ciphergate-cli 0.7.0__tar.gz → 0.7.1__tar.gz

{ciphergate_cli-0.7.0 → ciphergate_cli-0.7.1}/CHANGELOG.md

@@ -6,6 +6,17 @@ versioning: [PEP 440](https://peps.python.org/pep-0440/) with SemVer meaning (pr
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-10-30
+
+Makes the starter policy templates available after `pip install`. Existing commands and
+template contents are unchanged.
+
+### Added
+
+- The starter policy templates now ship in the wheel. `ciphergate init --template NAME` writes
+  one to a file and `ciphergate init --list-templates` lists them, so a `pip install` no longer
+  needs a repository clone to get them. Plain `ciphergate init` is unchanged.
+
 ## [0.7.0] - 2026-10-30
 
 First release published to PyPI. CLI, API and policy behaviour are unchanged, except for the
@@ -259,7 +270,8 @@ Pre-release (alpha). Licensed under Apache-2.0. Not a final release: the securit
 See `docs/limitations.md`. Deferred: optional NER/Presidio detectors, stdin/stdout streaming,
 directory processing, structured log parsers, key files, reversible token vault, lossy decoding.
 
-[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.1...HEAD
+[0.7.1]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.6.1...v0.7.0
 [0.6.1]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.5.0...v0.6.0

{ciphergate_cli-0.7.0 → ciphergate_cli-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ciphergate-cli
-Version: 0.7.0
+Version: 0.7.1
 Summary: Local-first, environment- and destination-aware inspection and sanitization of logs and test datasets.
 Project-URL: Homepage, https://github.com/aashishkumar-tech/ciphergate
 Project-URL: Source, https://github.com/aashishkumar-tech/ciphergate
@@ -50,7 +50,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.7.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.7.1 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -117,8 +117,24 @@ ciphergate --version
 
 Runtime dependencies: `typer`, `pydantic`, `PyYAML`.
 
+## Quick start after `pip install`
+
+The policy templates ship with the package. Copy one, review it, then run it on your own file:
+
+```bash
+ciphergate init --list-templates
+ciphergate init --template developer_logs --output developer_logs.yml
+ciphergate validate-policy developer_logs.yml
+ciphergate inspect app.log --policy developer_logs.yml --environment dev --destination local_dev
+```
+
+Every template is a starting point that requires review for your data and destination.
+
 ## Quick start (synthetic examples)
 
+These commands run from a clone of this repository, because `examples/` is not in the package.
+`policies/` in a clone holds the same templates that `ciphergate init --template` writes.
+
 ```bash
 # 1. Start from a template (refuses to overwrite without --force) and validate it.
 ciphergate init --output ciphergate-policy.yml

{ciphergate_cli-0.7.0 → ciphergate_cli-0.7.1}/README.md

@@ -11,7 +11,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.7.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.7.1 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -78,8 +78,24 @@ ciphergate --version
 
 Runtime dependencies: `typer`, `pydantic`, `PyYAML`.
 
+## Quick start after `pip install`
+
+The policy templates ship with the package. Copy one, review it, then run it on your own file:
+
+```bash
+ciphergate init --list-templates
+ciphergate init --template developer_logs --output developer_logs.yml
+ciphergate validate-policy developer_logs.yml
+ciphergate inspect app.log --policy developer_logs.yml --environment dev --destination local_dev
+```
+
+Every template is a starting point that requires review for your data and destination.
+
 ## Quick start (synthetic examples)
 
+These commands run from a clone of this repository, because `examples/` is not in the package.
+`policies/` in a clone holds the same templates that `ciphergate init --template` writes.
+
 ```bash
 # 1. Start from a template (refuses to overwrite without --force) and validate it.
 ciphergate init --output ciphergate-policy.yml

{ciphergate_cli-0.7.0 → ciphergate_cli-0.7.1}/pyproject.toml

@@ -62,6 +62,9 @@ path = "src/ciphergate/__init__.py"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/ciphergate"]
+# policies/ stays the one source of the starter templates; `ciphergate init --template` reads them.
+[tool.hatch.build.targets.wheel.force-include]
+"policies" = "ciphergate/policies"
 
 [tool.hatch.build.targets.sdist]
 include = [

{ciphergate_cli-0.7.0 → ciphergate_cli-0.7.1}/src/ciphergate/__init__.py

@@ -22,7 +22,7 @@ Supported public API (everything else is internal and may change without notice)
     rescan_directory(root, policy, context=None, *, recursive=False, strict=None) -> BatchReport
 """
 
-__version__ = "0.7.0"
+__version__ = "0.7.1"
 
 from ciphergate.config import RuntimeSettings
 from ciphergate.constants import (

