes descriptions back to monosecret.toml with inherited-edit provenance. The typed loader supports interactive prompt-and-store and preserves TOML edits through the builder.
• Inline specifications for all SDKs: a versioned call ABI (monosecret_call, INLINE_SPEC_SCHEMA_VERSION) lets SDKs resolve strict inline-spec v1 declarations with an explicit source (search, path, or inline), with capability detection against older native libraries. Ported to the .NET, Go, Haskell, Node (napi), PHP, Python, Ruby, and Swift SDKs.
• Structured caller context (0.20+): CallerContext (--caller, --caller-version, --caller-operation) records what invoked access in audit records without ever satisfying require_reason; threaded through the CLI, FFI (monosecret_call envelope), and every SDK.
• Shell completions: monosecret completions for bash, zsh, fish, and nushell (clap_complete + clap_complete_nushell).
• Git credential helper integration: git-credential-monosecret binary plus monosecret git configuration command, with repository-local includes, percent-encoding-aware paths, Windows support, and quiet Unix pipe-close handling.
• Docker credential helper integration: docker-credential-monosecret binary and monosecret docker configuration that avoids persisting ambient profiles.
• JSON Schema generation (monosecret schema): expose generated JSON Schema for specs, with property descriptions emitted by codegen.
• INI extraction: extract with format = "ini" selects values from INI documents alongside JSON pointers.
• Interactive prompt-and-store for the typed loader: prompt_missing resolves declared-but-missing secrets by prompting and storing.
• Spec builder round-trips: TOML edits through the builder preserve comments and unknown tables.
• import rework: imports run through explicit preparation, collision-check, copy, verification, and source-cleanup phases; --delete-source removes values only after every destination write succeeds.

Fixes

• check / value-free resolution surfaces (check --json, check --explain, SDK report resolutions) no longer report an unprovisioned required generate secret as resolved; such secrets are now missing_required with a non-zero exit until one real check/run mints the value. Optional generate secrets and non-retaining providers (e.g. null) are unaffected.
• run forwards signals to the child process, and the CLI restores the default SIGPIPE disposition so monosecret check | head exits quietly.
• 1Password: op inject batch recovery when referenced items are missing, fail-fast on auth errors, scoped auth diagnostic matching, and per-secret fallback preservation for unrecoverable batch failures.
• Infisical: separate Universal Auth login connection, shared metadata-only environment probes, ref environment resolved from the profile, path defaults in entry identity.
• GCSM: collision-safe monosecret2--{project}--{profile}--{key} convention names with legacy fallback.
• BWS: use the vault host as the default server URL.
• Bitwarden: preserve convention discovery and migration refs when project/profile contain /; case-insensitive convention recognition on init --from bw://.
• AWSSM: provider path boundary joining and IAM docs now grant BatchGetSecretValue on *.
• dotenv parsing switched from dotenvy to dotenv-ng: $-containing values stay literal, bcrypt-style strings round-trip, hyphens/unicode keys accepted, and output uses minimal quoting.
• AWS SSM / Scaleway: a JSON null field is treated as no value with shared rendering; SDK close() attempts every as_path file.
• Age provider supports deleting entries (0.20+).
• set/check preview the resolved write destination; check writes its report to stdout.
• Infisical: ambiguous-404 environment probes shared across reads, resolved environments compared structurally.
• BWS: default server URL from the vault host.
• GCSM legacy migration reads fixed; convention names collision-safe.

SDK & tooling

• All SDKs (Dart, Go, Haskell, Node, PHP, Python, Ruby, Swift, .NET) gain caller context, inline-spec call support, and the AWS-state release / close() fixes; the Node addon and CLI also learn musl target handling, and SDK CI builds every Rust-backed native package in one cargo invocation.
• The derive crate now generates code through the shared codegen IR with __private re-exports and supports prompt_missing interactive store on first access.
• FFI gains monosecret_call (versioned native operations incl. inline spec sources) plus its C header contract and cinstall updates.

Documentation & skill

• New provider guides (Fly.io, Azure App Configuration, Cloudflare, Kubernetes), git/docker integration guides, the dotenv-ng fork and moving-secrets blog posts, KDBX manual setup, GCSM versioned naming, Infisical environment probing, split AWS IAM policy examples, and the 0.20 CLI/caller-context reference updates.
• The @monosecret/skill agent skill now documents the 0.20 command surface (completions, integrations, import preflight, typed SDKs, declarative features).

