codespar (Python) 0.11.0

Offline V3 mandate verification: new codespar.mandate submodule (decode + canonical reconstruction pure-stdlib; Ed25519 verify via the [verify] extra). Parity with @codespar/sdk/mandate and codespar mandate verify; canonical signing string byte-locked across all four implementations. See codespar-core#114 / #115.

codespar 0.10.0 (Python SDK)

What's Changed

• docs: Sprint 2A — SDK READMEs drift cleanup (8 files) by @fabianocruz in #19
• chore(adapters): bump 12 framework adapters to 0.4.0 + peerDeps ^0.9.0 by @fabianocruz in #20
• feat(cli): 0.4.0 — sugar commands for SDK 0.9.0 typed methods by @fabianocruz in #21
• feat(api-types): 0.5.0 — add jwt_ecdsa to AuthTypeSchema by @fabianocruz in #22
• fix(deps): unbreak @codespar/sdk:typecheck — @codespar/types range in core + lock drift guard by @dangazineu in #26
• feat(sdk): @codespar/sdk/testing fakeSession export by @dangazineu in #23
• feat(examples): Pix + NFS-e walking skeleton — 4-step loop() against OSS MCP bridge by @dangazineu in #30
• feat(examples): service invoice from natural language (NFS-e + WhatsApp + aimock) by @dangazineu in #32
• feat(examples): WhatsApp installment negotiation (multi-turn session.send + Asaas preview) by @dangazineu in #34
• refactor(examples/pix-nfse-skeleton): raise bar to match installment-negotiation example by @dangazineu in #41
• refactor(examples/nfse-from-natural-language): raise bar to match installment-negotiation example by @dangazineu in #40
• chore: replace private roadmap codenames in public READMEs by @dangazineu in #55
• feat(sdk): hosted test-mode SDK surface — mocks forwarding, structured errors, tool-result guards, OSS test-parity seam by @dangazineu in #54
• chore(release): bump @codespar/types, @codespar/sdk, codespar to 0.10.0 by @dangazineu in #56
• fix(publish): surface real npm failures + tolerate propagation lag by @fabianocruz in #57
• fix(example/brazilian-ecommerce): pass declared_value on codespar_ship items by @fabianocruz in #59
• fix(example/brazilian-ecommerce): pass length_cm/width_cm/height_cm on ship items by @fabianocruz in #60
• ci(publish): relax whoami identity check + tighten 404-PUT lag heuristic by @dangazineu in #61
• ci(publish): drop per-package access preflight (incompatible with granular tokens) by @dangazineu in #62
• fix(publish): fail loud on multi-package 404-PUT, bump to Node 22 by @dangazineu in #63
• feat(publish): add OIDC trusted-publishing path via workflow_dispatch by @dangazineu in #64
• feat(publish): migrate tag-push path to OIDC trusted publishing by @dangazineu in #65

Full Changelog: python-v0.9.0...python-v0.10.0

codespar 0.9.0

codespar 0.9.0

SSE streaming for async settlement + verification status.

Added

• AsyncSession.payment_status_stream(tool_call_id, *, on_update=None) — SSE stream over GET /v1/tool-calls/:id/payment-status/stream. Pushes initial snapshot + every state change; returns last envelope on terminal state (5s grace).
• AsyncSession.verification_status_stream(tool_call_id, *, on_update=None) — KYC sibling with the same lifecycle.
• Sync wrappers: Session.payment_status_stream / Session.verification_status_stream.
• _http.stream_sse_get(...) — GET-based SSE iterator yielding (event_name, payload) tuples; filters heartbeat comment frames.

Compat

• Polling siblings (payment_status / verification_status) stay live for backward compat.
• User-Agent bumped to codespar-python/0.9.0.

TS paridade

• @codespar/sdk@0.9.0 + @codespar/types@0.7.0 published in lockstep.

Python SDK 0.3.0

First Python SDK release on the 0.3.x line — aligns with @codespar/sdk@0.3.0 (npm).

What's in 0.3.0

The features that justify the version jump from 0.1.1 already shipped to main between 2026-04-21 and today; this release tags them on PyPI:

• projectId on CodeSparConfig and SessionConfig (2-level Org → Project tenancy threading via x-codespar-project)
• session.authorize(server_id, config) — managed-auth flow (api_key, path_secret, OAuth) returns the connection state without leaving the session loop
• session.proxy_execute(request) — raw HTTP proxy through the Tool Router for tools the agent needs to call directly without an MCP shape

Skipping 0.2.x intentionally — keeps Python and JS on the same major-line so the matrix stays simple:

Package	Version
@codespar/sdk (npm)	0.3.0
codespar (PyPI)	0.3.0
@codespar/cli	0.3.0
Framework adapters	0.3.0
@codespar/types	0.1.0
@codespar/api-types	0.2.0

Install

pip install codespar==0.3.0

Publishing

PyPI upload via OIDC trusted publishing — no long-lived API tokens. The publish-python.yml workflow runs lint (ruff) + type check (mypy strict) + pytest + build + twine check + upload on this release event.

codespar Python SDK v0.1.1

Patch release with two quality fixes.

What changed

• PEP 561 `py.typed` marker — downstream mypy / pyright / pyrefly users now see the SDK's type hints. Without it the types were there in the source but invisible to type checkers.
• `examples/` directory — 5 runnable scripts covering the full surface:
  • `ecommerce_checkout.py` — streaming Complete Loop (4 tools)
  • `pix_payment.py` — blocking send + tool-call summary
  • `proxy_execute.py` — raw HTTP with server-side auth injection
  • `connect_link.py` — OAuth Connect Link generation
  • `async_basic.py` — same flow via `AsyncCodeSpar`

Install surface unchanged — still `pip install codespar`, still `httpx` only.

codespar Python SDK v0.1.0

First release of the CodeSpar Python SDK.

Same surface as `@codespar/sdk` — same backend, same payloads, same preset names.

Install

```bash
pip install codespar
```

Requires Python 3.10+.

Quick start

```python
from codespar import CodeSpar

cs = CodeSpar(api_key="csk_live_...")
session = cs.create("user_123", preset="brazilian")
print(session.send("Charge R$500 via Pix").message)
session.close()
cs.close()
```

What's included

• `CodeSpar` (sync) + `AsyncCodeSpar` (async) — both canonical, same API.
• `Session.send` / `send_stream` — blocking or streaming agent loop.
• `Session.execute` — call a specific tool by name.
• `Session.proxy_execute` — raw HTTP proxy to any connected server with server-side credential injection.
• `Session.authorize` — Connect Link OAuth flow for provider auth.
• Typed `StreamEvent` dataclasses (`UserMessageEvent`, `AssistantTextEvent`, `ToolUseEvent`, `ToolResultEvent`, `DoneEvent`, `ErrorEvent`).
• Presets: `brazilian`, `mexican`, `argentinian`, `colombian`, `all`.
• Per-project scoping: pass `project_id="prj_..."` on client or per session; defaults to the org's default project when omitted.
• `ApiError` / `ConfigError` / `StreamError` wrap every transport / protocol failure.

Publishing via trusted publishing

This release publishes to PyPI automatically via GitHub's OIDC flow — no long-lived API tokens in repo secrets.

Package source: packages/python/