verifiabl-issuer 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 369e3ae173f2115422efb4a81d7cd32b018e8cd15e291899e699d51048eeca4e
-  data.tar.gz: b058e79cd9791e2f17966455129d8df40e9869b3f550ff05906ad5bae98aea5f
+  metadata.gz: 8cf3e66351726697654b88589061b28c82e190f467547b9bd073d6a5245f5050
+  data.tar.gz: 6d72b35c21f986926737005d094a8b0b9478fe8fdf371a7c76f21e8d1b2b11c1
 SHA512:
-  metadata.gz: c2996561b125072f3d8a4fd9461d9164bf5689fc3773d3242e946d844351cb14fde3c0a39893ec50b74696b59cd6c880ce1917fedbe4a1da49d0f9642e11b22b
-  data.tar.gz: 719979e79cbc3853cc52d002d45757197d41dfc33fcd398dd1b125c25153b2c07a7e56a9558149c51c5e8c6a45c14cb9722c8a11e301695ba9fc2c7026830594
+  metadata.gz: 1bf0de98a23c28007861c6b4d2a2453bb7559e5f8559454d588c5acb55c77a5fffc035042d303e01d0e73c86da122c93094e732388608b627d422e8c50312c00
+  data.tar.gz: b342d904e02ba1aaec79bda866ecbc4061fdc2427b9c58fc20e65733b064d980ccf91c0b723e9cbb84ecbb7eb28317e667fd0bac872ba808e879d7c35085c359

data/CHANGELOG.md

@@ -2,7 +2,29 @@
 
 All notable changes to the Verifiabl Ruby SDK will be documented in this file.
 
-## Unreleased
+## [1.2.0] - 2026-11-03
+
+### Added
+
+- AU2 `leave_balances`: `annual`, `personal` and `long_service`, each with its
+  accrual this period, as `{amount:, unit:}` with `unit` from
+  `PayslipCodes::Australian::LEAVE_BALANCE_UNITS` (`hours`, `days` or
+  `weeks`). Needs an API that accepts AU2 leave balances.
+
+## [1.1.1] - 2026-10-28
+
+### Added
+
+- Each released gem has a GitHub build-provenance attestation, made before
+  publication. The README's "Verifying a release" section shows how to check
+  a downloaded gem with `gh attestation verify`.
+
+### Changed
+
+- The README section on `token_store:` now links to the documentation for
+  store choice and limits. It no longer recommends Solid Cache with Redis
+  and Memcached, and no longer tells Memcached users to set an
+  `error_handler:`.
 
 ## [1.1.0] - 2026-10-23
 

data/README.md

@@ -34,10 +34,8 @@ issuer = Verifiabl::Issuer::Client.new(configuration)
 
 ### Share tokens between processes
 
-Each client fetches an OAuth token and keeps it in memory, so each process fetches its own token.
-If you run many worker processes, for example an autoscaled job queue, set `token_store:` to a
-cache that the processes share. In a Rails application, use `Rails.cache` if Redis, Memcached or
-Solid Cache stores its data:
+Each process fetches its own OAuth token. To share one token between worker processes, set
+`token_store:` to a cache that the processes share:
 
 ```ruby
 configuration = Verifiabl::Issuer::Configuration.new(
@@ -47,48 +45,11 @@ configuration = Verifiabl::Issuer::Configuration.new(
 )
 ```
 
