History was squashed into the initial commit of this repo, so release-please
has no user-facing commits to build a changelog from. This forces the first
stable release of the 5.x line off the current dev tip and resets the prod
manifest baseline to the prior npm `latest` (4.4.9) so Release-As produces a
clean forward 5.0.0 instead of a no-op.

Release-As: 5.0.0
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(upgrade): compare prerelease versions per SemVer

`isOutdated` stripped the prerelease suffix before comparing, so
beta-to-beta bumps like 5.0.0-beta.0 -> 5.0.0-beta.1 both collapsed to
[5,0,0], compared equal, and `dcd upgrade` reported "Already on the
latest version". Same nudge in cloud.ts was affected.

Replace the naive major.minor.patch compare with a SemVer 2.0.0
`compareSemver` helper that handles prerelease precedence (a prerelease
ranks below its final release; identifiers compare dot-by-dot, numeric
numerically and below alphanumeric). Add unit coverage for the
regression and related cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: suppress refresh countdown in quiet mode

When --quiet is passed (geared at CI), the live results footer no longer
renders the "next refresh in Ns" / "refreshing…" countdown. The realtime
connection indicator is still shown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(cloud): warn on deprecated iOS 16 (removal 2026-08-23)

* feat(cloud): drop legacy Maestro removed-versions block; soft-warn on deprecated 1.39.5/1.41.0

* fix(installer): make beta opt-in, add stable/beta channels

The install scripts resolved the version from /latest.json, which (until a
stable release exists) synthesized the newest prerelease — so the default
`curl … | sh` was silently installing betas.

Pair the proxy's new channel support (get.devicecloud.dev now serves stable
on /latest.json and prereleases on ?channel=beta) with explicit opt-ins:

- DCD_BETA — request the beta channel (latest prerelease).
- DCD_VERSION — already pins an exact version; documented for rollback.
- Default (no opt-in) installs the latest *stable* only. When no stable
  release exists yet, the installer errors with guidance pointing at
  DCD_BETA / DCD_VERSION instead of falling back to a beta.

The manifest fetch is separated from parsing so a transient network/proxy
failure (curl -f non-zero) is reported differently from a channel that has
no release yet (HTTP 200 with "version": null).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: add open-source contribution governance

Scaffolding to open dcd-cli to external contributors:

- LICENSE (MIT), CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, CLA templates
- CODEOWNERS, PR template, issue forms + config, dependabot, .editorconfig
- pr-title-lint workflow: Conventional Commits on PR title (squash-merge model,
  types kept in sync with release-please changelog-sections)
- cla workflow: CLA Assistant Lite
- release-please: use a GitHub App token (falls back to GITHUB_TOKEN until the
  App secrets exist) so Release PRs trigger required checks under branch protection
- cli-ci: also run on production so the dev->production promotion PR is gated

* chore: drop CODEOWNERS

Low value for a small maintainer team where anyone can review anything; the
branch ruleset's approval requirement covers review without it.

* fix(ci): keep dependabot and fork PRs green (#46)

* fix(ci): keep dependabot and fork PRs green

Dependabot/fork PRs run without repo secrets, so three jobs failed on them:

- lint-and-test: HAS_PRIVATE_ACCESS was true for dependabot (same-repo head),
  so it tried to clone the private mock-api with an empty DCD_SSH_DEPLOY_KEY.
  Now excludes dependabot[bot], same as forks (skips mock-api + integration).
- claude-code-review: skips dependabot/fork PRs (no CLAUDE_CODE_OAUTH_TOKEN).
- cla: skips its action step until PERSONAL_ACCESS_TOKEN is configured so the
  check is green instead of 'Branch cla-signatures not found'; also fixes two
  invalid input names (custom-*-prompt -> custom-*-prcomment).

* ci: group all github-actions bumps into one weekly PR

Wildcard pattern so major action bumps join the group too, instead of one
PR per action.

* ci: power CLA via the shared automation GitHub App (#49)

* ci: power CLA via the shared automation GitHub App

Mint the CLA token from the same GitHub App release-please uses, instead of a
personal PAT (no expiry, signature commits show as the bot). Rename the App
secrets RELEASE_PLEASE_APP_* -> BOT_APP_* since one App now serves both
workflows. CLA self-skips until BOT_APP_ID is set.

Carries only the app-token delta — the dependabot/fork CI fixes and actions
grouping already landed on dev via #46.

* ci: allowlist internal maintainers (riglar, finalerock44) in CLA

* docs: set legal entity to Moropo Ltd t/a DeviceCloud (#50)

Fill the CLA party placeholder and the LICENSE/README copyright holder with the
registered entity. CLA still pending legal review.

