v0.8.0 — File-upload P1 fix + multi-file/stdin file --set + writable board_relation/dependency settings (M49 + M46 + M47 + M48)

The release whose headline is a fix, not a feature: M49 repairs the file-upload wire format. Published 0.7.0 (and every release back to v0.4-M31) shipped the Apollo GraphQL multipart-request spec (operations / map / numbered parts), which live Monday rejects — so monday item upload, monday update upload, and every friendly file --set was broken against the real API for five milestones (M31 / M38 / M42 / M43 / M46) while the test suite stayed green against a fixture asserting the wrong wire shape. 0.8.0 emits Monday's native multipart shape (query + a sibling variables field + a string-encoded map + a named file part, POSTed to /v2/file) and is the first release where file uploads actually work against live Monday — live-verified via a RUN_LIVE_TESTS-gated upload smoke test. If you use any file upload, upgrade from 0.7.0.

On top of the fix, three feature folds close long-standing deferrals: multi-file --set per call (M46, closes v0.6-M38 D2), stdin file --set <file-col>=- (M47, closes v0.6-M38 D7), and writable create-time board_relation / dependency column settings (M48). Plus an internal src/api/ error-decoration refactor cluster. No breaking changes vs 0.7.0 — every v0.8 surface is additive; the output envelope and 29 stable error codes are unchanged. Built incrementally as M49 + the refactor cluster + M46 + M47 + M48.

Re-scope 2026-05-21. v0.8 re-scoped from its original SKELETON (Monday API 2026-07 pin + user-entity migration M44 + user activity M45) to stay on API 2026-01 and ship the v0.6/v0.7 carve-out folds — mirroring the v0.7 pivot. @mondaydotcomorg/api is still pinned at 14.0.0 (baking 2026-01); no SDK 15.x (2026-04) or 16.x (2026-07) has published, so M44 / M45 + the v0.7-deferred M39 / M40 / M41 cluster defer to a future release.

Breaking changes vs 0.7.0

None. Every command, error code, envelope key, and warning shape shipped in 0.7.0 is preserved. v0.8 only adds (and fixes the upload wire shape — a fix that makes previously-broken uploads work, not a contract change).

Surface

117 commands shipped (unchanged from v0.7). M46 / M47 / M48 extend existing verbs rather than adding noun namespaces.

🚨 M49 — file-upload wire-format fix

src/api/multipart-transport.ts now POSTs Monday's native multipart shape to /v2/file: a query field, a sibling variables field, a string-encoded map (not the Apollo nested-object form), and the file under a named part. The bug never surfaced in tests because the mocked multipart fixture validated operationName + filename + variables but never the form structure — so it accepted a request the live wire would 4xx. The fix backs the corrected fixture with a RUN_LIVE_TESTS-gated live smoke test. No command surface, flag, or envelope change — the same item upload / update upload / file --set calls now succeed live instead of failing.

M46 — multi-file --set per call

monday item update (single + bulk) + monday item create accept multiple --set <file-col>=<path> entries per call, firing N sequential add_file_to_column legs per item with a per-leg partial-failure accumulator. Three operation-discriminated envelopes (add_files_to_columns / item_update_bulk_file_set_multi / item_create_with_files). Lifts v0.6-M38's single-file gate (closes D2).

M47 — stdin file --set <file-col>=-

A bare - file --set value sources the upload from stdin on item set / item update <iid> / item create — single-file, single-target (stdin is one non-replayable stream; not available on bulk --where). --filename <name> names the multipart part (default blob, MIME sniffed from the filename); an empty pipe rejects usage_error.details.reason: "stdin_file_empty". item create reads stdin before leg-1 so an empty pipe never orphans a created item (closes D7).

M48 — writable board_relation / dependency create-time settings

monday board column-create --type board_relation --settings '{"boardIds":[123,456]}' (ints, coerced from JSON ints or numeric strings with a Number.isSafeInteger guard). dependency is same-board only and takes {"allowMultipleItems"?:bool} (a boardIds / boardId key on dependency rejects with usage_error.details.rejected_keys). On the wire these two types wrap settings under defaults: {settings: {…}}; status / dropdown / numbers pass defaults: settings unwrapped. Wire-only — the dry-run echo and read-side Column.settings_str stay unwrapped.

Upgrade notes

• File uploads now work live. No code or flag change needed — item upload / update upload / file --set calls that silently failed (or 4xx'd) against 0.7.0 succeed on 0.8.0. The single most important reason to upgrade.
• multi_file_set_unsupported (v0.6-M38 D2) DROPPED — M46 picks up multiple file --set entries on update (single + bulk) + create.
• The v0.6-M38 D7 stdin file---set deferral CLOSED — M47 picks up stdin <file-col>=- on set / update-single / create. Bulk --where still rejects stdin (stdin_file_set_on_bulk_unsupported).
• board column-create --type board_relation|dependency --settings now succeeds where it previously had no documented shape (M48); dependency is same-board only.
• Multi-level subitem --parent rejection slips "v0.8" → "v0.9" (5th consecutive slip — Monday's sub_items_board still carries no subtasks column at API 2026-01; v0.8 stayed on 2026-01).
• Stable error-code registry stays at 29. New details.reason discriminator: "stdin_file_empty" (M47).

Tests + quality gates

• 4254 tests pass + 3 skipped (was 4124 + 1 at v0.7.0). The 3 skips: 2 pre-existing + the new RUN_LIVE_TESTS-gated multipart-upload live smoke test (M49). Green on Node 22 + 24.
• Coverage at branches 95.91% / functions 98.97% against the floor 95 / 95.45 / 95 / 95. npm audit reports 0 vulnerabilities (no audit-fix folded this cycle).
• User-facing help-text cleanup: stripped internal design-doc §numbers, milestone/version tags, and a raw GraphQL mutation name from monday help + verb --help so the published surface reads as clean public prose.

Full release notes in CHANGELOG.md.