Sardis v2.0.0a0 — Unified SDK Alpha

Sardis v2.0.0a0 — Unified SDK Alpha

The first alpha of the consolidated Sardis SDK. 30+ packages → 1 umbrella with composable submodules.

🎯 Highlights

• Single sardis package replaces 30+ separate sardis-* PyPI packages
• Submodules: sardis.core, sardis.cards, sardis.chain, sardis.ucp, sardis.protocol, sardis.compliance, sardis.guardrails, sardis.checkout, sardis.wallet, sardis.ramp, sardis.ledger, sardis.cli
• 9 framework integration extras: sardis[langchain,crewai,openai-agents,autogpt,browser-use,composio,adk,a2a,anthropic]
• 3 security fixes included (LithicConfig dedup, TAP replay fail-closed, webhook replay fail-closed)
• TypeScript SDK parallel release: sardis@2.0.0-rc.0 on npm with subpath exports + native fetch (drops axios → edge-runtime safe)

📦 Install

# Python
pip install sardis==2.0.0a0
pip install sardis[langchain]==2.0.0a0  # with framework extra

# TypeScript
npm install sardis@next  # 2.0.0-rc.0 dist-tagged 'next'

🚀 Quickstart

from sardis import Sardis

sardis = Sardis(api_key="sk_test_...", environment="sandbox")

# Create wallet
wallet = sardis.wallets.create(name="agent-1", chain="base")

# Issue spending policy
sardis.policies.set(wallet=wallet.id, policy="max $100/day on AI APIs")

# Execute payment (mock in sandbox)
result = sardis.pay(to="merchant_id", amount=25_00, token="USDC", wallet=wallet.id)

🔄 Migrating from v1.x

# Old
from sardis_v2_core import Wallet
from sardis_langchain import SardisToolkit

# New
from sardis.core import Wallet
from sardis.integrations.langchain import SardisToolkit

Pinned production deploys on v1.x packages continue to work (PyPI/npm tarballs immutable). See packages/sardis/MIGRATION_NOTES.md for full migration mapping.

For TypeScript users: npx sardis-migrate codemod rewrites legacy imports automatically.

🚨 Breaking Changes vs v1.x

This is a major version with structural changes. Renames (deferred to b0):

• SardisException → SardisError
• LedgerStore → Ledger
• SardisFiatRamp → Ramp
• UCP prefix dropped in sardis.ucp.*
• X402/TAP namespaced under sardis.protocol.X402 / sardis.protocol.TAP

These renames are PENDING in v2.0.0b0. v2.0.0a0 preserves old names for transition.

🛡 Security Strictness (production-affecting)

These fail-closed defaults are STRICTER than v1.x:

• TAP replay protection: now fails closed if no nonce cache configured (was silent no-op)
• Webhook replay protection: now fails closed if no cache_service (was silent no-op)
• Idempotency keys: same-key + different-payload returns HTTP 409 (was 200)
• JWT issuer/audience binding: now required
• Checkout mandate validation: now fail-closed

If your application relied on permissive defaults, you'll see new 4xx responses. Configure Redis-backed RedisNonceRegistry for production deploys.

📊 What's NOT Yet (v2.0.0b0)

• SardisException → SardisError rename
• 291-name sardis.core __init__.py curation (currently re-exports everything for compat)
• sardis-agent-sdk → sardis.integrations.anthropic rename

🔗 Links

• Docs: https://docs.sardis.sh
• PyPI: https://pypi.org/project/sardis/
• npm: https://www.npmjs.com/package/sardis
• Migration guide: MIGRATION_NOTES.md

🙏 Contributors

Generated with discipline by Claude Code agents across multiple sessions. See ~/project-directions/MEGA_PLAN.md for the architecture rationale.

v1.1.0

What's New in v1.1.0

• sardis.pay() unified API (Phase 1 + Phase 2 auto-routing)
• PolicyExplainer with structured denial output
• Agent Auth Protocol support
• Merchant self-serve portal
• 55+ Fumadocs documentation pages
• Stripe billing (3 tiers)
• Resend email integration
• Test/live API key modes
• @sardis/spend-widget npm package
• 281 lint fixes, 6 security alerts resolved
• WCAG AA accessibility compliance
• OpenSSF Scorecard hardening (SHA-pinned actions, CodeQL SAST, least-privilege permissions)

