@curviate/cli 0.24.0 → 0.24.2

package/CHANGELOG.md

@@ -8,6 +8,65 @@ a new command or flag is a minor; a breaking command/flag/exit-code change is a
 
 ## [Unreleased]
 
+## [0.24.2] - 2026-08-27
+
+### Changed
+
+- **`@curviate/sdk` pin raised from `0.24.2` to `0.24.3`** (exact, per the
+  compiler-coupling policy that `check:sdk-pin` enforces). The SDK's
+  corrected Sales Navigator response types now flow through to CLI users:
+  - `founded_on` is a `number`, was an open object.
+  - `websites` and `addresses` are `string[]`, were arrays of open objects.
+  - `contact_info.phones` and `contact_info.emails` are `string[]`, were
+    arrays of open objects.
+  - `specialties` is a `string[]` on `sales-navigator/search/companies`, was
+    `unknown`.
+  - `job_title` and `role` are required (non-optional) on `work_experience`
+    and `volunteering`.
+  - Nested `school`, `company` and `organization` references on `education`,
+    `work_experience` and `volunteering` are now declared, each with a
+    nullable `id`.
+
+  These are corrections, not behaviour changes. The wire has always sent
+  these shapes; the previous declarations described them wrongly. Upgrading
+  may turn a consumer's `tsc` red where it was green against a declaration
+  that did not match reality. That red is a pre-existing bug becoming
+  visible, not a new one. The CLI's own runtime behaviour and command surface
+  are unchanged in this release.
+
+- The vendored OpenAPI test fixture (`test/fixtures/openapi.json`) was
+  re-copied from the SDK at `0.24.3`, with `test/fixtures/VENDORED_FROM.json`
+  updated to match, as `check:fixture-pin` requires.
+
+## [0.24.1] - 2026-08-25
+
+### Fixed
+
+- **`@curviate/sdk` dependency pinned to an exact `0.24.2`** (was `^0.23.0`).
+  A caret range on a `0.x` package pins the minor (`^0.23.0` resolves to
+  `>=0.23.0 <0.24.0`), so the published CLI could never resolve the
+  registry's actual `latest` SDK once it moved to `0.24.x` - every SDK
+  release, the floor had been hand-bumped and drifted a minor behind. The
+  CLI is compiler-coupled to one SDK build, so the pin is now exact rather
+  than a range that can silently fail to admit the version actually
+  published.
+- **Added a `check:sdk-pin` prepack guard** that compares the *resolved*
+  `@curviate/sdk` version under `node_modules` (what actually gets bundled)
+  against the *declared* dependency, and fails the build on any mismatch or
+  non-exact range. Chained into `prepack` alongside the existing leak-scan
+  guards, so this class of drift cannot reach a publish undetected again.
+- **`check:clean` now flags a committed npm auth token** (the
+  `npm_`-prefixed shape an accidentally-tracked `.npmrc` carries), and
+  `.npmrc` / `*.tgz` are gitignored. Neither was previously scanned or
+  excluded (security-auditor F3).
+- **Fixed the flag-to-body-field guard's fail-open fixture check.** It
+  previously `describe.skip`'d its entire 8-test suite whenever the sibling
+  `packages/sdk` fixture wasn't found at a `process.cwd()`-relative path,
+  reporting green while running nothing. It now resolves the fixture
+  relative to the test file's own location (not cwd) and fails loudly, per
+  test, when the fixture is missing, since a broken checkout is a failing suite,
+  not a skipped one.
+
 ## [0.24.0] - 2026-08-18
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/cli",
-  "version": "0.24.0",
+  "version": "0.24.2",
   "private": false,
   "description": "Official command-line interface for the Curviate API.",
   "license": "MIT",
@@ -30,7 +30,8 @@
   },
   "scripts": {
     "build": "tsup",
-    "prepack": "node scripts/check-clean.mjs && node scripts/check-copy.mjs && tsup && node scripts/check-clean.mjs --dist",
+    "prepack": "node scripts/check-clean.mjs && node scripts/check-copy.mjs && node scripts/check-sdk-pin.mjs && node scripts/check-fixture-pin.mjs && tsup && node scripts/check-clean.mjs --dist",
+    "pretest": "node scripts/check-fixture-pin.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
@@ -38,11 +39,13 @@
     "check:clean": "node scripts/check-clean.mjs",
     "check:clean:dist": "node scripts/check-clean.mjs --dist",
     "check:copy": "node scripts/check-copy.mjs",
+    "check:sdk-pin": "node scripts/check-sdk-pin.mjs",
+    "check:fixture-pin": "node scripts/check-fixture-pin.mjs",
     "verify:dist": "pnpm build && node scripts/verify-dist.mjs",
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@curviate/sdk": "^0.23.0",
+    "@curviate/sdk": "0.24.3",
     "citty": "^0.1.6",
     "open": "^10.1.0"
   },