@north-light/cli 0.3.425 → 0.3.427

package/dist/builtin-memory/crouter-sdk/README.md

@@ -28,16 +28,16 @@ if (run.kind === 'result') console.log(run.output_parsed.root_cause);
 
 ## Go live with an app key
 
-Once you have installed the SDK and tried the local flow in [[crouter-sdk/getting-started]], build against production: [[crouter-sdk/guides/apps-on-crouter-cloud]] takes you from signing up at `https://account.northlight.ai` to a running app on your laptop, registering in the directory console. (`crtr cloud apps register` does the same from a machine joined to your account; production does not yet let a laptop join.) On a joined machine, generate the key and pull the settings with:
+Once you have installed the SDK and tried the local flow in [[crouter-sdk/getting-started]], build against production: [[crouter-sdk/guides/apps-on-crouter-cloud]] takes you from signing up at `https://account.northlight.ai` and joining your laptop (`crtr sys join`) to a running app on your laptop, registered with `crtr cloud apps register`. Generate the key and pull the settings with:
 
 ```bash
 npx @north-light/sdk keygen --app <client id>
 npx @north-light/sdk env --app <client id>
 ```
 
-`keygen` saves the private JWK to `local/app-key.json` (mode `0600`); keep that file out of git. With `--app`, it offers to add the public key to your registered app through your own `crtr`, as an additional key that never replaces the current one. Otherwise, click **Add key** on the app's **Sign-in** tab and paste the public JWK printed on stdout (or paste it under **Register an app** for a new app). An app authenticates only with its key; the directory issues no client secret.
+`keygen` saves the private JWK to `local/app-key.json` (mode `0600`); keep that file out of git. With `--app`, it offers to add the public key to your registered app through your own `crtr`, as an additional key that never replaces the current one. Otherwise, add the public JWK printed on stdout with `crtr cloud apps keys add --app-id <client id> --jwk '<public JWK>'`. An app authenticates only with its key; the directory issues no client secret.
 
-`env` reads the registration through `crtr cloud apps get` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN` into `local/app.env` (`--out` picks another file), keeping every other line. Both commands need this machine's `crtr` joined to your Northlight account; on a machine that isn't, they print a join step and exit 2. On a laptop against production, run `npx @north-light/sdk keygen --out local/app-key.json` without `--app`, paste the public JWK in the console, and write the env file by hand. An app is configured from four variables:
+`env` reads the registration through `crtr cloud apps get` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN` into `local/app.env` (`--out` picks another file), keeping every other line. Both commands need this machine's `crtr` joined to your Northlight account; on a machine that isn't, they print a join step and exit 2. An app is configured from four variables:
 
 | Variable | Value |
 |---|---|
@@ -85,7 +85,7 @@ The directory rejects the key until its public JWK is added to the app. To chang
 | [[crouter-sdk/docker]] | `start()`, `attach()`, `connection()` from `@north-light/env-docker` |
 | [[crouter-sdk/testing]] | `FakeCloud` from `@north-light/sdk/testing`: a fake directory and runtime your real `OAuth2Client` and `Crouter` talk to through `fetch` |
 | [[crouter-sdk/release-notes]] | Behavior changes an existing app must act on, newest first |
-| [[crouter-sdk/guides/apps-on-crouter-cloud]] | Building and registering an app against production (console registration, keys, env file, scopes, running locally, the `crtr cloud apps` commands); typed results from app runs with `runs.parse`, declines, bounding a run, `run_idle`, and waiting on a provider your app requires |
+| [[crouter-sdk/guides/apps-on-crouter-cloud]] | Building and registering an app against production (joining a laptop, `crtr cloud apps` registration, keys, env file, scopes, running locally, the `crtr cloud apps` commands); typed results from app runs with `runs.parse`, declines, bounding a run, `run_idle`, and waiting on a provider your app requires |
 | [[crouter-sdk/guides/apps-with-many-users]] | Per-person runtime connections, app-owned user access, privacy, and spending |
 
 ## Phases

package/dist/builtin-memory/crouter-sdk/getting-started.md

@@ -22,12 +22,12 @@ That installs the `crtr` CLI and the `crtrd` daemon. You do not have to start th
 ## 2. Install the SDK in your application
 
 ```bash
-npm i @north-light/sdk
+npm i --save-exact @north-light/sdk@0.3.422
 ```
 
 One dependency. It re-exports every data type you need, so you do not also install `@north-light/api`.
 
-`@latest` always works against production: a release reaches `latest` only once production serves its contract level. The `next` tag carries every release the moment it is published and may need a newer runtime than production runs (see [[crouter-sdk/errors]] for `RuntimeVersionError`). Pin an exact version in your app.
+`@latest` always works against production: a release reaches `latest` only once production serves its contract level. The `next` tag carries every release the moment it is published and may need a newer runtime than production runs (see [[crouter-sdk/errors]] for `RuntimeVersionError`). Keep the exact pin: the compatibility gate protects the wire, not the TypeScript API. To move it, check `npm view @north-light/sdk dist-tags` and read the [[crouter-sdk/release-notes]] first.
 
 ## 3. Node, on the owner's own daemon
 
@@ -176,7 +176,7 @@ An outcome is returned, never thrown — including a decline and a failure. Only
 