{ciphergate_cli-0.7.0 → ciphergate_cli-0.7.1}/src/ciphergate/cli.py

@@ -74,6 +74,7 @@ from ciphergate.pipeline.stdio import (
 )
 from ciphergate.policy.context import evaluate_gates, resolve_context
 from ciphergate.policy.engine import PolicyEngine
+from ciphergate.policy.templates import read_template, template_names
 from ciphergate.policy.validator import load_policy, validate_policy
 from ciphergate.reporting.safe_text import escape_control
 from ciphergate.reporting.serializer import (
@@ -351,6 +352,13 @@ def init_command(
     output: Annotated[
         Path, typer.Option("--output", "-o", help="Where to write the policy.")
     ] = Path("ciphergate-policy.yml"),
+    template: Annotated[
+        str | None,
+        typer.Option("--template", "-t", help="Named template (see --list-templates)."),
+    ] = None,
+    list_templates: Annotated[
+        bool, typer.Option("--list-templates", help="List named templates and exit.")
+    ] = False,
     force: ForceOpt = False,
     quiet: QuietOpt = False,
     debug: DebugOpt = False,
@@ -358,12 +366,17 @@ def init_command(
     """Write a starter policy template (it MUST be reviewed before real use)."""
 
     def body() -> int:
-        validate_output_path(output, protected=[], force=force, label="policy")
+        if list_templates:
+            sys.stdout.write("".join(f"{name}\n" for name in template_names()))
+            return 0
         text = (
-            resources.files("ciphergate")
+            read_template(template)
+            if template is not None
+            else resources.files("ciphergate")
             .joinpath("templates/starter_policy.yml")
             .read_text(encoding="utf-8")
         )
+        validate_output_path(output, protected=[], force=force, label="policy")
         with AtomicOutput(output, force=force) as out:
             out.stream.write(text)
             out.publish()

ciphergate_cli-0.7.1/src/ciphergate/policy/templates.py

@@ -0,0 +1,36 @@
+"""Starter policy templates shipped with the package. Every template requires review before use."""
+
+from __future__ import annotations
+
+from importlib import resources
+from importlib.resources.abc import Traversable
+from pathlib import Path
+
+from ciphergate.errors import UsageError
+
+
+def _templates_dir() -> Traversable:
+    packaged = resources.files("ciphergate").joinpath("policies")
+    if packaged.is_dir():
+        return packaged
+    # Editable install: the build copies policies/ into wheels only, so use the source checkout.
+    return Path(__file__).resolve().parents[3] / "policies"
+
+
+def template_names() -> list[str]:
+    """Names accepted by `read_template`, sorted."""
+    return sorted(
+        entry.name.removesuffix(".yml")
+        for entry in _templates_dir().iterdir()
+        if entry.name.endswith(".yml")
+    )
+
+
+def read_template(name: str) -> str:
+    """Return a template's text. `name` is only compared to known names, never used as a path."""
+    if name not in template_names():
+        raise UsageError(
+            "unknown policy template; run: ciphergate init --list-templates",
+            code="unknown_policy_template",
+        )
+    return _templates_dir().joinpath(f"{name}.yml").read_text(encoding="utf-8")

{ciphergate_cli-0.7.0 → ciphergate_cli-0.7.1}/tests/integration/test_cli_e2e.py

@@ -40,6 +40,36 @@ def test_init_refuses_overwrite(tmp_path: Path) -> None:
     assert invoke("init", "--output", target, "--force").exit_code == 0
 
 
+def test_init_lists_every_policy_template() -> None:
+    r = invoke("init", "--list-templates")
+    assert r.exit_code == 0
+    assert r.stdout.split() == sorted(p.stem for p in POLICIES.glob("*.yml"))
+
+
+@pytest.mark.parametrize("policy", sorted(POLICIES.glob("*.yml")), ids=lambda p: p.stem)
+def test_init_template_writes_a_valid_copy(tmp_path: Path, policy: Path) -> None:
+    target = tmp_path / "p.yml"
+    r = invoke("init", "--template", policy.stem, "--output", target)
+    assert r.exit_code == 0 and "template" in r.stdout.lower()
+    assert target.read_text(encoding="utf-8") == policy.read_text(encoding="utf-8")
+    assert invoke("validate-policy", target).exit_code == 0
+
+
+def test_init_template_refuses_overwrite(tmp_path: Path) -> None:
+    target = tmp_path / "p.yml"
+    target.write_text("keep", encoding="utf-8")
+    assert invoke("init", "--template", "dev_local", "--output", target).exit_code == 5
+    assert target.read_text(encoding="utf-8") == "keep"
+
+
+@pytest.mark.parametrize("name", ["nope", "../pyproject", "dev_local.yml", ""])
+def test_init_unknown_template_fails_and_writes_nothing(tmp_path: Path, name: str) -> None:
+    target = tmp_path / "p.yml"
+    r = invoke("init", "--template", name, "--output", target)
+    assert r.exit_code == 2
+    assert "--list-templates" in r.output and not target.exists()
+
+
 def test_validate_policy_exit_codes(tmp_path: Path) -> None:
     bad = tmp_path / "bad.yml"
     bad.write_text(