imperal-sdk 4.2.7__tar.gz → 4.2.9__tar.gz

{imperal_sdk-4.2.7 → imperal_sdk-4.2.9}/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 All notable changes to `imperal-sdk` are documented here.
 
+## 4.2.9 — 2026-05-13
+
+**Fix: regenerate `src/imperal_sdk/schemas/imperal.schema.json` after SecretDecl addition**
+
+v4.2.8 added the `SecretDecl` Pydantic model + `Manifest.secrets` field but
+forgot to regenerate the committed static JSON Schema mirror. CI gate
+`test_spec_validation.py::test_static_schema_matches_runtime_export[imperal]`
+caught the drift — runtime Pydantic schema (with `SecretDecl` + `secrets[]`)
+no longer matched the committed file.
+
+This release ships the regenerated `imperal.schema.json` so the static
+artifact equals the runtime model again. No public API change.
+
+## 4.2.8 — 2026-05-13
+
+**Fix: `secrets[]` finally in `Manifest` Pydantic schema**
+
+EXT-SECRETS-V1 manifest emitter has been writing `manifest["secrets"] = [...]`
+since v4.2.2, but the `Manifest` Pydantic model in `manifest_schema.py` had
+no matching field. With `model_config = ConfigDict(extra="forbid")`, this
+should have caused `validate_manifest_dict()` to reject every manifest that
+declared secrets — but publish-time validators didn't gate through this
+schema, so the drift lived silently for six PATCH releases.
+
+### Added
+
+- **`SecretDecl` Pydantic model** in `manifest_schema.py` — mirrors
+  `imperal_sdk.secrets.spec.SecretSpec.to_manifest_dict()`. Validates
+  `name` regex (`^[a-z][a-z0-9_]{0,62}$`), `write_mode` in
+  `{user, extension, both}`, `max_bytes` in `[1, 65536]`,
+  `rotation_hint_days >= 1` when present, non-empty `description`.
+- **`Manifest.secrets: Optional[List[SecretDecl]]`** field — additive,
+  back-compatible with manifests that don't declare any secrets.
+
+### Federal invariants
+
+| Invariant | What it pins |
+|---|---|
+| `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` | (already declared in v4.1.6 canary roundtrip test) Now actually holds for `secrets[]` — emitter and schema agree. |
+
+### Migration notes
+
+- **No code change required** in any extension. Existing manifests with
+  `secrets[]` (emitted since v4.2.2) now pass strict Pydantic validation
+  instead of relying on validators that didn't gate through the schema.
+- Manifests with malformed secret entries (e.g. `name` with uppercase or
+  invalid `write_mode`) will now fail `validate_manifest_dict()` at
+  publish time. Previously they slipped through.
+
 ## 4.2.7 — 2026-05-13
 
 **OAuth callback infrastructure + `ctx.webhook_url()` helper**

{imperal_sdk-4.2.7 → imperal_sdk-4.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imperal-sdk
-Version: 4.2.7
+Version: 4.2.9
 Summary: SDK for building Imperal Cloud extensions
 Author: Valentin Scerbacov, Imperal, Inc.
 License-Expression: AGPL-3.0-or-later

{imperal_sdk-4.2.7 → imperal_sdk-4.2.9}/src/imperal_sdk/__init__.py

@@ -39,7 +39,7 @@ from imperal_sdk.secrets import (
     SecretValueTooLarge, SecretDeclarationConflict,
 )
 
-__version__ = "4.2.7"
+__version__ = "4.2.9"
 
 __all__ = [
     # Core

{imperal_sdk-4.2.7 → imperal_sdk-4.2.9}/src/imperal_sdk/manifest_schema.py

@@ -240,6 +240,26 @@ class TrayDecl(BaseModel):
     tooltip: Optional[str] = None
 