 ## Go live with an app key
 
-Build against production from your laptop: [[crouter-sdk/guides/apps-on-crouter-cloud]] walks the whole path. In short, sign up at `https://account.northlight.ai`, register the app in the directory console (`https://account.northlight.ai/console`) with a `http://localhost:<port>` origin and a `http://localhost:<port>/auth/callback` redirect URI while you develop, generate the key with `npx @north-light/sdk keygen --out local/app-key.json` and paste its public JWK, and write `local/app.env` by hand. Production does not yet let a laptop join as an additional machine, so `crtr cloud apps …`, `keygen --app` and `env` work today only on a machine joined to your account; your Northlight chat agent can run the `crtr cloud apps` commands for you ([[crouter-sdk/guides/apps-on-crouter-cloud]]). If you do have a joined machine, generate the key and pull its settings with:
+Build against production from your laptop: [[crouter-sdk/guides/apps-on-crouter-cloud]] walks the whole path. In short, sign up at `https://account.northlight.ai`, create a join token at `https://account.northlight.ai/account/machines` and run `crtr sys join --directory https://account.northlight.ai --token <token>` on your laptop, register the app with `crtr cloud apps register` using a `http://localhost:<port>` origin and a `http://localhost:<port>/auth/callback` redirect URI while you develop, then generate the key and pull its settings with:
 
 ```bash
 npx @north-light/sdk keygen --app <client id>
@@ -187,7 +187,7 @@ npx @north-light/sdk env --app <client id>
 
 `env` runs `crtr cloud apps get --app-id <client id>` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID`, and `APP_ORIGIN` into `local/app.env` (`--out <path>` writes another file). It updates those three lines in place, keeps every other line and comment, and creates the file with mode `0600` when it doesn't exist. It never writes `CROUTER_KEY_FILE` or anything secret. It prints the values it set and the key file your app will read.
 
-Both commands reach your app through this machine's `crtr`, so the machine must be joined to your Northlight account. On one that isn't, they say so, print a join step and exit 2. Against production that join step does not work yet for a laptop: use `keygen` without `--app` and the console instead.
+Both commands reach your app through this machine's `crtr`, so the machine must be joined to your Northlight account. On one that isn't, they say so, print a join step and exit 2. Against production, [[crouter-sdk/guides/apps-on-crouter-cloud]] first.
 
 An app built on the SDK is configured from four variables:
 

package/dist/builtin-memory/crouter-sdk/guides/apps-on-crouter-cloud.md

@@ -9,7 +9,7 @@ when-and-why-to-read: When you are building and registering an app on
 
 # Apps on crouter cloud
 
-This page first walks through [building and registering an app](#build-and-register-an-app) against production, then covers [managing it with `crtr cloud apps`](#manage-an-app-with-crtr-cloud-apps), then runs.
+This page first walks through [building and registering an app](#build-and-register-an-app) against production with `crtr cloud apps`, then covers [managing it](#manage-an-app-with-crtr-cloud-apps), then runs.
 
 An app holding a person's connection starts runs on their runtime with `runs.start`, follows them with `runs.events` or `runs.reply`, and reads them with `runs.get`. This page covers getting data back from a run. For connections and per-person access, see [[crouter-sdk/guides/apps-with-many-users]].
 
@@ -17,53 +17,100 @@ An app holding a person's connection starts runs on their runtime with `runs.sta
 
 This part takes you from nothing to an app running on your laptop against Northlight's production directory, `https://account.northlight.ai`. Your app server runs on `localhost`, you sign in to it through Northlight, and it calls your own runtime. There is no local Northlight stack to run.
 
-You register and manage the app in the directory console, and you write the app's environment file by hand. You do not need `crtr` on your laptop. The `crtr cloud apps …` commands that automate these steps need a machine joined to your Northlight account, and production does not yet let a laptop join as an additional machine. [Manage an app with `crtr cloud apps`](#manage-an-app-with-crtr-cloud-apps) covers the two ways to use them today.
+You do all of it from the command line. Your laptop joins your Northlight account as an extra machine, and `crtr cloud apps …` registers and manages the app as you.
 
 The example app texts you, so it asks for the `sms` provider's `sms:send` scope. You need Node.js 22.19 or later.
 
-### 1. Sign up
+### 1. Account and join
 
-Open `https://account.northlight.ai/signup` in a fresh browser session (a private window, or a browser profile you have not signed in to Northlight with) and create your account. Signup texts a confirmation code to your phone, and that text is sent over iMessage, so use a phone number that has iMessage. A number that cannot receive iMessage gets "We couldn't send the text", and retrying does not help. Finish the account: the console needs an account with a runtime, and the app you build calls that runtime.
+Open `https://account.northlight.ai/signup` and create your account. Signup texts a confirmation code to your phone, and that text is sent over iMessage, so use a phone number that has iMessage. A number that cannot receive iMessage gets "We couldn't send the text", and retrying does not help. One phone number belongs to one account.
 
-### 2. Install the SDK
+Install the CLI (`npm i -g @north-light/cli`). Joining needs `crtr` 0.3.422 or later; `crtr --version` shows yours.
+
+Then join your laptop to the account:
+
+1. Open `https://account.northlight.ai/account/machines` and choose **Create join token**. A token needs a sign-in within the last 10 minutes, so the page asks you to sign in again if yours is older.
+2. The page shows two commands, with the token filled in. On your laptop, run them: first `crtr sys daemon stop` (a running daemon makes the join answer `daemon_running`), then `crtr sys join --directory https://account.northlight.ai --token <token>`. Add `--name <label>` to name the machine on the page. The token works once and expires at the time the page shows; the page shows it only once.
+
+   ```bash
+   crtr sys daemon stop
+   crtr sys join --directory https://account.northlight.ai --token <token> --name my-laptop
+   ```
+
+   It answers with `registered: true`, the machine id (`runtime:<id>`) and your user id.
+3. Check it: `crtr cloud apps mine` lists the apps you manage. Before you have joined, it answers `not_joined` and prints these same steps.
+
+Things to know before you join:
 
+- **Joining rewrites your crtr home.** Everything in your everyday crtr home that belonged to the local user (`user:local`) becomes your Northlight user, the next time the daemon starts. If you would rather not do that to your everyday home, join from a home you can throw away.
+- **There is no unjoin.** The only undo is removing the machine on `/account/machines`.
+- **Removing the machine stops it.** Once you choose **Remove** next to a machine, it gets no new tokens at once and the ones it holds expire within 5 minutes. After that its `cloud` commands answer `machine_revoked`: "This machine was removed from your Northlight account." It stays that way until you create a new join token and run `crtr sys join` again. Files on the computer stay on it.
+- **Your hosted machine is unchanged.** `/account/machines` lists it as "Northlight (hosted)", the default. Your chat agent at `https://chat.northlight.ai` still runs `crtr cloud apps …` as before.
+
+### 2. Install the SDK
 
 ```bash
 mkdir my-app && cd my-app
 npm init -y
-npm i @north-light/sdk@latest
+npm i --save-exact @north-light/sdk@0.3.422
 ```
 
-If a call fails with `426 runtime_version_unsupported`, the SDK is newer than the Northlight runtimes. This can happen briefly right after a new SDK release, until production runtimes are upgraded. Install the previous version (`npm i @north-light/sdk@<previous version>`) or wait, and tell Northlight at support@northlight.ai.
+`0.3.422` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [[crouter-sdk/release-notes]] for the versions in between, and install the new exact version the same way.
 
-### 3. Generate the signing key
+Pin an exact version of `@north-light/sdk` rather than a range or `latest`. A compatibility gate between the SDK and Northlight's runtimes protects the wire, so an SDK that is too new for the runtime is refused cleanly. It does not protect the TypeScript API: a later SDK release can change a type or a method your code uses, and an unpinned install picks that up on its next `npm i`. 
+If a call fails with `426 runtime_version_unsupported`, the SDK is newer than the Northlight runtimes. This can happen briefly right after a new SDK release, until production runtimes are upgraded. Install the previous version or wait, and tell Northlight at support@northlight.ai.
 
-An app signs in with a key, not a client secret. From your app's folder:
+### 3. Register the app
 
