ciphergate-cli 0.7.0__tar.gz → 0.8.0__tar.gz

{ciphergate_cli-0.7.0 → ciphergate_cli-0.8.0}/CHANGELOG.md

@@ -6,6 +6,26 @@ versioning: [PEP 440](https://peps.python.org/pep-0440/) with SemVer meaning (pr
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-10-30
+
+Adds the packaged policy templates to the Python API. Existing behaviour is unchanged.
+
+### Added
+
+- Python API for the packaged policy templates: `load_template(name)` returns a `Policy` and
+  `template_names()` lists the names. An unknown name raises `UsageError`.
+
+## [0.7.1] - 2026-10-30
+
+Makes the starter policy templates available after `pip install`. Existing commands and
+template contents are unchanged.
+
+### Added
+
+- The starter policy templates now ship in the wheel. `ciphergate init --template NAME` writes
+  one to a file and `ciphergate init --list-templates` lists them, so a `pip install` no longer
+  needs a repository clone to get them. Plain `ciphergate init` is unchanged.
+
 ## [0.7.0] - 2026-10-30
 
 First release published to PyPI. CLI, API and policy behaviour are unchanged, except for the
@@ -259,7 +279,9 @@ Pre-release (alpha). Licensed under Apache-2.0. Not a final release: the securit
 See `docs/limitations.md`. Deferred: optional NER/Presidio detectors, stdin/stdout streaming,
 directory processing, structured log parsers, key files, reversible token vault, lossy decoding.
 
-[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.8.0...HEAD
+[0.8.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.1...v0.8.0
+[0.7.1]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.6.1...v0.7.0
 [0.6.1]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.5.0...v0.6.0

{ciphergate_cli-0.7.0 → ciphergate_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ciphergate-cli
-Version: 0.7.0
+Version: 0.8.0
 Summary: Local-first, environment- and destination-aware inspection and sanitization of logs and test datasets.
 Project-URL: Homepage, https://github.com/aashishkumar-tech/ciphergate
 Project-URL: Source, https://github.com/aashishkumar-tech/ciphergate
@@ -50,7 +50,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.7.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.8.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -117,8 +117,24 @@ ciphergate --version
 
 Runtime dependencies: `typer`, `pydantic`, `PyYAML`.
 
+## Quick start after `pip install`
+
+The policy templates ship with the package. Copy one, review it, then run it on your own file:
+
+```bash
+ciphergate init --list-templates
+ciphergate init --template developer_logs --output developer_logs.yml
+ciphergate validate-policy developer_logs.yml
+ciphergate inspect app.log --policy developer_logs.yml --environment dev --destination local_dev
+```
+
+Every template is a starting point that requires review for your data and destination.
+
 ## Quick start (synthetic examples)
 
+These commands run from a clone of this repository, because `examples/` is not in the package.
+`policies/` in a clone holds the same templates that `ciphergate init --template` writes.
+
 ```bash
 # 1. Start from a template (refuses to overwrite without --force) and validate it.
 ciphergate init --output ciphergate-policy.yml
@@ -478,6 +494,15 @@ report = sanitize_file("app.log", "app.clean.log", policy,
 print(report.status, report.exit_code)
 ```
 
+After `pip install`, there is no `policies/` folder. Load a packaged template by name instead;
+`template_names()` lists them. Templates require review for your data and destination.
+
+```python
+from ciphergate import load_template, template_names
+print(template_names())
+policy = load_template("developer_logs")
+```
+
 Streams and directories use the same pipeline and the same safety rules as the CLI:
 
 ```python

{ciphergate_cli-0.7.0 → ciphergate_cli-0.8.0}/README.md

@@ -11,7 +11,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.7.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.8.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -78,8 +78,24 @@ ciphergate --version
 
 Runtime dependencies: `typer`, `pydantic`, `PyYAML`.
 
+## Quick start after `pip install`
+
+The policy templates ship with the package. Copy one, review it, then run it on your own file:
+
+```bash
+ciphergate init --list-templates
+ciphergate init --template developer_logs --output developer_logs.yml
+ciphergate validate-policy developer_logs.yml
+ciphergate inspect app.log --policy developer_logs.yml --environment dev --destination local_dev
+```
+
+Every template is a starting point that requires review for your data and destination.
+
 ## Quick start (synthetic examples)
 
+These commands run from a clone of this repository, because `examples/` is not in the package.
+`policies/` in a clone holds the same templates that `ciphergate init --template` writes.
+
 ```bash
 # 1. Start from a template (refuses to overwrite without --force) and validate it.
 ciphergate init --output ciphergate-policy.yml
@@ -439,6 +455,15 @@ report = sanitize_file("app.log", "app.clean.log", policy,
 print(report.status, report.exit_code)
 ```
 
+After `pip install`, there is no `policies/` folder. Load a packaged template by name instead;
+`template_names()` lists them. Templates require review for your data and destination.
+
+```python
+from ciphergate import load_template, template_names
+print(template_names())
+policy = load_template("developer_logs")
+```
+
 Streams and directories use the same pipeline and the same safety rules as the CLI:
 