Full changelog: v0.1.0...v1.1.0

v0.1.0

Changelog

• af79f97 Add PCI approval outreach and DB hardening checklist
• b56cc59 Add PCI enclave and embedded-card rollout runbook
• 2386e81 Add PagerDuty alert routing for production observability
• ef7516b Add atomic five-track hardening implementation plan
• 2585e8f Add completion callback retry client and idempotent finalize receipts
• 2d2e387 Add digest and chain verification summary to evidence bundle
• 53c0fac Add executor attestation and replay protection for secure checkout
• 72c979e Add idempotency and replay E2E release gate
• c223ff6 Add merchant capability preflight for secure checkout
• 9687747 Add migration for secure checkout metadata table
• f8f213f Add provider capability matrix endpoint for funding rails
• 2750e88 Add provider-agnostic funding adapter contract
• 892c390 Add secure checkout completion callback for executor
• baf9baf Add secure checkout executor with JIT card handoff
• a48ff8a Add signed idempotent reference executor dispatch worker
• fbbbb87 Add time-window scope and verifier metadata to evidence export
• d0df5cc Add unified compliance evidence export endpoint
• befe9c7 Auto-freeze cards on secure checkout auth anomalies
• cfcc124 Automate DR metrics and SOC2 evidence manifest gates
• e507d30 Document ownership for acquirer sponsor-bank and QSA workflow
• 28524cd Emit PAN-safe secure checkout audit events
• c286e0d Enforce strict forge CI with pinned solc and governance fuzz tests
• 227edbb Harden A2A authz with org-bound sender/recipient checks
• 14e95b9 Harden A2A message auth and sandbox exposure
• e3ca14a Harden live funding paths for recurring and crypto->card flows
• 698a5d6 Harden secure checkout with enclave pan-policy gates
• a333855 Harden secure checkout with persistent job store and DB-backed audit sink
• 4ae5223 Merge pull request #24 from EfeDurmaz16/dependabot/docker/python-3.14-slim
• d29e07e Persist deterministic funding attempt history with failover
• 40961f3 Persist secure checkout secret refs via cache-backed one-time store
• 097949f Require PCI/QSA readiness before enabling PAN lane in production
• 2e298c1 Strengthen PAN boundary policy surface and provider pre-report
• 00202b6 Support external executor dispatch for secure checkout jobs
• 839fab5 add compliance execution track and automated control checks
• 333dbc0 add escrow governance timelock release gate and runbook
• 55879d0 add ga prep execution gates for versioning onboarding and rollback
• aed1e6a add key governance release gate and rotation evidence runbook
• db6ee1a add provider live-lane certification kit and gate
• 8e29ccd add timelocked arbiter governance flow in sardis escrow
• d18485d agents+kya: auto-register manifests on agent creation with strict fail-closed mode
• b062fcb api+compliance: harden KYA/KYT gates and expose audit verification APIs
• 1608595 api: add cards provider readiness and resolve endpoints
• 9d25f94 api: add stripe funding audit trail and reconciliation endpoints
• 778039a api: add tenant-aware stripe issuing funding endpoints
• 1917fe2 api: enforce onchain policy approval outcomes and recipient merchant checks
• 283748a api: harden policy gates and add partner webhook security
• 25b8129 api: make card provider wiring config-driven with asa and stripe webhooks
• 6ca8a3a api: support SARDIS_CIRCLE_CPN nested env fallbacks
• e498186 api: support org-level KYT risk thresholds for AP2 and onchain rails
• d28c07c api: wire coinbase cdp onchain rail and add router tests
• 4a7d00f assets(landing): add integration platform SVG icons
• a5a1439 cards: accept STRIPE_SECRET_KEY in readiness checks
• 77a89b0 cards: add issuer adapter shim and production warm-mode gate
• 52903a9 cards: add issuer readiness scaffolding and connect-aware stripe funding
• d90c8e7 cards: add organization-aware issuer routing overrides
• 2377b87 cards: add provider router with fallback failover
• f149f44 cards: add rain and bridge adapter providers with app wiring
• 8cf23bb cards: fix lithic limits mapping and add stripe sdk dependency
• 3ff2433 chain: fail-closed circle live signer configuration
• 85ef05c chore(chain): remove stale TODO comment in meta-tx relay
• 312f148 chore(db): add migration for x402 challenge persistence
• a115f04 chore(deploy): add Cloud Run deploy script and checkout env template
• 9e5d205 chore(devops): add CI/CD, Docker, publish scripts, and deployment config
• 9d61592 chore(landing): add OpenClaw SVG icon to integrations
• 0066d1f chore(license): add sardis-protocol and sardis-wallet to proprietary scope
• 069f155 chore(openclaw): update repository links
• e7e4b4d chore(release): add cpn primary and warm-issuing readiness gate
• f240848 chore(release): align python package version with pyproject
• 0b30f98 chore(release): bump sardis-api to 0.3.1 and sardis-compliance to 0.4.1
• 27a6b4e chore: add Base mainnet contract deployment script
• 031c492 chore: add PyPI and npm publish scripts for all 25 packages
• a55dcb2 chore: add branch protection bootstrap script and runbook
• e0e316e chore: add screenshots and team docs to .gitignore
• 4ed8316 chore: bump all package versions for v0.4.0 release
• dc198e1 chore: bump package versions across all SDKs to v0.4.0
• c540c0e chore: clarify Solana as planned Q3 2026, skip unimplemented tests
• 5730c5a chore: enforce code ownership and required check manifest
• 8510c3c chore: gitignore screenshots, .mcp.json, session files, tmp/
• e87bc93 chore: ignore local marketing artifacts and shell history
• cec38ee chore: refresh investor positioning and runtime security messaging
• 5d3c12d chore: register Faz 5 routers and update dependencies
• b33d97f chore: unblock release readiness gates across env version and migrations
• bfa497f chore: update README, landing router, GCP config, and OpenAPI spec
• 432bab1 chore: update deploy configs and playground setup
• b668531 chore: update lock files and mobile config
• 0187783 chore: update pnpm-lock.yaml
• 9a2910c ci(contracts): add gas-ceiling guardrail tests to pipeline
• f1ebbb5 ci(contracts): publish gas profiling artifact in CI
• 97f6275 ci(nightly): add sandbox smoke pipeline and runbook
• 4e0af72 coinbase: scaffold cdp/x402 package and add onchain payment endpoint
• 5e5c6e7 compliance+core: add persistent Postgres KYA store with recovery and migration
• ce68f9b compliance: add KYA lifecycle APIs for agent registration and control
• 2fa4d29 compliance: add Merkle audit inclusion proofs per mandate
• c728edd contracts: switch to external Safe policy module default
• 1fe1891 core+api: add policy hash receipts and immutable audit anchoring
• 35769fe core+api: enforce deterministic rail guardrails for advisory AI mode
• d48f436 core+ledger: fix goal-drift amount detection and merkle odd-leaf proofs
• d1268ea core: imp...