kiosk-all 0.5.20 → 0.6.28

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc2033fb24171c243f3eeb9274e6dcd50974d1620f19ebd60153e4b746995c27
-  data.tar.gz: a230076b610f50081ab9e7364dd5042604f5c8545a22ceeda2ddeb8da9e62bac
+  metadata.gz: fc9f77abd1d31d88f0105e15bd39363b0d3d5e43d7198b1de59b41a2715aa2c0
+  data.tar.gz: bfce00226e39ade5f9ac011e50ec126e8a99af4832e7123357bdaed529cb4a30
 SHA512:
-  metadata.gz: 392b32aa91be55295fe6230b2c0295ba3987f39e6abe68377dbc4732c45f62c1e32f39b92a448696977f5fc9f10cb6ab797898ccd0658fdf624a03a115105753
-  data.tar.gz: fc3c0f521524d526762c2f5c0d52713830d4f03d92d7586839313631f3a8cfb279f27a4550d0b81e68166b52c004722f6daf3552f14f71efcd9e35cb4376b281
+  metadata.gz: d8411cdd458539c0208ce9dc0d9f8e5c39eed10f2c8e339a88badfa4e778757308343728fff21f4ddf4fa8b5aa2e452eaaa59c132eb28efd396ab31ab4c5f446
+  data.tar.gz: 4b7ddc45faf6aa8292acc647ad573a75775e4e0b8d44eb71d82f0666b9743f81863df6182d354a92e9f44814ef1582e759bc409670b675caaa7e48fc9e7d5db0

data/CHANGELOG.md

@@ -12,6 +12,150 @@ already written is edited.
 
 ## [Unreleased]
 
+## [0.6.28] — 2026-10-26
+
+- 2026-10-26: Version 0.6.28, the tree cut that matches skill 0.6.28.
+
+## [0.6.27] — 2026-10-26
+
+- 2026-10-26: Version 0.6.27, the tree cut that matches skill 0.6.27.
+## [0.6.26] — 2026-10-26
+
+- 2026-10-26: Version 0.6.26, the tree cut that matches skill 0.6.26.
+## [0.6.25] — 2026-10-26
+
+- 2026-10-26: Version 0.6.25, the tree cut that matches skill 0.6.25.
+- 2026-10-26: The README names the gems the proof-of-work toll needs, and the generator that creates the functions RLS policies call.
+
+## [0.6.24] — 2026-10-26
+
+- 2026-10-26: Version 0.6.24, the tree cut that matches skill 0.6.24.
+
+## [0.6.23] — 2026-10-26
+
+- 2026-10-26: Version 0.6.23, the tree cut that matches skill 0.6.23.
+
+## [0.6.22] — 2026-10-26
+
+- 2026-10-26: Version 0.6.22, the tree cut that matches skill 0.6.22.
+
+## [0.6.21] — 2026-10-26
+
+- 2026-10-26: Version 0.6.21, the tree cut that matches skill 0.6.21.
+
+## [0.6.20] — 2026-10-26
+
+- 2026-10-26: Version 0.6.20, the tree cut that matches skill 0.6.20.
+
+## [0.6.19] — 2026-10-26
+
+- 2026-10-26: Version 0.6.19, the tree cut that matches skill 0.6.19.
+
+## [0.6.18] — 2026-10-25
+
+- 2026-10-25: Version 0.6.18, the tree cut that matches skill 0.6.18.
+
+## [0.6.17] — 2026-10-25
+
+- 2026-10-25: Version 0.6.17, the tree cut that matches skill 0.6.17.
+
+## [0.6.16] — 2026-10-25
+
+- 2026-10-25: Version 0.6.16, the tree cut that matches skill 0.6.16.
+
+## [0.6.15] — 2026-10-25
+
+- 2026-10-25: Version 0.6.15, the tree cut that matches skill 0.6.15.
+
+## [0.6.14] — 2026-10-25
+
+- 2026-10-25: Version 0.6.14, the tree cut that matches skill 0.6.14.
+
+## [0.6.13] — 2026-10-25
+
+- 2026-10-25: Version 0.6.13, the tree cut that matches skill 0.6.13.
+
+## [0.6.12] — 2026-10-24
+
+- 2026-10-24: Version 0.6.12, the tree cut that matches skill 0.6.12.
+
+## [0.6.11] — 2026-10-24
+
+- 2026-10-24: Version 0.6.11, the tree cut that matches skill 0.6.11.
+
+## [0.6.10] — 2026-10-23
+
+- 2026-10-23: Version 0.6.10, the tree cut that matches skill 0.6.10.
+
+## [0.6.9] — 2026-10-23
+
+- 2026-10-23: Version 0.6.9, the tree cut that matches skill 0.6.9.
+
+## [0.6.8] — 2026-10-22
+
+- 2026-10-22: Version 0.6.8, the tree cut that matches skill 0.6.8.
+
+## [0.6.7] — 2026-10-22
+
+- 2026-10-22: Version 0.6.7, the tree cut that matches skill 0.6.7.
+
+## [0.6.6] — 2026-10-22
+
+- 2026-10-22: Version 0.6.6, the tree cut that matches skill 0.6.6.
+
+## [0.6.5] — 2026-10-22
+
+- 2026-10-22: Version 0.6.5, the tree cut that matches skill 0.6.5.
+
+## [0.6.4] — 2026-10-22
+
+- 2026-10-22: Version 0.6.4, the tree cut that matches skill 0.6.4.
+- 2026-10-22: The gem description names the OAuth registration and token endpoints.
+
+## [0.6.3] — 2026-10-22
+
+- 2026-10-22: Version 0.6.3, the tree cut that matches skill 0.6.3.
+
+## [0.6.2] — 2026-10-22
+
+- 2026-10-22: Version 0.6.2, the tree cut that matches skill 0.6.2.
+
+## [0.6.1] — 2026-10-22
+
+- 2026-10-22: Version 0.6.1, the tree cut that matches skill 0.6.1.
+
+## [0.6.0] — 2026-10-21
+
+- 2026-10-21: Version 0.6.0, the tree cut that matches skill 0.6.0.
+
+## [0.5.27] — 2026-10-21
+
+- 2026-10-21: Version 0.5.27, the tree cut that matches skill 0.5.27.
+
+## [0.5.26] — 2026-10-21
+
+- 2026-10-21: Version 0.5.26, the tree cut that matches skill 0.5.26.
+
+## [0.5.25] — 2026-10-21
+
+- 2026-10-21: Version 0.5.25, the tree cut that matches skill 0.5.25.
+
+## [0.5.24] — 2026-10-21
+
+- 2026-10-21: Version 0.5.24, the tree cut that matches skill 0.5.24.
+
+## [0.5.23] — 2026-10-21
+
+- 2026-10-21: Version 0.5.23, the tree cut that matches skill 0.5.23.
+
+## [0.5.22] — 2026-10-21
+
+- 2026-10-21: Version 0.5.22, the tree cut that matches skill 0.5.22.
+
+## [0.5.21] — 2026-10-21
+
+- 2026-10-21: Version 0.5.21, the tree cut that matches skill 0.5.21.
+
 ## [0.5.20] — 2026-10-20
 
