v0.6.0

[0.6.0] - 2026-09-08

Async session updates are safer, request fields are checked when reassigned, and concurrent
first access shares a single client resource instance. Extension code must await async-session
mutators, and request-building code must assign valid values instead of relying on later server
validation. See the migration notes for
async session mutation
and request assignment validation.

Added

• Distributions include 286 generated companion model stubs supporting construction with
  snake_case names or wire aliases under both mypy and pyright. Use one naming convention per
  call: mixed spellings remain a static error although they are valid at runtime. Stubs are not
  imported at runtime. The wheel is approximately 716 KiB.

Changed

• BREAKING: AsyncSessionManager.set_token(), clear(), and refresh() now raise
  TypeError instead of mutating state without the async lock, where an in-flight refresh could
  overwrite them. Extension code can reach the manager through client.call_context.session;
  migrate to await manager.aset_token(token, username), await manager.aclear(...), and
  await manager.arefresh(seen_generation, do_logon) with a no-argument async callback returning
  a token string or (token, username) pair; arefresh() returns None. For a manually seeded
  token that needs its own callback for a 401 refresh/replay, use
  await manager.acommit(token, username, alogon); aset_token() does not install that callback.
  The extension guide shows
  generation capture and type narrowing. Synchronous read accessors remain available.
• BREAKING: Request DTOs now validate direct attribute assignment, raising Pydantic
  ValidationError for invalid values that previously bypassed local assignment checks.
  Unknown-attribute assignment now raises ValidationError with error type no_such_attribute
  instead of a plain ValueError and its old message; except ValueError still works, but exact
  type checks and message matching can break.
  Literal wrong-typed assignments to typed DTOs were already mypy errors; audit dynamically
  supplied values, Any, unchecked code, and suppressed diagnostics for the runtime change.
  Models remain mutable, and accepted values may be coerced by field validation. All nested
  models reachable from shipped request DTOs validate their own field assignments. In-place
  container edits, such as appending to a nested list, remain unguarded, as do
  model_copy(update=...) and direct __dict__ writes; validate plain mappings with nested
  mappings/lists using model_validate(...) for validated updates. Reassigning or validating
  an existing DTO instance does not deeply revalidate its internals; extension-defined nested
  models need their own assignment validation. No submission-time deep revalidation is added.
• The pyright CI job is now required and runs pyright src tests, model stubtest, and selected
  consumer typing cases on Python 3.12. Strict mypy remains required. Stub/field parity tests
  check runtime model fields and aliases; catalog freshness requires the manual drift workflow.
• Updated the documentation deployment action, actions/deploy-pages, from 5.0.0 to 5.0.1.

Fixed

• Concurrent first access to a client resource now returns one shared instance. Resources remain
  lazy, and deprecated aliases retain their warnings and return the canonical resource.
• The models, endpoints, contract, client, and all generator commands stage and format
  their complete output before publication. all shares one transaction across models/stubs,
  endpoints, contracts, and client/resources. Staging failures preserve previous files;
  publication errors trigger rollback, with recovery backups retained if restoration fails.
  Symlinked resource trees are rejected, and recovery workspaces are excluded from distributions.
  Publication is not atomic across directories: concurrent readers can observe rename windows,
  and process termination may require manual recovery. Concurrent filesystem writers are
  unsupported; scaffold is outside this transaction support.
• Source distributions now include the test suite, generator fixtures, scripts, catalog pin,
  lockfile, and configuration/documentation assets read by the suite, so downstream packagers
  can run tests offline with development dependencies installed. Release artifact checks reject
  missing suite assets, and CI runs the suite from an extracted sdist. Live tests remain opt-in
  and skip by default when STONEX_LIVE is unset.