feat: add versioned client and provider IPC

.github/workflows/dotnet-package.yml

@@ -1,6 +1,6 @@
 name: ".NET SDK"
 
-# Builds the C# client and the runtime-specific secretspec-ffi libraries packed
+# Builds the C# client and the runtime-specific libsecretspec libraries packed
 # into Cachix.SecretSpec. Glibc Linux uses a manylinux_2_28 baseline; Alpine
 # receives separate musl assets.
 
@@ -25,7 +25,7 @@ on:
   pull_request:
     paths:
       - "secretspec-dotnet/**"
-      - "secretspec-ffi/**"
+      - "libsecretspec/**"
       - ".github/workflows/dotnet-package.yml"
       - "scripts/install-rustup.sh"
       - "scripts/sync-sdk-versions.sh"
@@ -46,35 +46,35 @@ jobs:
             target: x86_64-unknown-linux-gnu
             runner: ubuntu-latest
             container: quay.io/pypa/manylinux_2_28_x86_64:2026.08.05-1@sha256:e0b40ace8e818e96026eb47714b01998cbca022a6995797d0905474ce3e82ae8
-            library: libsecretspec_ffi.so
+            library: libsecretspec.so
             rustflags: -C strip=symbols
           - rid: linux-arm64
             target: aarch64-unknown-linux-gnu
             runner: ubuntu-24.04-arm
             container: quay.io/pypa/manylinux_2_28_aarch64:2026.08.05-1@sha256:f766b402889e40f439e7a3ee5788eef1aa3ef399d0110107d27419fa2ba9d905
-            library: libsecretspec_ffi.so
+            library: libsecretspec.so
             rustflags: -C strip=symbols
           - rid: osx-x64
             target: x86_64-apple-darwin
             runner: macos-15-intel
-            library: libsecretspec_ffi.dylib
+            library: libsecretspec.dylib
             deployment_target: "12.0"
             rustflags: -C strip=symbols
           - rid: osx-arm64
             target: aarch64-apple-darwin
             runner: macos-latest
-            library: libsecretspec_ffi.dylib
+            library: libsecretspec.dylib
             deployment_target: "12.0"
             rustflags: -C strip=symbols
           - rid: win-x64
             target: x86_64-pc-windows-msvc
             runner: windows-latest
-            library: secretspec_ffi.dll
+            library: secretspec.dll
             rustflags: -C strip=symbols -C target-feature=+crt-static
           - rid: win-arm64
             target: aarch64-pc-windows-msvc
             runner: windows-11-arm
-            library: secretspec_ffi.dll
+            library: secretspec.dll
             rustflags: -C strip=symbols -C target-feature=+crt-static
 
     steps:
@@ -110,7 +110,7 @@ jobs:
           MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target }}
           RUSTFLAGS: ${{ matrix.rustflags }}
         run: >-
-          cargo build -p secretspec-ffi --release
+          cargo build -p libsecretspec --release
           --target ${{ matrix.target }}
 
       - name: Verify glibc portability (glibc <= 2.28, no libdbus)
@@ -146,10 +146,18 @@ jobs:
 
