qurl-python 0.3.0__tar.gz → 0.5.0__tar.gz

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
       # visibility into which Python versions broke.
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.12", "3.13"]
+        python-version: ["3.10", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python ${{ matrix.python-version }}
@@ -93,6 +93,5 @@ jobs:
     with:
       header: "qURL Python SDK Build"
       gates: '{"Tests": "${{ needs.test.result }}", "Conformance schema 1": "${{ needs.test-schema1.result }}", "Type check": "${{ needs.type-check.result }}"}'
-      extra_fields: '{"Python": "3.10, 3.12, 3.13"}'
     secrets:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/claude-code-review.yml

@@ -161,7 +161,7 @@ jobs:
         # step, so the verify step never runs and the PR gets a bare
         # `cancelled` check with no comment and nothing saying why.
         timeout-minutes: 10
-        uses: anthropics/claude-code-action@e5ad3c7725bc2459721893f88879fef9dbcf97b0 # v1.0.202
+        uses: anthropics/claude-code-action@6c690188da61cf16ee7debb28383ba67f02abb4c # v1.0.242
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ github.token }}
@@ -223,7 +223,9 @@ jobs:
           # Use only the action's GitHub MCP subprocess for reads and the final
           # comment. It receives the repository token but not the Anthropic key.
           # Local, network, delegation, and GitHub file-write tools stay denied.
-          claude_args: '--model claude-opus-5 --disallowed-tools "Bash,Read,Glob,Grep,LS,Task,Edit,Write,MultiEdit,NotebookEdit,WebFetch,WebSearch,mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files,mcp__github__create_or_update_file,mcp__github__push_files,mcp__github__delete_file" --allowed-tools "mcp__github__get_pull_request,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_file_contents,mcp__github__search_code,mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__search_issues,mcp__github__search_pull_requests,mcp__github__list_issues,mcp__github__list_pull_requests,mcp__github__add_issue_comment"'
+          # Review model setting: Opus 5.5 at medium effort. Keep the model and
+          # effort identical in claude.yml; change both together.
+          claude_args: '--model claude-opus-5-5 --effort medium --disallowed-tools "Bash,Read,Glob,Grep,LS,Task,Edit,Write,MultiEdit,NotebookEdit,WebFetch,WebSearch,mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files,mcp__github__create_or_update_file,mcp__github__push_files,mcp__github__delete_file" --allowed-tools "mcp__github__get_pull_request,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_file_contents,mcp__github__search_code,mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__search_issues,mcp__github__search_pull_requests,mcp__github__list_issues,mcp__github__list_pull_requests,mcp__github__add_issue_comment"'
 
       - name: Verify terminal Claude review
         if: success() && steps.claude-review.outcome == 'success'
@@ -270,7 +272,7 @@ jobs:
           # restoreConfigFromBase() fetches the base branch through it. Asserting the
           # LOCAL_ORIGIN pin survived therefore tested the action's version, not
           # Claude's behavior, and failed closed on every real PR. Still
-          # present at v1.0.210, so bumping does not fix it.
+          # present at v1.0.238, so bumping does not fix it.
           #
           # The property that pin bought still has to hold: origin may only ever
           # address THIS repository, so no credential-bearing remote can point
@@ -286,20 +288,30 @@ jobs:
           # matters on GHES. A future action version that drops the ".git" suffix,
           # adds a port, or normalizes the path differently fails CLOSED here - safe,
           # but it breaks every run until the action_origin construction below is
-          # updated. The failure prints the observed and expected destinations, so
-          # start there.
+          # updated. The failure prints the observed host and the expected
+          # destination, so start there. An origin outside the allowlists prints
+          # neither.
+          # The authority is everything up to the first "/", and userinfo is everything
+          # in it before the LAST "@". Host and userinfo are then held to allowlists,
+          # because a URL client ends the host at "#", "?" or "\" as well: without that,
+          # https://evil.example#@github.com/o/r.git parses here as host github.com
+          # while git connects to evil.example. A shape outside the allowlists (an IPv6
+          # literal host, userinfo with other punctuation, no scheme at all) makes the
+          # function fail, and the caller fails closed.
           origin_destination() {
-            local url="$1" scheme rest authority path
-            if [[ "${url}" == *://* ]]; then
-              scheme="${url%%://*}"
-              rest="${url#*://}"
-              authority="${rest%%/*}"
-              path="${rest#"${authority}"}"
-              authority="${authority##*@}"
-              printf '%s://%s%s' "${scheme}" "${authority}" "${path}"
-              return
+            local url="$1" scheme rest authority host userinfo
+            [[ "${url}" == *://* ]] || return 1
+            scheme="${url%%://*}"
+            rest="${url#*://}"
+            authority="${rest%%/*}"
+            host="${authority##*@}"
+            if [[ "${authority}" == *@* ]]; then
+              userinfo="${authority%@*}"
+              [[ "${userinfo}" =~ ^[A-Za-z0-9._~%:_-]+$ ]] || return 1
             fi
-            printf '%s' "${url}"
+            [[ "${scheme}" =~ ^[A-Za-z][A-Za-z0-9+.-]*$ &&
+               "${host}" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] || return 1
+            printf '%s://%s%s' "${scheme}" "${host}" "${rest#"${authority}"}"
           }
 