-You can also use a different Active Support cache store, or any object with `read(key)` and
-`write(key, value, expires_in:, unless_exist: false)`. With `unless_exist: true`, `write` must
-write only if the key is absent, and return `false` if the key exists.
-
-The client encrypts each token with a key derived from the client secret before it writes the
-token. It names the entry with a keyed hash. The cache never holds a usable token or the client
-credentials.
-
-Each process uses its in-memory token. It reads the store only when that token is due for
-renewal, one minute before it expires. When the stored token is missing or due, one process
-claims the fetch and fetches a new token. The claim is an `unless_exist: true` write that lasts
-for 10 seconds, the limit of the token request. While that process fetches:
-
-- A process with a valid token continues to use it until the new token is in the store.
-- A process with no valid token polls the store for the new token. The interval starts at 0.1
-  seconds and doubles to a maximum of one second. If the claim expires, that process claims the
-  fetch.
-
-A fleet that renews together, or starts together after a quiet period, therefore fetches one
-token. When the API rejects a token, the client fetches a new token immediately. If the client
-fetched the rejected token less than one minute before, it returns the 401 instead.
-
-Limits:
-
-- A store failure costs a token fetch, not a registration. `Rails.cache` catches backend errors
-  and sends them to the Rails error reporter and logger, so `on_error` does not get them. To get
-  them in `on_error`, as an event with `token_store:` (`:read`, `:write` or `:claim`) and
-  `error:`, give the SDK a different store with an `error_handler:` that raises the exception
-  again. Do not make `Rails.cache` raise.
-- If the process that holds the claim stops during its fetch, the processes with no token wait
-  until the claim expires, at most 10 seconds.
-- The SDK cannot interrupt a store call. It checks the request's time budget after each call,
-  and store calls run while the client holds its token lock. Keep the store timeouts short. The
-  Rails Redis store default is one second.
-- The claim is best effort. If the store has no atomic `unless_exist`, such as a file store,
-  several processes can fetch. A store that is local to each process, such as a memory store,
-  shares nothing.
-- Stored expiry times are absolute. Keep worker clocks within one minute of each other.
-
-A store event has only `token_store:` and `error:`. A request failure has `method:`, `url:`,
-`path:` and `elapsed_ms:`. Check the kind of event before you read its fields. The SDK ignores
-exceptions from `on_error`, so if your handler fails on a store event, the report is lost:
+Not every store stops several processes from fetching at once. Before you choose a store, read
+[Share tokens between worker processes](https://docs.verifiabl.io/issuer-sdk?lang=ruby#share-tokens-between-worker-processes).
+
+If the store raises an error, `on_error` gets an event with only `token_store:` and `error:`.
+Check the kind of event before you read its fields:
 
 ```ruby
 on_error = lambda do |event|
@@ -158,6 +119,27 @@ shutdown, thread safety, and post-fork recreation.
 
 Report issues at [github.com/Verifiabl/verifiabl-ruby](https://github.com/Verifiabl/verifiabl-ruby/issues).
 
+## Verifying a release
+
+The release workflow attests each gem's build provenance before publishing it, and RubyGems.org
+serves the published bytes unchanged. Verify a gem with the [GitHub CLI](https://cli.github.com/).
+Attestations are signed with Sigstore, recorded in its public transparency log, and stored with the
+`Verifiabl/verifiabl-ruby` repository; they do not expire with workflow artifacts.
+
+```sh
+VERSION='<release version, for example 0.1.0-rc.1>'
+RUBYGEMS_VERSION="$(ruby -rrubygems -e 'puts Gem::Version.new(ARGV.fetch(0))' "$VERSION")"
+gem fetch verifiabl-issuer --version "$RUBYGEMS_VERSION"
+gh attestation verify "verifiabl-issuer-$RUBYGEMS_VERSION.gem" \
+  --repo Verifiabl/verifiabl-ruby \
+  --signer-workflow Verifiabl/verifiabl-ruby/.github/workflows/release.yml \
+  --source-ref "refs/tags/issuer/v$VERSION" \
+  --deny-self-hosted-runners
+```
+
+Release tags use the SemVer version; RubyGems normalizes prereleases, so `0.1.0-rc.1` is published
+as `0.1.0.pre.rc.1`.
+
 ## License
 
 MIT. See [LICENSE](https://github.com/Verifiabl/verifiabl-ruby/blob/main/gems/verifiabl-issuer/LICENSE).

data/lib/verifiabl/issuer/generated/non-pii-v2-fields.json

@@ -58,6 +58,32 @@
       }
     ],
     "reimbursements": "decimal",
+    "leave_balances": {
+      "annual": {
+        "amount": "decimal",
+        "unit": null
+      },
+      "annual_accrued_this_period": {
+        "amount": "decimal",
+        "unit": null
+      },
+      "personal": {
+        "amount": "decimal",
+        "unit": null
+      },
+      "personal_accrued_this_period": {
+        "amount": "decimal",
+        "unit": null
+      },
+      "long_service": {
+        "amount": "decimal",
+        "unit": null
+      },
+      "long_service_accrued_this_period": {
+        "amount": "decimal",
+        "unit": null
+      }
+    },
     "ytd": {
       "taxable": "decimal",
       "super": "decimal",

data/lib/verifiabl/issuer/generated/v2_codes.rb

@@ -44,6 +44,10 @@ module Verifiabl
         BASE_RATE_PERIODS = %w[
           hour day week fortnight month year
         ].map!(&:freeze).freeze
+
+        LEAVE_BALANCE_UNITS = %w[
+          hours days weeks
+        ].map!(&:freeze).freeze
       end
 
       module NewZealand

data/lib/verifiabl/issuer/version.rb

@@ -2,6 +2,6 @@
 
 module Verifiabl
   module Issuer
-    VERSION = "1.1.0"
+    VERSION = "1.2.0"
   end
 end

data/sig/verifiabl-issuer.rbs

@@ -15,6 +15,7 @@ module Verifiabl
         ETP_TYPES: Array[String]
         ETP_COMPONENTS: Array[String]
         PAY_FREQUENCIES: Array[String]
+        LEAVE_BALANCE_UNITS: Array[String]
       end
 
       module NewZealand

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: verifiabl-issuer
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Verifiabl
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-23 00:00:00.000000000 Z
+date: 2026-11-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64