 - 2026-10-20: Version 0.5.20, the tree cut that matches skill 0.5.20.

data/README.md

@@ -6,33 +6,54 @@ The «I just want to start» meta-gem for the [Kiosk](https://kiosk.tech) framew
 
 `kiosk-all` declares runtime dependencies on the two production data-plane gems:
 
-- **`kiosk-core`** — value types (`Identity`, `Mandate`), abstract adapter base classes, GUC namespace constants, `Kiosk.configure`, protocol version surface
-- **`kiosk-server`** — the whole host-side surface: the wire controllers (one endpoint per registered verb — `GET /kiosk/<query-name>`, `POST /kiosk/<action-name>` — plus `/kiosk/{schema,openapi.json,pay}`), the register/login proof-of-possession auth plane, JWKS, KYC attestation, `agents.txt` / `agents.json` / `/.well-known/kiosk.json` discovery, the account-binding ceremony, `Kiosk::Server::Executor`, the PoW gate, the Rails engine, the headers middleware and the `kiosk:install` generator
+- **`kiosk-core`** — value types (`Identity`, `Mandate::CheckoutMandate`, `Mandate::PaymentMandate`), abstract adapter base classes, GUC namespace constants, `Kiosk.configure`, protocol version surface
+- **`kiosk-server`** — the whole host-side surface: the Kiosk controllers (one path per operation — `GET /kiosk/<query-name>`, `POST /kiosk/<action-name>` — plus `/kiosk/{schema,openapi.json,pay}`), OAuth client registration and the token request with a client assertion and a DPoP proof, JWKS, KYC attestation, `agents.txt` / `agents.json` / `/.well-known/kiosk.json` discovery, the account-binding ceremony, `Kiosk::Server::Executor`, the proof-of-work toll, the Rails engine, the headers middleware and the `kiosk:install` generator
 
 Requiring `kiosk-all` loads `Kiosk` and `Kiosk::Server`.
 
 ## Install
 
-> **Not on RubyGems yet** — so every `gem` line below carries `github: "kiosk-hq/kiosk"`, which is what makes it copy-pasteable today. Publication status and the canonical install are stated once, in the monorepo README's [Install](https://github.com/kiosk-hq/kiosk#install) section.
+```ruby
+gem "kiosk-all"
+```
+
+That's it for the data plane. Optional pieces you add for your stack:
+
+### Proof-of-work toll — opt-in
+
+The toll needs two gems that `kiosk-all` does not pull in: `kiosk-reputation`
+(the policy that sets the toll, and the challenges) and `kiosk-pow-equihash`
+(the proof-of-work backend). Add both, and `require` them:
 
 ```ruby
-gem "kiosk-all", github: "kiosk-hq/kiosk"
+gem "kiosk-reputation"
+gem "kiosk-pow-equihash"
 ```
 
-That's it for the data plane. Optional pieces you add per stack:
+`c.reputation_policy` sets the call toll and `c.registration_pow_count` the
+registration toll; both need `c.pow_secret`. The kiosk-server README tells how
+to configure them.
 