 ```bash
-npx @north-light/sdk keygen --out local/app-key.json
+crtr cloud apps register \
+  --name "Texty" \
+  --origin http://localhost:3000 \
+  --logo https://example.com/logo.png \
+  --justification "Texts you a summary of your day." \
+  --redirect-uri http://localhost:3000/auth/callback
 ```
 
-Run it **without `--app`**: that is the form that needs no `crtr`. It writes the private key to `local/app-key.json` (mode `0600`; keep it out of git) and prints the public JWK, one line of JSON like `{"kty":"EC","x":"…","y":"…","crv":"P-256","kid":"…","alg":"ES256","use":"sig"}`. Keep that line for step 4. Never paste the private key anywhere.
+| Flag | Value |
+|---|---|
+| `--name` | Shown to people on the consent page and in their account. |
+| `--origin` | Where your app runs. `http://localhost:<port>` and `http://127.0.0.1:<port>` are accepted for development. |
+| `--logo` | Required. The URL of a square image. |
+| `--justification` | One sentence, quoted on the consent page as your words. |
+| `--redirect-uri` | Repeat the flag for each URI. Sign-in returns only to a URI listed here, matched exactly, so `localhost` and `127.0.0.1` are different URIs and the port counts. |
 
-### 4. Register the app in the console
+The answer is the registration: the app id (`app:<client id>`), `verified: false` and `testing: true` (see [Who can sign in: testing mode](#who-can-sign-in-testing-mode)), `key: {"source":"none"}` and an `env` block with `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN`. The client id is the part of the app id after `app:`. `crtr cloud apps get --app-id <client id>` shows it again. Until a key is added, `exchangeCode` throws an `AuthenticationError`.
 
-Open `https://account.northlight.ai/console`, choose **Register an app**, and fill in:
+`--app-id` takes `app:<client id>` or the bare client id everywhere.
 
-| Field | Value |
-|---|---|
-| Name | Shown to people on the consent page and in their account. |
-| Origin URL | Where your app runs, for example `http://localhost:3000`. `http://localhost:<port>` and `http://127.0.0.1:<port>` are accepted for development. |
-| Logo URL | Required. A square image. |
-| Why your app needs access | One sentence, quoted on the consent page as your words. |
-| Redirect URIs | One per line, for example `http://localhost:3000/auth/callback`. Sign-in returns only to a URI listed here, matched exactly, so `localhost` and `127.0.0.1` are different URIs and the port counts. |
-| Public key | Paste the public JWK from step 3. It is optional here; if you leave it empty, add it later with **Add key** on the app's **Sign-in** tab. |
+### 4. Generate the signing key and add it
 
-Choose **Register app**. The app page shows the **Client ID**: copy it. Until the public key is added, `exchangeCode` throws an `AuthenticationError`.
+An app signs in with a key, not a client secret. From your app's folder:
+
+```bash
+npx @north-light/sdk keygen --app <client id> --yes
+```
+
+This writes the private key to `local/app-key.json` (mode `0600`; keep it out of git) and adds its public key to the app through your own `crtr` (`crtr cloud apps keys add`). Without `--yes` it asks first. The answer is "Added key <kid> to <client id> as an additional key. Your current key still works."; `crtr cloud apps keys list --app-id <client id>` then shows the key as `active`. Never paste the private key anywhere.
 
 ### 5. Say what the app asks for
 
-On the app page, open **What it asks for**. The app starts with `crtr:llm` and `crtr:act` ticked and can only ask for what is ticked. Tick **Send you text messages from Northlight's number** (under "Tools from providers", scope `sms:send`), then save. Production does not tick it for you, and without it the consent page does not offer it and `providers.call` for `sms` is refused. The consent sentence and the scope string appear together on each row; take scope strings from that page and do not invent them.
+An app can only ask for scopes it has been given. It starts with `crtr:llm` and `crtr:act`. See what else it may ask for, then set the list:
+
+```bash
+crtr cloud apps asks --app-id <client id> --source sms
+crtr cloud apps set-scopes --app-id <client id> --scope crtr:llm --scope crtr:act --scope sms:send
+```
+
+`asks` lists, per source, what the app may ask for and whether it asks now; `sms:send` is under providers, with the consent sentence "Send you text messages from Northlight's number". `set-scopes` replaces the whole list, so repeat `--scope` for every scope you want (`crtr:act` needs `crtr:llm`). Without `sms:send` the consent page does not offer it and `providers.call` for `sms` is refused. Take scope strings from `asks` and do not invent them.
+
+If your app does not work without a provider being set up first (Doppel needs Context), name it:
+
+```bash
+crtr cloud apps set-requires --app-id <client id> --provider context
+```
+
+The person is then taken through that provider's setup page the first time they sign in to your app. Context asks for a profile URL, and its state stays `pending` for a few minutes afterwards; see [Waiting on a provider your app requires](#waiting-on-a-provider-your-app-requires).
 
 #### What each scope gates
 
@@ -79,17 +126,19 @@ A run you start can only do what the grant holds and the run's own `scopes` list
 
 #### Who can sign in: testing mode
 
-A new app is in testing: it is registered as `verified: false`, only you and up to 100 testers can sign in to it, and it is not shown in the marketplace. You can sign in as yourself with no setup. To let someone else in, add them by the email or phone number on their Northlight account: `crtr cloud apps testers add --app-id <id> --email them@example.com` (or `--phone +15551234567`). An email matches only while it is verified on that account. They can sign in right away; nobody gets a message, so tell them. `testers list` shows who is on the list and `testers remove` takes someone off.
-
-Anyone else who tries sees "<app> is still in testing", and your app's callback receives `error=access_denied` with `error_description=app_in_testing` instead of a `code`. [[crouter-sdk/client]] shows how to read it and what to show the person. Removing a tester stops their access at once, including their refresh tokens, and keeps their data; adding them back and signing in again restores it.
+A new app is in testing: it is registered as `verified: false`, only you and up to 100 testers can sign in to it, and it is not shown in the marketplace. You can sign in as yourself with no setup. To let someone else in, add them by the email or phone number on their Northlight account: `crtr cloud apps testers add --app-id <id> --email them@example.com` (or `--phone +15551234567`). An email matches only while it is verified on that account. They can sign in right away; nobody gets a message, so tell them. (Specified behavior: adding a tester, and everything below about a second person signing in, being refused or being removed, has not been run on production yet.) `crtr cloud apps testers list --app-id <id>` shows who is on the list and `testers remove` takes someone off. A testing app is also left out of the marketplace listing, even once you set `--listed true`.
 
-The `testers` leaves are `cloud` leaves like the rest, so they need a joined machine or your hosted chat agent (see [Manage an app with `crtr cloud apps`](#manage-an-app-with-crtr-cloud-apps)): a laptop cannot join production yet. Ask your chat agent to run the command, for example `crtr cloud apps testers add --app-id <id> --email them@example.com`.
+Per the testing-mode specification, anyone else who tries sees "<app> is still in testing", and your app's callback receives `error=access_denied` with `error_description=app_in_testing` instead of a `code`. [[crouter-sdk/client]] shows how to read it and what to show the person. Removing a tester stops their access at once, including their refresh tokens, and keeps their data; adding them back and signing in again restores it.
 
 When you are ready for everyone, email `support@northlight.ai` to have the app verified. Only Northlight staff can verify an app; registering never sets `verified: true`. Apps that existed before testing mode are already verified.
 
 ### 6. Write the environment file
 
-Create `local/app.env` by hand with the Client ID from step 4:
+```bash
+npx @north-light/sdk env --app <client id>
+```
+
+This reads the registration through `crtr cloud apps get` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN` into `local/app.env`, keeping every other line and comment in the file. `--out <path>` writes another file. It never writes `CROUTER_KEY_FILE` or anything secret. Add the key path yourself:
 
 ```bash
 CROUTER_ISSUER=https://account.northlight.ai
@@ -101,11 +150,11 @@ CROUTER_KEY_FILE=local/app-key.json
 | Variable | Value |
 |---|---|
 | `CROUTER_ISSUER` | `https://account.northlight.ai` |
-| `CROUTER_CLIENT_ID` | The Client ID from the app page |
-| `APP_ORIGIN` | The Origin URL you registered. The redirect URI is `${APP_ORIGIN}/auth/callback` by convention; it must match a registered redirect URI exactly. |
-| `CROUTER_KEY_FILE` | Path to the private key from step 3. Default `local/app-key.json` |
+| `CROUTER_CLIENT_ID` | The client id of your app |
+| `APP_ORIGIN` | The origin you registered. The redirect URI is `${APP_ORIGIN}/auth/callback` by convention; it must match a registered redirect URI exactly. |
+| `CROUTER_KEY_FILE` | Path to the private key from step 4. Default `local/app-key.json` |
 
-The file holds no secret, but keep it out of git with the key. On a machine joined to your account, `npx @north-light/sdk env --app <client id>` writes the first three for you.
+The file holds no secret, but keep it out of git with the key.
 
 ### 7. Run it locally
 
@@ -190,12 +239,9 @@ Test your app with `FakeCloud` from `@north-light/sdk/testing`. Your real `OAuth
 
 ## Manage an app with `crtr cloud apps`
 
-Everything in the console has a `crtr cloud apps` command: they are leaves of Northlight's `cloud` provider, and they run as you. Two things to know today:
-
-- **A laptop cannot run them yet.** The `cloud` commands appear on a machine joined to your Northlight account, and production does not yet let a laptop join as an additional machine. That is coming. Until it ships, do the steps above in the console and write the env file by hand. Do not follow older instructions to open `/account/machines` or to run `crtr sys join` against production: that page does not exist yet. `keygen --app` and `npx @north-light/sdk env` need the same joined machine, so use `keygen` without `--app`, as in step 3.
-- **Your Northlight chat agent can run them.** Open `https://chat.northlight.ai`, and ask your chat agent to run the command. It runs as you on your hosted runtime and prints the real output. Verified on production: `register`, `set-scopes`, `keys add`, `get`, `mine`, `asks`, `set-listing`, `set-requires` and `update`. For `keys add`, generate the key on your laptop as in step 3 and give the agent only the public JWK. Never ask it to generate your key: it would live on the hosted disk. If a command fails once with `launcher refused launch_failed`, run it again.
+Everything above is a `crtr cloud apps` command, and so is the rest of managing an app. They are leaves of Northlight's `cloud` provider, they run as you, and they need a machine joined to your account ([step 1](#1-account-and-join)).
 
-For example, ask the agent: "Run `crtr cloud apps register --name Texty --origin http://localhost:3000 --logo https://example.com/logo.png --justification "Texts you a summary of your day." --redirect-uri http://localhost:3000/auth/callback` and show me the raw output." Then `set-scopes --app-id <id> --scope crtr:llm --scope crtr:act --scope sms:send` and `keys add --app-id <id> --jwk '<public JWK>'`.
+Your Northlight chat agent at `https://chat.northlight.ai` can run the same commands as you, on your hosted runtime. Ask it to run a command and show you the raw output. It can list and change an app (`mine` and `set-scopes` were checked on production). It cannot delete one: see [Deleting an app](#deleting-an-app). Generate keys on your laptop and give an agent only a public JWK, never the private key.
 
