releases-cli Updates & Release Notes

Patch Changes

7fe55de: source backfill --dry-run now reports how much of the extracted history the source doesn't already have, as N not yet stored. Previously the dry-run line reported only how many entries were on the page, which said nothing about whether any of them were missing — during the 2026-07-23 ingest outage that gap let a run over a source missing its entire recent history read as uneventful. Requires an API worker carrying the new notStored field; against an older server the clause is omitted rather than guessed. The report type also catches up with the server: inserted is null on a dry run (nothing was written, no count computed) rather than a fabricated 0.

b124608: Fix getApiUrl() memoizing the API base URL process-wide on first call. Under bun test, every test file shares one process, so whichever file called it first locked the base URL for the rest of the run — files that set RELEASES_API_URL afterward got the stale (production) URL instead and their assertions failed. This was silently CI-red on main (22 tests failing) because CI's clean environment produces a call order that trips the memoization, while a developer machine with real credentials hits a different, unrelated set of failures. getApiUrl() now re-resolves from the environment on every call instead of caching.

f7a1b54: Fix releases stats reporting every source as never-fetched with zero recent releases. The command composed its summary from the legacy flat fields of /v1/stats and hardcoded source health, releasesInPeriod, and every lastFetchedAt to 0/null — a stale workaround from before the endpoint returned the full StatsSummary shape. It now reads the server's real values, so the output reflects actual ingestion health instead of implying the index is dead.

Minor Changes

88999c9: releases search --json now passes AI-scored importance (1–5) through in the slim search-hit shape, normalized to null when unscored — same norm as get / tail / latest. The TTY search table also marks importance ≥ 4 with the quiet glyph. Bumps @buildinternet/releases-api-types to ^0.48.0 for the search/related/digest wire field (monorepo #2135).

Patch Changes

e97462a: Surface a NODE_EXTRA_CA_CERTS / SSL_CERT_FILE hint on TLS certificate verification failures, and document custom-CA support (TLS-intercepting proxies) in the README.

Minor Changes

0b1a45e: Remove the deprecated get_source_changelog tool from the local stdio MCP bridge. It was deprecated in 0.71.0 in favor of get_catalog_entry with the changelog_* params (include_changelog / changelog_path / changelog_offset / changelog_limit / changelog_tokens); calling get_source_changelog by name now returns MCP's standard unknown-tool error. The REST helper sourceChangelog() is unchanged — get_catalog_entry and the admin source changelog CLI command still use it.

e7d50b4: releases search gains --category <slug> and --collection <slug> filters. --category scopes hits to organizations in a category (the API validates and resolves curator aliases like e-commerce → commerce, so the value is forwarded as-is); --collection scopes to a curated collection's member orgs (unknown slugs report "no collection matching …", mirroring --domain). Both forward to the new /v1/search params and compose with the existing --domain / --product / --kind / --since / --until scopes.

2d4b707: Surface the registry's AI-scored release importance (1–5, null when unscored). tail/latest gains --min-importance <1-5> (forwarded as ?minImportance=); the human table marks importance ≥4 with a quiet glyph (outline at 4, solid at 5), mirroring the web's render threshold, while --json output (get/tail/latest) passes the raw score through verbatim, including null. Bumps the @buildinternet/releases-api-types and @buildinternet/releases-core pins to the versions that carry the importance field.

Minor Changes

735ba8a: The local stdio MCP bridge's get_catalog_entry tool now accepts include_changelog, changelog_path, changelog_offset, changelog_limit, and changelog_tokens — matching the hosted server at mcp.releases.sh — so a source entry's tracked CHANGELOG can be inlined or sliced in the same call, without a separate lookup. changelog_tokens takes precedence over changelog_limit, and any changelog_* param implies include_changelog; the params are ignored (with a clear message) for product entries. The standalone get_source_changelog tool is now deprecated in favor of these params — it remains registered and functional for this release, but agents should migrate.

7ba0ebd: releases org get now renders stub-tier orgs (#1947): a stub · not yet tracked marker on the header and a Declared locations section listing each declared locator (kind, target, canonical flag), plus a hint to promote. Previously a stub printed as a bare identity block with no indication that it was a declared-but-untracked listing. --json output is unchanged.

