feat(provider): bootstrap credentials sourced from another provider

[domenkozar]

Summary

Provider aliases can now source their own credentials from another provider. An alias in [providers] may declare an env map binding an environment variable the provider needs (such as BWS_ACCESS_TOKEN or VAULT_TOKEN) to a source: a bare provider spec, which reads the value at the convention path, or a table with a ref giving exact coordinates. The credential is fetched from the source and handed to the store, so a machine token can live in the OS keyring instead of a plaintext environment variable, and it is never written into the environment of processes started by secretspec run.

[providers]
bws = { uri = "bws://project-uuid", env = { BWS_ACCESS_TOKEN = "keyring" } }
vault = { uri = "vault://kv/app?auth=approle", credentials = {
  VAULT_ROLE_ID   = { provider = "onepassword", ref = { vault = "Infra", item = "approle", field = "role_id" } },
  VAULT_SECRET_ID = { provider = "onepassword", ref = { vault = "Infra", item = "approle", field = "secret_id" } },
} }

Behavior

• An environment variable that is already set (non empty) wins, so CI keeps working with no extra configuration.
• Bootstrap chains are limited to one hop, enforced on every path the alias can appear on: chain primary, chain fallback, explicit --provider/SECRETSPEC_PROVIDER, and the default provider.
• Credentials are fetched once per invocation and profile, then reused across all secrets routed at the alias; convention path credentials are scoped per profile.
• Every source read, and every credential stored through login, is audited with a bootstrap marker naming the variable and the source store.
• Declaring an env variable the target provider never reads prints a warning naming the variables it does read.

CLI

• secretspec config provider login <alias> prompts for each declared bootstrap credential and stores it at its source, at exactly the location resolution later reads it from.
• secretspec config provider add gains a repeatable --env VAR=PROVIDER flag.

Also in this PR

• Docs for the feature (concepts, provider pages, CLI and configuration reference).
• A cleanup pass over the branch (reuse/simplification/efficiency review): ProviderAlias::env is a plain map instead of an Option, single registry scheme lookup, one ordering rule for bootstrap entries, bootstrap writes audit through the shared write audit helper, per provider bootstrap variable consts, and deduplicated CI release/build scripts.

Testing

• cargo test --package secretspec: 424 tests pass, including new coverage for overlay resolution, env wins, one hop validation, profile scoping, round trips through login, and plan grouping.
• PHP extension build script smoke tested (stages lib/secretspec.so, loads in PHP).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	secretspec	0472279	Commit Preview URL Branch Preview URL	Jul 16 2026, 01:00 AM