 `--app-id` takes `app:<client id>` or the bare client id. The leaves:
 
@@ -209,24 +255,50 @@ For example, ask the agent: "Run `crtr cloud apps register --name Texty --origin
 | `crtr cloud apps asks --app-id <id>` | Lists what an app may ask for, with whether it asks now. Large sources such as `integrations` print as a count. Narrow it with `--query sms:send`, `--source sms`, `--group providers\|apps\|agents\|space`, or `--query <text>`; for example `crtr cloud apps asks --app-id <id> --source sms`. |
 | `crtr cloud apps set-scopes --app-id <id> --scope …` | Replaces the scope list. Repeat `--scope` for every scope; `--clear` empties it; `crtr:act` needs `crtr:llm`. |
 | `crtr cloud apps set-requires --app-id <id> --provider …` | Names providers your app does not work without (for example `context`); `--clear` empties it. |
-| `crtr cloud apps keys add --app-id <id> --jwk '<public JWK>'` | Adds a signing key beside any existing one. Answers `created: false` if that key is already on the app. |
-| `crtr cloud apps set-listing --app-id <id> --login-start-url … --text-welcome …` (also `--listed`, `--price`) | Sets the listing fields; pass at least one. A loopback `--login-start-url` is accepted. `--listed true` was not run during this guide's checks. |
-| `crtr cloud apps testers add --app-id <id> --email …` (or `--phone …`) | Lets that person sign in while the app is in testing; at most 100. |
+| `crtr cloud apps keys add --app-id <id> --jwk '<public JWK>'` | Adds a signing key beside any existing one. Answers `created: false` if that key is already on the app. `keygen --app` calls it for you. |
+| `crtr cloud apps keys list --app-id <id>` | Lists the keys with their `kid` and `active` or `retired` status. |
+| `crtr cloud apps keys retire --app-id <id> --kid <kid>` | Retires a key so it no longer signs in. |
+| `crtr cloud apps set-listing --app-id <id> --login-start-url … --text-welcome …` (also `--listed`, `--price`) | Sets the listing fields; pass at least one. A loopback `--login-start-url` is accepted. `--listed true --price free` lists the app, so `cloud apps install` finds it; while the app is in testing it still stays out of the marketplace list. |
+| `crtr cloud apps install --app-id <id>` | Texts an install link to the signed-in person. If they already hold a grant it answers `status: already_have` and the install URL instead of texting. The app must be listed. |
+| `crtr cloud apps testers add --app-id <id> --email …` (or `--phone …`) | Lets that person sign in while the app is in testing; at most 100. Not yet run on production. |
 | `crtr cloud apps testers list --app-id <id>` | Lists the testers. |
-| `crtr cloud apps testers remove --app-id <id> --email …` (or `--phone …`) | Removes a tester and revokes their grants for the app. |
+| `crtr cloud apps testers remove --app-id <id> --email …` (or `--phone …`) | Removes a tester and revokes their grants for the app. Not yet run on production. |
 | `crtr cloud apps delete --app-id <id> --confirm <client id>` | Deletes the app and removes every person's grant for it. Only you at a joined machine's terminal can run it: an agent, including your chat agent, is refused with `provider_refused`. |
 
 ### Deleting an app
 
-The console has no control for deleting an app. `crtr cloud apps delete` is the way, and it runs only from a joined machine's terminal, which a laptop cannot be yet. Until then, email `support@northlight.ai` with the client id: Northlight staff can delete an app with an operator command. Deleting removes every person's grant for the app, so each runtime deletes the app's runs, space and schedules, and the app's next refresh for them fails with `invalid_grant`. It cannot be undone, and apps that hold the provider role cannot be deleted. Reusing an app for tests is usually simpler: change its redirect URIs and keys instead.
+```bash
+crtr cloud apps delete --app-id <client id> --confirm <client id>
+```
+
+It answers `deleted: true` and `removed_grants`, the number of people's grants it removed. Each runtime deletes the app's runs, space and schedules, and the app's next refresh fails with `invalid_grant`. The app's key stops working, the app's page answers 404 and `mine` no longer lists it. It cannot be undone, and apps that hold the provider role cannot be deleted.
+
+Only you can delete: run it yourself in the terminal of your joined machine. An agent, including your chat agent, is refused with `provider_refused`: "Only you can delete an app. Ask the person to run `crtr cloud apps delete` in their terminal." Reusing an app for tests is often simpler: change its redirect URIs and keys instead.
 
 ### Let people find and install it
 
-`login_start_url` is where Northlight starts sign-in for a person who installs your app from a link. In the console, open **Profile**, and under **Marketplace** set **Sign-in start URL**, **Text welcome** (one or two plain sentences, at most 120 characters, no links) and **Listed in the marketplace**. Your `/auth/login` route from step 7 is a valid start URL. Agents can install an app for people by text only while it is listed.
+`login_start_url` is where Northlight starts sign-in for a person who installs your app from a texted link (specified behavior: pressing the texted link was not run on production, only the text send was). Your `/auth/login` route from step 7 is a valid start URL, and a loopback one is accepted:
+
+```bash
+crtr cloud apps set-listing --app-id <client id> --listed true --price free \
+  --login-start-url http://localhost:3000/auth/login \
+  --text-welcome "Texts you a summary of your day."
+```
+
+`--text-welcome` is one or two plain sentences, at most 120 characters, with no links. Agents can install an app for people by text only while it is listed (`--listed true`). `crtr cloud apps install --app-id <client id>` sends the signed-in person a text with the install link. Run it only for yourself or for a person who asked: it sends a real text.
 
 ### Rotate keys
 
-Add a new key beside the old one, switch, verify with a real sign-in, then retire the old key. Use `keygen --out local/app-key-next.json` without `--app`, paste its public JWK with **Add key** on the **Sign-in** tab, and retire the old one there. [[crouter-sdk/getting-started]] has the full sequence.
+Add a new key beside the old one, switch, verify with a real sign-in, then retire the old key:
+
+```bash
+npx @north-light/sdk keygen --out local/app-key.next.json --app <client id> --yes
+# point CROUTER_KEY_FILE at local/app-key.next.json, restart, and sign in once
+crtr cloud apps keys list --app-id <client id>
+crtr cloud apps keys retire --app-id <client id> --kid <old kid>
+```
+
+The old key keeps working until you retire it, and your app's refreshes keep working after. [[crouter-sdk/getting-started]] has the full sequence.
 