       - name: Stage native NuGet asset
         shell: bash
+        # Ship the Windows cdylib as libsecretspec.dll. Cargo emits
+        # secretspec.dll there (MSVC drops the lib prefix), which is the same
+        # filename as the managed SecretSpec.dll on a case-insensitive
+        # filesystem, so the two collide in a consumer's output directory.
         run: |
           mkdir -p "staged/${{ matrix.rid }}/native"
+          packaged="${{ matrix.library }}"
+          if [ "$packaged" = "secretspec.dll" ]; then
+            packaged="libsecretspec.dll"
+          fi
           cp "target/${{ matrix.target }}/release/${{ matrix.library }}" \
-             "staged/${{ matrix.rid }}/native/"
+             "staged/${{ matrix.rid }}/native/$packaged"
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -192,15 +200,15 @@ jobs:
               bash scripts/install-rustup.sh
               export PATH="$HOME/.cargo/bin:$PATH"
               rustup toolchain install
-              cargo build -p secretspec-ffi --release \
+              cargo build -p libsecretspec --release \
                 --target "${{ matrix.target }}"
             '
           test -f \
-            "target/${{ matrix.target }}/release/libsecretspec_ffi.so"
+            "target/${{ matrix.target }}/release/libsecretspec.so"
       - name: Verify musl portability
         shell: bash
         run: |
-          library="target/${{ matrix.target }}/release/libsecretspec_ffi.so"
+          library="target/${{ matrix.target }}/release/libsecretspec.so"
           dynamic="$(readelf -d "$library")"
           needed="$(grep NEEDED <<<"$dynamic")"
           case "${{ matrix.target }}" in
@@ -227,7 +235,7 @@ jobs:
       - name: Stage native NuGet asset
         run: |
           mkdir -p "staged/${{ matrix.rid }}/native"
-          cp "target/${{ matrix.target }}/release/libsecretspec_ffi.so" \
+          cp "target/${{ matrix.target }}/release/libsecretspec.so" \
              "staged/${{ matrix.rid }}/native/"
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

.github/workflows/ffi-build.yml

@@ -1,6 +1,6 @@
 name: "FFI cdylib"
 
-# Builds the secretspec-ffi C ABI library for each platform the language SDKs
+# Builds the libsecretspec C ABI library for each platform the language SDKs
 # bundle. Linux builds use a manylinux_2_28 baseline. Other targets build
 # natively on per-platform runners rather than cross-compiling.
 
@@ -27,7 +27,7 @@ on:
   # sdks.yml; the full matrix here still runs on tags and manual dispatch.
   pull_request:
     paths:
-      - "secretspec-ffi/**"
+      - "libsecretspec/**"
       - ".github/workflows/ffi-build.yml"
       - "scripts/check-linux-portability.sh"
       - "scripts/install-rustup.sh"
@@ -46,17 +46,17 @@ jobs:
           - target: x86_64-unknown-linux-gnu
             runner: ubuntu-latest
             container: quay.io/pypa/manylinux_2_28_x86_64:2026.08.05-1@sha256:e0b40ace8e818e96026eb47714b01998cbca022a6995797d0905474ce3e82ae8
-            artifact: libsecretspec_ffi.so
+            artifact: libsecretspec.so
           - target: aarch64-unknown-linux-gnu
             runner: ubuntu-24.04-arm
             container: quay.io/pypa/manylinux_2_28_aarch64:2026.08.05-1@sha256:f766b402889e40f439e7a3ee5788eef1aa3ef399d0110107d27419fa2ba9d905
-            artifact: libsecretspec_ffi.so
+            artifact: libsecretspec.so
           - target: aarch64-apple-darwin
             runner: macos-latest
-            artifact: libsecretspec_ffi.dylib
+            artifact: libsecretspec.dylib
           - target: x86_64-pc-windows-msvc
             runner: windows-latest
-            artifact: secretspec_ffi.dll
+            artifact: secretspec.dll
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -74,7 +74,7 @@ jobs:
 
       - name: Build cdylib
         run: >-
-          cargo build -p secretspec-ffi --release
+          cargo build -p libsecretspec --release
           --target ${{ matrix.target }}
 
