shapi-cli 0.0.0-stage → 0.2.0

package/advisories/xero-finance-accounting-activities-decommissioned.json

@@ -0,0 +1,28 @@
+{
+  "id": "xero-finance-accounting-activities-decommissioned",
+  "provider": "xero",
+  "title": "Finance API Accounting Activities endpoints decommissioned",
+  "summary": "On 2026-05-04 Xero decommissioned the Finance API's Accounting Activities API: Account Usage, Lock History, Report History and User Activities. All of these endpoints now return errors. Xero suggests the Bank Statements API for cash flow and financial analysis.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/finance.xro/1.0/AccountingActivities/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-05-04",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-05-04",
+  "severity": "critical",
+  "migrationNote": "Remove calls to /finance.xro/1.0/AccountingActivities/AccountUsage, LockHistory, ReportHistory and UserActivities, along with the features built on them. For cash-flow or transaction analysis, move to the Finance API Bank Statements endpoint (/finance.xro/1.0/BankStatementsPlus/statements). Lock history and user activity data have no direct replacement.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/2.29.1/xero-finance.yaml",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero-finance.yaml"
+  ],
+  "status": "verified"
+}

package/advisories/xero-invoices-email-daily-limit-429.json

@@ -0,0 +1,32 @@
+{
+  "id": "xero-invoices-email-daily-limit-429",
+  "provider": "xero",
+  "title": "Invoice email daily limit returns 429 instead of 500 from 2027-01-14",
+  "summary": "From 2027-01-14, POST Invoices/{InvoiceID}/Email returns 429 Too Many Requests instead of a generic 500 when the organisation reaches its daily invoice-email limit. The 429 has no Retry-After header. Code that treats 500 as a retryable server error, or retries a 429 at once with a short backoff, will mishandle the limit.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/api.xro/2.0/Invoices/{InvoiceID}/Email"
+  },
+  "changeClass": "status-code",
+  "trigger": {
+    "statusCodes": [
+      500
+    ],
+    "newStatusCodes": [
+      429
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-10-15",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2027-01-14",
+  "severity": "medium",
+  "migrationNote": "Handle a 429 from the invoice Email endpoint separately from the per-minute rate limit. It is a daily limit with no Retry-After header, so don't retry immediately. Queue the send for after the daily reset, or tell the user sending was delayed. Stop relying on a 500 to detect this case.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml"
+  ],
+  "status": "verified"
+}

package/advisories/xero-nz-payroll-employee-tax-kiwisaverstatus-required.json

@@ -0,0 +1,27 @@
+{
+  "id": "xero-nz-payroll-employee-tax-kiwisaverstatus-required",
+  "provider": "xero",
+  "title": "NZ Payroll employee tax requests without KiwiSaverStatus return 400 from 2026-11-05",
+  "summary": "From 2026-11-05, KiwiSaverStatus is required when creating or updating employee tax details in NZ Payroll, for every tax code except WT and NSW. Requests that omit it return 400 Bad Request. Xero says it will not provide test instances or workarounds.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/payroll.xro/2.0/Employees/{EmployeeID}/Tax"
+  },
+  "changeClass": "required-field",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-08-06",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-11-05",
+  "severity": "critical",
+  "migrationNote": "Send KiwiSaverStatus explicitly in every POST to /payroll.xro/2.0/Employees/{EmployeeID}/Tax whose tax code is not WT or NSW. Get it from your own employee record or read the current tax details with a GET before updating. Treat a 400 on this call as a data error to show the user, not a reason to retry.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero-payroll-nz.yaml"
+  ],
+  "status": "verified"
+}

package/advisories/xero-organisation-class-ultra-enum.json

@@ -0,0 +1,31 @@
+{
+  "id": "xero-organisation-class-ultra-enum",
+  "provider": "xero",
+  "title": "Organisation Class enum gains ULTRA",
+  "summary": "Since 2026-06-30 the Organisation endpoint can return Class ULTRA for Australian organisations on the new Xero Ultra plan. Xero warns that integrations assuming only the existing values may fail to keep their connection to Xero. Strict enum parsing, including older SDK enums, can throw on the new value.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/api.xro/2.0/Organisation"
+  },
+  "changeClass": "enum-added",
+  "trigger": {
+    "enums": [
+      {
+        "field": "Class"
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-06-30",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-06-30",
+  "severity": "medium",
+  "migrationNote": "Accept unknown Organisation Class values instead of failing, and map ULTRA wherever you branch on plan type. If you use a generated SDK, upgrade to a version whose Class enum includes ULTRA, or deserialize Class as a plain string.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml"
+  ],
+  "status": "verified"
+}

package/bin/shapi.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { main } from "../dist/index.js";
+
+process.exitCode = await main(process.argv);