matrx-orm 3.1.84__tar.gz → 3.1.85__tar.gz

{matrx_orm-3.1.84 → matrx_orm-3.1.85}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.84
+Version: 3.1.85
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current

{matrx_orm-3.1.84 → matrx_orm-3.1.85}/matrx_orm/secrets_battery/FEATURE.md

@@ -106,9 +106,12 @@ carry PLAINTEXT, deliberately-unencrypted columns: `login_urls` (`text[]`),
 `[{key,label,value}]`), `browser_fill_enabled`. This module validates their
 shape — URLs must be http/https, `non_secret_fields` keys match `FIELD_KEY_RE`
 and are unique, entries carry only `{key,label,value}` — because it is the only
-write path. `handling` does NOT apply to them: whether a value is encrypted is
-decided by the catalog field's `storage_class`, never by handling. Never move a
-secret into these columns to make it "easier to read".
+write path. **`CredentialItem` declares every destination-login column** so the
+validated `update_credential_item` path can persist them; a database column that
+is absent from the model is an unwritable Vault field. `handling` does NOT apply
+to them: whether a value is encrypted is decided by the catalog field's
+`storage_class`, never by handling. Never move a secret into these columns to
+make it "easier to read".
 
 ## Consumer contract
 
@@ -255,11 +258,15 @@ Drift guard: `scripts/validate_secrets_decrypt.py` (loud, non-blocking, in
 configured key.
 
 Verified against live code + the live `users.user_secrets` /
-`users.credential_items` schema 2026-07-23 (item-layer smoke run live: bundle
-create, reveal, sealed denial, editable gate, rotate, item grants, soft delete).
+`users.credential_items` schema 2026-08-20 (destination-login metadata update,
+bundle create, reveal, sealed denial, editable gate, rotate, item grants, soft
+delete).
 
 ## Change Log
 
+- **2026-08-20** — Mirrored all five live destination-login metadata columns on
+  `CredentialItem`; the Vault update path had advertised them but rejected every
+  write because the canonical ORM model omitted them.
 - **2026-08-18** — Extended key rotation and decrypt-drift validation across
   protected-file attachment ciphertext, with field-and-file regression proof.
 - **2026-08-18** — Made restricted organization bulk resolution honor canonical

{matrx_orm-3.1.84 → matrx_orm-3.1.85}/matrx_orm/secrets_battery/model.py

@@ -51,6 +51,11 @@ class CredentialItem(Model):
     created_at = DateTimeField(null=False)
     updated_at = DateTimeField(null=False)
     deleted_at = DateTimeField()
+    login_urls = TextArrayField(null=False, default=[])
+    uri_match_mode = TextField(null=False, default="host")
+    notes = TextField()
+    non_secret_fields = JSONBField(null=False, default=[])
+    browser_fill_enabled = BooleanField(null=False, default=False)
 
     _table_name = "credential_items"
     _db_schema = "users"

{matrx_orm-3.1.84 → matrx_orm-3.1.85}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrx-orm"
-version = "3.1.84"
+version = "3.1.85"
 description = "Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching"
 readme = "README.md"
 license = { text = "MIT" }

{matrx_orm-3.1.84 → matrx_orm-3.1.85}/tests/test_secrets_battery.py

@@ -186,6 +186,18 @@ def test_public_api_surface():
         assert hasattr(s, name), name
 
 
+def test_credential_item_model_carries_destination_login_metadata():
+    from matrx_orm.secrets_battery import CredentialItem
+
+    assert {
+        "login_urls",
+        "uri_match_mode",
+        "notes",
+        "non_secret_fields",
+        "browser_fill_enabled",
+    } <= set(CredentialItem._fields)
+
+
 # ── Fakes for DB-free contract tests ──────────────────────────────────────