       - name: Verify Linux portability (glibc <= 2.28, no libdbus)
@@ -87,10 +87,10 @@ jobs:
       - name: Smoke test the C ABI (Unix)
         if: runner.os != 'Windows'
         run: |
-          cc secretspec-ffi/tests/smoke.c \
-            -I secretspec-ffi/include \
+          cc libsecretspec/tests/smoke.c \
+            -I libsecretspec/include \
             -L target/${{ matrix.target }}/release \
-            -lsecretspec_ffi -o smoke
+            -lsecretspec -o smoke
           LD_LIBRARY_PATH=target/${{ matrix.target }}/release \
           DYLD_LIBRARY_PATH=target/${{ matrix.target }}/release \
           ./smoke
@@ -100,17 +100,17 @@ jobs:
         shell: bash
         run: |
           ext="${{ matrix.artifact }}"; ext="${ext##*.}"
-          asset="secretspec-ffi-${{ matrix.target }}.${ext}"
+          asset="libsecretspec-${{ matrix.target }}.${ext}"
           cp "target/${{ matrix.target }}/release/${{ matrix.artifact }}" "$asset"
           echo "asset=$asset" >> "$GITHUB_OUTPUT"
 
       - name: Upload artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: secretspec-ffi-${{ matrix.target }}
+          name: libsecretspec-${{ matrix.target }}
           path: |
             ${{ steps.stage.outputs.asset }}
-            secretspec-ffi/include/secretspec.h
+            libsecretspec/include/secretspec.h
 
   release:
     name: Publish FFI release
@@ -126,7 +126,7 @@ jobs:
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: secretspec-ffi-*
+          pattern: libsecretspec-*
           path: staged
           merge-multiple: true
 
@@ -142,7 +142,7 @@ jobs:
         run: |
           set -euo pipefail
           mapfile -t assets < <(
-            find staged -maxdepth 1 -type f -name 'secretspec-ffi-*' -print |
+            find staged -maxdepth 1 -type f -name 'libsecretspec-*' -print |
               sort
           )
           if [[ "${#assets[@]}" -ne 4 ]]; then

.github/workflows/go-embed.yml

@@ -33,7 +33,7 @@ on:
   pull_request:
     paths:
       - "secretspec-go/**"
-      - "secretspec-ffi/**"
+      - "libsecretspec/**"
       - ".github/workflows/go-embed.yml"
       - "scripts/check-linux-portability.sh"
       - "scripts/install-rustup.sh"
@@ -85,7 +85,7 @@ jobs:
         shell: bash
         run: >-
           bash scripts/check-linux-portability.sh
-          "secretspec-go/lib/secretspec_ffi_${{ matrix.target }}.so"
+          "secretspec-go/lib/secretspec_${{ matrix.target }}.so"
 
       - name: Build and smoke test the embedded SDK (no SECRETSPEC_FFI_LIB)
         shell: bash
@@ -154,7 +154,7 @@ jobs:
           RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
         run: |
           set -euo pipefail
-          mapfile -t assets < <(find staged -type f -name 'secretspec_ffi_*' -print | sort)
+          mapfile -t assets < <(find staged -type f -name 'secretspec_*' -print | sort)
           if [[ "${#assets[@]}" -ne 4 ]]; then
             printf 'expected 4 embedded libraries, found %s\n' "${#assets[@]}" >&2
             printf '%s\n' "${assets[@]}" >&2

.github/workflows/go-static.yml

@@ -1,7 +1,7 @@
 name: "Go static lib"
 
 # Builds the fully-static (musl) Go binary for the `-tags static` binding: cgo
-# links libsecretspec_ffi.a directly into the executable, so the Rust resolver is
+# links libsecretspec.a directly into the executable, so the Rust resolver is
 # embedded and the binary has no dynamic dependencies at all. Built via devenv,
 # which provides the musl C cross-toolchain (for the sqlite3/aws-lc-sys build
 # scripts and the cgo link) and static libunwind.
@@ -34,7 +34,7 @@ on:
   pull_request:
     paths:
       - "secretspec-go/**"
-      - "secretspec-ffi/**"
+      - "libsecretspec/**"
       - ".github/workflows/go-static.yml"
 
 permissions:

.github/workflows/haskell-build.yml

@@ -1,7 +1,7 @@
 name: "Haskell SDK"
 
