@north-light/api 0.3.514 → 0.3.518

package/dist/api/contract.d.ts

@@ -1,5 +1,5 @@
 /** The contract level this build serves and requires. Written by `scripts/contract.mjs release`; never edit by hand. */
-export declare const CONTRACT_LEVEL = "1.23";
+export declare const CONTRACT_LEVEL = "1.24";
 /** Request header naming the one contract level the caller needs, e.g. `1.3`. Optional: absent means no check. */
 export declare const REQUIRED_CONTRACT_HEADER = "Crouter-Required-Contract";
 /** Response header listing the contract levels the server serves, comma-separated, one per major, e.g. `1.3`. */

package/dist/api/contract.js

@@ -12,7 +12,7 @@
 //
 // PURITY (spec §3.1): Node built-ins + `src/api/*` only.
 /** The contract level this build serves and requires. Written by `scripts/contract.mjs release`; never edit by hand. */
-export const CONTRACT_LEVEL = '1.23';
+export const CONTRACT_LEVEL = '1.24';
 /** Request header naming the one contract level the caller needs, e.g. `1.3`. Optional: absent means no check. */
 export const REQUIRED_CONTRACT_HEADER = 'Crouter-Required-Contract';
 /** Response header listing the contract levels the server serves, comma-separated, one per major, e.g. `1.3`. */

package/dist/core/command-plugins/bundle.js

@@ -15,7 +15,8 @@ const PROVIDER_ID = /^[A-Za-z0-9_-]{1,64}$/;
 const PROVIDER_KEYS = new Set(['id', 'major', 'groups']);
 const PROVIDER_GROUP_KEYS = new Set(['group', 'consent_line', 'rate', 'who', 'allowlist']);
 const PROVIDER_WHO = new Set(['own', 'user', 'allowlist', 'any']);
-const BUNDLE_KEYS = new Set(['bundleVersion', 'kinds', 'page_components', 'memory_extensions', 'version', 'transport', 'provider', 'object_kinds', 'scopes']);
+// `groups` is a provider archive's tool-group declaration (consent lines, `who`); only the directory reads it, so an install accepts the key and ignores it.
+const BUNDLE_KEYS = new Set(['bundleVersion', 'kinds', 'page_components', 'memory_extensions', 'version', 'transport', 'provider', 'object_kinds', 'scopes', 'groups']);
 function issue(code, message, received, expected, next, path) {
     return { code, message, received, expected, next, ...(path !== undefined ? { path } : {}) };
 }
@@ -276,7 +277,7 @@ function parseBundleMetadata(bytes) {
     const unknownKeys = Object.keys(record).filter((key) => !BUNDLE_KEYS.has(key));
     if (record['bundleVersion'] !== 1 || unknownKeys.length > 0) {
         return {
-            issue: bundleInvalid('bundle.json must contain bundleVersion 1 and at most version, transport, provider, kinds, page_components, memory_extensions, object_kinds, and scopes', JSON.stringify(raw), 'an object with bundleVersion set to 1 and optional version, transport, provider, kinds, page_components, memory_extensions, object_kinds, and scopes', 'Set bundle.json to {"bundleVersion":1} plus optional contribution blocks.', 'bundle.json'),
+            issue: bundleInvalid('bundle.json must contain bundleVersion 1 and at most version, transport, provider, kinds, page_components, memory_extensions, object_kinds, scopes, and groups', JSON.stringify(raw), 'an object with bundleVersion set to 1 and optional version, transport, provider, kinds, page_components, memory_extensions, object_kinds, scopes, and groups', 'Set bundle.json to {"bundleVersion":1} plus optional contribution blocks.', 'bundle.json'),
         };
     }
     // Install-time strictness: a bad block fails the install loudly here, because

package/dist/core/profiles/env-store.d.ts

@@ -1,4 +1,7 @@
 export declare function isReservedEnvName(name: string): boolean;
+/** The app env store's reservation: `isReservedEnvName` minus the admitted
+ *  deployment names. Both its write and read paths use this one rule. */
+export declare function isReservedAppEnvName(name: string): boolean;
 /** Every stored variable NAME for a profile, sorted. Never returns values. */
 export declare function listProfileEnvNames(profileId: string): string[];
 /** Set one variable, replacing any prior value under the same name. Holds the

package/dist/core/profiles/env-store.js

@@ -24,12 +24,25 @@ import { notFound, usage } from '../errors.js';
  *  read (`readStoreUnlocked`, which every reader — list/set/remove/inject —
  *  goes through), so even a reserved name that reached disk some other way
  *  (hand-edited file, a pre-reservation write) is uniformly invisible rather
- *  than trusted. */
+ *  than trusted.
+ *
+ *  Exception, app env store only (`isReservedAppEnvName`): the two names in
+ *  `APP_ENV_ADMITTED_CRTR_NAMES`. They are crtr-owned deployment settings (where
+ *  `crtr sys feedback` posts, and its bearer token) that must reach every node
+ *  of the app, and neither can redirect a broker's home, canvas or identity.
+ *  They are app-wide deployment config, so the per-profile store still refuses
+ *  them. */
 const RESERVED_ENV_PREFIX = 'CRTR_';
 const RESERVED_ENV_EXACT_NAMES = new Set(['HOME']);
+const APP_ENV_ADMITTED_CRTR_NAMES = new Set(['CRTR_FEEDBACK_ENDPOINT', 'CRTR_FEEDBACK_TOKEN']);
 export function isReservedEnvName(name) {
     return name.startsWith(RESERVED_ENV_PREFIX) || RESERVED_ENV_EXACT_NAMES.has(name);
 }
+/** The app env store's reservation: `isReservedEnvName` minus the admitted
+ *  deployment names. Both its write and read paths use this one rule. */
+export function isReservedAppEnvName(name) {
+    return isReservedEnvName(name) && !APP_ENV_ADMITTED_CRTR_NAMES.has(name);
+}
 /** NUL is the one byte no OS accepts in an env value — Node's own `spawn`
  *  rejects it synchronously and echoes the full value in the thrown error, so
  *  it must never reach storage or a spawn call. */

package/dist/shared/env.d.ts

@@ -85,6 +85,11 @@ export declare function envPiBinaryOverride(): string | undefined;
 /** Whether implicit daemon autostart is suppressed for this invocation
  *  (`CRTR_NO_DAEMON_AUTOSTART=1`). */
 export declare function envNoDaemonAutostart(): boolean;
+/** Port override for crtrd's localhost document listener (`CRTR_DOCUMENT_PORT`),
+ *  ahead of the `document_port` user setting. The test lanes set `0` so a daemon
+ *  under test binds an OS-picked port and never holds the real daemon's port.
+ *  Undefined when unset or not an integer from 0 to 65535. */
+export declare function envDocumentPort(): number | undefined;
 /** The `--tcp` fallback for crtrd's opt-in TCP listener (`CRTRD_TCP`), raw
  *  (`host:port` or undefined — absent means unix socket only). */
 export declare function envCrtrdTcp(): string | undefined;

package/dist/shared/env.js

@@ -221,6 +221,17 @@ export function envPiBinaryOverride() {
 export function envNoDaemonAutostart() {
     return process.env['CRTR_NO_DAEMON_AUTOSTART'] === '1';
 }
+/** Port override for crtrd's localhost document listener (`CRTR_DOCUMENT_PORT`),
+ *  ahead of the `document_port` user setting. The test lanes set `0` so a daemon
+ *  under test binds an OS-picked port and never holds the real daemon's port.
+ *  Undefined when unset or not an integer from 0 to 65535. */
+export function envDocumentPort() {
+    const raw = process.env['CRTR_DOCUMENT_PORT'];
+    if (raw === undefined || !/^\d+$/.test(raw))
+        return undefined;
+    const port = Number(raw);
+    return port <= 65535 ? port : undefined;
+}
 /** The `--tcp` fallback for crtrd's opt-in TCP listener (`CRTRD_TCP`), raw
  *  (`host:port` or undefined — absent means unix socket only). */
 export function envCrtrdTcp() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/api",
-  "version": "0.3.514",
+  "version": "0.3.518",
   "description": "Typed crtrd /v1 API contract — DTOs, route builders, the error contract, the CrtrClient, and the command-plugin manifest format. Zero runtime dependencies.",
   "type": "module",
   "main": "./dist/api/index.js",