           if [[ -z "${GITHUB_SERVER_URL:-}" || -z "${GITHUB_REPOSITORY:-}" ||
@@ -332,33 +344,20 @@ jobs:
             exit 1
           fi
           for origin_candidate in "${origin_urls[0]}" "${origin_push_urls[0]}"; do
-            # Never echo origin_candidate itself - it carries the token. Only the
-            # userinfo-stripped destination is safe to print.
-            origin_dest="$(origin_destination "${origin_candidate}")"
-            # After a correct strip the authority holds no "@", so a userinfo-position
-            # credential can only survive in the PATH: that is the mis-split signal -
-            # userinfo holding an unencoded "/" leaves the "@" past the first path
-            # separator, where "${authority##*@}" never reaches it. Test the path
-            # specifically rather than the whole string, so scp-style remotes
-            # (git@host:o/r.git, no scheme, credential is a key not userinfo) still
-            # print their real destination. This only redacts userinfo-position
-            # credentials; a secret elsewhere in the URL would still print, which
-            # needs the secret to be known already. A schemeless remote
-            # (tok@host:o/r.git) also prints verbatim: that is deliberate, so
-            # scp-style remotes keep their diagnostic value, and Actions secret
-            # masking covers registered secrets.
-            safe_dest="${origin_dest}"
-            if [[ "${origin_dest}" == *://* ]]; then
-              dest_rest="${origin_dest#*://}"
-              dest_authority="${dest_rest%%/*}"
-              if [[ "${dest_rest#"${dest_authority}"}" == *@* ]]; then
-                safe_dest='<redacted: destination path retained userinfo>'
-              fi
+            # Never echo origin_candidate itself - it may carry the token.
+            if [[ "${origin_candidate}" == "${LOCAL_ORIGIN}" ]]; then
+              continue
             fi
-            if [[ "${origin_candidate}" != "${LOCAL_ORIGIN}" ]] &&
-               [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
+            if ! origin_dest="$(origin_destination "${origin_candidate}")"; then
+              echo "::error::The review origin is neither '${LOCAL_ORIGIN}' nor a recognizable URL of this repository; failing closed."
+              exit 1
+            fi
+            if [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
                [[ "${origin_dest,,}" != "${action_origin_bare,,}" ]]; then
-              echo "::error::The review origin moved off this repository; failing closed. Got '${safe_dest}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
+              # Print only scheme and host: the path of a hostile URL can carry anything,
+              # including the token.
+              origin_host="${origin_dest#*://}"
+              echo "::error::The review origin moved off this repository; failing closed. Got host '${origin_dest%%://*}://${origin_host%%/*}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
               exit 1
             fi
           done

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/claude.yml

@@ -328,7 +328,7 @@ jobs:
         if: success()
         # v1.0.180 keeps interactive commands on the same fail-closed runner as
         # automatic review and avoids the v1.0.140/141 issue-comment crash.
-        uses: anthropics/claude-code-action@e5ad3c7725bc2459721893f88879fef9dbcf97b0 # v1.0.202
+        uses: anthropics/claude-code-action@6c690188da61cf16ee7debb28383ba67f02abb4c # v1.0.242
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # Omit github_token so the action uses its OIDC/GitHub App token path.
@@ -341,12 +341,13 @@ jobs:
           # Keep comment-triggered analysis on the same proven model as the
           # automatic PR review. The action's implicit default may select the
           # 1M-context variant, which this repository credential cannot start.
-          # scripts/check-claude-model-lockstep.py enforces this coupling.
+          # Nothing in this repository enforces this coupling: change the model and
+          # effort here and in claude-code-review.yml together.
           # Do not add extra allowed tools by default: the action's base GitHub
           # tools are sufficient here. The automatic review workflow uses a
           # narrow GitHub MCP allowlist because its explicit prompt needs PR
           # inspection.
-          claude_args: '--model claude-opus-5'
+          claude_args: '--model claude-opus-5-5 --effort medium'
 