 # Builds and tests the Haskell SDK (secretspec-hs) against a freshly built
-# secretspec-ffi staticlib. The SDK statically links the C ABI archive at build
+# libsecretspec staticlib. The SDK statically links the C ABI archive at build
 # time, so the Rust resolver is embedded in the binary and there is no runtime
 # loader path (no LD_LIBRARY_PATH).
 #
@@ -25,7 +25,7 @@ on:
   pull_request:
     paths:
       - "secretspec-hs/**"
-      - "secretspec-ffi/**"
+      - "libsecretspec/**"
       - "secretspec/**"
       - ".github/workflows/haskell-build.yml"
       - "scripts/sync-sdk-versions.sh"
@@ -66,17 +66,17 @@ jobs:
         run: |
           devenv shell -- bash -c '
             set -euo pipefail
-            cargo build -p secretspec-ffi -p secretspec
+            cargo build -p libsecretspec -p secretspec
             target_dir="$(cargo metadata --no-deps --format-version 1 \
               | grep -o "\"target_directory\":\"[^\"]*\"" | head -1 | sed "s/.*:\"\(.*\)\"/\1/")"
             export SECRETSPEC_BIN="$target_dir/debug/secretspec"
             # Capture the staticlib archive plus its transitive native deps. Stage
-            # the .a alone so -lsecretspec_ffi resolves to the archive (target/debug
+            # the .a alone so -lsecretspec resolves to the archive (target/debug
             # also holds the .so) and the resolver is embedded with no loader path.
-            native_libs="$(cargo rustc -q -p secretspec-ffi --crate-type staticlib -- \
+            native_libs="$(cargo rustc -q -p libsecretspec --crate-type staticlib -- \
               --print native-static-libs 2>&1 | sed -n "s/^note: native-static-libs: //p" | tail -1)"
             hs_lib_dir="$(mktemp -d)"
-            cp "$target_dir/debug/libsecretspec_ffi.a" "$hs_lib_dir/"
+            cp "$target_dir/debug/libsecretspec.a" "$hs_lib_dir/"
             cd secretspec-hs
             cabal update
             # --write-ghc-environment-files lets the codegen test compile the
@@ -88,9 +88,9 @@ jobs:
               --ghc-options="-optl${native_libs// / -optl}" \
               --write-ghc-environment-files=always --test-show-details=streaming
             ffi_prefix="$(mktemp -d)"
-            bash ../secretspec-ffi/scripts/cinstall.sh "$ffi_prefix" static
+            bash ../libsecretspec/scripts/cinstall.sh "$ffi_prefix" static
             PKG_CONFIG_PATH="$ffi_prefix/lib/pkgconfig" \
-              pkg-config --print-errors --exists secretspec_ffi
+              pkg-config --print-errors --exists libsecretspec
             PKG_CONFIG_PATH="$ffi_prefix/lib/pkgconfig" cabal test -f use-pkg-config \
               --write-ghc-environment-files=always --test-show-details=streaming
           '
@@ -130,20 +130,20 @@ jobs:
           # crate's list so the unused cdylib is never linked. Release like
           # the shipped artifacts: a debug archive carries sectionless .dwo
           # members that objcopy below refuses to process.
-          cargo rustc -p secretspec-ffi --release --target x86_64-pc-windows-gnu \
+          cargo rustc -p libsecretspec --release --target x86_64-pc-windows-gnu \
             --crate-type staticlib
           # The CLI (for the test-suite's end-to-end codegen test) builds for
           # the default MSVC host target, same as the released binaries.
           cargo build -p secretspec
           export SECRETSPEC_BIN="$(cygpath -w "$PWD/target/debug/secretspec.exe")"
-          native_libs="$(cargo rustc -q -p secretspec-ffi --release \
+          native_libs="$(cargo rustc -q -p libsecretspec --release \
             --target x86_64-pc-windows-gnu --crate-type staticlib -- \
             --print native-static-libs 2>&1 \
             | sed -n 's/^note: native-static-libs: //p' | tail -1)"
           # Stage the .a alone (target/ also holds rlibs) plus the import
           # libraries that ship inside cargo registry crates (see header).
           hs_lib_dir="$(mktemp -d)"
-          cp target/x86_64-pc-windows-gnu/release/libsecretspec_ffi.a "$hs_lib_dir/"
+          cp target/x86_64-pc-windows-gnu/release/libsecretspec.a "$hs_lib_dir/"
           # Two archive fixups for GHC's older bundled toolchain, which links
           # the final test binary:
           #  * rustc's windows-gnu objects carry `-exclude-symbols` .drectve
@@ -160,11 +160,11 @@ jobs:
           # objcopy refuses archives holding sectionless split-debuginfo
           # members (the prebuilt std ships .dwo members a linker never
           # selects), so drop those first.
-          ar t "$hs_lib_dir/libsecretspec_ffi.a" | grep '\.dwo$' | while read -r m; do
-            ar d "$hs_lib_dir/libsecretspec_ffi.a" "$m"
+          ar t "$hs_lib_dir/libsecretspec.a" | grep '\.dwo$' | while read -r m; do
+            ar d "$hs_lib_dir/libsecretspec.a" "$m"
           done
           objcopy --remove-section=.drectve --redefine-sym nanosleep64=nanosleep \
-            "$hs_lib_dir/libsecretspec_ffi.a"
+            "$hs_lib_dir/libsecretspec.a"
           printf '%s\n' "$native_libs" > "$hs_lib_dir/native-static-libs.txt"
           bash scripts/copy-mingw-import-libs.sh \
             "$hs_lib_dir/native-static-libs.txt" "$hs_lib_dir"
@@ -211,7 +211,7 @@ jobs:
         run: nix profile install nixpkgs#devenv
       - name: sdist and upload to Hackage
         # Requires the HACKAGE_TOKEN secret. The package statically links
-        # secretspec-ffi at build time, so Hackage's build bots cannot compile it
+        # libsecretspec at build time, so Hackage's build bots cannot compile it
         # (no staticlib, no Rust toolchain); the upload still succeeds and the
         # README documents the link requirement.
         env:

