vaultkit 0.3.0__tar.gz → 0.3.1__tar.gz

{vaultkit-0.3.0 → vaultkit-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vaultkit
-Version: 0.3.0
+Version: 0.3.1
 Summary: VaultKit Python SDK for policy-driven, runtime governed data access
 Author-email: VaultKit <founders@vaultkit.io>
 License: MIT

{vaultkit-0.3.0 → vaultkit-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vaultkit"
-version = "0.3.0"
+version = "0.3.1"
 description = "VaultKit Python SDK for policy-driven, runtime governed data access"
 authors = [
   { name = "VaultKit", email = "founders@vaultkit.io" }

{vaultkit-0.3.0 → vaultkit-0.3.1}/vaultkit/__init__.py

@@ -53,7 +53,7 @@ from .models import (
 # Optional (nice DX improvement)
 from .tools import ToolBuilder, ToolExecutor
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"
 
 __all__ = [
     "VaultKitClient",

{vaultkit-0.3.0 → vaultkit-0.3.1}/vaultkit/client.py

@@ -190,6 +190,7 @@ class VaultKitClient:
             raise DeniedError(
                 result.reason or "Request denied by policy",
                 policy_id=result.policy_id,
+                reason=result.reason,
             )
 
         # Case 1: data already returned (reuse path)
@@ -315,6 +316,7 @@ class VaultKitClient:
                 raise DeniedError(
                     result.reason or "Request denied",
                     policy_id=result.policy_id,
+                    reason=result.reason,
                 )
             if result.is_pending and not poll:
                 raise QueuedError(

{vaultkit-0.3.0 → vaultkit-0.3.1}/vaultkit/core/http.py

@@ -166,6 +166,7 @@ class HttpClient:
                     raw.get("error")
                     or raw.get("message")
                     or raw.get("detail")
+                    or raw.get("reason")
                     or msg
                 )
         except Exception:

{vaultkit-0.3.0 → vaultkit-0.3.1}/vaultkit/errors/exceptions.py

@@ -62,10 +62,12 @@ class DeniedError(VaultKitError):
         message: str,
         *,
         policy_id: Optional[str] = None,
+        reason: Optional[str] = None,
         context: Optional[ErrorContext] = None,
     ) -> None:
         super().__init__(message, context=context)
         self.policy_id = policy_id
+        self.reason = reason or message
 
 
 class QueuedError(VaultKitError):
@@ -185,10 +187,13 @@ def map_http_error(status_code: int, message: str, *, context: ErrorContext) ->
         return AuthError(message, context=context)
 
     if status_code == 403:
-        if error_type == "policy_denied":
+        # The intent API answers a denial with {"status": "denied", "policy_id", "reason"};
+        # older backends sent {"type": "policy_denied"}.
+        if error_type == "policy_denied" or raw.get("status") == "denied":
             return DeniedError(
                 message,
                 policy_id=raw.get("policy_id"),
+                reason=raw.get("reason"),
                 context=context,
             )
         return ForbiddenError(message, context=context)

{vaultkit-0.3.0 → vaultkit-0.3.1}/vaultkit/models/fetch_result.py

@@ -42,12 +42,23 @@ class FetchResult:
     @property
     def masked_fields(self) -> List[str]:
         """
-        Masked field names from meta, if your API returns them there.
+        Masked field names from meta.
+
+        funl sends meta.masked_fields as a map of field -> mask method
+        ({"email": "partial"}); a plain list of names is also accepted.
         Returns [] safely if meta is absent or has no masked_fields key.
         """
         value = (self.meta or {}).get("masked_fields")
+        if isinstance(value, dict):
+            return list(value.keys())
         return value if isinstance(value, list) else []
 
+    @property
+    def masking_methods(self) -> Dict[str, str]:
+        """Mask method per masked field, e.g. {"email": "partial"}. Empty if the API sent a list."""
+        value = (self.meta or {}).get("masked_fields")
+        return dict(value) if isinstance(value, dict) else {}
+
     @property
     def is_empty(self) -> bool:
         return not self.rows

{vaultkit-0.3.0 → vaultkit-0.3.1}/vaultkit/tools/executor.py

@@ -86,7 +86,6 @@ class ToolExecutor:
                     "name": d.dataset,
                     "datasource": d.datasource,
                     "visibility": visibility_map.get(getattr(d, "visibility", None), getattr(d, "visibility", None)),
-                    "field_count": len(getattr(d, "fields", []) or []),
                 }
                 for d in datasets
             ],
@@ -121,6 +120,7 @@ class ToolExecutor:
         }
 
         if result.masked_fields:
+            response["masked_fields"] = result.masked_fields
             response["note"] = f"Fields {result.masked_fields} were masked per data policy."
 
         return response
@@ -158,12 +158,17 @@ class ToolExecutor:
 
         if isinstance(exc, DeniedError):
             policy_id = getattr(exc, "policy_id", None)
+            reason = getattr(exc, "reason", None) or exc.message
             extra = f" (policy_id={policy_id})" if policy_id else ""
-            return self._error(
-                f"Access denied by VaultKit policy{extra}. Reason: {msg}. "
-                "Do not retry — this denial is deterministic.",
-                code="denied",
-            )
+            return {
+                "status": "denied",
+                "reason": reason,
+                "policy_id": policy_id,
+                "error": (
+                    f"Access denied by VaultKit policy{extra}. Reason: {reason}. "
+                    "Do not retry — this denial is deterministic."
+                ),
+            }
 
         if isinstance(exc, ApprovalRequiredError):
             return {

{vaultkit-0.3.0 → vaultkit-0.3.1}/vaultkit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vaultkit
-Version: 0.3.0
+Version: 0.3.1
 Summary: VaultKit Python SDK for policy-driven, runtime governed data access
 Author-email: VaultKit <founders@vaultkit.io>
 License: MIT