imperal-sdk 4.2.5__tar.gz → 4.2.6__tar.gz

{imperal_sdk-4.2.5 → imperal_sdk-4.2.6}/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to `imperal-sdk` are documented here.
 
+## 4.2.6 — 2026-05-13
+
+**New: `ui.Password` primitive + `ui.Input(type=)` kwarg**
+
+Adds a browser-blind credential-entry primitive for EXT-SECRETS-V1 Panel UIs.
+Renders as `<input type="password" autocomplete="new-password" spellcheck="false">`
+so values are visually masked while the user types and don't get saved into
+the browser's autofill database.
+
+### Added
+
+- **`ui.Password(placeholder=, on_submit=, value=, param_name=)`** — canonical
+  credential-entry component. Federal EXT-SECRETS-V1 entry surfaces (Dev Portal
+  Secrets tab, Panel SecretManagerCard equivalents) MUST use this instead of
+  `ui.Input` for write_mode='user'/'both' secrets.
+- **`ui.Input(type=)` kwarg** — accepts `"text"` (default), `"password"`,
+  `"email"`, `"number"`, `"url"`. Backward-compatible: existing `ui.Input(...)`
+  calls without `type=` continue rendering as text. The `type` prop is only
+  emitted into manifest when != `"text"`.
+
+### Panel rendering
+
+`DInput.tsx` now reads `type` from props and applies to the native
+`<input type={...}>` element. When `type === "password"` it also sets
+`autoComplete="new-password"` (suppresses browser autofill/save prompts) and
+`spellCheck={false}` (no red squiggle on opaque base64 / hex values).
+
+### Federal note
+
+`type="password"` is a defence against shoulder-surfing, not a security
+control. The plaintext still travels in the POST body to the server, which
+is the only correctness boundary. Audit chokepoint + Vault transit are what
+make this federal-grade — see EXT-SECRETS-V1 spec for the contract.
+
 ## 4.2.5 — 2026-05-13
 
 **Fix: synthetic `__panel__*` tools excluded from validator tool_count + tests**

{imperal_sdk-4.2.5 → imperal_sdk-4.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imperal-sdk
-Version: 4.2.5
+Version: 4.2.6
 Summary: SDK for building Imperal Cloud extensions
 Author: Valentin Scerbacov, Imperal, Inc.
 License-Expression: AGPL-3.0-or-later

{imperal_sdk-4.2.5 → imperal_sdk-4.2.6}/src/imperal_sdk/__init__.py

@@ -39,7 +39,7 @@ from imperal_sdk.secrets import (
     SecretValueTooLarge, SecretDeclarationConflict,
 )
 
-__version__ = "4.2.5"
+__version__ = "4.2.6"
 
 __all__ = [
     # Core

{imperal_sdk-4.2.5 → imperal_sdk-4.2.6}/src/imperal_sdk/ui/__init__.py

@@ -24,7 +24,7 @@ from .display import Text, Icon, Header, Image, Code, Markdown, Empty, Divider,
 from .interactive import Button, Card, Menu, Dialog, Tooltip, Link, SlideOver
 from .feedback import Alert, Progress, Chart, Loading, Error
 from .input_components import (
-    Input, Form, Select, MultiSelect, Toggle,
+    Input, Password, Form, Select, MultiSelect, Toggle,
     Slider, DatePicker, FileUpload, TextArea, RichEditor, TagInput,
 )
 from .graph import Graph
@@ -44,7 +44,7 @@ __all__ = [
     # Feedback
     "Alert", "Progress", "Chart", "Loading", "Error",
     # Input
-    "Input", "Form", "Select", "MultiSelect", "Toggle",
+    "Input", "Password", "Form", "Select", "MultiSelect", "Toggle",
     "Slider", "DatePicker", "FileUpload", "TextArea", "RichEditor", "TagInput",
     # Graph (Cytoscape-backed)
     "Graph",

{imperal_sdk-4.2.5 → imperal_sdk-4.2.6}/src/imperal_sdk/ui/input_components.py

@@ -10,13 +10,52 @@ def Input(
     on_submit: UIAction | None = None,
     value: str = "",
     param_name: str = "value",
+    type: str = "text",
 ) -> UINode:
-    """Text input field. on_submit fires on Enter, value merged as param_name."""
+    """Text input field. on_submit fires on Enter, value merged as param_name.
+
+    ``type`` (v4.2.6+) is a hint to the Panel renderer for native HTML input
+    behaviour: ``"text"`` (default), ``"password"`` (browser-blind, no echo),
+    ``"email"``, ``"number"``, ``"url"``. Prefer ``ui.Password(...)`` for
+    credential entry — it's a thin convenience wrapper that pins type for
+    federal EXT-SECRETS-V1 UIs.
+    """
     props: dict[str, Any] = {"placeholder": placeholder, "value": value, "param_name": param_name}
+    if type and type != "text":
+        props["type"] = type
     if on_submit: props["on_submit"] = on_submit
     return UINode(type="Input", props=props)
 
 
+def Password(
+    placeholder: str = "paste value…",
+    on_submit: UIAction | None = None,
+    value: str = "",
+    param_name: str = "value",
+) -> UINode:
+    """Password input — browser-blind, no echo, autocomplete='new-password'.
+
+    EXT-SECRETS-V1 (federal v4.2.6+) — the canonical credential-entry primitive.
+    Renders as ``<input type="password" autocomplete="new-password">`` in the
+    Panel UI so values are visually masked while the user types. Submitted
+    value rides into the action as ``param_name`` (default ``"value"``); use
+    inside ``ui.Form(defaults={...})`` to attach hidden context fields like
+    ``app_id`` and ``name``.
+
+    Federal note: type=password is a defence against shoulder-surfing, NOT a
+    security control. The plaintext still travels in the POST body to the
+    server, which is the only correctness boundary. Audit chokepoint + Vault
+    transit are what make this federal-grade.
+    """
+    return Input(
+        placeholder=placeholder,
+        on_submit=on_submit,
+        value=value,
+        param_name=param_name,
+        type="password",
+    )
+
+
 def Form(
     children: list[UINode],
     action: str = "",