v0.1.4

v0.1.4

Changes since published v0.1.3:

• move the Xero token cache out of site-packages to a user-owned location and validate its path through one guard;
• exercise the DPAPI token round-trip on the Windows CI leg;
• let an explicit --token-file beat the XERO_TOKEN_FILE environment variable so scripts can pin their credentials source; and
• documentation corrections: the fact-check fixes, the sample organisation name, a DISCLAIMER linked from the README, the provisional-member CA ANZ designation, and retirement of the last codename from user-facing docs.

The annotated v0.1.2 tag is protected and permanently records commit bd4cd417b06fb9dba3d6b36fbedbe544b1e0fec7. Workflow run 31832080223 passed its tests, archives, checksums and attestations, then stopped before draft creation because one step lacked GH_TOKEN. No v0.1.2 GitHub release or draft was created. The protected tag must never be moved, deleted or reused; v0.1.3 is the recovery release.

Security boundary

The release contains source and fabricated samples only: no Xero credentials, tokens or client exports, and it remains read-only against Xero.

Carried from v0.1.3: the complete Windows token cache is protected at rest with current-user DPAPI; a valid legacy plaintext cache is migrated atomically, under the existing cross-process lock, before any Xero request; corrupt, malformed or unknown-version cache envelopes are rejected without a network call or rewrite; the explicit non-Windows compatibility fallback remains plaintext JSON with owner-only 0600 permissions. Current-user DPAPI is a same-user, same-machine control: it does not protect tokens from code already running as that user, an administrator controlling the machine, or a compromised user session.

v0.1.3

v0.1.3

Changes since published v0.1.1:

• protect the complete Windows token cache at rest with current-user DPAPI and forbid any encryption or decryption UI;
• migrate a valid legacy plaintext Windows cache atomically, under the existing cross-process lock, before any Xero request;
• reject corrupt, malformed or unknown-version cache envelopes without a network call or rewrite;
• retain the explicit non-Windows compatibility fallback as plaintext JSON with owner-only 0600 permissions; and
• pass the scoped GitHub Actions token to every workflow step that invokes GitHub CLI, including the immediate remote tag and main recheck.

Current-user DPAPI is a same-user, same-machine control. It does not protect tokens from code already running as that user, an administrator controlling the machine, or a compromised user session, and it is not a portable cache format. The release contains source and fabricated samples only. It contains no Xero credentials, tokens or client exports and remains read-only against Xero.

Release lineage: the annotated v0.1.2 tag points to bd4cd417b06fb9dba3d6b36fbedbe544b1e0fec7 and remains protected by the no-bypass tag ruleset. Workflow run 31832080223 passed its tests, archive builds, checksums and attestations, then stopped before draft creation because the remote recheck step did not receive GH_TOKEN. No v0.1.2 GitHub release or draft was created. The protected tag is retained as failed pre-publication history and must never be moved, deleted or reused; v0.1.3 is the recovery release.

v0.1.1

v0.1.1

Changes since v0.1.0:

• coerce report values before formula-injection checks and refuse totals that cannot be represented exactly;
• align account-code parsing across report layouts and supported Python/Windows CI legs;
• serialise token-cache refresh and persistence so concurrent processes do not spend the same rotating refresh token; and
• add workflow-built source archives, SHA-256 checksums, an SPDX SBOM and GitHub build attestations.

The release contains source and fabricated samples only. It contains no Xero credentials, tokens or client exports and remains read-only against Xero.

v0.1.0

First tagged version of the Xero trial balance exporter.

Three readable Python files that pull a trial balance from the Xero API into a CSV that
Power BI, pandas or Excel loads without cleanup:

• auth.py runs the OAuth 2.0 authorisation code flow, validating state before trusting any
  error parameter, and stores the token pair durably.
• xero_client.py handles single-use refresh-token rotation, the rotation grace window, rate
  limiting and Retry-After.
• export_tb.py reads the trial balance report, uses the YTD column pair as the as-at balances,
  keeps the account GUID as the join key, and refuses to write an export where debits do not
  equal credits.

No SDK and no framework, so every OAuth step is visible. Requires Python 3.10 or newer. Apps
created on or after 2 March 2026 need the granular
accounting.reports.trialbalance.read scope. samples/sample-output.csv shows the output shape.