imperal-sdk 4.2.7__tar.gz → 4.2.8__tar.gz

{imperal_sdk-4.2.7 → imperal_sdk-4.2.8}/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to `imperal-sdk` are documented here.
 
+## 4.2.8 — 2026-05-13
+
+**Fix: `secrets[]` finally in `Manifest` Pydantic schema**
+
+EXT-SECRETS-V1 manifest emitter has been writing `manifest["secrets"] = [...]`
+since v4.2.2, but the `Manifest` Pydantic model in `manifest_schema.py` had
+no matching field. With `model_config = ConfigDict(extra="forbid")`, this
+should have caused `validate_manifest_dict()` to reject every manifest that
+declared secrets — but publish-time validators didn't gate through this
+schema, so the drift lived silently for six PATCH releases.
+
+### Added
+
+- **`SecretDecl` Pydantic model** in `manifest_schema.py` — mirrors
+  `imperal_sdk.secrets.spec.SecretSpec.to_manifest_dict()`. Validates
+  `name` regex (`^[a-z][a-z0-9_]{0,62}$`), `write_mode` in
+  `{user, extension, both}`, `max_bytes` in `[1, 65536]`,
+  `rotation_hint_days >= 1` when present, non-empty `description`.
+- **`Manifest.secrets: Optional[List[SecretDecl]]`** field — additive,
+  back-compatible with manifests that don't declare any secrets.
+
+### Federal invariants
+
+| Invariant | What it pins |
+|---|---|
+| `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` | (already declared in v4.1.6 canary roundtrip test) Now actually holds for `secrets[]` — emitter and schema agree. |
+
+### Migration notes
+
+- **No code change required** in any extension. Existing manifests with
+  `secrets[]` (emitted since v4.2.2) now pass strict Pydantic validation
+  instead of relying on validators that didn't gate through the schema.
+- Manifests with malformed secret entries (e.g. `name` with uppercase or
+  invalid `write_mode`) will now fail `validate_manifest_dict()` at
+  publish time. Previously they slipped through.
+
 ## 4.2.7 — 2026-05-13
 
 **OAuth callback infrastructure + `ctx.webhook_url()` helper**

{imperal_sdk-4.2.7 → imperal_sdk-4.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imperal-sdk
-Version: 4.2.7
+Version: 4.2.8
 Summary: SDK for building Imperal Cloud extensions
 Author: Valentin Scerbacov, Imperal, Inc.
 License-Expression: AGPL-3.0-or-later

{imperal_sdk-4.2.7 → imperal_sdk-4.2.8}/src/imperal_sdk/__init__.py

@@ -39,7 +39,7 @@ from imperal_sdk.secrets import (
     SecretValueTooLarge, SecretDeclarationConflict,
 )
 
-__version__ = "4.2.7"
+__version__ = "4.2.8"
 
 __all__ = [
     # Core

{imperal_sdk-4.2.7 → imperal_sdk-4.2.8}/src/imperal_sdk/manifest_schema.py

@@ -240,6 +240,26 @@ class TrayDecl(BaseModel):
     tooltip: Optional[str] = None
 
 
+class SecretDecl(BaseModel):
+    """One entry in `manifest['secrets']` — EXT-SECRETS-V1 (v4.2.2+).
+
+    Mirrors :class:`imperal_sdk.secrets.spec.SecretSpec` after
+    ``to_manifest_dict()``. The Pydantic model exists so
+    :func:`validate_manifest_dict` round-trips the emitted shape — closes
+    the `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` drift gap that lived
+    silently from v4.2.2 → v4.2.7.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    name: str = Field(..., pattern=r"^[a-z][a-z0-9_]{0,62}$")
+    description: str = Field(..., min_length=1)
+    required: bool = False
+    write_mode: Literal["user", "extension", "both"] = "user"
+    max_bytes: int = Field(default=4096, ge=1, le=65536)
+    rotation_hint_days: Optional[int] = Field(default=None, ge=1)
+
+
 # === Root model =======================================================
 
 class Manifest(BaseModel):
@@ -290,6 +310,14 @@ class Manifest(BaseModel):
     # Reserved for first-party Imperal authors (validator V31).
     system: Optional[bool] = None
 
+    # Federal v4.2.2 — EXT-SECRETS-V1. Optional array of per-user encrypted
+    # credential declarations the extension reads via ``ctx.secrets.get()``.
+    # Closes the `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` drift where the
+    # emitter wrote `secrets[]` from v4.2.2 onwards but this Pydantic model
+    # had no matching field (extra="forbid" would have rejected — but
+    # publish-time validators didn't gate through here).
+    secrets: Optional[List[SecretDecl]] = None
+
     # --- Marketplace merge (docs/imperal-cloud/developer-portal.md) ---
     name: Optional[str] = None
     description: Optional[str] = None