@north-light/api 0.3.420 → 0.3.422

package/dist/api/error-codes.d.ts

@@ -4,6 +4,11 @@ export declare const errorCodes: {
         readonly status: 401;
         readonly retryable: false;
     };
+    readonly machine_revoked: {
+        readonly type: "authentication_error";
+        readonly status: 401;
+        readonly retryable: false;
+    };
     readonly grant_revoked: {
         readonly type: "authentication_error";
         readonly status: 401;
@@ -79,6 +84,11 @@ export declare const errorCodes: {
         readonly status: 403;
         readonly retryable: false;
     };
+    readonly unsandboxed_machine: {
+        readonly type: "permission_error";
+        readonly status: 403;
+        readonly retryable: false;
+    };
     readonly isolated_run: {
         readonly type: "permission_error";
         readonly status: 403;

package/dist/api/error-codes.js

@@ -3,6 +3,8 @@
 // shape (provider_error, usage, stream_*) do not have a fixed tuple.
 export const errorCodes = {
     unauthorized: { type: 'authentication_error', status: 401, retryable: false },
+    // The directory no longer recognises this machine's runtime key: it was removed from the account.
+    machine_revoked: { type: 'authentication_error', status: 401, retryable: false },
     // A refusal that names no reason (runtime validation step 5, or the directory's bare invalid_grant). Not deprecated.
     grant_revoked: { type: 'authentication_error', status: 401, retryable: false },
     // The directory's reasons for refusing a refresh token (D2-ERR-49..51), carried in its invalid_grant error_description.
@@ -21,6 +23,8 @@ export const errorCodes = {
     // An app refusing its own operation because a provider in its `requires` is not `ready`; details `{ provider, state, message?, next }`, copied from `grant.get`'s `dependencies[provider]` entry (`next` = `<issuer>/connect/setup/<provider>?client_id=<grantee>`). The daemon never raises it (it only carries `dependencies`).
     provider_setup_pending: { type: 'permission_error', status: 403, retryable: false },
     question_pages_off: { type: 'permission_error', status: 403, retryable: false },
+    // An unsandboxed machine (a computer joined to a Northlight account) runs only the person's own terminal agents; app grantees run on the hosted machine.
+    unsandboxed_machine: { type: 'permission_error', status: 403, retryable: false },
     isolated_run: { type: 'permission_error', status: 403, retryable: false },
     provider_version_retired: { type: 'permission_error', status: 403, retryable: false },
     invalid_scope: { type: 'invalid_request_error', status: 400, retryable: false },

package/dist/types.d.ts

@@ -388,10 +388,12 @@ export interface ScopeConfig {
     runtime?: {
         issuer: string;
         audience: string;
-        listener: {
+        listener?: {
             address: string;
             port: number;
         };
+        /** Set by joining as a non-default machine: no app listener; only `app:terminal` nodes run. */
+        unsandboxed?: boolean;
         jwksUrl?: string;
         person_uids?: number[];
         /** Hosting file storage: `service_url` is the storage token audience and API

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/api",
-  "version": "0.3.420",
+  "version": "0.3.422",
   "description": "Typed crtrd /v1 API contract — DTOs, route builders, the error contract, the CrtrClient, and the command-plugin manifest format. Zero runtime dependencies.",
   "type": "module",
   "main": "./dist/api/index.js",