anyvali 1.0.7 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e69db0fbf58c8f8c3b86312b7726bdb9dcb8fa2267548346f68944dbab4369b
-  data.tar.gz: 9ec970eae7b0054112bb957bcd6fe22bf978da4076b77cb7bcec382fb154a159
+  metadata.gz: 7d3beeaa37d2d4f268cd4aa46f2f564c64ed4ad43de42901978ddc2949612034
+  data.tar.gz: 12f981176518f1084a673fd3c7a434f9911395c31547ecb36df6edfc0b36dfb7
 SHA512:
-  metadata.gz: 44d29c2d6593aef90eb191705302fca58678ac4067c7fc4f09503d61100d9a3e889a0ded7b5a512d316d1913e4432d07e8f59de92502b61b0628f25987d7e065
-  data.tar.gz: 8f1e3bfd37a3fb481a7e2c3fda01135ffe08acac7c0d12f17a28e003acbf7520bef4392ded582908edea39ca884d75ba1986c9b20a3bdec84b4f28de230ac275
+  metadata.gz: 39292dfec9cd01679ed49cae0832df36b86cf9f3e7c885fe275a4396818029ab99cf2e6725c1e99107418fdebf5b0ee91d5d6aacaae9a900275d024b5c26891a
+  data.tar.gz: f8a560d904eeea6d5a17025815d1e82037a1b95c961c2efab179780eea8e30c72d34a08dcada50045afa8fdbe63708925b1c61a50172571e2c28eaab854ae84c

data/README.md

@@ -202,6 +202,31 @@ schema = v.import_schema(json.loads(schema_json))
 result = schema.safe_parse(request_body)  # Same validation rules!
 ```
 
+## Sensitive Data
+
+Mark secrets with `sensitive: true`, then supply your own encryption function. AnyVali validates before and after transformation but never ships encryption logic or keys.
+
+```typescript
+import { decrypt, encrypt, object, safeParseEncrypted, string } from "anyvali";
+
+const Credentials = object({
+  username: string(),
+  password: string().minLength(12).describe("Password", { sensitive: true }),
+});
+
+const stored = encrypt(Credentials, input, (path, value) =>
+  `encrypted:${encryptWithYourKms(path, value)}`,
+);
+
+safeParseEncrypted(Credentials, stored); // validates the encrypted storage shape
+
+const clear = decrypt(Credentials, stored, (path, value) =>
+  decryptWithYourKms(path, value.slice("encrypted:".length)),
+);
+```
+
+Sensitive objects and arrays are encrypted as one opaque value. See the [sensitive data guide](docs/sensitive-data.md) for behavior, security boundaries, and every SDK's API names.
+
 ## Forms
 
 The JS SDK also ships a small forms layer for browser-native fields, HTML5 attributes, and AnyVali validation.

data/lib/anyvali/schema.rb

@@ -25,6 +25,8 @@ module AnyVali
 
     def safe_parse(input, path: [], context: nil)
       context ||= ValidationContext.new
+      handled, sensitive = handle_sensitive(input, path, context)
+      return sensitive if handled
       value = input
       issues = []
 
@@ -174,6 +176,45 @@ module AnyVali
 
     protected
 
+    def handle_sensitive(input, path, context)
+      return [false, nil] unless @metadata["sensitive"] == true && !input.nil? && context.sensitive_mode
+
+      if context.sensitive_mode == :encrypted
+        unless input.is_a?(String)
+          return [true, ParseResult.new(value: nil, issues: [ValidationIssue.new(
+            code: IssueCodes::INVALID_TYPE,
+            path: path,
+            expected: "encrypted:<value>",
+            received: Schema.type_name(input)
+          )])]
+        end
+        unless input.start_with?("encrypted:") && input.length > "encrypted:".length
+          return [true, ParseResult.new(value: nil, issues: [ValidationIssue.new(
+            code: IssueCodes::INVALID_STRING,
+            path: path,
+            expected: "encrypted:<value>",
+            received: input
+          )])]
+        end
+        return [true, ParseResult.new(value: input, issues: [])]
+      end
+
+      key = path.freeze
+      if context.sensitive_cache&.key?(key)
+        return [true, ParseResult.new(value: context.sensitive_cache[key], issues: [])]
+      end
+
+      value = input
+      if context.sensitive_mode == :encrypt
+        checked = safe_parse(input, path: path, context: ValidationContext.new(definitions: context.definitions))
+        return [true, checked] if checked.failure?
