matrx-orm 3.1.251__tar.gz → 3.1.253__tar.gz

{matrx_orm-3.1.251 → matrx_orm-3.1.253}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.251
+Version: 3.1.253
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current

{matrx_orm-3.1.251 → matrx_orm-3.1.253}/matrx_orm/core/fields.py

@@ -14,8 +14,16 @@ from uuid import UUID
 _JT = TypeVar("_JT", default=dict[str, Any] | list[Any])
 
 
+# A lone surrogate half (a JS string cut mid-emoji, a scraped page's broken
+# escape) is the NUL byte's sibling: json.dumps writes it as "\\udc80" and
+# Postgres refuses the whole jsonb value with 22P02 "Unicode low surrogate must
+# follow a high surrogate". A properly paired high+low is legal and kept.
+_LONE_SURROGATE = re.compile("[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]")
+
+
 def _strip_nul_bytes(value: Any) -> Any:
-    """Recursively remove ``\\x00`` bytes from every string in *value*.
+    """Recursively remove ``\\x00`` bytes from every string in *value*, and
+    replace every lone surrogate half with U+FFFD.
 
     JSON allows ``\\u0000`` but Postgres ``text``/``jsonb`` columns
     reject it (Postgres uses C-style NUL-terminated strings internally,
@@ -35,10 +43,12 @@ def _strip_nul_bytes(value: Any) -> Any:
     """
     if isinstance(value, str):
         if "\x00" in value:
-            return value.replace("\x00", "")
+            value = value.replace("\x00", "")
+        if _LONE_SURROGATE.search(value):
+            value = _LONE_SURROGATE.sub("\ufffd", value)
         return value
     if isinstance(value, dict):
-        return {k: _strip_nul_bytes(v) for k, v in value.items()}
+        return {_strip_nul_bytes(k): _strip_nul_bytes(v) for k, v in value.items()}
     if isinstance(value, (list, tuple)):
         return [_strip_nul_bytes(v) for v in value]
     return value

{matrx_orm-3.1.251 → matrx_orm-3.1.253}/matrx_orm/secrets_battery/FEATURE.md

@@ -84,7 +84,7 @@ ownership/shape helper and does not decrypt.
 
 **Native source admission (`native_source.py`).** `validate_native_source` is the server reader of the provider's exact source-v1 byte format; Rust remains the encoder and authenticator. It requires an explicit positive source-size limit, preserves nullable names and bytes, rejects duplicate/noncanonical JSON and COSE, and derives public metadata only after maintained P-256 key-pair validation. The result is provider-custody data, never a response model or generic field. `repr` and fixed failures omit material. `scripts/check_native_source_parity.py --rust-core <native-vault-provider/core>` compares the real compiled Rust reader against the server corpus; no mocked oracle. This prerequisite adds no creator, materializer, database row or native readiness. Verified September19 against132 focused tests and525 cross-language cases.
 
-**Native lifecycle component (`native_lifecycle.py`).** The shared coordinator must supply locked parent/child projections from the exported field constants, current host management authority and its active transaction. Inspection locks the exact native metadata child; component delete/restore mutate only that child's tombstone and lifecycle. Deletion accepts active and restored-quarantined sources; recovery compares aware ISO manifest timestamps to database timestamps, then parses the already-validated manifest instant only at the typed native restore mutation boundary. Personal metadata provenance is enforced by the database guard, never inferred from the request scope. Coordinator/preview integration and actual aggregate database acceptance remain pending; these helpers alone do not enable protected recovery. Contract: [native lifecycle](../../../../../common-docs/projects/credential-sharing-browser-login/REGISTER.md).
+**Native lifecycle component (`native_lifecycle.py`).** The shared coordinator must supply locked parent/child projections from the exported field constants, current host management authority and its active transaction. Inspection locks the exact native metadata child; component delete/restore mutate only that child's tombstone and lifecycle. Deletion accepts active and restored-quarantined sources; recovery compares aware ISO manifest timestamps to database timestamps, then parses the already-validated manifest instant only at the typed native restore mutation boundary. Personal metadata provenance is enforced by the database guard, never inferred from the request scope. Coordinator/preview integration and actual aggregate database acceptance remain pending; these helpers alone do not enable protected recovery. Contract: [native lifecycle](../../../../common-docs/projects/credential-sharing-browser-login/REGISTER.md).
 
 **`inject_into_sandbox=true` REQUIRES an env alias — refused otherwise.** A
 container environment is a NAME→value map, so a field with `key IS NULL` has

{matrx_orm-3.1.251 → matrx_orm-3.1.253}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrx-orm"
-version = "3.1.251"
+version = "3.1.253"
 description = "Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching"
 readme = "README.md"
 license = { text = "MIT" }

matrx_orm-3.1.253/tests/test_jsonb_postgres_illegal_text.py

@@ -0,0 +1,22 @@
+"""JSONB writes never carry text Postgres refuses (NUL, lone surrogate halves).
+
+2026-10-24: a lone low surrogate in a chat message's content reached
+``JSONBField.get_db_prep_value``, which stripped only NUL; json.dumps wrote
+``"\\udc80"`` and Postgres refused the batch with 22P02.
+"""
+
+from __future__ import annotations
+
+import json
+
+from matrx_orm.core.fields import JSONBField
+
+
+def test_jsonb_prep_replaces_lone_surrogates_and_keeps_pairs() -> None:
+    field = JSONBField()
+    encoded = field.get_db_prep_value(
+        {"t": "a\udc80b\ud83d", "k\udc81": ["\ud83d\ude00", "😀", "nul\x00x"]}
+    )
+    assert "\\udc8" not in encoded and "\\ud83d\"" not in encoded
+    decoded = json.loads(encoded)
+    assert decoded == {"t": "a\ufffdb\ufffd", "k\ufffd": ["😀", "😀", "nulx"]}