[domenkozar]

Summary

• add a project-level [defaults].providers chain for provider-backed secrets
• keep project defaults deliberately narrow: only providers is accepted
• allow the chain to select project or user-global aliases, including aliases whose ref templates use {project}, {profile}, and {key}
• preserve the existing precedence of CLI/environment overrides, secret chains, and profile defaults

This provides a deterministic version of the developer-specific workflow discussed in #409 without adding ambient environment-variable interpolation to provider references:

# secretspec.toml (0.21+)
[defaults]
providers = ["developer"]

# ~/.config/secretspec/config.toml
[defaults.providers.developer]
uri = "awsps://developer@us-east-1"
ref = { item = "/{project}/{profile}/developers/alice/{key}" }

Each developer can define developer differently while the project manifest remains shared.

Resolution order

1. --provider
2. SECRETSPEC_PROVIDER
3. secret provider chain, including inherited default-profile declarations
4. active profile defaults
5. project [defaults].providers
6. user-global default provider

Validation

• cargo test -p secretspec --lib: 1497 passed, 4 ignored
• focused project-default and alias-template tests
• derive unit tests
• cargo fmt --all -- --check
• repository clippy hook
• npm --prefix docs run build

The new syntax and all documentation references are marked as SecretSpec 0.21+.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	secretspec	1a1b419	Commit Preview URL Branch Preview URL	Sep 03 2026, 06:59 PM