matrx-orm 3.1.24__tar.gz → 3.1.26__tar.gz

{matrx_orm-3.1.24 → matrx_orm-3.1.26}/CLAUDE.md

@@ -32,7 +32,7 @@ Every table that becomes a Model needs row identity: a single-column primary key
 - **Adapters**: `AsyncPostgreSQLAdapter`, `SupabaseAdapter`, `PostgRESTClientAdapter`.
 - **Signals**: `pre_create`, `post_create`, `pre_save`, `post_save`, `pre_delete`, `post_delete`.
 - **Schema builder** (`matrx_orm.schema_builder`): code generation for Python + TypeScript type definitions from the DB schema. Postgres **VIEWs** are emitted as **read-only `Model` classes** into the same schema models file (on by default; per-entry `output.include_views: false` opts a schema out, `output.exclude_views: [...]` skips individual views). View models get no manager/DTO/base-class/auto_config (views are not writable), synthesize `_primary_keys` from an `id` column (else the first column, for cache-key/`load_by_id` only), and emit plain typed fields with **no `ForeignKey`** (views carry no FK metadata — nothing cross-schema to resolve). Never hand-write a view model again.
-- **Secrets battery** (`matrx_orm.secrets`): the ONE canonical user-credential vault — `users.user_secrets` CRUD + the platform's single Fernet primitive, keyed by `CREDENTIALS_ENCRYPTION_KEY`. Any package: `configure_secrets(db_config_name=...)` once, then `await require_user_secret(user_id, key)`. No package ever calls another service to resolve a credential. Contract: [`matrx_orm/secrets/FEATURE.md`](matrx_orm/secrets/FEATURE.md).
+- **Secrets battery** (`matrx_orm.secrets_battery`): the ONE canonical user-credential vault — `users.user_secrets` CRUD + the platform's single Fernet primitive, keyed by `CREDENTIALS_ENCRYPTION_KEY`. Any package: `configure_secrets(db_config_name=...)` once, then `await require_user_secret(user_id, key)`. No package ever calls another service to resolve a credential. Contract: [`matrx_orm/secrets_battery/FEATURE.md`](matrx_orm/secrets_battery/FEATURE.md).
 - **Polymorphic associations** (`matrx_orm.associations`): `EntityRegistry` (token→Model) + `Associations` — a registry-driven, **ownership-gated** edge engine over a host's polymorphic edge table. Every `source→target` hop is org-scoped *and* the resolved target's `org_id` is re-verified (fail-closed, screams on mismatch), so a hop can't widen access past the tenant boundary. Hardcodes no table names — the host wires its own edge + token-registry models.
 
 Public API is defined explicitly in `matrx_orm/__init__.py` (100+ exports). Treat changes there as semver-breaking.

{matrx_orm-3.1.24 → matrx_orm-3.1.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: matrx-orm
-Version: 3.1.24
+Version: 3.1.26
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current

{matrx_orm-3.1.24 → matrx_orm-3.1.26}/matrx_orm/__init__.py

@@ -2,6 +2,7 @@ from .adapters import AdapterRegistry, AsyncPostgreSQLAdapter, BaseAdapter
 from .adapters.postgrest_client_adapter import PostgRESTClientAdapter
 from .adapters.supabase_adapter import SupabaseAdapter
 from .associations import (
+    ANY_ROLE,
     Associations,
     CrossOrgAssociationError,
     EntityRef,
@@ -358,6 +359,7 @@ __all__ = [
     "get_model_by_table_name",
     "validate_relation_resolution",
     # ── Polymorphic associations (registry-driven, ownership-gated) ────────────
+    "ANY_ROLE",
     "Associations",
     "CrossOrgAssociationError",
     "EntityRef",

