@theokit/sdk 4.47.0 → 4.49.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 4.49.0
+
+### Minor Changes
+
+- d0d62bd: Add `auditEnvReachability`: report config keys with no environment path and no documented opt-out, and opt-outs that no longer exempt anything.
+
+## 4.48.0
+
+### Minor Changes
+
+- d9ddcbe: Add `recordWiring`: report which project entities a build requested, which it wired, and which a trust posture withheld — derived from the values handed to the builder rather than from re-reading configuration.
+
 ## 4.47.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -661,6 +661,17 @@ var SkillReadTool = class {
   }
 };
 
+// src/env-reachability.ts
+function auditEnvReachability(input) {
+  const reachable = new Set(input.reachable);
+  const exempt = new Set(input.optOuts.map((o) => o.key));
+  const declared = new Set(input.keys);
+  return {
+    unreachable: input.keys.filter((k) => !reachable.has(k) && !exempt.has(k)),
+    staleOptOuts: input.optOuts.filter((o) => !declared.has(o.key) || reachable.has(o.key)).map((o) => o.key)
+  };
+}
+
 // src/event-bus.ts
 var EventBus = class {
   handlers = /* @__PURE__ */ new Map();
@@ -2197,6 +2208,29 @@ function resolveTrustPosture(input) {
   return { level, source, allows };
 }
 
+// src/wiring-record.ts
+var UngatedCapabilityError = class extends chunkYULF6FPB_cjs.TheokitAgentError {
+  name = "UngatedCapabilityError";
+};
+function recordWiring(input) {
+  const record = {};
+  for (const [capability, requested] of Object.entries(input.requested)) {
+    const allowed = input.posture.allows[capability];
+    if (allowed === void 0) {
+      throw new UngatedCapabilityError(
+        `capability \`${capability}\` was recorded as wired but the posture does not gate it; gated capabilities are: ${Object.keys(input.posture.allows).join(", ") || "(none)"}`
+      );
+    }
+    record[capability] = {
+      // Copied, not aliased. See the @returns note.
+      active: allowed ? [...requested] : [],
+      requested: [...requested],
+      suppressedByTrust: !allowed && requested.length > 0
+    };
+  }
+  return record;
+}
+
 Object.defineProperty(exports, "GOAL_CONTINUATION_MARKER", {
   enumerable: true,
   get: function () { return chunkOBA6YK2R_cjs.GOAL_CONTINUATION_MARKER; }
@@ -2344,9 +2378,11 @@ exports.Squad = Squad;
 exports.Task = Task;
 exports.Theokit = Theokit;
 exports.TokenLimiter = TokenLimiter;
+exports.UngatedCapabilityError = UngatedCapabilityError;
 exports.UnicodeNormalizer = UnicodeNormalizer;
 exports.applyMode = applyMode;
 exports.applySecurityFloor = applySecurityFloor;
+exports.auditEnvReachability = auditEnvReachability;
 exports.chargeAndCheckThresholds = chargeAndCheckThresholds;
 exports.createCounterBudgetTracker = createCounterBudgetTracker;
 exports.estimateTokens = estimateTokens;
@@ -2359,6 +2395,7 @@ exports.mkMemoryId = mkMemoryId;
 exports.normalizeSchema = normalizeSchema;
 exports.normalizeUsage = normalizeUsage;
 exports.preflightCheck = preflightCheck;
+exports.recordWiring = recordWiring;
 exports.resolveTrustPosture = resolveTrustPosture;
 exports.runGoalLoop = runGoalLoop;
 exports.scopedConversationId = scopedConversationId;