@consciousclouds/access 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to `@consciousclouds/access` are documented here.
 
+## 0.1.2
+
+- No API change. Republished so that the bytes on the registry reproduce from the committed tree and are
+  pinned by the published-byte digest gate (`scripts/sdk_packed_digest.py`). 0.1.1's immutable bytes differ
+  from the source that followed it by one comment, which no gate could see because no digest was recorded;
+  from this release the packed contents are pinned per version and CI refuses a source change that would
+  diverge from what was published.
+
+## 0.1.1
+
+- Fail-closed repair: `decodeURIComponent` sat outside every guard, so a malformed cookie threw `URIError` out
+  of every server-side entry point instead of denying. Packaging repair: the `capability-sdk` dependency was
+  `workspace:*`, which would have shipped an uninstallable tarball. No API change.
+
 ## 0.1.0
 
 - Initial release. The policy-free Access SDK for the Control Plane's operator

package/dist/server/index.js

@@ -16,8 +16,8 @@ const EMPTY_SCOPE = { project: '', environment: '' };
  * Pull one cookie value out of a raw `Cookie:` header.
  *
  * FAIL-CLOSED ON A MALFORMED VALUE. `decodeURIComponent` THROWS a URIError on an invalid percent-escape, and a
- * cookie header is attacker-influenced input: a request carrying `cc=%` made identity, session and can all
- * throw rather than deny, which turns a fail-closed adapter into a 500 — and a crash is not a denial. A value
+ * cookie header is attacker-influenced input: a request carrying `cc=%` made every entry point below throw
+ * rather than deny, which turns a fail-closed adapter into a 500 — and a crash is not a denial. A value
  * that cannot be decoded is not a credential, so it reads as ABSENT, which is exactly the state every caller
  * already handles.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consciousclouds/access",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Conscious Clouds Access SDK \u2014 the thin, policy-free client for the Control Plane's operator identity + Access surface. Types (root) + isomorphic HTTP wrappers (/client) + a request-bound fail-closed BFF adapter (/server) + React hooks & AccessProvider (/react). Reuses the `Capability` `<primitive>.<verb>` vocabulary and the operator-shell's allowed|denied|unknown decision union. NO policy logic \u2014 every decision is the Control Plane's; the SDK only asks the five operating questions and enforces the answers (fail-closed).",
   "license": "Apache-2.0",
   "type": "module",