chore: version packages

CHANGELOG.md

@@ -1,5 +1,35 @@
 # @codacy/codacy-cloud-cli
 
+## 1.9.0
+
+### Minor Changes
+
+- [#37](https://github.com/codacy/codacy-cloud-cli/pull/37) [`402edd8`](https://github.com/codacy/codacy-cloud-cli/commit/402edd8d7bc8260cce9951da357e7b410ec2b219) Thanks [@alerizzo](https://github.com/alerizzo)! - Add repository (project) token support
+
+ You can now authenticate with a **repository token** — scoped to a single repository — instead of a personal account API token that reaches every organization and repository you can see. This is the right credential for CI and for the auto-configuration agent: if it leaks, the blast radius is one repository.
+
+ ```bash
+ codacy tools --repository-token <your-repository-token>
+ # or, for a whole CI job:
+ export CODACY_PROJECT_TOKEN=<your-repository-token>
+ ```
+
+ Get one from **Codacy > Repository > Settings > Integrations > Project API token**. The new `--repository-token <token>` flag is accepted by every command, and `CODACY_PROJECT_TOKEN` is picked up automatically.
+
+ **Token precedence** (identical to the Codacy Analysis CLI): `--repository-token` > `CODACY_PROJECT_TOKEN` > `CODACY_API_TOKEN` > stored `codacy login`. An explicit `--repository-token` wins outright, so a deliberately scoped run is never silently widened. Note that `CODACY_PROJECT_TOKEN` outranks `CODACY_API_TOKEN` — unset it if you want your account token used.
+
+ **Not every command accepts a repository token**, because Codacy only honours them on a limited set of repository-scoped operations:
+
+ - **Fully supported:** `tools`, `tool`, `patterns`, `pattern`, `issues` (including `--overview`), `tools --import`, `repository --reanalyze` / `--reanalyze-and-wait`.
+ - **Partially supported:** `repository` works but omits the pull request and coverage sections. In `--output json`, `pullRequests` stays an empty array and a new `unavailable: ["pullRequests"]` field marks what couldn't be fetched. Output under an account token is unchanged.
+ - **Account token required:** `info`, `repositories`, `ls`, `directories`, `pull-request`, `pull-requests`, `issue`, `findings`, `finding`, `issues --ignore`/`--ignored`, `tools --import --force`, and `repository`'s `--add`/`--remove`/`--follow`/`--unfollow`/`--link-standard`/`--unlink-standard`.
+
+ Unsupported combinations now fail immediately with a message naming the operation, why a repository token can't perform it, and which token is in use — instead of sending a request that comes back as a bare `Unauthorized`.
+
+ `codacy login` continues to store account tokens only; repository tokens are passed per command or via the environment.
+
+ Also fixed: `codacy repository` no longer loses the entire dashboard when the pull request lookup fails, and `codacy login` no longer reports a repository token as "invalid" when it is rejected for being the wrong kind of token.
+
 ## 1.8.0
 
 ### Minor Changes

package.json

@@ -1,6 +1,6 @@
 {
  "name": "@codacy/codacy-cloud-cli",
- "version": "1.8.0",
+ "version": "1.9.0",
  "description": "A command-line tool to interact with Codacy Cloud from your terminal",
  "homepage": "https://www.codacy.com",
  "repository": {