kavrix 0.2.4 → 0.2.6

package/README.md

@@ -41,6 +41,13 @@ kavrix db vault create --profile work
 # 3. Copy the returned opaque vault ID into the flat commands.
 kavrix put github/token --profile work --vault <vault-id>
 kavrix get github/token --reveal --profile work --vault <vault-id>
+
+# Or create an explicit project/service/item hierarchy.
+kavrix context create platform --environment production --profile work --vault <vault-id>
+kavrix service create github --context platform --profile work --vault <vault-id>
+kavrix item create deploy --context platform --service github --profile work --vault <vault-id>
+kavrix field set token --type api-key --context platform --service github \
+  --item deploy --profile work --vault <vault-id>
 ```
 
 Sensitive input is prompted for or read from stdin; it is never accepted as a
@@ -57,19 +64,28 @@ options in your installed version.
 | `db key create`                                                            | Create an exact-snapshot key for full local-file sharing.                             |
 | `db recovery ...`                                                          | Manage database-root recovery kits.                                                   |
 | `migrate database`                                                         | Copy one legacy version 2 vault into a database.                                      |
+| `context`, `service`, `item`, `field`                                      | Manage structured project credentials and schema-driven typed fields.                 |
 | `put`, `get`, `list`, `view`, `search`, `stats`, `has`, `rename`, `remove` | Store, read, and organize credentials.                                                |
 | `key status/verify/copy/replicate/assign/rewrap`                           | Manage protected key files.                                                           |
 | `recovery create/verify/status/revoke/use`                                 | Manage recovery kits.                                                                 |
 | `doctor`, `doctor health`                                                  | Validate a vault; repair bounded transient state safely.                              |
 | `init`, `vault`, `legacy v2 commands`                                      | Version 2 compatibility surface.                                                      |
 | `run`                                                                      | Execute one command with selected credentials injected as environment variables only. |
-| `policy create/list/show/remove`                                           | Stored rules: allowlists, SHA-256 pins, TTLs, deny, confirmations.                    |
-| `grant create/list/revoke`                                                 | Temporary consumable authorizations with expiry and use caps.                         |
+| `policy create/list/show/remove/check/explain/lint/diff/suggest`           | Stored rules plus read-only simulation, diagnostics, previews, and narrowing advice.  |
+| `grant create/list/show/revoke`                                            | Temporary consumable authorizations with live expiry, restrictions, and use caps.     |
 | `audit`                                                                    | Plaintext-free security audit trail.                                                  |
 | `agent run`, `agent exec`                                                  | Credential firewall that brokers AI coding agents.                                    |
 
-Plaintext output is always opt-in through `--reveal`; listing and dashboard
-commands never display credential values.
+Sensitive plaintext output is opt-in through `--reveal` or multiline-safe
+`--reveal-base64`; listing and dashboard commands never display field values.
+`field get` may return a non-sensitive value according to its schema.
+
+Database vaults organize private data as project context/environment →
+service/group → credential item → typed fields. The root flat commands remain
+a compatibility projection over the default context/service and never split a
+literal name such as `github/token` into hierarchy segments. Field definitions
+carry copy, reveal, reauthentication, and export policies; present values stay
+redacted until an allowed explicit reveal.
 
 ## Running tools without pasting secrets
 
@@ -78,8 +94,13 @@ kavrix run --secret AWS_KEY=aws/deploy-key -- terraform plan
 
 kavrix policy create deploy --secret aws/deploy-key \
   --command terraform --hash terraform=<sha256> --ttl 30m
+kavrix policy check deploy -- terraform plan
+kavrix policy explain deploy -- terraform plan
+kavrix policy lint
+kavrix policy suggest
 
 kavrix grant create aws/deploy-key --ttl 15m --max-uses 3
+kavrix grant show <grant-id>
 
 kavrix agent run
 ```
@@ -87,6 +108,9 @@ kavrix agent run
 Policies are evaluated fail-closed before any child process spawns, grants are
 consumed atomically and can be revoked immediately, and `kavrix audit` records
 policy, grant, authorization, and completion events without secret material.
+The policy developer tools and grant inspection authenticate metadata without
+decrypting credential payloads, modifying audit state, or creating a missing
+authorization sidecar.
 
 ## Options worth knowing
 
@@ -99,6 +123,7 @@ policy, grant, authorization, and completion events without secret material.
 | `--value-stdin`                     | Read a credential value from stdin.                                        |
 | `--secrets-stdin`                   | Read every unlock secret from exact stdin frames.                          |
 | `--reveal`                          | The explicit guard that prints plaintext.                                  |
+| `--reveal-base64`                   | Authorized multiline-safe field-value output.                              |
 | `--json`                            | Masked machine-readable output.                                            |
 | `--overwrite`                       | Opt in to replacing something that already exists.                         |
 | `--allow-insecure-transport`        | Explicit opt-in to unencrypted MongoDB transport (isolated networks only). |
@@ -124,8 +149,9 @@ must explicitly enable validated TLS.
 - Losing all valid owner keys and all database recovery kits makes the database
   permanently unrecoverable by design; there is no reset or escrow.
 - User identities, public enrollment, per-vault grants and roles, revocation
-  with rotation, ownership transfer, groups, structured items, and typed fields
-  are not yet implemented.
+  with rotation, and ownership transfer are not yet implemented. Structured
+  payloads model notes, attachment ownership, and history, but 0.2.6 does not
+  add attachment transfer or history-restore commands.
 - Windows command scripts (`.bat`, `.cmd`, `.com`) are refused for execution;
   invoke real executables.