Deferred

• Upstream's JVM SDK (secretspec-jvm) is not ported in this sync; the fork's per-language SDK set is unchanged. A follow-up will port it as a jvm/ workspace SDK with its own CI.
• Upstream's cargo-dist/WinGet/ARM64 release workflows stay out of scope — the fork keeps its monochange-based publishing.

Fixes

Restore op+token:// scheme and batch shared-item reads

Packages: monosecret

Restore the legacy op+token://<account>/<basePath> provider scheme and route its field references through the batched op inject path. Secrets that live as sections of one shared 1Password item are now fetched in a single op inject call (plus one auth preflight) instead of one op read per secret, cutting monosecret run / msload secret-loading time by roughly an order of magnitude. The onepassword+token:// scheme keeps its current behavior; op+token:// is restored for backward compatibility and still requires the token as a provider credential or OP_SERVICE_ACCOUNT_TOKEN.

Owner: @ifiokjr · Review: PR #40

v0.2.1

0.2.1 (2026-08-14)

Grouped release for monosecret.

Fixes

Remove stale proc-macro-error2 crates-io git patch

Packages: monosecret

The .cargo/config.toml [patch.crates-io] section pointed at a git fork of proc-macro-error2 that nothing in the dependency graph uses (the Cargo.lock entries are [[patch.unused]]). cargo still tries to fetch the git source during resolution, which breaks offline vendored builds (e.g. nixpkgs' buildRustPackage). Removing the patch and pruning the stale lockfile entries fixes the offline build.

Owner: @ifiokjr · Review: PR #33

v0.2.0

0.2.0 (2026-08-13)

Grouped release for monosecret.

Breaking

Integrate native references and language SDKs

Packages: monosecret

Add provider-independent table-form ref coordinates, address-based provider
resolution, batch reads, writable checks, and value-free resolution reports.
Provider implementations must migrate to the new address-oriented APIs.

Integrate the shared native resolver source, local build paths, and tests for
monosecret_ffi, Dart, @monosecret/client, Python, Go, Ruby, and Haskell
bindings. The Dart package now resolves through dart:ffi without a separately
installed CLI, and release builds publish verified C ABI assets for Linux,
macOS, and Windows servers. Registry distribution for the other new native SDK
artifacts remains deferred.

Owner: @ifiokjr · Review: PR #24 · Related issues: #23, #27, #28

Move the Dart builder package entrypoint

Packages: dart:monosecret_builder

Expose the builder factory from package:monosecret_builder/monosecret_builder.dart, update build.yaml to use that package-named library, and remove the previous package:monosecret_builder/builder.dart entrypoint. Consumers importing the builder directly should update to the new package-named library.

Owner: Ifiok Jr. · Review: PR #29 · Related issues: #23, #27, #28

Documentation

Fix the depends_on docs example and validate docs snippets

Packages: rust:monosecret

The depends_on example in the configuration reference used a
service_token = { secret = "..." } shape that did not deserialize into
ProviderDependency, so anyone copying it hit a parse error. Use the correct
secret = "..." form, make the example a complete copy-pasteable config, and
document the optional as field for injecting a dependency under a different
env-var name.

Add an integration test (docs_snippets) that scans the docs for TOML snippets
marked with an invisible <!-- monosecret-test: ... --> marker and parses /
validates them against the Config, GlobalConfig, and Project schemas, so
reference examples can't silently drift from the schema again. The harness is
opt-in (no false positives on partial snippets) and a no-op when the docs tree
isn't present.

Owner: @ifiokjr · Review: PR #27

Repair stale documentation links and installation guidance

Packages: rust:monosecret

Point historical issue references to the original cachix/secretspec repository, restore the original SecretSpec announcement and devenv integration URLs, and replace the unavailable custom installer with the published @monosecret/cli npm package.

Owner: Ifiok Jr. · Review: PR #29 · Related issues: #23, #27, #28

v0.1.0

0.1.0 (2026-07-05)

Grouped release for monosecret.

