0.1.1

Built from the same contract as 0.1.0 (info.version 0.1.0, 22 operations).

Changed

• Responses from a newer API no longer fail. The docs promise that clients can ignore values
  they don't know, and 0.1.0 raised APIResponseValidationError instead:
  • Enums accept values this version doesn't list. A new appointment status comes back as an
    AppointmentStatus that equals the string, such as "on_hold", with that value; the known
    values are the same members as before. Compare with the members you handle and treat
    anything else as unknown. This applies to every enum in doctronic.types, including
    Scope, Role, Sex, and State.
  • Data that doesn't match the contract, such as a missing field or a value of another type, is
    returned instead of raised. Fields that match are typed as usual, and the others are kept as
    the API sent them. Missing required fields are None; optional fields keep their defaults.
    The SDK logs a warning on the doctronic logger that names the request ID and the fields,
    never their values.
  • APIResponseValidationError now means the SDK can't use the response at all: the body isn't
    JSON, data is missing or null for an operation that returns data, or a 200 stream isn't
    text/event-stream.
• verify_webhook() raises WebhookVerificationError for an empty secret instead of
  ValueError, as the TypeScript SDK does. A handler that answers WebhookVerificationError
  with 400 now also rejects deliveries when its secret isn't configured. Code that caught
  ValueError for this case should catch WebhookVerificationError.
• Retries of 409 read the contract's x-doctronic-retryable-codes extension. A code the
  contract documents for the operation is final unless that list names it, such as
  error.idempotency.concurrent_request; error.idempotency.payload_mismatch is final. Without
  the extension, the rules are the same as in 0.1.0.
• scripts/generate.py reads openapi/doctronic-v1.json, a pinned copy of the public contract,
  by default, and the required codegen check compares against it. It covers only operations that
  take the organization API token (HTTPBearer), so browser-only operations such as /embed/*
  and the schemas only they use stay out of the SDK. For today's contract the generated
  operations are unchanged.

Added

• WEBHOOK_SIGNATURE_HEADER, the TypeScript SDK's name for the signature header.
  SIGNATURE_HEADER stays.
• async with patient.chats.stream(...) as stream: on AsyncDoctronic, without the extra
  await. stream() returns an AsyncChatStreamManager. Awaiting it still returns the
  AsyncChatStream, async with await ... still works, and it's still a coroutine for
  asyncio.create_task() and asyncio.gather().
• Python 3.14 and 3.15 in the classifiers and the CI test matrix.
• Package metadata: keywords, and classifiers for the development status, audience, operating
  system, topics, AsyncIO, and Pydantic 2.
• regenerate.yml: when the docs publish a contract, and daily, it updates the pinned contract,
  regenerates, runs the checks, and opens a pull request that lists new operations and is
  labeled breaking-change when the docs flag one.
• contract-drift.yml: a daily job that reports when the pinned contract falls behind the
  published one. It isn't a required check.
• README sections on versioning and support, and a link to the TypeScript SDK.
• CONTRIBUTING.md, a code of conduct (Contributor Covenant 2.1), issue and pull request
  templates that warn against posting tokens or patient data, and CODEOWNERS.
• Each release gets a GitHub Release with its CHANGELOG entry as the notes. The release workflow
  stops before publishing when the CHANGELOG has no entry for the version.

Fixed

• The README's links to examples/quickstart.py and LICENSE were relative and broke on PyPI;
  every link in the README is absolute now. Its webhook example imports what it uses.
• examples/quickstart.py no longer reads DOCTRONIC_API_URL, which the SDK never reads. Pass
  base_url= to point the client somewhere else.
• Building from the sdist accepts any hatchling from 1.27 (the first with PEP 639 license
  metadata) up to 2, instead of exactly 1.32.4.
• The sdist no longer includes the repository's .gitignore.
• PermissionDeniedError described a 403 for a user the organization can't act on. The
  contract documents 403 only for error.auth.insufficient_scope; that user case is a 404.

Security

• certifi before 2026.10.18 bundles emSign root CAs whose intermediate keys were compromised
  (GHSA-6q48-6c7w-9gw2). httpx uses certifi for TLS verification. The SDK doesn't pin certifi,
  so upgrade it in your environment: pip install --upgrade "certifi>=2026.10.18". The
  repository's lockfile now has 2026.10.23.

Published to PyPI as doctronic 0.1.1.