{matrx_orm-3.1.24 → matrx_orm-3.1.26}/matrx_orm/associations.py

@@ -36,14 +36,32 @@ tested against in-memory fakes with no database.
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any, Callable
+from typing import TYPE_CHECKING, Any
+from collections.abc import Callable
 
 from matrx_utils import vcprint
 
 if TYPE_CHECKING:
     from matrx_orm.core.base import Model
 
-__all__ = ["EntityRef", "EntityRegistry", "Associations", "UnknownEntityType", "CrossOrgAssociationError"]
+__all__ = [
+    "EntityRef",
+    "EntityRegistry",
+    "Associations",
+    "UnknownEntityType",
+    "CrossOrgAssociationError",
+    "ANY_ROLE",
+]
+
+
+class _AnyRole:
+    """Sentinel: 'match every role' (distinct from ``None`` = the NULL-role edge)."""
+
+    def __repr__(self) -> str:  # pragma: no cover - repr only
+        return "ANY_ROLE"
+
+
+ANY_ROLE = _AnyRole()
 
 
 class UnknownEntityType(ValueError):
@@ -68,7 +86,10 @@ def _registry_model_lookup(schema: str, table: str) -> type[Model] | None:
     from matrx_orm.core.registry import model_registry
 
     for model in model_registry.all_models().values():
-        if getattr(model, "_db_schema", None) == schema and getattr(model, "_table_name", None) == table:
+        if (
+            getattr(model, "_db_schema", None) == schema
+            and getattr(model, "_table_name", None) == table
+        ):
             return model
     return None
 
@@ -164,6 +185,7 @@ class Associations:
         target_type_field: str = "target_type",
         target_id_field: str = "target_id",
         org_field: str = "org_id",
+        role_field: str = "role",
     ) -> None:
         self._assoc = association_model
         self._reg = registry
@@ -172,6 +194,8 @@ class Associations:
         self._tt = target_type_field
         self._ti = target_id_field
         self._org = org_field
+        self._role = role_field
+        self._role_available = True  # refined by _validate_field_bindings when introspectable
         self._validate_field_bindings()
 
     def _validate_field_bindings(self) -> None:
@@ -203,27 +227,52 @@ class Associations:
                 f"found on the model — {detail}. Available columns: "
                 f"{sorted(fields)}. Pass the correct *_field name(s) to Associations(...)."
             )
+        # role is OPTIONAL on the edge table — engines over role-less edge
+        # tables keep working; passing a role against one raises at call time.
+        self._role_available = self._role in fields
 
     # ---- writes ----------------------------------------------------------
 
+    def _role_filter(self, role: Any) -> dict[str, Any]:
+        """Translate a role argument into an edge filter. ``ANY_ROLE`` → no
+        filter; ``None`` → the NULL-role edge; a string → that role. Raises
+        loudly when a role is used against a role-less edge table."""
+        if role is ANY_ROLE:
+            return {}
+        if not self._role_available:
+            model_name = getattr(self._assoc, "__name__", str(self._assoc))
+            raise ValueError(
+                f"role={role!r} was passed but edge model {model_name} has no "
+                f"{self._role!r} column — add the column or configure role_field."
+            )
+        return {self._role: role}
+
     async def associate(
         self,
         source: EntityRef,
         target: EntityRef,
         *,
         org_id: str,
+        role: str | None = None,
         metadata: dict[str, Any] | None = None,
         created_by: str | None = None,
         verify: bool = True,
     ) -> Any:
         """Idempotently create the ``source -> target`` edge in ``org_id``.
 
+        **``role`` is part of edge identity** (mirroring the DB's unique index
+        ``(source, target, role) NULLS NOT DISTINCT``): the same endpoints with
+        different roles are DISTINCT edges; ``role=None`` names the NULL-role
+        edge. **A repeat call with ``metadata`` UPDATES the existing edge's
+        metadata** (full replace — the edge's metadata is the caller's document,
+        e.g. keyword-portfolio settings on a keyword→project link); with
+        ``metadata=None`` the existing edge is returned untouched.
+
         Validates both tokens against the registry; with ``verify=True`` (the
         default) it also loads each endpoint and confirms it exists and is in
         ``org_id`` — raising :class:`CrossOrgAssociationError` otherwise, so a
         leaky or dangling edge can never be *created* (the write-side mate of the
-        read-side gate). Then ``get_or_create`` on the unique tuple so a repeat
-        call is a no-op. ``org_id`` is required — the edge is the tenancy
+        read-side gate). ``org_id`` is required — the edge is the tenancy
         boundary. Pass ``verify=False`` only for trusted/bulk callers that already
         guarantee both endpoints. Returns the edge row.
         """
@@ -246,11 +295,21 @@ class Associations:
             self._ti: target.id,
             self._org: org_id,
         }
-        edge, _created = await self._assoc.get_or_create(defaults=defaults, **lookup)
+        if self._role_available:
+            lookup[self._role] = role
+        elif role is not None:
+            self._role_filter(role)  # raises with the loud config message
+        edge, created = await self._assoc.get_or_create(defaults=defaults, **lookup)
+        if not created and metadata is not None and getattr(edge, "metadata", None) != metadata:
+            edge = await edge.update(metadata=metadata)
         return edge
 