Breaking

Rebrand secretspec as monosecret

Packages: monosecret

Rename crates, CLI, npm packages, and Dart SDK to monosecret while preserving compatibility fallbacks.

Owner: @ifiokjr · Review: PR #2

Add the initial TypeScript client package for invoking Monosecret from Node.js applications.

Packages: @monosecret/client

import { MonosecretClient } from "@monosecret/client";

const monosecret = new MonosecretClient();
const databaseUrl = await monosecret.get("DATABASE_URL", {
  profile: "development",
});

const environment = await monosecret.loadEnvironment({
  include: ["DATABASE_URL", "API_KEY"],
});

Owner: Ifiok Jr. · Introduced in: 36f1fec

• dart:monosecret_builder: Add a secret-value-free manifest command for SDK code generation, introduce a build_runner-based Dart typed SDK generator, reorganize source by ecosystem into crates/, npm/, and dart/, and wire Rust, Dart, and npm coverage reports with package-level Codecov flags.

Features

• rust:monosecret: Port upstream audit log support

monosecret env: load secrets into any shell

Packages: rust:monosecret

Add monosecret env (alias load-env) to load resolved secrets into the
surrounding shell or a CI environment with one command. A --shell flag
selects the output format:

• bash/sh/zsh — export KEY='value'; (apply with eval "$(...)")
• fish — set -gx KEY 'value'; (apply with | source)
• powershell/pwsh — $env:KEY='value'; (apply with | iex)
• nushell/nu — load-env { KEY: "value" }
• github — appends KEY<<DELIM heredoc blocks to $GITHUB_ENV and prints
  ::add-mask:: so values are masked in the run log
• gitlab/dotenv — portable KEY="value" for artifacts:reports:dotenv

Values are escaped per the target shell's rules. Reuses the same secret
resolution path and require_reason policy as monosecret run, and supports
--include/--group filtering and --output to write to a file.

Owner: @ifiokjr · Review: PR #14

• Add a secret-value-free manifest command for SDK code generation, introduce a build_runner-based Dart typed SDK generator, reorganize source by ecosystem into crates/, npm/, and dart/, and wire Rust, Dart, and npm coverage reports with package-level Codecov flags.
  Packages: rust:monosecret, dart

Sync upstream secretspec 0.12.2 support

Packages: rust:monosecret

Merge upstream/main through 0.12.2.

• Restore the monosecret audit CLI command (show_audit_log,
  filter_audit_entries, sanitize_field, format_audit_line) that was
  dropped during the rebrand merge, plus the audit field on GlobalConfig
  so the log path can be resolved from the user-global [audit] config.
• port the pass provider store_dir query parameter
  (PASSWORD_STORE_DIR scoped per invocation) and the shared
  query_value / encode_query / QUERY_ENCODE_SET helpers so query
  values round-trip through form-urlencoded parsing (awssm prefix too).

Owner: @ifiokjr · Review: PR #13

Fixes

Fix release PR formatting and CI packaging failures so auto-generated release

Packages: monosecret

PRs always pass checks. Run fix:format before committing in the release PR
workflow, use dart pub publish --dry-run --skip-validation in CI to avoid
server-side validation errors, and call build:dist directly in the publish
workflow instead of nesting devenv shells.

Owner: @ifiokjr · Review: PR #11

• monosecret: Port upstream secret-access reason policy into Monosecret, including CLI/SDK reason handling, config enforcement, and Proton Pass audit reason forwarding.
• rust:monosecret: Update Monosecret documentation and CLI website links to the GitHub Pages site.

Other

• Add a secret-value-free manifest command for SDK code generation, introduce a build_runner-based Dart typed SDK generator, reorganize source by ecosystem into crates/, npm/, and dart/, and wire Rust, Dart, and npm coverage reports with package-level Codecov flags.
  Packages: rust:monosecret_derive, @monosecret/cli, @monosecret/client, @monosecret/skill, @monosecret/cli-darwin-arm64, @monosecret/cli-darwin-x64, @monosecret/cli-linux-arm64-gnu, @monosecret/cli-linux-arm64-musl, @monosecret/cli-linux-x64-gnu, @monosecret/cli-linux-x64-musl, @monosecret/cli-win32-arm64-msvc, @monosecret/cli-win32-x64-msvc