# Changelog

All notable changes to this project are documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [1.0.0] - 2026-07-07

First stable release.

### Changed

- **Zero-SDK providers — install size cut ~94% (58 MB → ~3.5 MB).** Every provider now talks to
  its HTTP API directly with `fetch` instead of a vendor SDK. The `openai`, `@anthropic-ai/sdk`,
  `@google/genai`, **and `@aws-sdk/client-bedrock-runtime`** dependencies are all removed, and the
  OpenAI-compatible providers (`openai`, `openrouter`, `ollama`, `openai-compatible`) share one
  implementation. Cold `npx` runs are far faster and lighter, with **no change** to configuration,
  environment variables, supported providers, or output.
- **Bedrock IAM auth now signs its own requests (SigV4 via Node's built-in `crypto`)** instead of
  the AWS SDK, so it keeps working everywhere — including CI with temporary credentials from OIDC
  / assume-role (`AWS_SESSION_TOKEN`) — with nothing extra to install. The `BEDROCK_API_KEY` path
  is unchanged.

### Added

- **Update notifier.** `generate` checks npm for a newer release and prints `current → latest` when
  you're behind. Built to never cost time: it runs concurrently with the AI request, is cached for a
  day, caps the network wait, and stays silent in CI, non-interactive shells, under `--quiet`, or with
  `NO_UPDATE_NOTIFIER` set — any network failure is ignored. No new dependencies.
- **Clearer "request too large" errors.** When a prompt (plus the reserved `max_tokens` output)
  exceeds a provider's per-request or per-minute token limit (HTTP 413, common on free tiers), the
  error now explains how to fix it — narrow the range, lower `--max-tokens`, reduce `maxDiffLines`,
  or use a higher-tier key — while still surfacing the provider's own message. It is treated as
  non-retryable.
- **`--dry-run` now reports the total tokens requested** (prompt **plus** the reserved output
  budget), not just the prompt, so you can catch an over-limit request before spending anything.
- **Version flag is now `-v`** — `ledger -v` prints the version (rebound from Commander's
  default `-V`); `--version` still works.

## [1.0.0-beta.1] - 2026-07-01

### Added

- **`--stdout`** flag to also echo notes to stdout when writing to `--output-file`.
- Retry logic now honours a provider's **`Retry-After`** header on rate limits (capped at 30s),
  falling back to exponential backoff when absent — makes rate-limited free tiers usable.

### Fixed

- **Bedrock**: extract the first text block from the Converse response instead of assuming it's
  first, so **reasoning models** (e.g. `openai.gpt-oss-*`, DeepSeek) no longer return empty notes.
- **Bedrock**: `AWS_REGION` now falls back to `us-east-1` when set but **empty** (as a CI `env:`
  block does), instead of building an invalid endpoint and failing with `fetch failed`.
- **Bedrock**: the API-key request now aborts on timeout rather than leaking the socket.
- **OpenAI**: send `max_completion_tokens` instead of the deprecated `max_tokens`, so **reasoning
  models** (o-series, gpt-5) no longer 400.
- **Anthropic**: return the first `text` content block rather than index 0, guarding against a
  leading tool-use/thinking block.
- **`--last N`**: clamp to available history — asking for more commits than exist now includes
  everything back to the first commit instead of failing with a git "unknown revision" error.

### Changed

- **`--output-file`** no longer echoes notes to stdout by default; the file is the output. Use
  `--stdout` to restore the old dual-write behaviour. (`--quiet` still silences progress on stderr.)
- **Default models refreshed** to current, docs-verified IDs: the `anthropic` provider now
  defaults to `claude-sonnet-5` (was the now-legacy `claude-sonnet-4-6`), and `bedrock` to
  `anthropic.claude-sonnet-5` (was `anthropic.claude-sonnet-4-6-v1:0`, whose `-v1:0` suffix is
  not the current Bedrock ID form).

### Dependencies

- **Migrated the Gemini provider off the deprecated `@google/generative-ai` SDK** to the
  unified `@google/genai` (v2). No user-facing behaviour change.
- **Upgraded all dependencies to their latest supported versions**, verified against a full
  typecheck, the test suite, and live provider runs: `openai` 4 → 6, `@anthropic-ai/sdk`
  0.27 → 0.109, `@aws-sdk/client-bedrock-runtime` → latest, `commander` 12 → 14, `js-yaml`
  4 → 5, plus dev tooling (`typescript` 5 → 6, `eslint` 9 → 10, `vitest` 2 → 4, `tsup`,
  `typescript-eslint`). The `@anthropic-ai/sdk` bump also drops the deprecated transitive
  `node-domexception` from that path.
- Adjusted the config loader to js-yaml 5's named exports (`import * as yaml`), switched the
  tsconfig to `Bundler` module resolution (TS 6), and dropped the now-redundant
  `@types/js-yaml` (js-yaml 5 ships its own types).
- Security advisories reduced from 5 (incl. critical/high) to 1 low-severity, dev-only esbuild
  dev-server issue that is never shipped.

