digiwin_dsp 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce7484e03d7d931e7b16d56ac6be5c6842414da91b22a559d4d298aaa69c25e7
-  data.tar.gz: d250ea83a0f9516d49679311ab960e0009f3597ac46b553e6efdc0e344d280ed
+  metadata.gz: cf609190d9515001cb6540d2bbf8a88c8e1f6a5294ea21edbe1408bad4305fc4
+  data.tar.gz: 61f86d3485d0322c3bd0af81bddcdf0ae3105327d9de63a038dbab6854a3901b
 SHA512:
-  metadata.gz: 2b496c0024aacf110d67fdb273d5f22b93c3825685dd0acedea7e235efa6cfd2aee4cb0cc247edf96272fe1de58a5da95ae233200b3cbb0dfc4f8333cc987fd8
-  data.tar.gz: 43641ec002ecd264abf8d3734234ea0bd66674608c8c499c74f5264a9d577181c0ba97664a9140ca3fa68a033e6055e368c2680ef7f3248ea199e36ffc7e2b08
+  metadata.gz: 977f1b3a3e31e5de38b1bc48327ef5427cbedeb12b60949f1812c964a768fc96ab1810ca4b1aae7f4427c38b85c6fe108f296082ec0b202052bab76578901a31
+  data.tar.gz: 9301f03f1af6630147a6d1ad88fd7db41fdd70c329886b5b526a75bbf4f2492643852f353115f5c65e22c759656d1cb86708620d28199f3d9b4514360f69da90

data/CHANGELOG.md

@@ -6,6 +6,28 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-05-21
+
+### Fixed
+
+- **Envelope failure-message regexes now match anywhere in the string**
+  (dropped the `\A` anchor). Discovered via live UAT smoke test: DSP
+  prepends the offending `form_no` to `Message`, so the actual response
+  is e.g. `"ORDER-123:Duplicated:訂單不可重複"` rather than the
+  OpenAPI-example shape `"Duplicated:訂單不可重複"`. Previously the
+  prefix caused `DuplicateRequestError` / `RateLimitError` /
+  `ValidationError` / `ServerError` classifications to fall through to
+  generic `DigiwinDsp::Error`, defeating typed-rescue logic in callers.
+
+### Changed
+
+- CI CVE audit switched from the `bundler-audit` Ruby gem to the
+  `7a6163/gem-audit-action@v1` GitHub Action (which wraps the
+  `gem-audit` Rust binary). Faster, no runtime gem to keep updated, and
+  the action handles platform/version selection. Dropped `bundler-audit`
+  from the dev/test Gemfile group.
+- Rubocop now excludes `scripts/**/*` (operator scripts; not gem source).
+
 ## [0.2.0] - 2026-05-21
 
 Security + correctness release. Addresses every HIGH and MEDIUM finding
@@ -118,7 +140,8 @@ Initial release. Covers the four Self-hosted Website Module (自有官網模組)
 - The gem is **synchronous on purpose**. Callers wrap requests in their own background job runner (e.g. ActiveJob) when needed.
 - Idempotency: clients can send `X-Idempotency-Key` via the `idempotency_key:` kwarg. DSP also dedupes server-side by `form_no + platform_id`.
 
-[Unreleased]: https://github.com/7a6163/digiwin_dsp/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/7a6163/digiwin_dsp/compare/v0.2.1...HEAD
+[0.2.1]: https://github.com/7a6163/digiwin_dsp/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/7a6163/digiwin_dsp/compare/v0.1.1...v0.2.0
 [0.1.1]: https://github.com/7a6163/digiwin_dsp/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/7a6163/digiwin_dsp/releases/tag/v0.1.0

data/lib/digiwin_dsp/client.rb

@@ -25,13 +25,15 @@ module DigiwinDsp
 
     # Patterns DSP returns in the response body's `Message` field on Status=Failure.
     # The Chinese substrings are verbatim DSP responses — see docs/dsp-api-spec.md.
-    # Order matters: more-specific patterns first.
+    # Live DSP prepends the offending form_no to Message (e.g.
+    # "ORDER-123:Duplicated:訂單不可重複"), so we substring-match rather than
+    # anchor with \A. Order matters: more-specific patterns first.
     ENVELOPE_FAILURE_MAP = [
-      [/\ADuplicated:/, DuplicateRequestError], # order already exists
-      [/\AProcessing:資料處理中/, RateLimitError], # transient; retry later
-      [/\AProcessing:取消訂單處理中/, ValidationError], # cancel in flight
-      [/\AWrongStatus:/, ValidationError], # bad payload
-      [/\A系統異常:/, ServerError] # DSP internal error
+      [/Duplicated:/, DuplicateRequestError], # order already exists
+      [/Processing:資料處理中/, RateLimitError], # transient; retry later
+      [/Processing:取消訂單處理中/, ValidationError], # cancel in flight
+      [/WrongStatus:/, ValidationError], # bad payload
+      [/系統異常:/, ServerError] # DSP internal error
     ].freeze
 
     def initialize(configuration: DigiwinDsp.configuration, authenticator: nil)

data/lib/digiwin_dsp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DigiwinDsp
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: digiwin_dsp
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Zac