-    async def dissociate(self, source: EntityRef, target: EntityRef, *, org_id: str) -> int:
-        """Delete the ``source -> target`` edge(s) in ``org_id``. Returns the count removed."""
+    async def dissociate(
+        self, source: EntityRef, target: EntityRef, *, org_id: str, role: Any = ANY_ROLE
+    ) -> int:
+        """Delete the ``source -> target`` edge(s) in ``org_id``. Returns the count
+        removed. Default removes every role's edge between the endpoints;
+        ``role=None`` targets only the NULL-role edge, a string only that role."""
         if not org_id:
             raise ValueError("dissociate requires a non-empty org_id")
         edges = await self._assoc.filter_items(
@@ -260,6 +319,7 @@ class Associations:
                 self._tt: target.type,
                 self._ti: target.id,
                 self._org: org_id,
+                **self._role_filter(role),
             }
         )
         for edge in edges:
@@ -269,25 +329,45 @@ class Associations:
     # ---- reads -----------------------------------------------------------
 
     async def edges_from(
-        self, source: EntityRef, *, org_id: str, target_type: str | None = None
+        self,
+        source: EntityRef,
+        *,
+        org_id: str,
+        target_type: str | None = None,
+        role: Any = ANY_ROLE,
     ) -> list[Any]:
-        """Raw edge rows where ``source`` is the source, in ``org_id`` (optionally one target type)."""
+        """Raw edge rows where ``source`` is the source, in ``org_id`` (optionally
+        one target type and/or one role — ``role=None`` = the NULL-role edges)."""
         filters: dict[str, Any] = {self._st: source.type, self._si: source.id, self._org: org_id}
         if target_type is not None:
             filters[self._tt] = target_type
+        filters.update(self._role_filter(role))
         return await self._assoc.filter_items(**filters)
 
     async def edges_to(
-        self, target: EntityRef, *, org_id: str, source_type: str | None = None
+        self,
+        target: EntityRef,
+        *,
+        org_id: str,
+        source_type: str | None = None,
+        role: Any = ANY_ROLE,
     ) -> list[Any]:
-        """Raw edge rows where ``target`` is the target, in ``org_id`` (optionally one source type)."""
+        """Raw edge rows where ``target`` is the target, in ``org_id`` (optionally
+        one source type and/or one role — ``role=None`` = the NULL-role edges)."""
         filters: dict[str, Any] = {self._tt: target.type, self._ti: target.id, self._org: org_id}
         if source_type is not None:
             filters[self._st] = source_type
+        filters.update(self._role_filter(role))
         return await self._assoc.filter_items(**filters)
 
     async def targets_from(
-        self, source: EntityRef, target_type: str, *, org_id: str, load: bool = True
+        self,
+        source: EntityRef,
+        target_type: str,
+        *,
+        org_id: str,
+        load: bool = True,
+        role: Any = ANY_ROLE,
     ) -> list[Any]:
         """Resolve the ``target_type`` entities ``source`` points to — ownership-gated.
 
@@ -297,17 +377,23 @@ class Associations:
         With ``load=False`` only the :class:`EntityRef` pointers are returned (still
         org-scoped by the edge query, but NOT row-verified).
         """
-        edges = await self.edges_from(source, org_id=org_id, target_type=target_type)
+        edges = await self.edges_from(source, org_id=org_id, target_type=target_type, role=role)
         ids = [getattr(e, self._ti) for e in edges]
         if not load:
             return [EntityRef(target_type, i) for i in ids]
         return await self._load_gated(target_type, ids, org_id)
 
     async def sources_to(
-        self, target: EntityRef, source_type: str, *, org_id: str, load: bool = True
+        self,
+        target: EntityRef,
+        source_type: str,
+        *,
+        org_id: str,
+        load: bool = True,
+        role: Any = ANY_ROLE,
     ) -> list[Any]:
         """Reverse of :meth:`targets_from` — the ``source_type`` entities pointing at ``target``."""
-        edges = await self.edges_to(target, org_id=org_id, source_type=source_type)
+        edges = await self.edges_to(target, org_id=org_id, source_type=source_type, role=role)
         ids = [getattr(e, self._si) for e in edges]
         if not load:
             return [EntityRef(source_type, i) for i in ids]