### Changed (breaking)

- **Minimum Node version is now 20** (was 18, which is EOL). This aligns `engines` with what
  `@google/genai` and the AWS SDK already require, and the build target moves to `node20`.

## [1.0.0-beta.0] - 2026-06-29

First public **beta**. Functionally complete; published under the npm `beta` dist-tag for testing
ahead of a stable `1.0.0`. Interfaces, flags, and generated output may still change based on feedback.

`ledger` generates AI-powered release notes from git history — analysing
commits **and** the actual code diffs — and runs identically on a laptop or in any CI.

### Added

- **`ledger generate`** — release notes from git history, with range selection
  (`--since-last-tag`, `--from`/`--to`, `--last N`).
- **Commit collection and diff analysis** (added/modified/deleted/renamed files, line counts).
- **Smart context reduction** with per-file and total caps to control token usage.
- **Audience modes**: `engineering`, `business`, `qa`.
- **Output formats**: Markdown and JSON (notes on stdout, progress on stderr), plus
  `-o, --output-file` with `--append` / `--prepend` — prepend inserts below a leading `#` title, so
  `ledger generate -o CHANGELOG.md --prepend` maintains a changelog in place (a missing file is created).
- **Providers (BYOK)**: OpenAI, Anthropic, Gemini, OpenRouter, Ollama, Bedrock, plus an
  **`openai-compatible`** provider for any service speaking the OpenAI Chat Completions API (Groq,
  Together, Fireworks, DeepSeek, Mistral, xAI, Perplexity, Azure OpenAI, or a self-hosted
  vLLM/LiteLLM/LocalAI server) — set `baseURL` (config / `LEDGER_BASE_URL` / `--base-url`), a `model`,
  and a key from `LEDGER_API_KEY` (or a custom var via `apiKeyEnv`); also exposed via the GitHub
  Action `base-url` input.
- **YAML/JSON config loader** and **`ledger init`** to scaffold a config file. Config options:
  `provider`, `model`, `maxDiffLines`, `maxTokens`, `timeout`, `maxRetries`.
- **CI auto-detection** for GitHub Actions, GitLab CI, Jenkins, CircleCI, Buildkite, and a
  generic `CI` fallback. With no range flag, the range is derived automatically: a tag build
  uses _previous tag → this tag_; a PR/MR build uses _base branch → HEAD_.
- **CI output enrichment**: repository, ref, and pipeline URL in the notes header, and on
  GitHub the notes are appended to the job **step summary** (`$GITHUB_STEP_SUMMARY`), with a
  `--no-summary` opt-out.
- **Operational flags**: `--quiet`, `--dry-run` (assemble context + estimate tokens without
  calling the AI), `--max-tokens`, `--timeout`, `--fail-on-empty`.
- **Documented exit-code contract**: `0` success, `1` runtime error, `2` usage/config/auth
  error, `3` empty range with `--fail-on-empty`.
- **Resilience**: per-request timeout plus automatic retry with exponential backoff and
  jitter on transient errors (429/5xx/network) across all providers.
- **Composite GitHub Action** (`action.yml`) and copy-paste templates for GitLab CI,
  Jenkins, and generic runners under [`examples/`](./examples).
- **Tooling**: vitest test suite, ESLint configuration, a matrix CI workflow
  (Node 18/20/22 → typecheck → lint → test → build), and a publish-on-tag release workflow
  with npm provenance.

[Unreleased]: https://github.com/anishhs-gh/ledger/compare/v1.0.0...HEAD
[1.0.0]: https://github.com/anishhs-gh/ledger/compare/v1.0.0-beta.1...v1.0.0
[1.0.0-beta.1]: https://github.com/anishhs-gh/ledger/compare/v1.0.0-beta.0...v1.0.0-beta.1
[1.0.0-beta.0]: https://github.com/anishhs-gh/ledger/releases/tag/v1.0.0-beta.0