+        value = checked.value
+      end
+      value = context.sensitive_transform.call(path.dup, value)
+      context.sensitive_cache[key] = value if context.sensitive_cache
+      [true, ParseResult.new(value: value, issues: [])]
+    end
+
     def validate(value, path, issues, context)
       raise NotImplementedError, "Subclasses must implement validate"
     end

data/lib/anyvali/schemas/intersection_schema.rb

@@ -17,6 +17,8 @@ module AnyVali
 
     def safe_parse(input, path: [], context: nil)
       context ||= ValidationContext.new
+      handled, sensitive = handle_sensitive(input, path, context)
+      return sensitive if handled
       all_issues = []
       merged_output = nil
 

data/lib/anyvali/schemas/object_schema.rb

@@ -37,6 +37,9 @@ module AnyVali
     end
 
     def safe_parse(input = nil, path: [], context: nil, **kwargs)
+      context ||= ValidationContext.new
+      handled, sensitive = handle_sensitive(input, path, context)
+      return sensitive if handled
       input = kwargs unless kwargs.empty?
       context ||= ValidationContext.new
       issues = []

data/lib/anyvali/schemas/optional_schema.rb

@@ -19,6 +19,8 @@ module AnyVali
       # When used in objects, absence is handled by ObjectSchema
       # If called directly with a value, delegate to inner schema
       context ||= ValidationContext.new
+      handled, sensitive = handle_sensitive(input, path, context)
+      return sensitive if handled
       @inner_schema.safe_parse(input, path: path, context: context)
     end
 

data/lib/anyvali/schemas/ref_schema.rb

@@ -15,6 +15,8 @@ module AnyVali
 
     def safe_parse(input, path: [], context: nil)
       context ||= ValidationContext.new
+      handled, sensitive = handle_sensitive(input, path, context)
+      return sensitive if handled
       resolved = resolve(context)
       if resolved.nil?
         issues = [ValidationIssue.new(

data/lib/anyvali/validation_context.rb

@@ -3,11 +3,14 @@
 module AnyVali
   class ValidationContext
     attr_reader :definitions
-    attr_accessor :inherited_unknown_keys
+    attr_accessor :inherited_unknown_keys, :sensitive_mode, :sensitive_transform, :sensitive_cache
 
     def initialize(definitions: {})
       @definitions = definitions
       @inherited_unknown_keys = nil
+      @sensitive_mode = nil
+      @sensitive_transform = nil
+      @sensitive_cache = nil
     end
   end
 end

data/lib/anyvali.rb

@@ -165,6 +165,65 @@ module AnyVali
     RefSchema.new(ref: ref_path)
   end
 
+  def safe_parse_encrypted(schema, data)
+    context = ValidationContext.new
+    context.sensitive_mode = :encrypted
+    schema.safe_parse(data, context: context)
+  end
+
+  def encrypt(schema, data, transform)
+    encrypted = transform_sensitive(schema, schema.parse(data), :encrypt, transform)
+    result = safe_parse_encrypted(schema, encrypted)
+    raise ValidationError, result.issues if result.failure?
+    result.value
+  end
+
+  def decrypt(schema, data, transform)
+    encrypted = safe_parse_encrypted(schema, data)
+    raise ValidationError, encrypted.issues if encrypted.failure?
+    schema.parse(transform_sensitive(schema, encrypted.value, :decrypt, transform))
+  end
+
+  def transform_sensitive(schema, data, mode, transform)
+    transform_sensitive_node(schema, data, [], mode, transform, {})
+  end
+  private_class_method :transform_sensitive
+
+  def transform_sensitive_node(schema, data, path, mode, transform, cache)
+    if schema.metadata["sensitive"] == true && !data.nil?
+      return cache[path] if cache.key?(path)
+      value = mode == :encrypt ? schema.parse(data) : data
+      return cache[path.dup.freeze] = transform.call(path.dup, value)
+    end
+
+    case schema
+    when ObjectSchema
+      data.merge(schema.properties.each_with_object({}) do |(key, child), output|
+        output[key] = transform_sensitive_node(child, data[key], path + [key], mode, transform, cache) if data.key?(key)
+      end)
+    when ArraySchema
+      data.each_with_index.map { |value, index| transform_sensitive_node(schema.items_schema, value, path + [index], mode, transform, cache) }
+    when TupleSchema
+      data.each_with_index.map { |value, index| transform_sensitive_node(schema.element_schemas[index], value, path + [index], mode, transform, cache) }
+    when RecordSchema
+      data.each_with_object({}) do |(key, value), output|
+        output[key] = transform_sensitive_node(schema.values_schema, value, path + [key], mode, transform, cache)
+      end
+    when OptionalSchema, NullableSchema
+      data.nil? ? nil : transform_sensitive_node(schema.inner_schema, data, path, mode, transform, cache)
+    when UnionSchema
+      child = schema.variant_schemas.find do |variant|
+        mode == :decrypt ? safe_parse_encrypted(variant, data).success? : variant.safe_parse(data).success?
+      end
+      child ? transform_sensitive_node(child, data, path, mode, transform, cache) : data
+    when IntersectionSchema
+      schema.all_of_schemas.reduce(data) { |value, child| transform_sensitive_node(child, value, path, mode, transform, cache) }
+    else
+      data
+    end
+  end
+  private_class_method :transform_sensitive_node
+
   # Interchange
 
   def export(schema, mode: :portable, definitions: {})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: anyvali
 version: !ruby/object:Gem::Version
-  version: 1.0.7
+  version: 1.1.0
 platform: ruby
 authors:
 - AnyVali Contributors
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-24 00:00:00.000000000 Z
+date: 2026-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest