# Changelog

All notable changes to this project will be documented in this file.

## [2.0.5] - 2026-06-03

### Added

- **Invoice templates** - `rp push` and `rp pull` now support an optional invoice document template (`documents/invoice.html`). Unlike the other policy documents, the invoice template has no default fallback: if the file is absent it is left out entirely, and it is only created on pull when one already exists.

## [2.0.0] - 2026-04-22

### BREAKING CHANGES

#### Minimum Node.js Version

- **Node.js 20+ is now required.** Support for Node.js 14, 16, and 18 has been dropped.

#### Removed Commands

The following CLI commands have been removed:

- `rp lint` - Use your IDE's ESLint integration or run `npm run lint` directly instead.
- `rp ai` - The AI-powered Joi schema generation feature has been removed.

#### Removed Short Flags

The following short flag aliases have been removed. Use the long form instead:

| Removed Short Flag | Long Form Alternative | Command |
|--------------------|----------------------|---------|
| `-ad` | `--api-docs` | `rp generate`, `rp diff` |
| `-cm` | `--collection-module` | `rp clone` |
| `-ut` | `--unit-tests` | `rp diff` |
| `-rm` | `--read-me` | `rp diff` |
| `-ns` | `--no-sort` | `rp pull`, `rp push` |

**Migration:** Update any scripts, CI pipelines, or shell aliases that use the removed short flags to use the long form instead.

### Added

- **Spinner UX** - Added loading spinners via `ora` for `push`, `pull`, `publish`, and `clone` operations.
- **Improved error messages** - `PlatformError` and `NetworkError` now provide contextual suggestions for common failure modes.
- **Parallel API calls** - Improved performance in `push` and `publish` operations by running independent API calls in parallel.
- **New dependencies** - Added `dayjs`, `zod`, and `ora`.

### Changed

- **Joi v11 to v18** - Upgraded Joi with backward-compatible shims for `.valid([...])` array syntax and `Joi.validate()`.
- **ESLint v7 to v10** - Migrated from `.eslintrc.js` to the new flat config format (`eslint.config.mjs`).
- **Test runner** - Replaced `vm2` sandbox with direct Mocha execution for unit tests.
- **Native fetch** - Replaced `node-fetch` with Node.js native `fetch`.
- **Centralized error handling** - API helpers now use `throwResponseErrors: true` for consistent error handling.

### Removed

- **vm2** - Removed due to critical security vulnerabilities (sandbox escape CVEs).
- **node-fetch** - Replaced by native `fetch` available in Node.js 18+.
- **openai** - Removed along with the `rp ai` command.
- **dotenv** - No longer bundled; use your own environment configuration.
- **uuid** - Replaced by `crypto.randomUUID()` from Node.js core.

### Security

- Removed `vm2` dependency which had known sandbox escape vulnerabilities.

### Upgrade Guide

1. Ensure you are running Node.js 20 or later.
2. Update any scripts using removed short flags (see table above).
3. Remove any usage of the `rp lint` command; use `npm run lint` instead.
4. Remove any usage of the `rp ai` command.
5. Run `npm install` to update dependencies.