Changelog

(feat): Add support for SDK variables (x-fern-sdk-variables / variables in api.yml). Each variable is exposed as an optional keyword on the root client (e.g. Client.new(target_account_sid: "AC...")); path parameters bound to a variable are removed from the endpoint methods and request classes, and the value is read from the client instead. String variables declared with an env fall back to ENV.fetch("<ENV_VAR>", nil) when the keyword is omitted, and endpoints raise an ArgumentError with a clear message when a required variable is still unset.

(fix): The additional_body_parameters request option is now applied to request bodies. Previously it was documented on every endpoint method but silently ignored. Extra properties are merged into the serialized JSON (or form-urlencoded) body using their API wire-format names, override SDK-set fields with the same name, and create a body when the endpoint has none (except GET and HEAD requests, which are still sent without a body). Multipart (file upload) requests are not affected.

(fix): Fix pagination for endpoints whose cursor or offset lives in the request body (e.g. $request.cursor or $request.options.offset). The generated iterators previously referenced an undeclared query_params and raised NameError on first use; they now read and advance the body property, creating omitted parent objects.

(fix): Nil values are no longer serialized as {} (nil.to_h), and optional<nullable<T>> fields keep their nullable metadata so explicit nil values are preserved, while omitted optional fields are still left out of the request.

(feat): Add the opt-in allowCustomHttpClient config. When enabled, the generated client accepts an http_client: keyword — any object responding to request(url, http_request) and returning a Net::HTTPResponse — that replaces the SDK’s built-in Net::HTTP transport. This lets callers configure proxies, custom TLS, connection reuse, or request/response interceptors (logging, signing, header injection). Retries still wrap the custom client, and it is also used for OAuth / inferred-auth token requests. The custom client owns its own connection settings, including timeouts.

(fix): The README’s Environments example for a multi-URL SDK passes the environment constant through the client’s environment: keyword instead of base_url:. With more than one URL per environment the constant is a hash of URLs, and base_url: expects a string, so the example built a client that could not make a request. Single-URL SDKs keep base_url:.

(chore): Bump bundled @fern-api/generator-cli to 0.10.3. When the hosted auto-version analysis of the full SDK diff fails, generator-cli now retries chunk-by-chunk instead of silently applying a PATCH bump; any remaining unavailable or incomplete analysis adds a “Version bump not verified” notice to the SDK PR body and disables automerge.

(fix): Enum values (and other screaming-snake constants) named begin or end are now emitted as BEGIN_ / END_, since BEGIN and END are Ruby reserved words and END = "end" is a syntax error.

(feat): Inline documentation on XML-encoded (TwiML) types: each field carries its property description as a comment, and fluent child methods document the child type, the text parameter’s description, and every attribute via @option attributes entries.

(fix): Cap generated request-wrapper filenames (lib/<gem>/<service>/types/*_request.rb) at 100 characters, matching the existing cap on type filenames, so gem build no longer fails with Gem::Package::TooLongFileName for endpoints with long path-derived names (e.g. operations without an operationId). Over-long names are truncated with a short deterministic hash appended; the Ruby class name is unchanged.

(feat): Generate the shared WebhooksHelper from the API-wide api.settings.webhook-signature setting in generators.yml (IR sdkConfig.webhookSignatureVerification). The helper is emitted even when the API definition models no webhooks; webhook-specific signature overrides still produce their own named helpers.

(chore): Bump bundled @fern-api/generator-cli to 0.10.1. Auto-versioned MAJOR/MINOR bumps no longer produce a version-only changelog.md block when the AI analysis returns an empty changelog entry; the PR description, version bump reason, or commit message body is used instead.

(fix): Honor the org-level whitelabel setting (readmeConfig.whiteLabel) and the apiName/disabledSections (IR disabledFeatures) readme config options when generating README.md. Previously the “Built with Fern” badge was always emitted.

(feat): Object types with an xml encoding (e.g. TwiML) now generate XML support: to_xml/to_xml_element, from_xml/from_xml_element, fluent child builders (response.say("Hello", voice: "alice"), with an add_ prefix when a child tag collides with a field), and preservation of unknown attributes and child elements (additional_attributes, additional_children, add_child). A REXML-based Internal::Xml runtime (with DOCTYPE rejection) is emitted only when XML-encoded types exist.

(fix): A 503 now raises a typed error instead of ArgumentError. ServiceUnavailableError inherited from ApiError, which accepts 0..1 positional arguments, while it is raised with the (msg, code:) signature its siblings use — so constructing it threw from inside the SDK and the caller lost the response during exactly the outage they needed to see. Every other 5xx mapped correctly; this was a one-word divergence from ResponseError.

(fix): Fix file upload endpoints crashing with NoMethodError. Generated multipart code now calls FormData#add_file instead of the non-existent to_form_data_part, file arrays add one part per file, and declared MIME types are forwarded as content_type:. FormData#add_file also accepts a file path String (matching the generated method signatures), reading the file contents and deriving the filename from the path. Non-file multipart properties are now added unless the value is nil, so false and 0 are no longer silently dropped while an explicitly-passed nil is still omitted rather than sent as an empty part.

(feat): Added the respectAuthSchemeNames configuration option. With it enabled, credential keyword arguments on the client follow the names configured on the auth schemes (token: { name: apiKey } produces api_key: instead of token:), matching the TypeScript and Python generators. Names that would shadow a built-in client keyword (base_url, environment, max_retries, app_info, client, request_options) are suffixed with _auth, and global headers that collide with a credential or built-in keyword are prefixed with header_. The option defaults to false, since renaming a keyword argument breaks callers of an already published gem; the default is expected to flip in the next major version.

(fix): Respect endpoint-level disabled retries. Endpoints configured with retries: { disabled: true } (x-fern-retries in OpenAPI) now pin the generated request’s retry count to zero, so they are never retried regardless of the client-level or per-request retry settings.

(fix): Fixed generated WireMock stubs for OAuth client credentials APIs whose token endpoint is itself marked as authenticated: the token (and refresh) endpoint stub no longer requires an Authorization header, since the token request is made to obtain the token and cannot carry one yet.

(fix): Endpoints whose request body is a referenced type no longer serialize path parameters into the JSON body. With respectOptionalRequestBody, an omitted optional body on such an endpoint now sends no body and no Content-Type instead of a body containing the path parameters.

(feat): Add the respectOptionalRequestBody configuration option. When enabled, an endpoint whose request body the API does not require lets callers omit the body: the request then carries neither a body nor a Content-Type header, instead of sending {} as application/json. Disabled by default.

(feat): Add an opt-in preferExplicitAuth configuration option. When enabled (and the API composes OAuth client-credentials with basic auth via auth: any), auth credentials passed explicitly to the client constructor take precedence over environment-variable defaults when selecting the auth scheme — e.g. explicitly provided basic auth credentials win over OAuth client ID/secret environment variables. Disabled by default, so existing generated output and runtime behavior are unchanged.