vaultkit 1.0.7 → 1.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cba4a6b29805455820a7137e864da2d9637bd59e2f4be377bd51875836ee6d5f
-  data.tar.gz: 33672d087e2cf391855bcd839162b706fab6908daebbf45504d67f7ed4093ff3
+  metadata.gz: 3cc5f978b053f8fe4ac4e146a50b90e2fecc93b884073816c760bb0d99502b96
+  data.tar.gz: 26b63ecee6b659f0bf0f645455963f712aac27df77850e142dabc894d5b8070a
 SHA512:
-  metadata.gz: 3e13e955409aa362de4bb76a526698c0157378dc77c803e80cd0d5c7d5bab39296d4dde4e04b55592c2e1f1ba6d4b20de9ad847263536c69baea791d643a6c1d
-  data.tar.gz: b355ce713edba89b7d293499489c0b0f4aaae614ca5f3af0249e31a043d1efbb25aa4359f710b86d9dca585bbe7b4b1f7651ac9d2e454197323a6a7bae347b61
+  metadata.gz: ba3984df812852cab48f7a530d77d021a8ecbb43432cd212f3ed7d0cd14c71705fce6894f05d3b7db84569168cd4004609fe9f9a702ca2b90c6130c59dcf3402
+  data.tar.gz: 7d5c1ca12d0fb08798c6c85bfa2fc10fd6db0667129f7d2fa51e72542dae471c734511f3480e1b73ba3c070903985fb5c42bb789905c1dea3aa4e383d3a6b599

data/lib/vkit/cli/base_cli.rb

@@ -202,7 +202,7 @@ module Vkit
 
         desc "bundle", "Compile YAML policies into a JSON policy bundle"
         option :policies_dir, type: :string, default: "config/policies"
-        option :registry_dir, type: :string, default: "config"
+        option :registry_dir, type: :string, default: "datasets"
         option :out, type: :string, default: "dist/policy_bundle.json"
         option :org, type: :string
         option :version, type: :string

data/lib/vkit/cli/commands/fetch_command.rb

@@ -16,8 +16,7 @@ module Vkit
               body: {}
             )
 
-            rows = response.dig("rows", "rows") || []
-            meta = response.dig("rows", "meta") || {}
+            rows, meta = normalize_response(response)
 
             print_result(rows, meta, format)
           end
@@ -42,6 +41,24 @@ module Vkit
             raise "Unknown format: #{format}"
           end
         end
+
+        def normalize_response(response)
+          rows =
+            if response["rows"].is_a?(Array)
+              response["rows"]
+            else
+              response.dig("rows", "rows") || []
+            end
+        
+          meta =
+            if response["meta"].is_a?(Hash)
+              response["meta"]
+            else
+              response.dig("rows", "meta") || {}
+            end
+        
+          [rows, meta]
+        end
       end
     end
   end

data/lib/vkit/cli/commands/policy_bundle_command.rb

@@ -67,22 +67,21 @@ module Vkit
         private
 
         def git_sha
-          `git rev-parse HEAD`.strip
-        rescue
+          out = `git rev-parse HEAD 2>/dev/null`.strip
+          return out unless out.empty?
+        
           Time.now.to_i.to_s
         end
-
+        
         def git_repo
-          `git config --get remote.origin.url`.strip
-        rescue
-          nil
+          out = `git config --get remote.origin.url 2>/dev/null`.strip
+          out.empty? ? nil : out
         end
-
+        
         def git_ref
-          `git rev-parse --abbrev-ref HEAD`.strip
-        rescue
-          nil
-        end
+          out = `git rev-parse --abbrev-ref HEAD 2>/dev/null`.strip
+          out.empty? ? nil : out
+        end        
       end
     end
   end

data/lib/vkit/cli/commands/request_command.rb

@@ -80,11 +80,20 @@ module Vkit
             exit 0
 
           when "ok"
-            rows = result["rows"] || []
+            rows = result["rows"]
+            meta = result["meta"] || {}
+
+            unless rows.is_a?(Array)
+              raise "Invalid response: expected rows to be an array"
+            end
 
             puts "✅ OK — #{rows.size} rows"
-            puts "ℹ️  Query Metadata:"
-            puts JSON.pretty_generate(result["meta"] || {})
+
+            if meta.any?
+              puts "ℹ️  Query Metadata:"
+              puts JSON.pretty_generate(meta)
+            end
+
             puts
             puts "ℹ️  Data Rows:"
             Vkit::Core::TableFormatter.render(rows)

data/lib/vkit/policy/bundle_compiler.rb

@@ -104,7 +104,31 @@ module Vkit
 
       def self.extract_masking(p)
         return unless p.dig("action", "mask")
-        p["masking"]
+      
+        raw =
+          p["masking"] ||
+          p.dig("action", "masking") || {}
+      
+        default_method =
+          normalize_mask_method(raw["default_method"]) if raw["default_method"]
+      
+        rules =
+          case raw["rules"]
+          when Hash
+            raw["rules"].each_with_object({}) do |(field, method), acc|
+              acc[field.to_s] = normalize_mask_method(method)
+            end
+          else
+            {}
+          end
+      
+        result = {}
+        result["default_method"] = default_method if default_method
+        result["rules"] = rules if rules.any?
+      
+        return if result.empty?
+      
+        result
       end
 
       def self.normalize_registry(raw)
@@ -139,6 +163,16 @@ module Vkit
         end
       end
 