 ## Getting a result back from a run
 

package/dist/clients/attach/viewer.js

@@ -1852,7 +1852,7 @@ Dropped: ${u.dropped}`}}}}var PIn=h(()=>{"use strict";Gt();BD();$D();LD();wU()})
 ${m}
 `)}if(f==="node-done"){process.stderr.write(`
 \u2713 node ${i} finished \u2014 final report submitted.
-`);let m=e.tagPane()??process.env.TMUX_PANE??my()?.pane;!o&&m!==void 0&&ua()&&J0(m)}u()}};return{done:l,teardown:d,isTornDown:()=>c,installSignalHandlers:()=>{let f=()=>d("signal");process.once("SIGTERM",f),process.once("SIGHUP",f),process.once("SIGINT",f)}}}var pkn=h(()=>{"use strict";Ap();wye()});var I0,xye=h(()=>{"use strict";I0=class extends Error{constructor(n){super(`node ${n} has no running broker \u2014 focus or revive it first`);this.nodeId=n;this.name="BrokerUnavailableError"}nodeId}});import{EventEmitter as vxi}from"node:events";var _U,fet=h(()=>{"use strict";Fr();dK();Uhe();Kwe();Sh();TYe();xye();_U=class extends vxi{constructor(n,r={}){super();this.nodeId=n;this.options=r}nodeId;options;socket;decoder=new d6(IYe);closeEmitted=!1;redialFaultRecorded=!1;get socketPath(){return qM(this.nodeId)}recordSocketFault(n,r){if(this.options.recordsViewerFaults===!1)return;if(n==="redial"){if(this.redialFaultRecorded)return;this.redialFaultRecorded=!0}let i=Fhe("viewer\u2194broker",r);Cat(this.nodeId,{link:"viewer\u2194broker",op:n,kind:i.kind,retry:n==="redial"?{disposition:"auto",by:"client"}:{disposition:"manual"},message:r instanceof Error?r.message:String(r)}).catch(o=>{dc({event:"broker.daemon.operation.failed",level:"error",node_id:this.nodeId,error:o,fields:{operation:"viewer_fault_record"}})})}connect(){let n=ybe(this.nodeId);this.socket=n,n.on("connect",()=>{this.redialFaultRecorded=!1,this.clearSocketFault(),this.emit("connect")}),n.on("data",r=>this.onData(r)),n.on("error",r=>this.onError(r,"connect")),n.on("close",()=>this.onClose())}redial(n={}){return this.destroy(),this.decoder=new d6(IYe),this.closeEmitted=!1,n.brokerUnavailableIsExpected&&(this.redialFaultRecorded=!1,this.clearSocketFault()),new Promise((r,i)=>{let o=ybe(this.nodeId);this.socket=o;let s=!1;o.on("connect",()=>{s||(s=!0,this.redialFaultRecorded=!1,this.clearSocketFault(),this.emit("connect"),r())}),o.on("data",a=>this.onData(a)),o.on("error",a=>{if(s){this.onError(a,"redial");return}s=!0;let c=a.code==="ECONNREFUSED"||a.code==="ENOENT";(!n.brokerUnavailableIsExpected||!c)&&this.recordSocketFault("redial",a);try{o.destroy()}catch{}i(a)}),o.on("close",()=>this.onClose())})}send(n){let r=this.socket;if(!(r===void 0||r.destroyed))try{r.write(Jme(n))}catch{}}destroy(){let n=this.socket;if(n!==void 0&&!n.destroyed)try{n.destroy()}catch{}}clearSocketFault(){this.options.recordsViewerFaults!==!1&&Iat(this.nodeId,{link:"viewer\u2194broker"}).catch(n=>{dc({event:"broker.daemon.operation.failed",level:"error",node_id:this.nodeId,error:n,fields:{operation:"viewer_fault_clear"}})})}onData(n){let r;try{r=this.decoder.push(n)}catch(i){let o=i instanceof BF?`broker sent an oversized frame (${i.message}) \u2014 disconnecting`:`failed to decode a broker frame: ${String(i)}`;this.emitError(new Error(o)),this.destroy();return}for(let i of r)this.emit("frame",i)}onError(n,r){this.recordSocketFault(r,n),n.code==="ECONNREFUSED"||n.code==="ENOENT"?this.emitError(new I0(this.nodeId)):this.emitError(new Error(`view socket error: ${n.message}`))}onClose(){this.closeEmitted||(this.closeEmitted=!0,this.emit("close"))}emitError(n){this.listenerCount("error")>0&&this.emit("error",n)}}});import{EventEmitter as Sxi}from"node:events";function Cxi(t,e){if("socketPath"in t)return`ws+unix://${t.socketPath}:/v1/nodes/${encodeURIComponent(e)}/attach?revive=0`;let n=new URL(t.previewEndpoint);return n.protocol=n.protocol==="http:"?"ws:":"wss:",n.pathname=`/v1/nodes/${encodeURIComponent(e)}/attach`,n.search="?wakeParked=1",n.hash="",n.toString()}var QD,fkn=h(()=>{"use strict";OFe();Uhe();xye();QD=class extends Sxi{constructor(n,r){super();this.nodeId=n;this.target=r}nodeId;target;ws;closeEmitted=!1;get url(){return Cxi(this.target,this.nodeId)}dial(){let n=new Fk.default(this.url,{..."relayToken"in this.target?{headers:{authorization:`Bearer ${this.target.relayToken}`}}:{},perMessageDeflate:!1});return this.ws=n,n}connect(){let n=this.dial();n.on("open",()=>{this.emit("connect")}),n.on("message",r=>this.onMessage(r)),n.on("error",r=>this.onError(r)),n.on("close",(r,i)=>this.onClose(r,i.toString()))}redial(n){return this.destroy(),this.closeEmitted=!1,new Promise((r,i)=>{let o=this.dial(),s=!1;o.on("open",()=>{s||(s=!0,this.emit("connect"),r())}),o.on("message",a=>this.onMessage(a)),o.on("error",a=>{if(s){this.onError(a);return}s=!0;try{o.terminate()}catch{}i(a)}),o.on("close",(a,c)=>{s&&this.onClose(a,c.toString())})})}send(n){let r=this.ws;if(!(r===void 0||r.readyState!==Fk.default.OPEN))try{r.send(JSON.stringify(n))}catch{}}destroy(){let n=this.ws;if(n!==void 0&&n.readyState<=Fk.default.OPEN)try{n.close()}catch{}}onMessage(n){let r;try{r=JSON.parse(n.toString())}catch{return}this.emit("frame",r)}onError(n){this.emitError(new Error(`relay transport error: ${n.message}`))}onClose(n,r){if(this.closeEmitted)return;this.closeEmitted=!0;let i=Fhe("viewer\u2194broker",{code:n,reason:r});(n===1008||i.kind==="protocol"||n===1011&&(/^no running broker/.test(r)||/^no node /.test(r)))&&this.emitError(new I0(this.nodeId)),this.emit("close")}emitError(n){this.listenerCount("error")>0&&this.emit("error",n)}}});import{EventEmitter as Ixi}from"node:events";import{randomUUID as Txi}from"node:crypto";function met(t){return t===null?!0:t.lifecycle==="resident"&&t.status==="done"&&t.intent==="parked"&&t.final_report==null?!1:t.status==="done"||t.status==="dead"||t.status==="canceled"}var mkn,nV,hkn=h(()=>{"use strict";fet();xye();fet();fkn();mkn=1e4;nV=class extends Ixi{constructor(n,r={}){super();this.nodeId=n;this.transport=r.transport??new _U(n),this.transport.on("connect",()=>{this.closeEmitted=!1,this.connected=!0,this.lastTransportError=void 0,this.emit("connect")}),this.transport.on("frame",i=>this.onFrame(i)),this.transport.on("error",i=>{this.lastTransportError=i.message,this.emitError(i)}),this.transport.on("close",()=>this.onClose())}nodeId;transport;closeEmitted=!1;connected=!1;lastTransportError;pending=new Map;request(n){let r=Txi();return new Promise((i,o)=>{if(!this.connected){o(new Error(`cannot issue '${n.type}': no live broker connection`));return}let s=setTimeout(()=>{this.pending.delete(r),o(new Error(`request '${n.type}' timed out after ${mkn}ms`))},mkn);typeof s.unref=="function"&&s.unref(),this.pending.set(r,{resolve:i,reject:o,timer:s}),this.send({...n,id:r})})}rejectAllPending(n){for(let{reject:r,timer:i}of