{matrx_orm-3.1.24 → matrx_orm-3.1.26}/matrx_orm/core/async_db_manager.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import asyncio
+from dataclasses import dataclass
 import json
 import logging
 import os
@@ -285,6 +286,15 @@ _init_connection = _init_connection_default
 _init_vector_codec = _init_connection_default
 
 
+@dataclass(frozen=True, slots=True)
+class ConnectionIdentity:
+    """The role/database a pool is actually connected as."""
+
+    current_user: str
+    session_user: str
+    database: str
+
+
 class AsyncDatabaseManager:
     _instance = None
     _pools = {}
@@ -496,6 +506,30 @@ class AsyncDatabaseManager:
                         ) from e
             return cls._pools[config_name]
 
+    @classmethod
+    async def connection_identity(cls, config_name: str) -> ConnectionIdentity:
+        """Who is this pool actually connected AS.
+
+        Exists so a service can PROVE it is inside its granted database
+        boundary (`current_user` = its scoped role) without hand-writing SQL —
+        the question "which role am I?" is database introspection, which the
+        ORM owns. Postgres exposes `current_user` / `session_user` /
+        `current_database` as reserved keywords rather than callable
+        functions, so `call_function` cannot reach them; this is the sanctioned
+        accessor.
+        """
+        pool = await cls.get_pool(config_name)
+        async with pool.acquire() as conn:
+            row = await conn.fetchrow(
+                "SELECT current_user AS current_user, session_user AS session_user, "
+                "current_database() AS database"
+            )
+        return ConnectionIdentity(
+            current_user=row["current_user"],
+            session_user=row["session_user"],
+            database=row["database"],
+        )
+
     @classmethod
     def _start_keepalive(cls, config_name: str, pool_min: int) -> None:
         """Start (or restart) the per-config pool keepalive task.