* ci: bump the actions group across 1 directory with 6 updates (#47)

Bumps the actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2` | `3` |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4` | `6` |
| [actions/setup-node](https://github.com/actions/setup-node) | `5` | `6` |
| [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5` | `6` |
| [googleapis/release-please-action](https://github.com/googleapis/release-please-action) | `4` | `5` |



Updates `actions/create-github-app-token` from 2 to 3
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@v2...v3)

Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `pnpm/action-setup` from 4 to 6
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v4...v6)

Updates `actions/setup-node` from 5 to 6
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v5...v6)

Updates `amannn/action-semantic-pull-request` from 5 to 6
- [Release notes](https://github.com/amannn/action-semantic-pull-request/releases)
- [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md)
- [Commits](amannn/action-semantic-pull-request@v5...v6)

Updates `googleapis/release-please-action` from 4 to 5
- [Release notes](https://github.com/googleapis/release-please-action/releases)
- [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md)
- [Commits](googleapis/release-please-action@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: amannn/action-semantic-pull-request
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: googleapis/release-please-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: finalerock44 <77282157+finalerock44@users.noreply.github.com>

* fix: v5 release blockers — installer, binary version, repeated flags,… (#51)

fix: v5 release blockers — installer, binary version, repeated flags, upgrade, CI output

- install.ps1: fix PS 5.1 parse error (`$asset:` -> `${asset}`) that made
  `irm | iex` a no-op on stock Windows; decode the octet-stream SHA256SUMS
  (Byte[] under -UseBasicParsing) to text before splitting.
- build/version: stamp the version into the bun-compiled binary via
  `bun --define __DCD_CLI_VERSION__` (the compiled binary can't read
  package.json), so `dcd --version` no longer reports 0.0.0. npm/tsx path
  still falls back to reading package.json. Adds src/global.d.ts.
- cloud: collect repeated `-e/--env`, `-m/--metadata`, `--include-tags`,
  `--exclude-tags`, `--exclude-flows` from rawArgs (citty/parseArgs kept only
  the last occurrence, silently dropping earlier values); echo the collected
  values too.
- upgrade: query the beta channel for prerelease installs and distinguish
  "no newer release on this channel" from a real network failure, replacing
  the misleading "Could not reach the update manifest" error during the beta.
- progress/polling: make the realtime status indicator TTY-aware — in
  non-interactive/CI output, print one line per state change instead of
  flooding logs with a per-frame spinner (not suppressed by --quiet/--json-file).
- methods: downgrade primary-Backblaze-upload failure warnings to debug-only;
  the Supabase fallback recovers and validateUploadResults raises the only
  user-facing error (when every strategy fails).
- list/status: build console links from the env the CLI targets
  (resolveFrontendUrl) instead of the API's hardcoded-prod consoleUrl.
- cloud: validate a local --app-file exists during --dry-run.

* chore(dev): release 5.0.0-beta.2 (#36)

Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>

* fix: stop CLA locking release PRs (breaks release pipeline) (#52)

The CLA Assistant action defaults lock-pullrequest-aftermerge=true, so merging
a release-please PR locked it; release-please then failed trying to comment on
the locked PR, killing the Release job before npm publish + binary upload ran
(seen on v5.0.0-beta.2). Set lock-pullrequest-aftermerge=false.

Also skip release-please PRs in claude-code-review (version bumps — nothing to
review, and it must never block a release).

* feat(live): add a beta warning to `dcd live start` (#54)

Prints a beta notice (billed at $0.03/min, contact support to enroll) before
starting a session. The API's new enrollment gate returns a 403 whose
"contact support" message the CLI already surfaces verbatim on a non-enrolled
org.

* chore(dev): release 5.0.0-beta.3 (#53)

Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Tom Riglar <tom.riglar@moropo.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>

Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>

Promote the DB-driven notices feature (CLI render via ui, console banner, API block enforcement, CI identity forwarding) from dev to stable.

Release-As: 5.1.0

Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>

Promote from dev to stable:

* fix: recover cleanly when the stored session is dead (#72) — `dcd login`
  now mints a dedicated Supabase session for the CLI rather than reusing the
  browser's refresh-token family, and a dead stored session recovers instead
  of hard-failing.
* deps: bump the minor-and-patch group (9 updates) (#71) and
  eslint-plugin-unicorn 68 -> 69 (#70).

Carries only the source delta — package.json version, CHANGELOG.md and the
release-please manifests stay as release-please left them on production.