this.pending.values())clearTimeout(i),r(new Error(n));this.pending.clear()}connect(){this.transport.connect()}redial(n){return this.transport.redial(n)}send(n){this.transport.send(n)}close(){this.transport.destroy()}onFrame(n){if(n.type==="data"){let r=typeof n.id=="string"?this.pending.get(n.id):void 0;r&&(this.pending.delete(n.id),clearTimeout(r.timer),r.resolve(n));return}if(n.type==="error"&&typeof n.id=="string"&&this.pending.has(n.id)){let r=this.pending.get(n.id);this.pending.delete(n.id),clearTimeout(r.timer),r.reject(new Error(n.message||`request failed: ${n.code}`));return}this.emit("frame",n)}onClose(){this.closeEmitted||(this.closeEmitted=!0,this.connected=!1,this.rejectAllPending(this.lastTransportError??"broker connection closed"),this.emit("close"))}emitError(n){this.listenerCount("error")>0&&this.emit("error",n)}}});var het=h(()=>{"use strict";hkn()});function gkn(t,e){let{nodeId:n,socket:r,canvasSource:i}=t,o,s=!1,a=e.initialDormant===!0,c=!1,u=!1,l=()=>{},d,p,f=new Promise(x=>{l=x}),m=x=>u?Promise.resolve(!1):new Promise(E=>{let _=C=>{d=void 0,p=void 0,E(C)};d=setTimeout(()=>_(!0),x),p=()=>{d!==void 0&&clearTimeout(d),_(!1)}}),g=()=>{r.send({type:"hello",role:e.role,client_id:e.clientId,term:{cols:process.stdout.columns??80,rows:process.stdout.rows??24}})},y=async()=>{s=!0,e.setNotice("\u21BB node refreshing \u2014 reconnecting\u2026",{sticky:!0});let x=200;try{for(;!u&&!e.isTornDown();){let E;try{E=await i.getRow(n)}catch{E=void 0}if(E!==void 0&&met(E)){c=E?.status==="done";break}let _=E?.status==="idle"||E?.intent==="idle-release"||E?.lifecycle==="resident"&&E.status==="done"&&E.intent==="parked"&&E.final_report==null,C=_&&!a;a=_,C&&e.onEnterDormancy(),e.setNotice(_?"":"\u21BB node refreshing \u2014 reconnecting\u2026",{sticky:!_});try{if(!await Promise.race([r.redial({brokerUnavailableIsExpected:_}).then(()=>!0),f.then(()=>!1)])||u||e.isTornDown())return;g(),a=!1,e.setNotice("");return}catch{if(!await m(_?Rxi:Math.min(x,kxi)))return;x*=2}}}finally{s=!1}!u&&!e.isTornDown()&&e.teardown(c?"node-done":"broker-gone")};return{sendHello:g,startDormant:()=>{s||u||e.isTornDown()||(e.onEnterDormancy(),y())},isDormant:()=>a,lastSocketError:()=>o,install:()=>{r.on("frame",e.onFrame),r.on("error",x=>{o=x.message}),r.on("close",()=>{e.isTornDown()||s||y()})},stop:()=>{u||(u=!0,p?.(),l())}}}var kxi,Rxi,ykn=h(()=>{"use strict";het();kxi=1e3,Rxi=3e3});function bye(t){if(typeof t!="object"||t===null||Array.isArray(t))return!1;try{let e=Object.getPrototypeOf(t);if(e!==Object.prototype&&e!==null||Object.getOwnPropertySymbols(t).length!==0)return!1;let n=Object.getOwnPropertyNames(t).sort();if(n.length!==3||n[0]!=="body"||n[1]!=="commandName"||n[2]!=="kind")return!1;let r=Object.getOwnPropertyDescriptors(t);if(Object.values(r).some(o=>!("value"in o)))return!1;let i=t;return i.kind!=="memory-slash"||typeof i.commandName!="string"||typeof i.body!="string"?!1:(JSON.stringify(t),!0)}catch{return!1}}function Dxi(t){let e="",n=0,r=!0,i,o;for(;n<t.length;){if(r&&o===void 0){let a=t.slice(n).match(/^(?: {0,3})(`{3,}|~{3,})/);if(a!==null){let c=a[1][0],u=a[1].length;i===void 0?i={marker:c,length:u}:i.marker===c&&u>=i.length&&(i=void 0)}}if(i===void 0&&o===void 0&&t.startsWith("<!--",n)){let a=t.indexOf("-->",n+4),c=a===-1?t.length:a+3,u=t.indexOf(`
+`);let m=e.tagPane()??process.env.TMUX_PANE??my()?.pane;!o&&m!==void 0&&ua()&&J0(m)}u()}};return{done:l,teardown:d,isTornDown:()=>c,installSignalHandlers:()=>{let f=()=>d("signal");process.once("SIGTERM",f),process.once("SIGHUP",f),process.once("SIGINT",f)}}}var pkn=h(()=>{"use strict";Ap();wye()});var I0,xye=h(()=>{"use strict";I0=class extends Error{constructor(n){super(`node ${n} has no running broker \u2014 focus or revive it first`);this.nodeId=n;this.name="BrokerUnavailableError"}nodeId}});import{EventEmitter as vxi}from"node:events";var _U,fet=h(()=>{"use strict";Fr();dK();Uhe();Kwe();Sh();TYe();xye();_U=class extends vxi{constructor(n,r={}){super();this.nodeId=n;this.options=r}nodeId;options;socket;decoder=new d6(IYe);closeEmitted=!1;redialFaultRecorded=!1;get socketPath(){return qM(this.nodeId)}recordSocketFault(n,r){if(this.options.recordsViewerFaults===!1)return;if(n==="redial"){if(this.redialFaultRecorded)return;this.redialFaultRecorded=!0}let i=Fhe("viewer\u2194broker",r);Cat(this.nodeId,{link:"viewer\u2194broker",op:n,kind:i.kind,retry:n==="redial"?{disposition:"auto",by:"client"}:{disposition:"manual"},message:r instanceof Error?r.message:String(r)}).catch(o=>{dc({event:"broker.daemon.operation.failed",level:"error",node_id:this.nodeId,error:o,fields:{operation:"viewer_fault_record"}})})}connect(){let n=ybe(this.nodeId);this.socket=n,n.on("connect",()=>{this.redialFaultRecorded=!1,this.clearSocketFault(),this.emit("connect")}),n.on("data",r=>this.onData(r)),n.on("error",r=>this.onError(r,"connect")),n.on("close",()=>this.onClose())}redial(n={}){return this.destroy(),this.decoder=new d6(IYe),this.closeEmitted=!1,n.brokerUnavailableIsExpected&&(this.redialFaultRecorded=!1,this.clearSocketFault()),new Promise((r,i)=>{let o=ybe(this.nodeId);this.socket=o;let s=!1;o.on("connect",()=>{s||(s=!0,this.redialFaultRecorded=!1,this.clearSocketFault(),this.emit("connect"),r())}),o.on("data",a=>this.onData(a)),o.on("error",a=>{if(s){this.onError(a,"redial");return}s=!0;let c=a.code==="ECONNREFUSED"||a.code==="ENOENT";(!n.brokerUnavailableIsExpected||!c)&&this.recordSocketFault("redial",a);try{o.destroy()}catch{}i(a)}),o.on("close",()=>this.onClose())})}send(n){let r=this.socket;if(!(r===void 0||r.destroyed))try{r.write(Jme(n))}catch{}}destroy(){let n=this.socket;if(n!==void 0&&!n.destroyed)try{n.destroy()}catch{}}clearSocketFault(){this.options.recordsViewerFaults!==!1&&Iat(this.nodeId,{link:"viewer\u2194broker"}).catch(n=>{dc({event:"broker.daemon.operation.failed",level:"error",node_id:this.nodeId,error:n,fields:{operation:"viewer_fault_clear"}})})}onData(n){let r;try{r=this.decoder.push(n)}catch(i){let o=i instanceof BF?`broker sent an oversized frame (${i.message}) \u2014 disconnecting`:`failed to decode a broker frame: ${String(i)}`;this.emitError(new Error(o)),this.destroy();return}for(let i of r)this.emit("frame",i)}onError(n,r){this.recordSocketFault(r,n),n.code==="ECONNREFUSED"||n.code==="ENOENT"?this.emitError(new I0(this.nodeId)):this.emitError(new Error(`view socket error: ${n.message}`))}onClose(){this.closeEmitted||(this.closeEmitted=!0,this.emit("close"))}emitError(n){this.listenerCount("error")>0&&this.emit("error",n)}}});import{EventEmitter as Sxi}from"node:events";function Cxi(t,e){if("socketPath"in t)return`ws+unix://${t.socketPath}:/v1/nodes/${encodeURIComponent(e)}/attach?revive=0`;let n=new URL(t.previewEndpoint);return n.protocol=n.protocol==="http:"?"ws:":"wss:",n.pathname=`/v1/nodes/${encodeURIComponent(e)}/attach`,n.search="?wakeParked=1",n.hash="",n.toString()}var QD,fkn=h(()=>{"use strict";OFe();Uhe();xye();QD=class extends Sxi{constructor(n,r){super();this.nodeId=n;this.target=r}nodeId;target;ws;closeEmitted=!1;get url(){return Cxi(this.target,this.nodeId)}dial(){let n=new Fk.default(this.url,{..."relayToken"in this.target?