v6.11.3

Patch Changes

• 4aed829: SMOODEV-1527: Fix the eso-refresher exiting immediately after its initial mint (it unref()'d the interval timer, and a pending await new Promise(() => {}) doesn't hold Node's event loop open — so the process exited 0 → CrashLoopBackOff). The production interval now keeps the daemon alive; tests inject their own scheduler so they're unaffected.

v6.11.2

Patch Changes

• 52b574a: SMOODEV-2389: Mobile SDK parity fixes (ADR-074 / Mobile-Runtime-Mode-Spec). Swift: publicValue(forKey:) is now truly synchronous (spec row 2) — SmooConfig is a lock-guarded class instead of an actor, the structural twin of the Kotlin SDK. Both SDKs: evaluateLimit gains step (snaps to the nearest multiple before the [min, max] clamp, matching TS clampLimit / Rust clamp_limit per ADR-066), and evaluate failures now throw typed errors carrying the key (featureFlagNotFound/featureFlagContext/featureFlagEvaluation + limit* siblings in Swift; FeatureFlagNotFoundException et al. in Kotlin) so callers can branch on 404/400/5xx without parsing messages. Kotlin: SmooConfig is now Closeable (releases the Ktor client).

v6.11.1

Patch Changes

• 7f28077: SMOODEV-2382 (ADR-074): mobile SDK consumption enablers — root Package.swift (SPM resolves only at repo root; consumers pin a revision) and jitpack.yml + maven-publish for the Kotlin SDK (com.github.SmooAI:config:<sha> via JitPack; Maven Central under ai.smoo is the durable follow-up). Also sweeps doc/code references ADR-073 → ADR-074 (073 was claimed by a parallel workstream).

v6.11.0

Minor Changes

• a17d3a6: SMOODEV-2381 (ADR-073): Kotlin SDK (/kotlin, ai.smoo:smooai-config) — the Kotlin/Android twin of the Swift mobile runtime mode. Same parity contract (docs/Mobile-Runtime-Mode-Spec.md): baked public bundle + live user-JWT flag/limit evaluation, offline-safe chains, caller-injected Ktor engine, pure-Kotlin JVM (no Android SDK).

v6.10.0

Minor Changes

• 007c75d: SMOODEV-2380 (ADR-073): Swift SDK (/swift, SPM package SmooAIConfig) — the first mobile runtime mode implementation. Baked public-config bundle + live user-JWT flag/limit evaluation against the /config/app/* surface, offline-safe read chains, zero dependencies. Parity contract: docs/Mobile-Runtime-Mode-Spec.md.

v6.9.0

Minor Changes

• 6377b67: SMOODEV-2306: Add limits — a fourth config kind. A limit is a numeric,
  segment-resolved, clamp-aware value that resolves live through the same server
  segment evaluator as feature flags (never baked) and tunes a soft target
  within a client-applied [min, max] clamp.

  • Schema: defineConfig({ limitsSchema }) + defineLimit({ default, min, max, step }), exposing LimitKeys + _limitsMeta, serialized as bounded JSON-Schema number nodes.
  • TS client: ConfigClient.evaluateLimit, createLimitEvaluator, getClientLimit, clampLimit, and a limit tier (getLimit sync + evaluateLimit async, clamped) on buildClientConfig / buildConfig.
  • Polyglot parity (mirroring the feature-flag evaluator): Rust evaluate_limit + clamp_limit, Python evaluate_limit + clamp_limit, Go EvaluateLimit + ClampLimit, .NET EvaluateLimitAsync + LimitSpec.Clamp, each with typed Limit* error types.

  Endpoint contract: POST /organizations/{org_id}/config/limits/{key}/evaluate.

v6.8.0

Minor Changes

• 23e6577: bootstrapFetch now honors a SMOOAI_HARNESS_<KEY> env override (e.g.
  SMOOAI_HARNESS_DATABASE_URL, SMOOAI_HARNESS_RLS_DATABASE_URL) that
  short-circuits the HTTP fetch entirely — the same §15 escape hatch
  packages/db drizzleClient.resolveDbUrl already honors at runtime. This makes
  the prod-script override work uniformly across ALL cold-start config consumers
  (db-migrate and friends), not just the runtime drizzle client. Previously
  bootstrapFetch ignored the override and fell through to env='development'
  when no SST stage was set, silently fetching the wrong environment's value.

v6.7.0

Minor Changes

• ad2c77f: SMOODEV-1526: Port the ESO manifest generator (buildClusterSecretStore + buildExternalSecret) to the Go, Python, Rust, and C# SDKs for language parity with the TypeScript reference. Each emits the same ClusterSecretStore (webhook → real api.smoo.ai config-values endpoint) and per-workload ExternalSecret (secret-tier config keys → UPPER_SNAKE_CASE env vars, with overrides + duplicate guard), using each language's native snakecase util. Epic SMOODEV-1522.
• ad2c77f: SMOODEV-1526: Port the ESO bearer-token refresher core (the refresh algorithm + SecretWriter abstraction) to the Go, Python, Rust, and C# SDKs for parity with the TypeScript reference. Each mirrors the same behavior — invalidate-then-mint each cycle so the bootstrap Secret always holds a near-full-TTL token, fail-loud initial write, non-fatal loop-tick retries — driven by the language's own TokenProvider and unit-tested with a fake writer (no live cluster). The k8s-backed writer is intentionally an optional adapter so base SDK consumers don't pull a heavy k8s client; the TypeScript sidecar remains the canonical deployable. Epic SMOODEV-1522.

v6.6.0

Minor Changes

• bb64793: SMOODEV-1524: Add an ESO manifest generator (@smooai/config/eso-manifests). buildClusterSecretStore() emits a ClusterSecretStore whose webhook provider points at the real api.smoo.ai config-values endpoint (org + environment baked in, bearer from the bootstrap Secret the eso-refresher keeps fresh), and buildExternalSecret() emits a per-workload ExternalSecret mapping secret-tier config keys to env-var names (UPPER_SNAKE_CASE by default, with per-key overrides like DASHSCOPE_API_KEY ← alibabaModelStudioApiKey). Replaces the hand-maintained ESO YAML and makes ESO sync a first-class output of the config system. Epic SMOODEV-1522.

v6.5.0

Minor Changes

• 8fe21bd: SMOODEV-1523: Add an ESO bearer-token refresher (@smooai/config/eso-refresher + smooai-config-eso-refresher bin). It re-mints the OAuth2 client_credentials access token on a short interval (reusing TokenProvider) and writes it into the ExternalSecrets bootstrap Kubernetes Secret, so ESO's webhook provider always reads a fresh, non-expired bearer. This is what lets workload secrets sync via ESO instead of being Pulumi-baked at SST deploy time — decoupling @smooai/config secret-value changes from the ~1h platform deploy (epic SMOODEV-1522).