       - name: Verify reviewed pull request head
         if: success() && steps.claude.outcome == 'success'
@@ -394,7 +395,7 @@ jobs:
           # restoreConfigFromBase() fetches the base branch through it. Asserting the
           # LOCAL_ORIGIN pin survived therefore tested the action's version, not
           # Claude's behavior, and failed closed on every real PR (#268). Still
-          # present at v1.0.210, so bumping does not fix it.
+          # present at v1.0.238, so bumping does not fix it.
           #
           # The property that pin bought still has to hold: origin may only ever
           # address THIS repository, so no credential-bearing remote can point
@@ -410,20 +411,30 @@ jobs:
           # matters on GHES. A future action version that drops the ".git" suffix,
           # adds a port, or normalizes the path differently fails CLOSED here - safe,
           # but it breaks every run until the action_origin construction below is
-          # updated. The failure prints the observed and expected destinations, so
-          # start there.
+          # updated. The failure prints the observed host and the expected
+          # destination, so start there. An origin outside the allowlists prints
+          # neither.
+          # The authority is everything up to the first "/", and userinfo is everything
+          # in it before the LAST "@". Host and userinfo are then held to allowlists,
+          # because a URL client ends the host at "#", "?" or "\" as well: without that,
+          # https://evil.example#@github.com/o/r.git parses here as host github.com
+          # while git connects to evil.example. A shape outside the allowlists (an IPv6
+          # literal host, userinfo with other punctuation, no scheme at all) makes the
+          # function fail, and the caller fails closed.
           origin_destination() {
-            local url="$1" scheme rest authority path
-            if [[ "${url}" == *://* ]]; then
-              scheme="${url%%://*}"
-              rest="${url#*://}"
-              authority="${rest%%/*}"
-              path="${rest#"${authority}"}"
-              authority="${authority##*@}"
-              printf '%s://%s%s' "${scheme}" "${authority}" "${path}"
-              return
+            local url="$1" scheme rest authority host userinfo
+            [[ "${url}" == *://* ]] || return 1
+            scheme="${url%%://*}"
+            rest="${url#*://}"
+            authority="${rest%%/*}"
+            host="${authority##*@}"
+            if [[ "${authority}" == *@* ]]; then
+              userinfo="${authority%@*}"
+              [[ "${userinfo}" =~ ^[A-Za-z0-9._~%:_-]+$ ]] || return 1
             fi
-            printf '%s' "${url}"
+            [[ "${scheme}" =~ ^[A-Za-z][A-Za-z0-9+.-]*$ &&
+               "${host}" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] || return 1
+            printf '%s://%s%s' "${scheme}" "${host}" "${rest#"${authority}"}"
           }
 
           if [[ -z "${GITHUB_SERVER_URL:-}" || -z "${GITHUB_REPOSITORY:-}" ||
@@ -456,33 +467,20 @@ jobs:
             exit 1
           fi
           for origin_candidate in "${origin_urls[0]}" "${origin_push_urls[0]}"; do
-            # Never echo origin_candidate itself - it carries the token. Only the
-            # userinfo-stripped destination is safe to print.
-            origin_dest="$(origin_destination "${origin_candidate}")"
-            # After a correct strip the authority holds no "@", so a userinfo-position
-            # credential can only survive in the PATH: that is the mis-split signal -
-            # userinfo holding an unencoded "/" leaves the "@" past the first path
-            # separator, where "${authority##*@}" never reaches it. Test the path
-            # specifically rather than the whole string, so scp-style remotes
-            # (git@host:o/r.git, no scheme, credential is a key not userinfo) still
-            # print their real destination. This only redacts userinfo-position
-            # credentials; a secret elsewhere in the URL would still print, which
-            # needs the secret to be known already. A schemeless remote
-            # (tok@host:o/r.git) also prints verbatim: that is deliberate, so
-            # scp-style remotes keep their diagnostic value, and Actions secret
-            # masking covers registered secrets.
-            safe_dest="${origin_dest}"
-            if [[ "${origin_dest}" == *://* ]]; then
-              dest_rest="${origin_dest#*://}"
-              dest_authority="${dest_rest%%/*}"
-              if [[ "${dest_rest#"${dest_authority}"}" == *@* ]]; then
-                safe_dest='<redacted: destination path retained userinfo>'
-              fi
+            # Never echo origin_candidate itself - it may carry the token.
+            if [[ "${origin_candidate}" == "${LOCAL_ORIGIN}" ]]; then
+              continue
             fi
-            if [[ "${origin_candidate}" != "${LOCAL_ORIGIN}" ]] &&
-               [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
+            if ! origin_dest="$(origin_destination "${origin_candidate}")"; then
+              echo "::error::The local origin is neither '${LOCAL_ORIGIN}' nor a recognizable URL of this repository; failing closed."
+              exit 1
+            fi
+            if [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
                [[ "${origin_dest,,}" != "${action_origin_bare,,}" ]]; then
-              echo "::error::The local origin moved off this repository; failing closed. Got '${safe_dest}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
+              # Print only scheme and host: the path of a hostile URL can carry anything,
+              # including the token.
+              origin_host="${origin_dest#*://}"
+              echo "::error::The local origin moved off this repository; failing closed. Got host '${origin_dest%%://*}://${origin_host%%/*}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
               exit 1
             fi
           done

