imperal-sdk 5.0.2__tar.gz → 5.0.3__tar.gz

{imperal_sdk-5.0.2 → imperal_sdk-5.0.3}/CHANGELOG.md

@@ -2,6 +2,50 @@
 
 All notable changes to `imperal-sdk` are documented here.
 
+## 5.0.3 — 2026-05-27 — Manifest `hidden_in_sidebar` field (system-only)
+
+System apps may opt out of the Imperal Panel sidebar tile by declaring
+`hidden_in_sidebar: true` in their `imperal.json`. Chat tools, lifecycle
+hooks, skeleton refreshes, and audit ledger continue to function — only
+the visual sidebar icon is suppressed.
+
+### Federal contract — `I-EXT-MANIFEST-HIDDEN-SIDEBAR-SYSTEM-ONLY`
+
+`hidden_in_sidebar=true` is only honoured when `system=true` is also set.
+Third-party extensions MUST NOT hide themselves from the user-facing
+sidebar. A new root model validator on `Manifest` rejects any manifest
+that pairs `hidden_in_sidebar=true` with `system=false`/`None`:
+
+```text
+hidden_in_sidebar=True requires system=True (federal
+I-EXT-MANIFEST-HIDDEN-SIDEBAR-SYSTEM-ONLY — third-party extensions
+cannot hide themselves from the sidebar)
+```
+
+### Runtime flow (kernel + auth-gw, shipped 2026-05-27)
+
+1. SDK validates the manifest at `imperal build` / publish time.
+2. Kernel scans `/opt/extensions/*/imperal.json` on worker boot and on
+   Registry catalog invalidation, publishes the set of opted-out
+   `app_id`s to Redis SET `imperal:hidden_in_sidebar_apps`.
+3. `imperal-auth-gateway` `GET /v1/users/{user_id}/extensions` reads the
+   set via a second Redis client (`kernel_shared_redis_url`) and drops
+   matching tiles from the response so the Imperal Panel sidebar never
+   renders the icon.
+
+### Touched files
+
+- `src/imperal_sdk/manifest_schema.py` — adds
+  `Manifest.hidden_in_sidebar: Optional[bool] = None` next to `system`
+  and a `model_validator(mode="after")` that enforces the system-only
+  rule. `validate_manifest_dict` surfaces violations as `M4`
+  ValidationIssues.
+- `src/imperal_sdk/schemas/imperal.schema.json` — regenerated to include
+  the new field (static-vs-runtime gate in
+  `tests/test_manifest_schema.py` and `tests/test_spec_validation.py`).
+
+No other public API changes. No schema-version bump (still v3).
+
 ## 5.0.2 — 2026-05-26 — Federal source-cite hygiene
 
 **Docs-only release. No behavior change. No new APIs.** Adds two federal-contract

{imperal_sdk-5.0.2 → imperal_sdk-5.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imperal-sdk
-Version: 5.0.2
+Version: 5.0.3
 Summary: SDK for building Imperal Cloud extensions
 Author: Valentin Scerbacov, Imperal, Inc.
 License-Expression: AGPL-3.0-or-later

{imperal_sdk-5.0.2 → imperal_sdk-5.0.3}/src/imperal_sdk/__init__.py

@@ -39,7 +39,7 @@ from imperal_sdk.secrets import (
     SecretValueTooLarge, SecretDeclarationConflict,
 )
 
-__version__ = "5.0.2"
+__version__ = "5.0.3"
 
 __all__ = [
     # Core

{imperal_sdk-5.0.2 → imperal_sdk-5.0.3}/src/imperal_sdk/manifest_schema.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 import re
 from typing import Any, Dict, List, Literal, Optional
 
-from pydantic import BaseModel, ConfigDict, Field, ValidationError, field_validator
+from pydantic import BaseModel, ConfigDict, Field, ValidationError, field_validator, model_validator
 
 
 # === Regex contracts ==================================================
@@ -321,6 +321,17 @@ class Manifest(BaseModel):
     # Reserved for first-party Imperal authors (validator V31).
     system: Optional[bool] = None
 
+    # Federal I-EXT-MANIFEST-HIDDEN-SIDEBAR-SYSTEM-ONLY (2026-05-27) —
+    # `hidden_in_sidebar=True` instructs the Imperal Panel sidebar to NOT
+    # render the icon for this extension. Functionality is preserved
+    # (chat tools still work, skeleton still runs, lifecycle still fires)
+    # — only the visual sidebar tile is suppressed.
+    #
+    # Restricted to system apps (`system=True`) — third-party extensions
+    # MUST NOT hide themselves from the user-facing sidebar. Enforced by
+    # `validate_manifest_dict` (V32) and the root model_validator below.
+    hidden_in_sidebar: Optional[bool] = None
+
     # Federal v4.2.2 — EXT-SECRETS-V1. Optional array of per-user encrypted
     # credential declarations the extension reads via ``ctx.secrets.get()``.
     # Closes the `I-MANIFEST-EMITTER-SCHEMA-SYMMETRIC` drift where the
@@ -372,6 +383,22 @@ class Manifest(BaseModel):
                 )
         return v
 
+    @model_validator(mode="after")
+    def _hidden_in_sidebar_requires_system(self) -> "Manifest":
+        """Federal I-EXT-MANIFEST-HIDDEN-SIDEBAR-SYSTEM-ONLY.
+
+        Third-party extensions MUST NOT hide themselves from the user-facing
+        Imperal Panel sidebar. The hidden_in_sidebar flag is reserved for
+        first-party Imperal system apps (system=True).
+        """
+        if self.hidden_in_sidebar is True and self.system is not True:
+            raise ValueError(
+                "hidden_in_sidebar=True requires system=True "
+                "(federal I-EXT-MANIFEST-HIDDEN-SIDEBAR-SYSTEM-ONLY — "
+                "third-party extensions cannot hide themselves from the sidebar)"
+            )
+        return self
+
 
 # === Public API =======================================================