 
+class SecretDecl(BaseModel):
+    """One entry in `manifest['secrets']` — EXT-SECRETS-V1 (v4.2.2+).
+
+    Mirrors :class:`imperal_sdk.secrets.spec.SecretSpec` after
+    ``to_manifest_dict()``. The Pydantic model exists so
+    :func:`validate_manifest_dict` round-trips the emitted shape — closes
+    the `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` drift gap that lived
+    silently from v4.2.2 → v4.2.7.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    name: str = Field(..., pattern=r"^[a-z][a-z0-9_]{0,62}$")
+    description: str = Field(..., min_length=1)
+    required: bool = False
+    write_mode: Literal["user", "extension", "both"] = "user"
+    max_bytes: int = Field(default=4096, ge=1, le=65536)
+    rotation_hint_days: Optional[int] = Field(default=None, ge=1)
+
+
 # === Root model =======================================================
 
 class Manifest(BaseModel):
@@ -290,6 +310,14 @@ class Manifest(BaseModel):
     # Reserved for first-party Imperal authors (validator V31).
     system: Optional[bool] = None
 
+    # Federal v4.2.2 — EXT-SECRETS-V1. Optional array of per-user encrypted
+    # credential declarations the extension reads via ``ctx.secrets.get()``.
+    # Closes the `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` drift where the
+    # emitter wrote `secrets[]` from v4.2.2 onwards but this Pydantic model
+    # had no matching field (extra="forbid" would have rejected — but
+    # publish-time validators didn't gate through here).
+    secrets: Optional[List[SecretDecl]] = None
+
     # --- Marketplace merge (docs/imperal-cloud/developer-portal.md) ---
     name: Optional[str] = None
     description: Optional[str] = None

{imperal_sdk-4.2.7 → imperal_sdk-4.2.9}/src/imperal_sdk/schemas/imperal.schema.json

@@ -224,6 +224,63 @@
       "title": "Schedule",
       "type": "object"
     },
+    "SecretDecl": {
+      "additionalProperties": false,
+      "description": "One entry in `manifest['secrets']` — EXT-SECRETS-V1 (v4.2.2+).\n\nMirrors :class:`imperal_sdk.secrets.spec.SecretSpec` after\n``to_manifest_dict()``. The Pydantic model exists so\n:func:`validate_manifest_dict` round-trips the emitted shape — closes\nthe `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` drift gap that lived\nsilently from v4.2.2 → v4.2.7.",
+      "properties": {
+        "name": {
+          "pattern": "^[a-z][a-z0-9_]{0,62}$",
+          "title": "Name",
+          "type": "string"
+        },
+        "description": {
+          "minLength": 1,
+          "title": "Description",
+          "type": "string"
+        },
+        "required": {
+          "default": false,
+          "title": "Required",
+          "type": "boolean"
+        },
+        "write_mode": {
+          "default": "user",
+          "enum": [
+            "user",
+            "extension",
+            "both"
+          ],
+          "title": "Write Mode",
+          "type": "string"
+        },
+        "max_bytes": {
+          "default": 4096,
+          "maximum": 65536,
+          "minimum": 1,
+          "title": "Max Bytes",
+          "type": "integer"
+        },
+        "rotation_hint_days": {
+          "anyOf": [
+            {
+              "minimum": 1,
+              "type": "integer"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Rotation Hint Days"
+        }
+      },
+      "required": [
+        "name",
+        "description"
+      ],
+      "title": "SecretDecl",
+      "type": "object"
+    },
     "Signal": {
       "additionalProperties": false,
       "description": "One entry in `manifest['signals']`.",
@@ -254,7 +311,7 @@
     },
     "Tool": {
       "additionalProperties": false,
-      "description": "One entry in `manifest['tools']`.\n\nFederal v4.0.0 \u2014 typed dispatch fields (action_type, chain_callable,\neffects, params_schema, return_schema, event) declared at top level so\nthe kernel chain planner can route deterministically without\nre-deriving from extension code.",
+      "description": "One entry in `manifest['tools']`.\n\nFederal v4.0.0 — typed dispatch fields (action_type, chain_callable,\neffects, params_schema, return_schema, event) declared at top level so\nthe kernel chain planner can route deterministically without\nre-deriving from extension code.",
       "properties": {
         "name": {
           "minLength": 1,
@@ -704,6 +761,21 @@
       "default": null,
       "title": "System"
     },
+    "secrets": {
+      "anyOf": [
+        {
+          "items": {
+            "$ref": "#/$defs/SecretDecl"
+          },
+          "type": "array"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "default": null,
+      "title": "Secrets"
+    },
     "name": {
       "anyOf": [
         {