 ### RLS defense-in-depth — opt-in
 
-`kiosk-all` does **not** pull in `kiosk-rls`. Kiosk's isolation comes from the sanctioned per-verb query/action/pay surface with app-layer authz; Postgres RLS is available as belt-and-suspenders hardening. Opt in explicitly:
+`kiosk-all` does **not** pull in `kiosk-rls`. Kiosk's isolation comes from the declared queries, actions and `pay`, each authorized in the application; Postgres RLS is available as belt-and-suspenders hardening. Opt in explicitly:
 
 ```ruby
-gem "kiosk-rls", github: "kiosk-hq/kiosk"   # opt-in: DB-level RLS defense-in-depth
+gem "kiosk-rls"   # opt-in: DB-level RLS defense-in-depth
+```
+
+The gem puts `enable_rls_on` and its siblings on `ActiveRecord::Migration`
+itself. A policy reads the request's customer through `kiosk_current_*()` SQL
+functions, and the install generator writes the migration that creates them:
+
+```sh
+bin/rails generate kiosk:rls:install --user-id-type=uuid
+bin/rails db:migrate
 ```
 
-That line is the whole installation: kiosk-rls's railtie puts `enable_rls_on`
-and its siblings on `ActiveRecord::Migration` itself. See the kiosk-rls README
-for the DSL and for the role posture (`app_role`, `enforce_db_role`), which is
-the part you do configure.
+Give it the `--user-id-type` that you gave `kiosk:install`. See the kiosk-rls
+README for the policy language and for the role settings (`app_role`,
+`enforce_db_role`), which you configure.
 
 ### Test harness — pick one
 
@@ -40,8 +61,8 @@ the part you do configure.
 
 ```ruby
 group :test do
-  gem "kiosk-rls-rspec", github: "kiosk-hq/kiosk"     # if you use RSpec
-  # gem "kiosk-rls-minitest", github: "kiosk-hq/kiosk" # if you use Minitest
+  gem "kiosk-rls-rspec"      # if you use RSpec
+  # gem "kiosk-rls-minitest" # if you use Minitest
 end
 ```
 
@@ -52,13 +73,13 @@ Why not bundled: test-support gems pull in `rspec`/`minitest` and host-test infr
 `kiosk-all` does **not** pull in any adapter gem. Add the ones you actually use:
 
 ```ruby
-gem "kiosk-user-idp-devise", github: "kiosk-hq/kiosk"   # only shipped user-IdP adapter today
-gem "kiosk-pay-stripe",      github: "kiosk-hq/kiosk"   # only shipped PSP adapter today
+gem "kiosk-user-idp-devise"   # the one shipped sign-in adapter
+gem "kiosk-pay-stripe"        # only shipped PSP adapter today
 ```
 
 Those two are the whole set: `git ls-files 'kiosk-user-idp-*/*.gemspec' 'kiosk-pay-*/*.gemspec'` names one gem each. For a stack or a market neither covers, subclass `Kiosk::UserIdentityProviders::Base` or `Kiosk::PaymentProviders::Base` in your own app and assign it in the initializer.
 
-Why not bundled: there is no «one PSP per provider» or «one IdP per provider» globally; bundling Stripe + Paddle + every IdP would pull five unused gems into every Gemfile. Providers pick per market (`kiosk-pay-*`) and per existing identity stack (`kiosk-user-idp-*`) — this is the same reason `kiosk-pay-all` is deliberately not provided.
+Why not bundled: each operator picks a payment provider for its market (`kiosk-pay-*`) and an identity adapter for the sign-in it already has (`kiosk-user-idp-*`). A bundle of every adapter would put unused gems into every Gemfile.
 
 ## Status
 

data/lib/kiosk/all/version.rb

@@ -2,6 +2,6 @@
 
 module Kiosk
   module All
-    VERSION = '0.5.20'
+    VERSION = '0.6.28'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kiosk-all
 version: !ruby/object:Gem::Version
-  version: 0.5.20
+  version: 0.6.28
 platform: ruby
 authors:
 - Phil Pirozhkov
@@ -15,38 +15,38 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
 - !ruby/object:Gem::Dependency
   name: kiosk-server
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
 description: |
   kiosk-all is the «I just want to start» entry point for the Kiosk
   framework. Installing it pulls in the production data-plane gems:
   kiosk-core (value types, abstract bases, configuration) and
-  kiosk-server — the whole host-side surface: the wire controllers
+  kiosk-server — the whole host-side surface: the Kiosk controllers
   (one endpoint per verb — GET /kiosk/<query-name>, POST
   /kiosk/<action-name> — plus /kiosk/{schema,openapi.json,pay}), the
-  register/login auth plane, JWKS,
+  OAuth registration and token endpoints, JWKS,
   KYC attestation, discovery, the account-binding ceremony, the
-  Executor, the PoW gate, the headers middleware and the `kiosk:install`
+  Executor, the proof-of-work toll, the headers middleware and the `kiosk:install`
   generator.
 
   Deliberately out of scope: