matrx-orm 3.1.144__tar.gz → 3.1.145__tar.gz

{matrx_orm-3.1.144 → matrx_orm-3.1.145}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.144
+Version: 3.1.145
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current
@@ -25,7 +25,7 @@ Requires-Python: >=3.13
 Requires-Dist: asyncpg>=0.31.0
 Requires-Dist: cryptography>=43.0
 Requires-Dist: gitpython>=3.1.40
-Requires-Dist: matrx-utils>=2.0.38
+Requires-Dist: matrx-utils>=2.0.39
 Requires-Dist: psycopg-pool>=3.2.5
 Requires-Dist: psycopg[binary]>=3.2.5
 Requires-Dist: python-dotenv>=1.0

{matrx_orm-3.1.144 → matrx_orm-3.1.145}/matrx_orm/secrets_battery/org_service.py

@@ -550,9 +550,16 @@ async def resolve_org_secrets(
     keys: list[str] | None = None,
     for_sandbox: bool = False,
     include_sealed: bool = False,
+    names_only: bool = False,
 ) -> dict[str, str]:
     """Bulk-resolve an org's readable secrets to ``{key: plaintext}``.
 
+    ``names_only=True`` answers "WHICH keys would resolve" without touching a
+    single value: no decrypt, no ``last_used_at`` stamp, every value ``""``.
+    It applies the exact same filters and grant checks, so the key set is the
+    one the plaintext call would return. Built for the sandbox briefing, which
+    tells the agent the NAMES of the env vars its vault injected — never values.
+
     A ``restricted`` secret is readable by an org ADMIN or by a user holding a
     ``can_use`` grant — the admin bypass is preserved verbatim from the retired
     ``private_vault.resolve_organization_secrets``. The HOST must have already
@@ -623,6 +630,9 @@ async def resolve_org_secrets(
             )
             if not field_granted and not item_granted:
                 continue
+        if names_only:
+            resolved[str(row["key"])] = ""
+            continue
         try:
             resolved[str(row["key"])] = decrypt_value(row["value_encrypted"])
         except Exception as exc:  # noqa: BLE001 — one bad row must not block the rest
@@ -635,7 +645,7 @@ async def resolve_org_secrets(
             continue
         used_ids.append(str(row["id"]))
 
-    if used_ids:
+    if used_ids and not names_only:
         await UserSecret.update_where({"id__in": used_ids}, last_used_at=datetime.now(UTC))
     return resolved
 
@@ -648,6 +658,7 @@ async def resolve_effective_secrets(
     keys: list[str] | None = None,
     for_sandbox: bool = False,
     include_sealed: bool = False,
+    names_only: bool = False,
 ) -> dict[str, str]:
     """**The bulk credential hierarchy** — org values, then the user's PERSONAL
     values overlaid on top, so a personal secret wins on key collision.
@@ -659,7 +670,10 @@ async def resolve_effective_secrets(
 
     ``include_sealed=False`` (default) excludes ``handling='sealed'`` fields in
     BOTH branches — only trusted execution paths pass ``True``. Keyless rows
-    (item fields with no env alias) never resolve into an environment."""
+    (item fields with no env alias) never resolve into an environment.
+
+    ``names_only=True`` returns the same KEY set with every value ``""`` and
+    decrypts nothing (see :func:`resolve_org_secrets`)."""
     resolved: dict[str, str] = {}
     if organization_id:
         resolved.update(
@@ -670,6 +684,7 @@ async def resolve_effective_secrets(
                 keys=keys,
                 for_sandbox=for_sandbox,
                 include_sealed=include_sealed,
+                names_only=names_only,
             )
         )
 
@@ -692,6 +707,9 @@ async def resolve_effective_secrets(
     if for_sandbox:
         rows = _keyed_for_sandbox(rows, scope=f"user {user_id}")
     for row in rows:
+        if names_only:
+            resolved[str(row["key"])] = ""
+            continue
         try:
             resolved[str(row["key"])] = decrypt_value(row["value_encrypted"])
         except Exception as exc:  # noqa: BLE001 — one bad row must not block the rest

{matrx_orm-3.1.144 → matrx_orm-3.1.145}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrx-orm"
-version = "3.1.144"
+version = "3.1.145"
 description = "Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching"
 readme = "README.md"
 license = { text = "MIT" }
@@ -41,7 +41,7 @@ dependencies = [
     "gitpython>=3.1.40",
     "psycopg[binary]>=3.2.5",
     "psycopg-pool>=3.2.5",
-    "matrx-utils>=2.0.38",
+    "matrx-utils>=2.0.39",
     "pyyaml>=6.0.3",
     "python-dotenv>=1.0",
     "cryptography>=43.0",