{headers:{authorization:`Bearer ${this.target.relayToken}`}}:{},perMessageDeflate:!1});return this.ws=n,n}connect(){let n=this.dial();n.on("open",()=>{this.emit("connect")}),n.on("message",r=>this.onMessage(r)),n.on("error",r=>this.onError(r)),n.on("close",(r,i)=>this.onClose(r,i.toString()))}redial(n){return this.destroy(),this.closeEmitted=!1,new Promise((r,i)=>{let o=this.dial(),s=!1;o.on("open",()=>{s||(s=!0,this.emit("connect"),r())}),o.on("message",a=>this.onMessage(a)),o.on("error",a=>{if(s){this.onError(a);return}s=!0;try{o.terminate()}catch{}i(a)}),o.on("close",(a,c)=>{s&&this.onClose(a,c.toString())})})}send(n){let r=this.ws;if(!(r===void 0||r.readyState!==Fk.default.OPEN))try{r.send(JSON.stringify(n))}catch{}}destroy(){let n=this.ws;if(n!==void 0&&n.readyState<=Fk.default.OPEN)try{n.close(1e3)}catch{}}onMessage(n){let r;try{r=JSON.parse(n.toString())}catch{return}this.emit("frame",r)}onError(n){this.emitError(new Error(`relay transport error: ${n.message}`))}onClose(n,r){if(this.closeEmitted)return;this.closeEmitted=!0;let i=Fhe("viewer\u2194broker",{code:n,reason:r});(n===1008||i.kind==="protocol"||n===1011&&(/^no running broker/.test(r)||/^no node /.test(r)))&&this.emitError(new I0(this.nodeId)),this.emit("close")}emitError(n){this.listenerCount("error")>0&&this.emit("error",n)}}});import{EventEmitter as Ixi}from"node:events";import{randomUUID as Txi}from"node:crypto";function met(t){return t===null?!0:t.lifecycle==="resident"&&t.status==="done"&&t.intent==="parked"&&t.final_report==null?!1:t.status==="done"||t.status==="dead"||t.status==="canceled"}var mkn,nV,hkn=h(()=>{"use strict";fet();xye();fet();fkn();mkn=1e4;nV=class extends Ixi{constructor(n,r={}){super();this.nodeId=n;this.transport=r.transport??new _U(n),this.transport.on("connect",()=>{this.closeEmitted=!1,this.connected=!0,this.lastTransportError=void 0,this.emit("connect")}),this.transport.on("frame",i=>this.onFrame(i)),this.transport.on("error",i=>{this.lastTransportError=i.message,this.emitError(i)}),this.transport.on("close",()=>this.onClose())}nodeId;transport;closeEmitted=!1;connected=!1;lastTransportError;pending=new Map;request(n){let r=Txi();return new Promise((i,o)=>{if(!this.connected){o(new Error(`cannot issue '${n.type}': no live broker connection`));return}let s=setTimeout(()=>{this.pending.delete(r),o(new Error(`request '${n.type}' timed out after ${mkn}ms`))},mkn);typeof s.unref=="function"&&s.unref(),this.pending.set(r,{resolve:i,reject:o,timer:s}),this.send({...n,id:r})})}rejectAllPending(n){for(let{reject:r,timer:i}of this.pending.values())clearTimeout(i),r(new Error(n));this.pending.clear()}connect(){this.transport.connect()}redial(n){return this.transport.redial(n)}send(n){this.transport.send(n)}close(){this.transport.destroy()}onFrame(n){if(n.type==="data"){let r=typeof n.id=="string"?this.pending.get(n.id):void 0;r&&(this.pending.delete(n.id),clearTimeout(r.timer),r.resolve(n));return}if(n.type==="error"&&typeof n.id=="string"&&this.pending.has(n.id)){let r=this.pending.get(n.id);this.pending.delete(n.id),clearTimeout(r.timer),r.reject(new Error(n.message||`request failed: ${n.code}`));return}this.emit("frame",n)}onClose(){this.closeEmitted||(this.closeEmitted=!0,this.connected=!1,this.rejectAllPending(this.lastTransportError??"broker connection closed"),this.emit("close"))}emitError(n){this.listenerCount("error")>0&&this.emit("error",n)}}});var het=h(()=>{"use strict";hkn()});function gkn(t,e){let{nodeId:n,socket:r,canvasSource:i}=t,o,s=!1,a=e.initialDormant===!0,c=!1,u=!1,l=()=>{},d,p,f=new Promise(x=>{l=x}),m=x=>u?Promise.resolve(!1):new Promise(E=>{let _=C=>{d=void 0,p=void 0,E(C)};d=setTimeout(()=>_(!0),x),p=()=>{d!==void 0&&clearTimeout(d),_(!1)}}),g=()=>{r.send({type:"hello",role:e.role,client_id:e.clientId,term:{cols:process.stdout.columns??80,rows:process.stdout.rows??24}})},y=async()=>{s=!0,e.setNotice("\u21BB node refreshing \u2014 reconnecting\u2026",{sticky:!0});let x=200;try{for(;!u&&!e.isTornDown();){let E;try{E=await i.getRow(n)}catch{E=void 0}if(E!==void 0&&met(E)){c=E?.status==="done";break}let _=E?.status==="idle"||E?.intent==="idle-release"||E?.lifecycle==="resident"&&E.status==="done"&&E.intent==="parked"&&E.final_report==null,C=_&&!a;a=_,C&&e.onEnterDormancy(),e.setNotice(_?"":"\u21BB node refreshing \u2014 reconnecting\u2026",{sticky:!_});try{if(!await Promise.race([r.redial({brokerUnavailableIsExpected:_}).then(()=>!0),f.then(()=>!1)])||u||e.isTornDown())return;g(),a=!1,e.setNotice("");return}catch{if(!await m(_?Rxi:Math.min(x,kxi)))return;x*=2}}}finally{s=!1}!u&&!e.isTornDown()&&e.teardown(c?"node-done":"broker-gone")};return{sendHello:g,startDormant:()=>{s||u||e.isTornDown()||(e.onEnterDormancy(),y())},isDormant:()=>a,lastSocketError:()=>o,install:()=>{r.on("frame",e.onFrame),r.on("error",x=>{o=x.message}),r.on("close",()=>{e.isTornDown()||s||y()})},stop:()=>{u||(u=!0,p?.(),l())}}}var kxi,Rxi,ykn=h(()=>{"use strict";het();kxi=1e3,Rxi=3e3});function bye(t){if(typeof t!="object"||t===null||Array.isArray(t))return!1;try{let e=Object.getPrototypeOf(t);if(e!==Object.prototype&&e!==null||Object.getOwnPropertySymbols(t).length!==0)return!1;let n=Object.getOwnPropertyNames(t).sort();if(n.length!==3||n[0]!=="body"||n[1]!=="commandName"||n[2]!=="kind")return!1;let r=Object.getOwnPropertyDescriptors(t);if(Object.values(r).some(o=>!("value"in o)))return!1;let i=t;return i.kind!=="memory-slash"||typeof i.commandName!="string"||typeof i.body!="string"?!1:(JSON.stringify(t),!0)}catch{return!1}}function Dxi(t){let e="",n=0,r=!0,i,o;for(;n<t.length;){if(r&&o===void 0){let a=t.slice(n).match(/^(?: {0,3})(`{3,}|~{3,})/);if(a!==null){let c=a[1][0],u=a[1].length;i===void 0?i={marker:c,length:u}:i.marker===c&&u>=i.length&&(i=void 0)}}if(i===void 0&&o===void 0&&t.startsWith("<!--",n)){let a=t.indexOf("-->",n+4),c=a===-1?t.length:a+3,u=t.indexOf(`
 `,c),l=t.lastIndexOf(`
 `,n-1)+1,d=t.slice(l,n),p=t.slice(c,u===-1?t.length:u);if(d.trim()===""&&p.trim()===""){d.length>0&&(e=e.slice(0,-d.length)),n=u===-1?t.length:u+1,r=!0;continue}let f=t.slice(n,c);r=f.endsWith(`
 `),n+=f.length;continue}if(i===void 0&&t[n]==="`"){let a=n;for(;t[a]==="`";)a++;let c=a-n;o===void 0?o=c:o===c&&(o=void 0),e+=t.slice(n,a),r=!1,n=a;continue}let s=t[n];e+=s,r=s===`