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/codeql.yml

@@ -33,13 +33,13 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: "/language:${{ matrix.language }}"

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/dependency-age-check-actions.yml

@@ -10,6 +10,7 @@ name: Dependency Age Check (Actions)
 # no workflow/composite-action changes are in the diff.
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
   workflow_dispatch:
 
 # Cancel superseded runs on the same PR branch — the reusable workflow
@@ -35,7 +36,7 @@ jobs:
     # only if/name/needs/permissions/secrets/strategy/uses/with/concurrency
     # are valid on a job that calls a reusable workflow. The reusable
     # workflow itself sets `timeout-minutes: 5` internally.
-    uses: layervai/ops-routines-workflows/.github/workflows/age-check-actions.yml@d07fa2fe3a103907ff2b1a1a71509a6dcd8e9d32 # v0.13.0
+    uses: layervai/ops-routines-workflows/.github/workflows/age-check-actions.yml@414821a809395384de83d853a4bfd5b46e6bfc55 # v0.15.0
     with:
       min_age_days: 7
       # Post a sticky PR comment when an age-check fails, listing each

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/dependency-age-check-pip.yml

@@ -10,6 +10,7 @@ name: Dependency Age Check (pip)
 # no requirements/poetry.lock/pyproject.toml changes are in the diff.
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
   workflow_dispatch:
 
 # Cancel superseded runs on the same PR branch — pypi.org calls are
@@ -34,7 +35,7 @@ jobs:
     # only if/name/needs/permissions/secrets/strategy/uses/with/concurrency
     # are valid on a job that calls a reusable workflow. The reusable
     # workflow itself sets `timeout-minutes: 5` internally.
-    uses: layervai/ops-routines-workflows/.github/workflows/age-check-pip.yml@d07fa2fe3a103907ff2b1a1a71509a6dcd8e9d32 # v0.13.0
+    uses: layervai/ops-routines-workflows/.github/workflows/age-check-pip.yml@414821a809395384de83d853a4bfd5b46e6bfc55 # v0.15.0
     with:
       min_age_days: 7
       # Post a sticky PR comment when an age-check fails, listing each

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/issue-priority.yml

@@ -48,6 +48,6 @@ jobs:
     # reusable's own `sender.type != 'Bot'` check short-circuits them
     # before setFailed — net effect is a near-instant no-op run.
     if: ${{ github.actor != 'github-actions[bot]' }}
-    uses: layervai/ops-routines-workflows/.github/workflows/issue-priority.yml@d07fa2fe3a103907ff2b1a1a71509a6dcd8e9d32 # v0.13.0
+    uses: layervai/ops-routines-workflows/.github/workflows/issue-priority.yml@88b48c5ab3e1262018f44bbe5f4a03b94a3e39aa # v0.14.0
     permissions:
       issues: write

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/pr-title.yml

@@ -28,6 +28,7 @@ jobs:
             chore
             revert
           scopes: |
+            main
             client
             api
             ci