.github/workflows/ruby-gems.yml

@@ -1,7 +1,7 @@
 name: "Ruby gems"
 
 # Builds platform-specific gems for the Ruby SDK. Each gem bundles the
-# secretspec-ffi staticlib (into vendor/); at `gem install` mkmf compiles a tiny
+# libsecretspec staticlib (into vendor/); at `gem install` mkmf compiles a tiny
 # C glue and statically links that archive, so the resolver is embedded in the
 # extension and one platform gem serves every Ruby ABI.
 #
@@ -108,7 +108,7 @@ jobs:
         run: |
           cd secretspec-rb
           # Installing compiles the extension (spec.extensions) against the
-          # bundled vendor/libsecretspec_ffi.a -- no Rust toolchain needed here.
+          # bundled vendor/libsecretspec.a -- no Rust toolchain needed here.
           gem install --no-document --install-dir "$RUNNER_TEMP/gemhome" secretspec-*.gem
           # Run outside the repo so only the installed extension satisfies require.
           cd "$RUNNER_TEMP"

.github/workflows/sdks.yml

@@ -66,12 +66,12 @@ jobs:
       - name: Build the native resolver
         env:
           MACOSX_DEPLOYMENT_TARGET: "12.0"
-        run: cargo build -p secretspec-ffi
+        run: cargo build -p libsecretspec
       - name: Build the local XCFramework
         run: >-
           bash scripts/build-swift-xcframework.sh
           secretspec-swift/Artifacts/CSecretSpec.xcframework
-          target/debug/libsecretspec_ffi.dylib
+          target/debug/libsecretspec.dylib
       - name: Run the Swift SDK and conformance tests
         run: |
           swift build --target SecretSpecExamples