matrx-orm 3.1.83__tar.gz → 3.1.85__tar.gz

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/.gitignore

@@ -285,3 +285,4 @@ db/evidence/
 # Pooler contamination evidence — machine-local forensic capture, not source
 db/evidence/
 db/mirror/.env.mirror
+supabase/.temp/

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.83
+Version: 3.1.85
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/matrx_orm/python_sql/db_objects.py

@@ -110,7 +110,7 @@ def get_full_db_objects(schema, database_project):
                     'full_type', pg_catalog.format_type(a.atttypid, a.atttypmod),
                     'base_type', t.typname,
                     'domain_type', CASE WHEN t.typtype = 'd' THEN t.typname ELSE NULL END,
-                    'enum_labels', CASE WHEN t.typtype = 'e' THEN (SELECT array_agg(enumlabel) FROM pg_enum WHERE enumtypid = t.oid) ELSE NULL END,
+                    'enum_labels', CASE WHEN t.typtype = 'e' THEN (SELECT array_agg(enumlabel ORDER BY enumsortorder) FROM pg_enum WHERE enumtypid = t.oid) ELSE NULL END,
                     'is_array', a.attndims > 0,
                     'nullable', NOT a.attnotnull,
                     'default', pg_get_expr(d.adbin, d.adrelid),

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/matrx_orm/schema_builder/FEATURE.md

@@ -2,6 +2,13 @@
 
 The schema builder generates importable models and manager wrappers from live database metadata.
 
+## Deterministic database metadata
+
+- PostgreSQL enum labels are emitted in `pg_enum.enumsortorder`. Introspection
+  must never rely on catalog row order; otherwise identical generator runs
+  oscillate every generated model containing that enum.
+- Guard: `packages/matrx-orm/tests/schema/test_enum_ordering.py`.
+
 ## Manager method names
 
 - A generated manager must never contain duplicate method names; later definitions silently replace earlier behavior in Python.

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/matrx_orm/secrets_battery/FEATURE.md

@@ -106,9 +106,12 @@ carry PLAINTEXT, deliberately-unencrypted columns: `login_urls` (`text[]`),
 `[{key,label,value}]`), `browser_fill_enabled`. This module validates their
 shape — URLs must be http/https, `non_secret_fields` keys match `FIELD_KEY_RE`
 and are unique, entries carry only `{key,label,value}` — because it is the only
-write path. `handling` does NOT apply to them: whether a value is encrypted is
-decided by the catalog field's `storage_class`, never by handling. Never move a
-secret into these columns to make it "easier to read".
+write path. **`CredentialItem` declares every destination-login column** so the
+validated `update_credential_item` path can persist them; a database column that
+is absent from the model is an unwritable Vault field. `handling` does NOT apply
+to them: whether a value is encrypted is decided by the catalog field's
+`storage_class`, never by handling. Never move a secret into these columns to
+make it "easier to read".
 
 ## Consumer contract
 
@@ -255,11 +258,15 @@ Drift guard: `scripts/validate_secrets_decrypt.py` (loud, non-blocking, in
 configured key.
 
 Verified against live code + the live `users.user_secrets` /
-`users.credential_items` schema 2026-07-23 (item-layer smoke run live: bundle
-create, reveal, sealed denial, editable gate, rotate, item grants, soft delete).
+`users.credential_items` schema 2026-08-20 (destination-login metadata update,
+bundle create, reveal, sealed denial, editable gate, rotate, item grants, soft
+delete).
 
 ## Change Log
 
+- **2026-08-20** — Mirrored all five live destination-login metadata columns on
+  `CredentialItem`; the Vault update path had advertised them but rejected every
+  write because the canonical ORM model omitted them.
 - **2026-08-18** — Extended key rotation and decrypt-drift validation across
   protected-file attachment ciphertext, with field-and-file regression proof.
 - **2026-08-18** — Made restricted organization bulk resolution honor canonical

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/matrx_orm/secrets_battery/model.py

@@ -51,6 +51,11 @@ class CredentialItem(Model):
     created_at = DateTimeField(null=False)
     updated_at = DateTimeField(null=False)
     deleted_at = DateTimeField()
+    login_urls = TextArrayField(null=False, default=[])
+    uri_match_mode = TextField(null=False, default="host")
+    notes = TextField()
+    non_secret_fields = JSONBField(null=False, default=[])
+    browser_fill_enabled = BooleanField(null=False, default=False)
 
     _table_name = "credential_items"
     _db_schema = "users"

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrx-orm"
-version = "3.1.83"
+version = "3.1.85"
 description = "Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching"
 readme = "README.md"
 license = { text = "MIT" }

matrx_orm-3.1.85/tests/schema/test_enum_ordering.py

@@ -0,0 +1,8 @@
+from pathlib import Path
+
+
+def test_schema_introspection_orders_enum_labels_by_postgres_enum_order() -> None:
+    source = (Path(__file__).parents[2] / "matrx_orm" / "python_sql" / "db_objects.py").read_text()
+
+    assert "array_agg(enumlabel ORDER BY enumsortorder)" in source
+    assert "array_agg(enumlabel) FROM pg_enum" not in source

{matrx_orm-3.1.83 → matrx_orm-3.1.85}/tests/test_secrets_battery.py

@@ -186,6 +186,18 @@ def test_public_api_surface():
         assert hasattr(s, name), name
 
 
+def test_credential_item_model_carries_destination_login_metadata():
+    from matrx_orm.secrets_battery import CredentialItem
+
+    assert {
+        "login_urls",
+        "uri_match_mode",
+        "notes",
+        "non_secret_fields",
+        "browser_fill_enabled",
+    } <= set(CredentialItem._fields)
+
+
 # ── Fakes for DB-free contract tests ──────────────────────────────────────