sdk-ruby-v0.5.0

Added

• Ankusa.verify_signature(headers, body, secrets, tolerance_seconds: 300, now: nil)
  verifies the Standard Webhooks signature an HTTP sink with a secret adds,
  comparing with OpenSSL.fixed_length_secure_compare; failures raise
  Ankusa::InvalidSignatureError (code, field, never retryable).
• Ankusa::Message and Ankusa.decode_message(data), plus
  Ankusa::InvalidMessageError (with code, field and retryable? false):
  decode and validate the v1 queue message every sink delivers — the inline
  (body_base64) and claim-check (claim) body forms, sha256,
  dedupe_key, replay_id, and the forwarded headers, ignoring unknown
  keys.
• Message#idempotency_key / HookHeaders#idempotency_key, the key to store
  in a processed-ids table: the key Ankusa shipped (the message's
  idempotency_key field, or the x-ankusa-idempotency-key header), and for a
  message or delivery that predates it tenant:source_id:dedupe_key (tenant
  default when there is none) when a dedupe_key is set, else id, with an
  optional #replay:<replay_id> suffix (include_replay: true). The decoded
  field stays in to_h[:idempotency_key].
• HookHeaders#dedupe_key / #replay_id / #idempotency_key's field, parsed
  from x-ankusa-dedupe-key / x-ankusa-replay-id / x-ankusa-idempotency-key.
• AdminClient#create_replay, #get_replay, #list_replays and
  #update_replay for the POST/GET/PATCH /v1/replays replay-job API (kinds
  dlq, archive, quarantine).

Changed

• ClaimCheckClient#redeem raises ClaimCheckUnavailableError (retryable)
  for a gateway 408 or 429 instead of ClaimRejectedError.

Removed

• AdminClient#replay_dead_letters, replaced by the replay-job API above.
  POST /v1/dlq/replay no longer exists.