Release-As: 5.1.1

Promote from dev to stable:

* feat(cloud): upload-level device matrix (#1105) — one `dcd cloud` upload
  carries N device configs via repeatable `--ios-device-matrix <device>:<version>`
  / `--android-device-matrix <device>:<apiLevel>[:play]`, fanning out into one
  result row per (flow × config). Each flag names exactly one validated cell;
  there is no cross-product. Sequential flows form N independent depends_on
  chains, one per device. Adds a pre-submit cell-count + cost preview and a
  `device` object on each `--json` `tests[]` entry.
* fix(cloud): refuse a device matrix on an API that cannot honour it — an older
  API silently strips the unknown field and runs one device, exiting 0; the CLI
  now fails loudly instead of under-testing in silence.
* test: run the integration suite via execFile argv rather than a shell,
  clearing the whole js/shell-command-injection-from-environment class.

REQUIRES the dcd API carrying #1105 to be on production first. Without it the
matrix flags cannot be honoured (the CLI refuses, by design).

Carries only the source delta — package.json version, CHANGELOG.md and the
release-please manifests stay as release-please left them on production.

Release-As: 5.2.0

Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>

Promote from dev to stable:

* feat: client-side envelope encryption of app binaries, flow zips and env vars
  (#94, #101) — opt-in via `--encrypt` / `DCD_ENCRYPT_BINARIES=1` and off by
  default, so uploads stay byte-identical unless asked for. Per-upload DEK,
  chunked AES-256-GCM container, X25519 sealed-box DEK wrap; encrypted binaries
  dedup on the plaintext hash so re-uploads still hit the cache.
* feat(artifacts): prefer server-assembled bundle delivery for downloads (#93) —
  falls back to the inline endpoint on 501, so it degrades cleanly against an
  API that has not shipped bundles.
* feat(device): add Android API level 37 (Android 17) (#107) — the flag enum
  accepts 37, but the device/API-level pair is validated against the
  compatibility matrix the *target* API serves, and production still tops out at
  36, so 37 is refused client-side until the platform gate flips.
* refactor(cloud): remove the enterprise-only --mitmHost / --mitmPath flags
  (#102). The submitted config payload for runs that never passed them is
  byte-identical.
* fix(deps) / deps: clear every outstanding pnpm audit advisory (#89, #92, #95,
  #100, #106), bump chalk 5 -> 6, and regenerate the schema types from the
  current API swagger (#105).

No platform prerequisite this time: the envelope decrypt half (dcd api +
simulators) is already on production with both env KEK public keys pinned,
bundle delivery has a 501 fallback, and API 37 is gated server-side.

Carries only the source delta — package.json version, CHANGELOG.md and the
release-please manifests stay as release-please left them on production.

Release-As: 5.3.0

Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>

Promote from dev to stable:

* fix(cloud): exclude config-shaped files from flow discovery (#114, closes
  dcd-cli#99) — a `config.yaml` sitting in a flows folder was picked up as a
  flow and blew up `processDependencies` with "Expected an array of steps".
  Detection is by shape, not filename, so several named configs can coexist in
  one folder. A flow merely *missing* its `---` separator still errors loudly
  rather than being silently dropped.
* fix(cloud): reject malformed executionOrder instead of silently running in
  parallel (#117, closes dcd-cli#110) — the config was `yaml.load`ed and
  straight-cast, so an `executionOrder` in the wrong shape was ignored and every
  flow ran in parallel. A zod schema (`src/services/workspace-config.schema.ts`)
  is now the single source of truth, with `IWorkspaceConfig` inferred from it so
  the compile-time and runtime views cannot drift.
* deps: bump the minor-and-patch group with 5 updates (#112), plus
  eslint-plugin-unicorn 72 -> 73 and pnpm/action-setup 6.0.9 -> 6.0.10.

Behaviour changes users will notice:

* A malformed `executionOrder` is now a hard error with a targeted message
  showing found-vs-expected. Anyone whose config was mis-shaped has been running
  flows in parallel without knowing; after this they get a clear failure instead.
  That is the point of the fix, but it is the one change that can turn a
  previously-green pipeline red.
* Unrecognised top-level config keys emit a warning (with a did-you-mean for
  near-misses). Keys are preserved, not stripped — the config is forwarded to
  the API as `fields.workspaceConfig`, so stripping would silently alter the
  payload.
* Config warnings go to stderr, so `--json` stdout stays parseable and the MCP
  server's JSON-RPC stdout channel stays clean.

No platform prerequisite: both fixes are client-side (flow discovery and config
validation). The submitted payload for an already-valid config is unchanged.

Carries only the source delta — package.json version, CHANGELOG.md and the
release-please manifests stay as release-please left them on production.

Release-As: 5.3.1