@theokit/sdk 4.44.0 → 4.45.0

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 4.45.0
+
+### Minor Changes
+
+- f9a29f5: `applySecurityFloor` — a lower-trust configuration layer may tighten a security setting, never loosen it.
+
+  Layered configuration usually resolves last-wins, and for the keys that decide confinement that is a
+  hole: a project layer outranks the user's own file, so a cloned repository can hand itself the most
+  permissive sandbox and the operator's global choice loses silently, at the moment the directory is
+  opened. Nothing fails; the confinement is simply gone.
+
+  The rule is generic and the vocabulary is not, so the vocabulary is parameters: which values count
+  as more permissive, which layers are restricted, and which layer is the operator's explicit
+  override. A second product supplies its own without inheriting the first's words.
+
+  The override is returned verbatim even when outside the vocabulary — validating the operator's flag
+  is the consumer's job, and silently dropping an unrecognised one is worse than passing it through. A
+  value outside the vocabulary in a RESTRICTED layer is ignored instead: a typo in a repository's
+  config must neither become the effective setting nor read as maximally permissive.
+
+  Additive. Nothing calls it yet.
+
+## 4.44.1
+
+### Patch Changes
+
+- 0cabe27: `pnpm release` now verifies its tags reached the remote instead of trusting an exit code.
+
+  `changeset publish` creates one annotated tag per published package and pushes them, then reports
+  success on its own exit code — and an exit code is not evidence a ref transferred.
+
+  Measured 2026-08-11: `git push` contacts the remote BEFORE `pre-push` runs, `pre-push` runs the full
+  `pnpm validate` for around eleven minutes, and by the time the transfer begins the server has
+  dropped the idle connection. Git dies of SIGPIPE (exit 141) silently — no error text, nothing
+  transferred, output ending in `✓ pre-push gates passed`. A missing release tag is not noticed that
+  day; it is noticed weeks later by whoever is bisecting.
+
+  `scripts/verify-release-refs.mjs` compares the tags at a revision against `git ls-remote`, and is
+  wired into `pnpm release` after `changeset publish` rather than offered as a wrapper — a wrapper
+  only helps whoever remembers to call it.
+
+  Three distinct exit codes, because collapsing them is the failure being removed: `0` verified,
+  `1` a tag never reached the remote, `2` could not check (unreachable remote, or a revision that does
+  not resolve).
+
 ## 4.44.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -1621,6 +1621,39 @@ var Security = class {
   }
 };
 
+// src/security-floor.ts
+function permissivenessOf(order, value) {
+  if (value === void 0) return -1;
+  return order.indexOf(value);
+}
+function baseline(input) {
+  const { restricted, override, layers } = input;
+  let value;
+  for (const [name, candidate] of Object.entries(layers)) {
+    if (name === override || restricted.includes(name)) continue;
+    if (candidate !== void 0) value = candidate;
+  }
+  return value;
+}
+function tightenOnly(input, start) {
+  const { permissiveness, restricted, layers } = input;
+  let resolved = start;
+  let ceiling = permissivenessOf(permissiveness, start);
+  for (const layer of restricted) {
+    const candidate = layers[layer];
+    if (candidate === void 0) continue;
+    const level = permissivenessOf(permissiveness, candidate);
+    if (level < 0) continue;
+    if (ceiling >= 0 && level > ceiling) continue;
+    resolved = candidate;
+    ceiling = level;
+  }
+  return resolved;
+}
+function applySecurityFloor(input) {
+  return input.layers[input.override] ?? tightenOnly(input, baseline(input));
+}
+
 // src/session-scope.ts
 function scopedConversationId(scope, id) {
   return `${scope}__${id}`;
@@ -2267,6 +2300,7 @@ exports.Theokit = Theokit;
 exports.TokenLimiter = TokenLimiter;
 exports.UnicodeNormalizer = UnicodeNormalizer;
 exports.applyMode = applyMode;
+exports.applySecurityFloor = applySecurityFloor;
 exports.chargeAndCheckThresholds = chargeAndCheckThresholds;
 exports.createCounterBudgetTracker = createCounterBudgetTracker;
 exports.estimateTokens = estimateTokens;