+      def self.normalize_mask_method(method)
+        case method.to_s
+        when "redact"   then "full"
+        when "hash"     then "hash"
+        when "truncate" then "partial"
+        when "nullify"  then "full"
+        else "full"
+        end
+      end
+
       # Canonicalization
       def self.canonical_json(obj)
         JSON.generate(sort_keys_deep(obj))

data/lib/vkit/policy/packs/ai_safety/policies/03_mask_sensitive_by_default_for_agents.yaml

@@ -13,3 +13,6 @@ action:
   mask: true
   reason: "Agents should not receive raw sensitive fields by default."
   ttl: "4h"
+
+masking:
+  default_method: redact

data/lib/vkit/policy/packs/financial_compliance/policies/02_mask_payment_tokens.yaml

@@ -11,4 +11,7 @@ context: {}
 action:
   mask: true
   reason: "Payment tokens/card-related data must never be exposed in raw form."
-  ttl: "24h"
+  ttl: 24h
+
+masking:
+  default_method: redact

data/lib/vkit/policy/packs/starter/policies/02_mask_pii_by_default.yaml

@@ -1,13 +1,16 @@
 id: mask_pii_by_default
 description: "Mask PII fields by default unless explicitly allowed."
 
+priority: 80
+
 match:
   fields:
-    sensitivity: pii
-
-priority: 80
+    contains: ["pii"]
 
 action:
   mask: true
   reason: "PII is masked by default for safety."
-  ttl: "1h"
+  ttl: 1h
+
+masking:
+  default_method: redact

data/lib/vkit/policy/policy_validator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Vkit
   module Policy
     class PolicyValidator
@@ -28,7 +30,7 @@ module Vkit
           MSG
         end
 
-        validate_action!(action, prefix)
+        validate_action!(action, policy, prefix)
         true
       end
 
@@ -41,7 +43,7 @@ module Vkit
         MSG
       end
 
-      def self.validate_action!(action, prefix)
+      def self.validate_action!(action, policy, prefix)
         intents = ACTION_KEYS.select { |k| action[k] == true }
 
         if intents.empty?
@@ -81,7 +83,8 @@ module Vkit
           require_string!(action, "approver_role", prefix)
 
         when "mask"
-          # masking config can be validated later
+          # masking is optional, but if present must be valid
+          validate_masking!(policy, prefix) if policy.key?("masking")
 
         when "allow"
           # nothing required
@@ -124,6 +127,73 @@ module Vkit
           MSG
         end
       end
+
+      # Masking validation (aligned with compiler + runtime)
+      def self.validate_masking!(policy, prefix)
+        masking = policy["masking"]
+        return unless masking
+
+        unless masking.is_a?(Hash)
+          raise ValidationError, "#{prefix}masking must be a mapping."
+        end
+
+        allowed_keys = %w[default_method rules]
+        unknown_keys = masking.keys - allowed_keys
+
+        if unknown_keys.any?
+          raise ValidationError, <<~MSG
+            #{prefix}Unknown keys in masking: #{unknown_keys.join(', ')}
+
+            Allowed keys:
+              - default_method
+              - rules
+          MSG
+        end
+
+        if masking["default_method"]
+          validate_mask_method!(
+            masking["default_method"],
+            prefix,
+            "masking.default_method"
+          )
+        end
+
+        if masking["rules"]
+          unless masking["rules"].is_a?(Hash)
+            raise ValidationError,
+              "#{prefix}masking.rules must be a mapping of field → method."
+          end
+
+          masking["rules"].each do |field, method|
+            validate_mask_method!(
+              method,
+              prefix,
+              "masking.rules.#{field}"
+            )
+          end
+        end
+      end
+
+      def self.validate_mask_method!(method, prefix, path)
+        allowed = %w[redact hash truncate nullify full partial]
+
+        unless allowed.include?(method.to_s)
+          raise ValidationError, <<~MSG
+            #{prefix}Invalid masking method at #{path}.
+
+            Allowed values:
+              - redact
+              - hash
+              - truncate
+              - nullify
+              - full
+              - partial
+
+            Got:
+              #{method.inspect}
+          MSG
+        end
+      end
     end
   end
 end

data/lib/vkit/policy/schema/policy_bundle.schema.json

@@ -264,19 +264,15 @@
             "type": "object",
             "additionalProperties": false,
             "properties": {
-              "fields": {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "required": ["name", "method"],
-                  "additionalProperties": false,
-                  "properties": {
-                    "name": { "type": "string" },
-                    "method": {
-                      "type": "string",
-                      "enum": ["redact", "hash", "truncate", "nullify"]
-                    }
-                  }
+              "default_method": {
+                "type": "string",
+                "enum": ["full", "hash", "partial"]
+              },
+              "rules": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string",
+                  "enum": ["full", "hash", "partial"]
                 }
               }
             }

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.0.7"
+  VERSION = "1.0.8"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.0.7
+  version: 1.0.8
 platform: ruby
 authors:
 - Nnamdi Ogundu
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-17 00:00:00.000000000 Z
+date: 2026-02-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor