release: 0.9.0 and Node 24 Actions runtimes

.github/workflows/node.js.yml

@@ -27,9 +27,9 @@ jobs:
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
@@ -40,9 +40,9 @@ jobs:
   packaging-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Use Node.js 24.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 24.x
           cache: "npm"

.github/workflows/publish.yml

@@ -17,12 +17,13 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Use Node.js 24.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 24.x
           registry-url: "https://registry.npmjs.org/"
+          package-manager-cache: false
       - run: npm ci
       - run: npm run build --if-present
       - name: Verify package contents

.github/workflows/release.yml

@@ -50,10 +50,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 24.x
 
@@ -108,7 +108,7 @@ jobs:
           sha256sum ${{ matrix.binary-name }} > ${{ matrix.binary-name }}.sha256
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ${{ matrix.binary-name }}
           path: |
@@ -124,10 +124,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: artifacts
 
@@ -246,7 +246,7 @@ jobs:
           VERSION: ${{ steps.tag_version.outputs.version }}
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           files: release-assets/*
           name: Release v${{ steps.tag_version.outputs.version }}

.github/workflows/snap-release.yml

@@ -20,10 +20,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 24.x
           cache: npm
@@ -64,7 +64,7 @@ jobs:
           echo "Snap file: $SNAP_FILE"
 
       - name: Upload snap artifact to GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           files: ${{ steps.snap_file.outputs.file }}
         env:

CONTRIBUTING.md

@@ -215,7 +215,7 @@ User-facing README download examples should use the same version as `package.jso
 
 ```sh
 IPB_NO_UPDATE_CHECK=1 npm run tapes
-# runs scripts/tapes.sh — requires VHS and a built CLI
+# builds, npm links local ipb, then runs scripts/tapes.sh — requires VHS
 ```
 
 Regenerate assets under `assets/` when UX of recorded commands changes meaningfully.

README.md

@@ -137,28 +137,28 @@ macOS:
 
 ```sh
 # Apple Silicon
-curl -L https://github.com/devinpearson/ipb/releases/download/v0.8.4/ipb-macos-arm64 -o ipb
+curl -L https://github.com/devinpearson/ipb/releases/download/v0.9.0/ipb-macos-arm64 -o ipb
 chmod +x ipb
 sudo mv ipb /usr/local/bin/
 
 # Intel
-curl -L https://github.com/devinpearson/ipb/releases/download/v0.8.4/ipb-macos-x64 -o ipb
+curl -L https://github.com/devinpearson/ipb/releases/download/v0.9.0/ipb-macos-x64 -o ipb
 chmod +x ipb
 sudo mv ipb /usr/local/bin/
 ```
 
 Linux (.deb):
 
 ```sh
-wget https://github.com/devinpearson/ipb/releases/download/v0.8.4/ipb_0.8.4_amd64.deb
-sudo dpkg -i ipb_0.8.4_amd64.deb
+wget https://github.com/devinpearson/ipb/releases/download/v0.9.0/ipb_0.9.0_amd64.deb
+sudo dpkg -i ipb_0.9.0_amd64.deb
 sudo apt-get install -f
 ```
 
 Linux binary:
 
 ```sh
-curl -L https://github.com/devinpearson/ipb/releases/download/v0.8.4/ipb-linux-x64 -o ipb
+curl -L https://github.com/devinpearson/ipb/releases/download/v0.9.0/ipb-linux-x64 -o ipb
 # or: ipb-linux-arm64
 chmod +x ipb
 sudo mv ipb /usr/local/bin/

package.json

@@ -1,6 +1,6 @@
 {
   "name": "investec-ipb",
-  "version": "0.8.4",
+  "version": "0.9.0",
   "main": "bin/index.js",
   "bin": {
     "ipb": "./bin/index.js"
@@ -9,7 +9,7 @@
   "scripts": {
     "build": "npm run clean && tsc && npm run copy-files",
     "clean": "rimraf ./bin",
-    "copy-files": "cp -r ./templates/ ./bin/templates/ && cp -r ./assets/ ./bin/assets/ && cp instructions.txt ./bin/instructions.txt",
+    "copy-files": "cp -r ./templates/ ./bin/templates/ && cp -r ./assets/ ./bin/assets/ && cp instructions.txt ./bin/instructions.txt && chmod +x ./bin/index.js",
     "test": "vitest",
     "test:run": "vitest --run",
     "lint": "biome check .",
@@ -23,7 +23,7 @@
     "ci": "npm run build && npm run type-check && npm run lint && npm run lint:md && npm run format:check && npm run test:run && npm audit",
     "verify:ci": "npm run build && npm run test:run && npm run bundle",
     "dev": "vitest",
-    "tapes": "./scripts/tapes.sh",
+    "tapes": "npm run build && chmod +x ./bin/index.js && npm link && ./scripts/tapes.sh",
     "docs": "npm run build && node bin/index.js docs",
     "docs:source": "node --loader tsx src/cmds/docs.ts",
     "prepublishOnly": "npm run build && npm run docs",

scripts/tapes.sh

@@ -1,21 +1,50 @@
 #!/usr/bin/env bash
+set -euo pipefail
+
+# Ctrl+C / SIGTERM should stop the whole suite, not just the current vhs.
+trap 'printf "\nInterrupted — stopping tape generation.\n" >&2; exit 130' INT TERM
+
 export DEBUG=true
-vhs tapes/cards.tape
-vhs tapes/deploy.tape
-vhs tapes/env.tape
-vhs tapes/fetch.tape
-vhs tapes/logs.tape
-vhs tapes/new.tape
-vhs tapes/publish.tape
-vhs tapes/published.tape
-vhs tapes/run.tape
-vhs tapes/simulate.tape
-vhs tapes/toggle.tape
-vhs tapes/upload-env.tape
-vhs tapes/upload.tape
-vhs tapes/accounts.tape
-vhs tapes/beneficiaries.tape
-vhs tapes/balances.tape
-vhs tapes/transactions.tape
-vhs tapes/pay.tape
-vhs tapes/transfer.tape
+export IPB_NO_UPDATE_CHECK="${IPB_NO_UPDATE_CHECK:-1}"
+
+# npm link points the global `ipb` at ./bin/index.js; tsc emits without +x.
+if [[ ! -x ./bin/index.js ]]; then
+  chmod +x ./bin/index.js
+fi
+if ! command -v ipb >/dev/null 2>&1; then
+  printf 'ipb is not on PATH. Run npm link after building.\n' >&2
+  exit 1
+fi
+if ! ipb --version >/dev/null 2>&1; then
+  printf 'Linked ipb is not executable (permission denied). Fixing ./bin/index.js and retrying.\n' >&2
+  chmod +x ./bin/index.js
+  ipb --version >/dev/null
+fi
+
+tapes=(
+  cards
+  deploy
+  env
+  fetch
+  logs
+  new
+  publish
+  published
+  run
+  simulate
+  toggle
+  upload-env
+  upload
+  accounts
+  beneficiaries
+  balances
+  transactions
+  pay
+  transfer
+)
+
+for name in "${tapes[@]}"; do
+  printf 'Recording tapes/%s.tape...\n' "$name"
+  # Run in foreground process group so SIGINT reaches vhs.
+  vhs "tapes/${name}.tape"
+done

src/cmds/fetch.ts

@@ -20,7 +20,7 @@ interface Options extends CommonOptions {
 /**
  * Fetches saved code from a card and saves it to a file.
  * @param options - CLI options including card key, filename, and API credentials
- * @throws {CliError} When card key is missing, API doesn't support fetching, or file operations fail
+ * @throws {CliError} When card key is missing, API response is unexpected, or file operations fail
  */
 export async function fetchCommand(options: Options) {
   const cardKey = normalizeCardKey(options.cardKey, credentials.cardKey);
@@ -36,17 +36,7 @@ export async function fetchCommand(options: Options) {
   let normalizedFilename = '';
   await withSpinner(spinner, spinnerEnabled, async () => {
     const api = await initializeApi(credentials, options);
-
-    // The api object may not have a getCode method; use getSavedCode if available, or handle gracefully
-    // biome-ignore lint/suspicious/noExplicitAny: API interface may not include all methods
-    if (typeof (api as any).getSavedCode !== 'function') {
-      throw new CliError(
-        ERROR_CODES.UNSUPPORTED_OPERATION,