Patch Changes

64951a6: Add releases admin release refetch <releaseId> to re-fetch a single release's live page and heal it in place (title/content/publishedAt, same rel_ id). Supports --url for releases whose stored URL is a synthesized #fragment index anchor, defaults to a dry-run preview, and writes with --apply.

abeab6e: Consolidate agent skills by audience: this repo now ships only the three user-facing skills (releases-mcp, releases-cli, analyzing-releases). The releases-admin plugin, its five mirrored operator skills, and the discovery/worker agent definitions are removed — the canonical operator skills live in the backend monorepo's .claude/skills/ tree. The @buildinternet/releases-skills npm wrapper is retired (removed from the workspace and the changesets fixed group; deprecated on npm). npx skills add buildinternet/releases-cli and releases skills install continue to work unchanged.

Minor Changes

eaa4ad1: Add releases json export <org> — generate a releases.json v2 domain manifest from an already-tracked org. Reconstructs the manifest from what the registry knows about the org (products + release sources) by calling the backend GET /v1/orgs/:slug/manifest endpoint, so an owner can host the result at /.well-known/releases.json and take ownership of their listing. Prints to stdout by default (pipeable into releases json validate -) or writes to a file with -o/--output. Completes the owner round-trip alongside releases json validate. Re-ingest enriches missing fields only (fill-if-empty), never overwriting existing values.

Bumps @buildinternet/releases-api-types to ^0.41.0 for the product-level tags field, so releases json validate accepts manifests that declare product tags. json export itself trusts the backend and does not strict-validate the API response against the pinned schema (the deployed API can run ahead of the published types), so it only guards for a version: 2 shape.

Minor Changes

f1f11ae: releases json validate <domain> now validates live against the registry's listing endpoint (previously deferred). The domain form POSTs the public /v1/listing/validate endpoint and renders the verdict plus the materialization plan — identity, products, and each release locator with its classification ("goes live" / "reviewed first") — ending with an activation pointer for unlisted domains. Exit codes: 0 valid, 1 invalid or check failed (the old unconditional exit 2 is gone). --json emits the raw ListingValidationResult merged with { target }. Bumps @buildinternet/releases-api-types to ^0.39.0 for the listing wire types.

af88692: releases admin release update (and its deprecated release edit alias) now accept a --url <url> flag to set a release's canonical URL. Passing a non-empty value sets the URL; passing an empty string (--url "") clears it. The backend PATCH /v1/releases/:id route already accepted the url field — this wires it through the CLI.

042efbd: Add stub-tier org verbs (buildinternet/releases#1947): releases admin org create-stub (curator-authored stub org with repeatable --location JSON locators and/or --from-file), releases admin org create-stub-from-domain <domain> (stub from a domain's /.well-known/releases.json manifest, --dry-run supported), and releases admin org promote <slug> (materialize declared locations into sources and flip the org to tracked, --dry-run supported). Bumps @buildinternet/releases-api-types to ^0.38.0 for the stub-tier wire types.

Minor Changes

c1e5ee6: Add releases json validate <path> — validate a releases.json v2 owner manifest against the published schema (ReleasesJsonConfigSchema) before publishing it. Accepts a file path or - for stdin, detects the hosting scope (domain vs repo) for readable path-anchored errors, and supports --json for machine output (exit 0 valid / 1 invalid). The domain form (live fetch + materialization plan) is deferred until the public dry-run endpoint lands (buildinternet/releases#1910) so web and CLI share one verdict.

Patch Changes

cf95da6: Adopt @buildinternet/releases-api-types 0.37.0 (releases.json v2 schema) and migrate the repo-root releases.json to the v2 manifest format (product binding + github: "self" release locator).

Patch Changes

• b8d7f2f: Read API error messages through api-types' canonical decodeApiError instead of a hand-rolled envelope reader. Behavior is unchanged — the nested { error: { code, type, message } } envelope, a legacy flat { message } body, and malformed payloads (which fall back to the HTTP status text) all resolve exactly as before — but the CLI now shares the published wire-shape decoder rather than duplicating it. Bumps @buildinternet/releases-api-types to ^0.35.0 and @buildinternet/releases-core to ^0.25.0 (the versions that first export the errors module).