{qurl_python-0.3.0 → qurl_python-0.5.0}/.github/workflows/secrets-scan.yml

@@ -16,6 +16,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318 # v3.97.0
+      - uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c # v3.97.4
         with:
           extra_args: --only-verified

qurl_python-0.5.0/.release-please-manifest.json

@@ -0,0 +1 @@
+{".":"0.5.0"}

{qurl_python-0.3.0 → qurl_python-0.5.0}/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.5.0](https://github.com/layervai/qurl-python/compare/v0.4.0...v0.5.0) (2026-11-07)
+
+
+### ⚠ BREAKING CHANGES
+
+* send the required public resource name ([#185](https://github.com/layervai/qurl-python/issues/185))
+* list_access_codes no longer accepts limit or cursor, and list_access_codes_all no longer accepts page_size. The API does not support these parameters. Remove them from calls.
+* **client:** adopt the kind-first credential API ([#133](https://github.com/layervai/qurl-python/issues/133))
+
+### Features
+
+* align resource identity and sharing with Go SDK ([#169](https://github.com/layervai/qurl-python/issues/169)) ([91018dd](https://github.com/layervai/qurl-python/commit/91018dd645613e4a5d506eab620597f29a4bff6e))
+* **client:** adopt the kind-first credential API ([#133](https://github.com/layervai/qurl-python/issues/133)) ([b5c579b](https://github.com/layervai/qurl-python/commit/b5c579b67fbad0d2c9989a404cf3c9c4dd0d3101))
+* paginate the contract list APIs in both clients ([#174](https://github.com/layervai/qurl-python/issues/174)) ([0a8f7e4](https://github.com/layervai/qurl-python/commit/0a8f7e43f13a3a90776d48e9715a75959cee083f))
+* send the required public resource name ([#185](https://github.com/layervai/qurl-python/issues/185)) ([0ea8726](https://github.com/layervai/qurl-python/commit/0ea8726d9f5c8f2eb9c6604fe8a66e79aa8f9206))
+
+
+### Bug Fixes
+
+* avoid replaying uncertain POST and PATCH operations ([#177](https://github.com/layervai/qurl-python/issues/177)) ([717f8ec](https://github.com/layervai/qurl-python/commit/717f8ecd61ae8a8b7bd1b9dd1780436debd8405d)), closes [#71](https://github.com/layervai/qurl-python/issues/71) [#20](https://github.com/layervai/qurl-python/issues/20)
+* **ci:** allow generated release PR titles ([#189](https://github.com/layervai/qurl-python/issues/189)) ([ebfe45d](https://github.com/layervai/qurl-python/commit/ebfe45d469cdafeaa7f753b2cf7ffefa38a278e2))
+* match the unpaginated access-code list contract ([#178](https://github.com/layervai/qurl-python/issues/178)) ([8254f75](https://github.com/layervai/qurl-python/commit/8254f75ff5d7efd7978e9e258dfc1f1d8e5bdf54))
+* redact invalid resolve tokens before transport ([#171](https://github.com/layervai/qurl-python/issues/171)) ([b7f3546](https://github.com/layervai/qurl-python/commit/b7f3546978b5a40fc603211731158bac739346ed))
+* require the LangChain Python 3.14 import fix ([#175](https://github.com/layervai/qurl-python/issues/175)) ([9a7f274](https://github.com/layervai/qurl-python/commit/9a7f2745b43261b64fee943907ad8ae1753ddd47))
+* validate connector lookups by immutable slug ([#168](https://github.com/layervai/qurl-python/issues/168)) ([2b68486](https://github.com/layervai/qurl-python/commit/2b68486b32a8b24ff2486640f0cd8541ff962350))
+* validate single-token management IDs before transport ([#172](https://github.com/layervai/qurl-python/issues/172)) ([2b40d5d](https://github.com/layervai/qurl-python/commit/2b40d5dd3826cb8c42a556e11b103660872a07aa))
+
+
+### Documentation
+
+* explain qURL sharing workflows in Python ([#167](https://github.com/layervai/qurl-python/issues/167)) ([4770030](https://github.com/layervai/qurl-python/commit/47700308e531bb9e7507a45c6d68038d663a4a85))
+
+## [0.4.0](https://github.com/layervai/qurl-python/compare/v0.3.0...v0.4.0) (2026-10-08)
+
+
+### ⚠ BREAKING CHANGES
+
+* preserve canonical resource quotas and monthly usage ([#157](https://github.com/layervai/qurl-python/issues/157))
+
+### Bug Fixes
+
+* preserve canonical resource quotas and monthly usage ([#157](https://github.com/layervai/qurl-python/issues/157)) ([e017e78](https://github.com/layervai/qurl-python/commit/e017e7807c5012a93de387ec73a57043d1028806))
+
 ## [0.3.0](https://github.com/layervai/qurl-python/compare/v0.2.2...v0.3.0) (2026-09-08)