matrx_orm-3.1.26/matrx_orm/secrets_battery/FEATURE.md

@@ -0,0 +1,112 @@
+# matrx-orm secrets battery — the ONE credential vault
+
+**One table, one key, everywhere.** Every platform credential — personal AND
+organizational — lives in `users.user_secrets` (Fernet-encrypted). Every package
+and deployment that needs a credential holds the same `CREDENTIALS_ENCRYPTION_KEY`
+and reads the vault directly through this module. **No package calls another
+package or a service to resolve a credential** — there is no privileged
+decryptor (decided 2026-07-21; doctrine: `docs/packages/PACKAGE_DOCTRINE.md` §5).
+
+There is no second vault. The `private_vault.organization_secrets` system
+(Supabase Vault, decryption inside Postgres) was **annihilated 2026-07-21** —
+schema, tables, SECURITY DEFINER functions, and the duplicated `vault.secrets`
+material all dropped. A new `Fernet(...)` or a second secrets table anywhere is
+a defect.
+
+## Consumer contract
+
+```python
+from matrx_orm.secrets_battery import require_secret
+api_key = await require_secret(user_id, organization_id, "DATAFORSEO_API_KEY")
+```
+
+**`require_secret` is the one you want.** It implements the hierarchy:
+**personal → organization → raise**, naming both scopes it searched. Most people
+never hold their own API keys — their organization does.
+
+`require_user_secret(user_id, key)` is the personal-only variant. Both raise
+`SecretNotFoundError` / `SecretDecryptError` and never return None;
+`get_user_secret` / `get_org_secret` are the degradable twins.
+
+## Scope — one table, two shapes
+
+A row is PERSONAL (`user_id` set, `organization_id` NULL) or ORG-SCOPED
+(`organization_id` set, `user_id` NULL). A DB CHECK enforces exactly one, and
+partial unique indexes make `(scope, key)` unique among live rows.
+
+| Surface | Personal | Org |
+|---|---|---|
+| read one | `get_user_secret` | `get_org_secret` |
+| read many | — | `resolve_org_secrets` |
+| hierarchy (one key) | `require_secret` | ← same call |
+| hierarchy (many keys) | `resolve_effective_secrets` | ← same call |
+| CRUD | `create/update/delete_user_secret` | `create/update/delete_org_secret` |
+| listing | `list_user_secrets` | `list_org_secrets` |
+| grants | — | `set_org_secret_grants` |
+
+**Precedence is the same in both directions:** a PERSONAL value wins over an org
+value on key collision. `require_secret` checks personal first;
+`resolve_effective_secrets` loads org values then overlays personal on top. They
+are two expressions of one rule — keep them that way.
+
+## Grants and access modes
+
+An org secret is `access_mode='all_members'` (default) or `'restricted'`.
+A restricted secret is readable only by a user holding a `can_use` row in
+`users.user_secret_grants` — **or by an org admin**, via the `is_org_admin`
+flag the host computes and passes down.
+
+## The authorization boundary — read this before adding a check here
+
+**matrx-orm has no tenancy model and must never grow one.** This module does NOT
+decide who is a member or an admin of an organization. The HOST asserts that and
+passes the outcome in as `is_org_admin`. What the battery DOES own is the
+per-secret grant check, because `user_secret_grants` is its own table.
+
+aidream's authorization layer is
+[`aidream/services/user_secrets/organizations.py`](../../../../aidream/services/user_secrets/organizations.py):
+membership → `iam.has_org_access_for`, adminhood → `public.is_org_admin_for`,
+asserted before the battery is touched.
+
+## Audit
+
+`users.user_secret_audit` records **actions and metadata, NEVER values**
+(`record_secret_audit`). Audit is a trail, not a transaction: a failed audit
+write is logged loudly but never fails the operation the user asked for —
+losing the trail must not also lose the work.
+
+## Wiring
+
+- **Hosted:** `configure_secrets(db_config_name="<registered config>")` at
+  startup (aidream: `package_integration.py`) — aliases `matrx_secrets` onto the
+  host pool. One physical pool.
+- **Standalone package/service:** register your DB with matrx-orm, call the same
+  `configure_secrets`. Key comes from `CREDENTIALS_ENCRYPTION_KEY` env, or pass
+  `encryption_key=` (host injection).
+- Key resolution (byte-identical to the historical aidream implementation — all
+  existing ciphertexts keep decrypting): explicit key → `CREDENTIALS_ENCRYPTION_KEY`
+  (44-char urlsafe-base64 used directly, else SHA-256-derived) → `SUPABASE_SECRET_KEY`
+  derivation with a loud warning → loud RuntimeError.
+
+## Invariants
+
+- **This is the only Fernet instance in the universe.** The dict-payload helpers
+  (`encrypt_payload`/`decrypt_payload`) serve `tool.mcp_user_conn` blobs — same
+  key, same instance.
+- Every read is scoped by a **required** `user_id` or `organization_id`. No None
+  = "show everything".
+- Soft delete by default (`deleted_at`); the partial unique indexes back the
+  upserts.
+- `value_hint` is the only value-derived field that may reach a listing/UI.
+  Listing and management surfaces are value-free by construction.
+- `value_version` is bumped by the `users.user_secrets_value_version` DB trigger
+  when `value_encrypted` changes — never by hand.
+- Rotating an org secret's value CLEARS its personal-secret lineage
+  (`source_user_secret_id`) — the org value is no longer what the contributor holds.
+- One unreadable row (key drift) is skipped with a loud log during bulk
+  resolution — a broken row must not deny every other key.
+
+Drift guard: `scripts/validate_secrets_decrypt.py` (loud, non-blocking, in
+`release.sh`) asserts every active row still decrypts with the configured key.
+
+Verified against live code + the live `users.user_secrets` schema 2026-07-21.