 ```python

{ciphergate_cli-0.7.0 → ciphergate_cli-0.8.0}/pyproject.toml

@@ -62,6 +62,9 @@ path = "src/ciphergate/__init__.py"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/ciphergate"]
+# policies/ stays the one source of the starter templates; `ciphergate init --template` reads them.
+[tool.hatch.build.targets.wheel.force-include]
+"policies" = "ciphergate/policies"
 
 [tool.hatch.build.targets.sdist]
 include = [

{ciphergate_cli-0.7.0 → ciphergate_cli-0.8.0}/src/ciphergate/__init__.py

@@ -3,6 +3,8 @@
 Supported public API (everything else is internal and may change without notice)::
 
     load_policy(path) -> Policy
+    load_template(name) -> Policy        # a packaged template; review it before relying on it
+    template_names() -> list[str]
     validate_policy(path_or_policy) -> ValidationResult
     inspect_file(path, policy, context=None) -> RunReport
     plan_file(path, policy, context=None) -> RunReport
@@ -22,7 +24,7 @@ Supported public API (everything else is internal and may change without notice)
     rescan_directory(root, policy, context=None, *, recursive=False, strict=None) -> BatchReport
 """
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"
 
 from ciphergate.config import RuntimeSettings
 from ciphergate.constants import (
@@ -55,6 +57,7 @@ from ciphergate.pipeline.streams import (
     rescan_stream,
     sanitize_stream,
 )
+from ciphergate.policy.templates import load_template, template_names
 from ciphergate.policy.validator import (
     Policy,
     ValidationResult,
@@ -82,6 +85,7 @@ __all__ = [
     "inspect_file",
     "inspect_stream",
     "load_policy",
+    "load_template",
     "plan_directory",
     "plan_file",
     "plan_stream",
@@ -91,5 +95,6 @@ __all__ = [
     "sanitize_directory",
     "sanitize_file",
     "sanitize_stream",
+    "template_names",
     "validate_policy",
 ]

{ciphergate_cli-0.7.0 → ciphergate_cli-0.8.0}/src/ciphergate/cli.py

@@ -74,6 +74,7 @@ from ciphergate.pipeline.stdio import (
 )
 from ciphergate.policy.context import evaluate_gates, resolve_context
 from ciphergate.policy.engine import PolicyEngine
+from ciphergate.policy.templates import read_template, template_names
 from ciphergate.policy.validator import load_policy, validate_policy
 from ciphergate.reporting.safe_text import escape_control
 from ciphergate.reporting.serializer import (
@@ -351,6 +352,13 @@ def init_command(
     output: Annotated[
         Path, typer.Option("--output", "-o", help="Where to write the policy.")
     ] = Path("ciphergate-policy.yml"),
+    template: Annotated[
+        str | None,
+        typer.Option("--template", "-t", help="Named template (see --list-templates)."),
+    ] = None,
+    list_templates: Annotated[
+        bool, typer.Option("--list-templates", help="List named templates and exit.")
+    ] = False,
     force: ForceOpt = False,
     quiet: QuietOpt = False,
     debug: DebugOpt = False,
@@ -358,12 +366,17 @@ def init_command(
     """Write a starter policy template (it MUST be reviewed before real use)."""
 
     def body() -> int:
-        validate_output_path(output, protected=[], force=force, label="policy")
+        if list_templates:
+            sys.stdout.write("".join(f"{name}\n" for name in template_names()))
+            return 0
         text = (
-            resources.files("ciphergate")
+            read_template(template)
+            if template is not None
+            else resources.files("ciphergate")
             .joinpath("templates/starter_policy.yml")
             .read_text(encoding="utf-8")
         )
+        validate_output_path(output, protected=[], force=force, label="policy")
         with AtomicOutput(output, force=force) as out:
             out.stream.write(text)
             out.publish()

