Fixed

• Validate every customer-readable member in the exact built source distribution, including root release/configuration files and future nested package data.
• Fail closed on unsafe archives and source/version provenance drift while explicitly excluding reviewed binary and development-only surfaces.
• Remove unsupported universal-entitlement wording from the packaged environment example.
• Pin the build frontend used by pull-request and release verification.

Patch release removing an incorrect claim that application attribution metadata changes request entitlements.

• Corrects sync and async client wording.
• Adds relationship-aware authored and exact installed-wheel claim validation.
• Preserves optional X-App-URL and X-App-Name usage attribution behavior.
• Adds request-context attribution and entitlement-claim regressions.

Runtime API behavior and telemetry header contracts are unchanged.

Changed

• Route Brent, WTI, gasoil, and EU carbon futures through instrument-generic API paths in synchronous and asynchronous clients.
• Preserve contract-code and legacy venue-slug inputs as compatibility aliases.
• Publish canonical examples independently on both installed client surfaces.

Verification

• Protected-main Python 3.8-3.12 run 31532248741 passed.
• Protected-main authenticated live run 31532248702 passed.
• Exact 53-file wheel was recursively scanned and cold-installed; canonical, code, legacy, and curve production paths passed.

Added

• Document an executable, coverage-gated permit-to-production workflow using 14-digit API numbers.
• Accept live filtered well-permit searches without a legacy free-form query.

Fixed

• Decode raw, data-wrapped, root well_permits, and nested production well-permit envelopes in synchronous and asynchronous clients, failing closed on malformed responses.
• Harden the PyPI release chain with exact artifact-set verification, shared version parsing, both workflow extensions, symlink rejection, and bounded public-index readback.

Verification

• Protected-main test run 31513868208 passed on Python 3.8-3.12.
• Protected-main live run 31513868191 passed keyless, authenticated, and canonical customer snippets.
• Docs deployment 31513868226 passed.

Fixed

• Detect mutable request, call, query, hit, and credit rate claims using an order-independent bounded sentence rule across authored docs, generated surfaces, and every customer-readable wheel file.
• Cover prefix, suffix, duration-window, hyphenated, and allowed/limit orderings while preserving explicit negative boundaries for tests, versions, page sizes, retry counts, and unrelated sentences.
• Direct allowance guidance to the reviewed live Product Facts contract instead of hard-coding a numeric entitlement.
• Report each physical numeric rate claim once through a single semantic classifier.

Verification

• Release commit: ba974eb2865b5707c0e1c2c41c86fe160f3aad19
• Python 3.8-3.12 hosted matrix: 458 passed / 13 skipped
• Ruff, mypy, 63 authored/generated public surfaces, and 53 exact wheel files: green
• Exact wheel clean install, dependency check, recursive claim scan, and live production demo: green
• Post-main Test, Live API, and Docs workflows: green

This release supersedes v1.12.3 for storefront-claim enforcement.

Superseded by v1.12.4, which removes mutable numeric entitlement exceptions and adds order-independent rate-claim enforcement. This artifact remains immutable for auditability.

Fixed

• Match hyphenated free-tier/free-api-key wording and universal price or commodity catalog claims in every readable wheel surface.
• Replace the remaining package and documentation variants with current-account and runtime-response terminology.
• Bind the clean release smoke to the exact versioned wheel instead of the first wheel found in dist.

Verification

• Python 3.8 through 3.12 tests, Ruff, mypy, 63-surface claim validation, exact versioned wheel clean install, pip check, and live production contract tests.
• The wheel scan derives all readable customer files recursively from RECORD and explicitly excludes compiled bytecode.

v1.12.3 supersedes v1.12.2, which remains immutable for auditability.

Superseded: v1.12.3 is the supported final release. v1.12.2 remains available unchanged for auditability; use v1.12.3 for complete packaged-claim coverage.

Fixed

• Replace stale quota, plan, cadence, uptime, cache, and generic real-time claims in public docs, generated HTML, and installed SDK recovery text.
• Derive installed claim discovery from the exact wheel RECORD and scan every customer-readable UTF-8 artifact while excluding compiled bytecode.
• Validate all readable authored and generated docs/package surfaces, including future HTML, type-stub, Markdown, JSON, and package-data files.
• Keep the canonical 50 requests/day allowance linked to reviewed product facts and defer mutable entitlements to API response metadata and current pricing.

Verification

• Python 3.8 through 3.12 tests, Ruff, mypy, claim validation, exact wheel clean install, pip check, and live production contract tests.
• All actionable review threads addressed and resolved before merge.

Fixed

• Validate the exact built wheel from a dependency-free build environment before trusted PyPI publication.
• Supersedes the unpublished v1.12.0 artifact; the v1.12.0 GitHub release remains marked prerelease for an immutable audit trail.

Includes the reviewed v1.12.0 SDK changes: commodity search, richer validation errors, strict date validation, paginated DataFrame history, durable-quota retry handling, and hardened production synthetics.

Publication halted

The trusted-publishing workflow stopped before PyPI upload because the clean-wheel validator imported the source package before runtime dependencies were installed. No oilpriceapi==1.12.0 artifact was published to PyPI.

The release code passed the Python 3.8-3.12, live API, dependency-audit, and scheduled synthetic gates. The publisher bootstrap fix and registry artifact are superseded by v1.12.1; use v1.12.1 or newer.

Source-accurate PyPI storefront and canonical first-request validation, plus the additive beta well-production resource already present on main. Public examples now require currency, unit, source, and an exact API timestamp field; CI rejects stale mutable claims.\n\nVerification: Python 3.8-3.12 matrices, live API smoke, 355 local tests, package build, and Twine checks all passed.