matrx_orm-3.1.26/matrx_orm/secrets_battery/__init__.py

@@ -0,0 +1,136 @@
+"""matrx-orm secrets battery — the ONE canonical user-credential vault.
+
+One shared database table (``users.user_secrets``), one encryption key
+(``CREDENTIALS_ENCRYPTION_KEY``), held by every package/deployment that needs
+credentials. No package ever calls another package (or a service) to resolve
+a credential — it reads and decrypts directly through this module.
+
+Consumer contract (the whole thing):
+
+    from matrx_orm.secrets_battery import require_user_secret
+    api_key = await require_user_secret(user_id, "DATAFORSEO_API_KEY")
+
+Wiring:
+
+* **Hosted (inside aidream or any app with a registered pool):**
+  ``configure_secrets(db_config_name="<registered config>")`` — registers a
+  name alias; one physical pool, no second connection.
+* **Standalone package:** register your database with matrx-orm as usual,
+  then ``configure_secrets(db_config_name=...)``. The key comes from the
+  ``CREDENTIALS_ENCRYPTION_KEY`` env var, or pass ``encryption_key=`` here.
+
+Contract details: ``FEATURE.md`` beside this module.
+"""
+
+from __future__ import annotations
+
+from .crypto import (
+    configure_encryption,
+    decrypt_payload,
+    decrypt_value,
+    encrypt_payload,
+    encrypt_value,
+    get_fernet,
+    mask_value,
+    reset_encryption_for_tests,
+)
+from .model import PACKAGE_DB_NAME, UserSecret, UserSecretAudit, UserSecretGrant
+from .org_service import (
+    ACCESS_MODES,
+    OrgSecretRow,
+    create_org_secret,
+    delete_org_secret,
+    get_org_secret_row,
+    list_org_secrets,
+    record_secret_audit,
+    resolve_effective_secrets,
+    resolve_org_secrets,
+    set_org_secret_grants,
+    sync_org_secret_from_user,
+    update_org_secret,
+)
+from .service import (
+    KNOWN_CATEGORIES,
+    VALID_KEY_RE,
+    SecretDecryptError,
+    SecretNotFoundError,
+    SecretRow,
+    bulk_upsert_from_env_text,
+    create_user_secret,
+    delete_user_secret,
+    get_user_secret,
+    list_user_secrets,
+    parse_env_text,
+    get_org_secret,
+    require_secret,
+    require_user_secret,
+    update_user_secret,
+)
+
+
+def configure_secrets(
+    *,
+    db_config_name: str | None = None,
+    encryption_key: str | None = None,
+) -> None:
+    """Bind the battery. Idempotent; call once at startup.
+
+    ``db_config_name`` — an already-registered matrx-orm config to alias
+    ``matrx_secrets`` onto. ``encryption_key`` — explicit key injection for
+    hosts that prefer passing it over the env var."""
+    if encryption_key is not None:
+        configure_encryption(encryption_key)
+    if db_config_name is not None and db_config_name != PACKAGE_DB_NAME:
+        from matrx_orm import is_database_registered, register_database_alias
+
+        if not is_database_registered(db_config_name):
+            raise RuntimeError(
+                f"configure_secrets: db config {db_config_name!r} is not registered — "
+                "register the database with matrx-orm first"
+            )
+        if not is_database_registered(PACKAGE_DB_NAME):
+            register_database_alias(PACKAGE_DB_NAME, db_config_name)
+
+
+__all__ = [
+    "configure_secrets",
+    "configure_encryption",
+    "reset_encryption_for_tests",
+    "get_fernet",
+    "encrypt_value",
+    "decrypt_value",
+    "encrypt_payload",
+    "decrypt_payload",
+    "mask_value",
+    "UserSecret",
+    "UserSecretGrant",
+    "UserSecretAudit",
+    "PACKAGE_DB_NAME",
+    "ACCESS_MODES",
+    "OrgSecretRow",
+    "create_org_secret",
+    "delete_org_secret",
+    "get_org_secret_row",
+    "list_org_secrets",
+    "record_secret_audit",
+    "resolve_effective_secrets",
+    "resolve_org_secrets",
+    "set_org_secret_grants",
+    "sync_org_secret_from_user",
+    "update_org_secret",
+    "SecretRow",
+    "SecretNotFoundError",
+    "SecretDecryptError",
+    "KNOWN_CATEGORIES",
+    "VALID_KEY_RE",
+    "list_user_secrets",
+    "get_user_secret",
+    "require_secret",
+    "get_org_secret",
+    "require_user_secret",
+    "create_user_secret",
+    "update_user_secret",
+    "delete_user_secret",
+    "parse_env_text",
+    "bulk_upsert_from_env_text",
+]