ciphergate_cli-0.8.0/src/ciphergate/policy/templates.py

@@ -0,0 +1,42 @@
+"""Starter policy templates shipped with the package. Every template requires review before use."""
+
+from __future__ import annotations
+
+from importlib import resources
+from importlib.resources.abc import Traversable
+from pathlib import Path
+
+from ciphergate.errors import UsageError
+from ciphergate.policy.validator import Policy, load_policy_text
+
+
+def _templates_dir() -> Traversable:
+    packaged = resources.files("ciphergate").joinpath("policies")
+    if packaged.is_dir():
+        return packaged
+    # Editable install: the build copies policies/ into wheels only, so use the source checkout.
+    return Path(__file__).resolve().parents[3] / "policies"
+
+
+def template_names() -> list[str]:
+    """Names accepted by `read_template`, sorted."""
+    return sorted(
+        entry.name.removesuffix(".yml")
+        for entry in _templates_dir().iterdir()
+        if entry.name.endswith(".yml")
+    )
+
+
+def read_template(name: str) -> str:
+    """Return a template's text. `name` is only compared to known names, never used as a path."""
+    if name not in template_names():
+        raise UsageError(
+            "unknown policy template; run: ciphergate init --list-templates",
+            code="unknown_policy_template",
+        )
+    return _templates_dir().joinpath(f"{name}.yml").read_text(encoding="utf-8")
+
+
+def load_template(name: str) -> Policy:
+    """Load a named template as a `Policy`. It is a starting point that requires review."""
+    return load_policy_text(read_template(name), source_name=f"{name}.yml")

{ciphergate_cli-0.7.0 → ciphergate_cli-0.8.0}/tests/integration/test_cli_e2e.py

@@ -40,6 +40,36 @@ def test_init_refuses_overwrite(tmp_path: Path) -> None:
     assert invoke("init", "--output", target, "--force").exit_code == 0
 
 
+def test_init_lists_every_policy_template() -> None:
+    r = invoke("init", "--list-templates")
+    assert r.exit_code == 0
+    assert r.stdout.split() == sorted(p.stem for p in POLICIES.glob("*.yml"))
+
+
+@pytest.mark.parametrize("policy", sorted(POLICIES.glob("*.yml")), ids=lambda p: p.stem)
+def test_init_template_writes_a_valid_copy(tmp_path: Path, policy: Path) -> None:
+    target = tmp_path / "p.yml"
+    r = invoke("init", "--template", policy.stem, "--output", target)
+    assert r.exit_code == 0 and "template" in r.stdout.lower()
+    assert target.read_text(encoding="utf-8") == policy.read_text(encoding="utf-8")
+    assert invoke("validate-policy", target).exit_code == 0
+
+
+def test_init_template_refuses_overwrite(tmp_path: Path) -> None:
+    target = tmp_path / "p.yml"
+    target.write_text("keep", encoding="utf-8")
+    assert invoke("init", "--template", "dev_local", "--output", target).exit_code == 5
+    assert target.read_text(encoding="utf-8") == "keep"
+
+
+@pytest.mark.parametrize("name", ["nope", "../pyproject", "dev_local.yml", ""])
+def test_init_unknown_template_fails_and_writes_nothing(tmp_path: Path, name: str) -> None:
+    target = tmp_path / "p.yml"
+    r = invoke("init", "--template", name, "--output", target)
+    assert r.exit_code == 2
+    assert "--list-templates" in r.output and not target.exists()
+
+
 def test_validate_policy_exit_codes(tmp_path: Path) -> None:
     bad = tmp_path / "bad.yml"
     bad.write_text(

ciphergate_cli-0.8.0/tests/unit/test_policy_templates.py

@@ -0,0 +1,55 @@
+"""Packaged policy templates through the public Python API."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+import ciphergate
+from ciphergate import (
+    ContextInput,
+    RunStatus,
+    load_policy,
+    load_template,
+    sanitize_file,
+    template_names,
+)
+from ciphergate.errors import CipherGateError, UsageError
+from tests.conftest import EXAMPLES, POLICIES
+
+
+def test_public_exports() -> None:
+    for name in ("load_template", "template_names"):
+        assert name in ciphergate.__all__ and hasattr(ciphergate, name)
+
+
+def test_names_match_the_policy_files() -> None:
+    assert template_names() == sorted(p.stem for p in POLICIES.glob("*.yml"))
+
+
+@pytest.mark.parametrize("name", template_names())
+def test_load_template_matches_the_policy_file(name: str) -> None:
+    policy = load_template(name)
+    assert policy.name == load_policy(POLICIES / f"{name}.yml").name
+    assert policy.source_name == f"{name}.yml"
+
+
+@pytest.mark.parametrize("name", ["nope", "../pyproject", "dev_local.yml", ""])
+def test_unknown_template_is_rejected(name: str) -> None:
+    with pytest.raises(UsageError) as err:
+        load_template(name)
+    assert err.value.code == "unknown_policy_template"
+    assert isinstance(err.value, CipherGateError)
+
+
+def test_loaded_template_still_blocks_and_publishes_nothing(tmp_path: Path) -> None:
+    output = tmp_path / "out.log"
+    report = sanitize_file(
+        EXAMPLES / "sample.log",
+        output,
+        load_template("prd_external_ai"),
+        ContextInput(),
+    )
+    assert report.status == RunStatus.BLOCKED and report.exit_code == 1
+    assert not output.exists()