-        'API client does not support fetching saved code (getSavedCode missing)'
-      );
-    }
-    // biome-ignore lint/suspicious/noExplicitAny: API interface may not include all methods
-    const result = await (api as any).getSavedCode(cardKey);
+    const result = await api.getCode(cardKey);
 
     if (
       !result ||
@@ -60,15 +50,7 @@ export async function fetchCommand(options: Options) {
       );
     }
 
-    const fetchedCode = result.data.result.code;
-    if (typeof fetchedCode !== 'string') {
-      throw new CliError(
-        ERROR_CODES.INVESTEC_API_ERROR,
-        'Failed to fetch code: Unexpected API response'
-      );
-    }
-
-    code = fetchedCode;
+    code = result.data.result.code;
     normalizedFilename = await validateFilePathForWrite(options.filename, ['.js']);
   });
 

src/cmds/pay.ts

@@ -27,7 +27,7 @@ import type { CommonOptions } from './types.js';
 export async function payCommand(
   accountId: string,
   beneficiaryId: string,
-  amount: number,
+  amount: number | string,
   reference: string,
   options: CommonOptions
 ) {
@@ -45,11 +45,11 @@ export async function payCommand(
     throw new CliError(ERROR_CODES.INVALID_INPUT, 'Beneficiary ID is required');
   }
 
+  // Commander passes args as strings; coerce before validation/formatting.
   if (!amount) {
-    const amt = await input({ message: 'Enter amount (in rands):' });
-    amount = parseFloat(amt);
+    amount = await input({ message: 'Enter amount (in rands):' });
   }
-  validateAmount(amount);
+  amount = validateAmount(amount);
 
   if (!reference) {
     reference = await input({ message: 'Enter reference for the payment:' });

src/cmds/transfer.ts

@@ -25,7 +25,7 @@ import type { CommonOptions } from './types.js';
 export async function transferCommand(
   accountId: string,
   beneficiaryAccountId: string,
-  amount: number,
+  amount: number | string,
   reference: string,
   options: CommonOptions
 ) {
@@ -42,11 +42,11 @@ export async function transferCommand(
   }
   validateAccountId(beneficiaryAccountId);
 
+  // Commander passes args as strings; coerce before validation/formatting.
   if (!amount) {
-    const amt = await input({ message: 'Enter amount (in rands):' });
-    amount = parseFloat(amt);
+    amount = await input({ message: 'Enter amount (in rands):' });
   }
-  validateAmount(amount);
+  amount = validateAmount(amount);
 
   if (!reference) {
     reference = await input({ message: 'Enter reference for the transfer:' });

src/utils/input-validation.ts

@@ -1,25 +1,40 @@
 import { CliError, ERROR_CODES } from '../errors.js';
 
-export function validateAmount(amount: number, maxDecimals = 2): void {
-  if (Number.isNaN(amount)) {
+/**
+ * Validates a monetary amount and returns it as a number.
+ * Accepts CLI string args (Commander always passes strings) or numbers.
+ * @param amount - Amount in rands
+ * @param maxDecimals - Maximum allowed fractional digits
+ * @returns Parsed finite positive amount
+ */
+export function validateAmount(amount: number | string, maxDecimals = 2): number {
+  if (typeof amount === 'string' && amount.trim() === '') {
     throw new CliError(ERROR_CODES.INVALID_INPUT, 'Amount must be a valid number');
   }
 
-  if (amount <= 0) {
+  const value = typeof amount === 'string' ? Number(amount.trim()) : Number(amount);
+
+  if (Number.isNaN(value)) {
+    throw new CliError(ERROR_CODES.INVALID_INPUT, 'Amount must be a valid number');
+  }
+
+  if (value <= 0) {
     throw new CliError(ERROR_CODES.INVALID_INPUT, 'Amount must be positive');
   }
 
-  if (!Number.isFinite(amount)) {
+  if (!Number.isFinite(value)) {
     throw new CliError(ERROR_CODES.INVALID_INPUT, 'Amount must be a finite number');
   }
 
-  const decimalPlaces = (amount.toString().split('.')[1] || '').length;
+  const decimalPlaces = (value.toString().split('.')[1] || '').length;
   if (decimalPlaces > maxDecimals) {
     throw new CliError(
       ERROR_CODES.INVALID_INPUT,
       `Amount can have at most ${maxDecimals} decimal place${maxDecimals === 1 ? '' : 's'}. Found ${decimalPlaces} decimal place${decimalPlaces === 1 ? '' : 's'}.`
     );
   }
+
+  return value;
 }
 
 export function validateAccountId(accountId: string): void {