package/dist/core/broker-client/transport-relay.js

@@ -1 +1 @@
-var l=Object.defineProperty;var a=(r,t)=>l(r,"name",{value:t,configurable:!0});import{EventEmitter as d}from"node:events";import{WebSocket as h}from"ws";import{classify as m}from"../fault-classifier.js";import{BrokerUnavailableError as f}from"./transport.js";function u(r,t){if("socketPath"in r)return`ws+unix://${r.socketPath}:/v1/nodes/${encodeURIComponent(t)}/attach?revive=0`;const e=new URL(r.previewEndpoint);return e.protocol=e.protocol==="http:"?"ws:":"wss:",e.pathname=`/v1/nodes/${encodeURIComponent(t)}/attach`,e.search="?wakeParked=1",e.hash="",e.toString()}a(u,"relayUrl");class k extends d{static{a(this,"RelayTransport")}nodeId;target;ws;closeEmitted=!1;constructor(t,e){super(),this.nodeId=t,this.target=e}get url(){return u(this.target,this.nodeId)}dial(){const t=new h(this.url,{..."relayToken"in this.target?{headers:{authorization:`Bearer ${this.target.relayToken}`}}:{},perMessageDeflate:!1});return this.ws=t,t}connect(){const t=this.dial();t.on("open",()=>{this.emit("connect")}),t.on("message",e=>this.onMessage(e)),t.on("error",e=>this.onError(e)),t.on("close",(e,n)=>this.onClose(e,n.toString()))}redial(t){return this.destroy(),this.closeEmitted=!1,new Promise((e,n)=>{const o=this.dial();let i=!1;o.on("open",()=>{i||(i=!0,this.emit("connect"),e())}),o.on("message",s=>this.onMessage(s)),o.on("error",s=>{if(i){this.onError(s);return}i=!0;try{o.terminate()}catch{}n(s)}),o.on("close",(s,c)=>{i&&this.onClose(s,c.toString())})})}send(t){const e=this.ws;if(!(e===void 0||e.readyState!==h.OPEN))try{e.send(JSON.stringify(t))}catch{}}destroy(){const t=this.ws;if(t!==void 0&&t.readyState<=h.OPEN)try{t.close()}catch{}}onMessage(t){let e;try{e=JSON.parse(t.toString())}catch{return}this.emit("frame",e)}onError(t){this.emitError(new Error(`relay transport error: ${t.message}`))}onClose(t,e){if(this.closeEmitted)return;this.closeEmitted=!0;const n=m("viewer\u2194broker",{code:t,reason:e});(t===1008||n.kind==="protocol"||t===1011&&(/^no running broker/.test(e)||/^no node /.test(e)))&&this.emitError(new f(this.nodeId)),this.emit("close")}emitError(t){this.listenerCount("error")>0&&this.emit("error",t)}}export{k as RelayTransport};
+var l=Object.defineProperty;var a=(r,t)=>l(r,"name",{value:t,configurable:!0});import{EventEmitter as d}from"node:events";import{WebSocket as h}from"ws";import{classify as m}from"../fault-classifier.js";import{BrokerUnavailableError as f}from"./transport.js";function u(r,t){if("socketPath"in r)return`ws+unix://${r.socketPath}:/v1/nodes/${encodeURIComponent(t)}/attach?revive=0`;const e=new URL(r.previewEndpoint);return e.protocol=e.protocol==="http:"?"ws:":"wss:",e.pathname=`/v1/nodes/${encodeURIComponent(t)}/attach`,e.search="?wakeParked=1",e.hash="",e.toString()}a(u,"relayUrl");class k extends d{static{a(this,"RelayTransport")}nodeId;target;ws;closeEmitted=!1;constructor(t,e){super(),this.nodeId=t,this.target=e}get url(){return u(this.target,this.nodeId)}dial(){const t=new h(this.url,{..."relayToken"in this.target?{headers:{authorization:`Bearer ${this.target.relayToken}`}}:{},perMessageDeflate:!1});return this.ws=t,t}connect(){const t=this.dial();t.on("open",()=>{this.emit("connect")}),t.on("message",e=>this.onMessage(e)),t.on("error",e=>this.onError(e)),t.on("close",(e,n)=>this.onClose(e,n.toString()))}redial(t){return this.destroy(),this.closeEmitted=!1,new Promise((e,n)=>{const o=this.dial();let i=!1;o.on("open",()=>{i||(i=!0,this.emit("connect"),e())}),o.on("message",s=>this.onMessage(s)),o.on("error",s=>{if(i){this.onError(s);return}i=!0;try{o.terminate()}catch{}n(s)}),o.on("close",(s,c)=>{i&&this.onClose(s,c.toString())})})}send(t){const e=this.ws;if(!(e===void 0||e.readyState!==h.OPEN))try{e.send(JSON.stringify(t))}catch{}}destroy(){const t=this.ws;if(t!==void 0&&t.readyState<=h.OPEN)try{t.close(1e3)}catch{}}onMessage(t){let e;try{e=JSON.parse(t.toString())}catch{return}this.emit("frame",e)}onError(t){this.emitError(new Error(`relay transport error: ${t.message}`))}onClose(t,e){if(this.closeEmitted)return;this.closeEmitted=!0;const n=m("viewer\u2194broker",{code:t,reason:e});(t===1008||n.kind==="protocol"||t===1011&&(/^no running broker/.test(e)||/^no node /.test(e)))&&this.emitError(new f(this.nodeId)),this.emit("close")}emitError(t){this.listenerCount("error")>0&&this.emit("error",t)}}export{k as RelayTransport};

package/dist/daemon/api/bridge.d.ts

@@ -41,6 +41,19 @@ export declare function startRemoteAttachHeartbeat(ws: WebSocket, intervalMs?: n
  *  `ErrorBody`, spec §8) to the raw socket and destroy it. Never throws — a
  *  reset peer is swallowed. Shared with server.ts's auth and startup gates. */
 export declare function refuseUpgrade(socket: Duplex, status: number, statusText: string, code: string, message: string): void;
+/** Relay one remote WS ⇄ one node broker `view.sock`. Opens the socket on
+ *  connect; forwards each complete frame socket→WS (bounded decode, one WS
+ *  message per frame) and re-frames each WS message WS→socket (trailing
+ *  newline). The relay is semantically verbatim — it never INTERPRETS a frame
+ *  (it only splits/joins the newline framing). Closes the WS on socket
+ *  gone/no-broker, destroys the socket on WS close; idempotent teardown, no
+ *  leaks. Validates the node id first (path-safety + existence) as belt-and-
+ *  suspenders — the upgrade handler already guarded both. */
+/** A viewer that closed its WebSocket on purpose: 1000 normal, 1001 going
+ *  away, or 1005 — a close frame carrying no status, which is what a bare
+ *  `ws.close()` sends. None is a link fault; only an abnormal drop (1006) or an
+ *  error code is. */
+export declare function isCleanViewerClose(code: number): boolean;
 /** Handle the HTTP upgrade for `GET /v1/nodes/{id}/attach`. A-9 matches the
  *  route, extracts `{id}`, and calls this with the raw upgrade triplet; this
  *  owns the WS handshake (its own noServer `wss` above) AND the spec §5.3

package/dist/daemon/api/bridge.js

@@ -1,8 +1,8 @@
-var E=Object.defineProperty;var s=(t,e)=>E(t,"name",{value:e,configurable:!0});import{WebSocketServer as $}from"ws";import{isSafeNodeId as A}from"../../core/canvas/paths.js";import{getNode as S}from"../../core/canvas/index.js";import{BROKER_READ_CAPS as R,CLIENT_READ_CAPS as T,FrameDecoder as B,FrameOverflowError as x}from"../../core/runtime/broker-protocol.js";import{classify as k}from"../../core/fault-classifier.js";import{clearFault as p,recordFault as g}from"../../core/canvas/recovery.js";import{decideAttachRevive as C}from"../../core/runtime/revive.js";import{connectViewSocket as N,probeViewSocket as O,waitForBrokerViewSocket as P}from"../../core/runtime/view-socket.js";import{isBeneathRefusal as F}from"../../core/spaces/open-beneath.js";import{attachViewer as _,detachViewer as U}from"./viewer-presence.js";const D=new $({noServer:!0,maxPayload:R.maxLineBytes}),L=25e3,H=6e4;function V(t,e=L,i=H){let o=!0,n=!1,a=Date.now();const f=s(()=>{o=!0},"acknowledge"),m=s(()=>{n||(n=!0,clearInterval(h),t.off("pong",f))},"stop");t.on("pong",f);const h=setInterval(()=>{if(Date.now()-a>i){o=!0;return}if(!o){m(),t.terminate();return}o=!1;try{t.ping()}catch{m(),t.terminate()}},e);return h.unref(),{stop:m,noteActivity:s(()=>{a=Date.now()},"noteActivity")}}s(V,"startRemoteAttachHeartbeat");function b(t){const e=Buffer.from(t,"utf8");return e.byteLength<=123?t:e.subarray(0,123).toString("utf8")}s(b,"clampReason");function u(t,e,i,o,n){const a=JSON.stringify({error:{code:o,message:n}}),f=`HTTP/1.1 ${e} ${i}\r
+var $=Object.defineProperty;var s=(r,e)=>$(r,"name",{value:e,configurable:!0});import{WebSocketServer as R}from"ws";import{isSafeNodeId as A}from"../../core/canvas/paths.js";import{getNode as S}from"../../core/canvas/index.js";import{BROKER_READ_CAPS as C,CLIENT_READ_CAPS as T,FrameDecoder as x,FrameOverflowError as B}from"../../core/runtime/broker-protocol.js";import{classify as k}from"../../core/fault-classifier.js";import{clearFault as d,recordFault as g}from"../../core/canvas/recovery.js";import{decideAttachRevive as N}from"../../core/runtime/revive.js";import{connectViewSocket as O,probeViewSocket as P,waitForBrokerViewSocket as F}from"../../core/runtime/view-socket.js";import{isBeneathRefusal as U}from"../../core/spaces/open-beneath.js";import{attachViewer as _,detachViewer as D}from"./viewer-presence.js";const L=new R({noServer:!0,maxPayload:C.maxLineBytes}),V=25e3,H=6e4;function M(r,e=V,i=H){let n=!0,o=!1,a=Date.now();const f=s(()=>{n=!0},"acknowledge"),m=s(()=>{o||(o=!0,clearInterval(h),r.off("pong",f))},"stop");r.on("pong",f);const h=setInterval(()=>{if(Date.now()-a>i){n=!0;return}if(!n){m(),r.terminate();return}n=!1;try{r.ping()}catch{m(),r.terminate()}},e);return h.unref(),{stop:m,noteActivity:s(()=>{a=Date.now()},"noteActivity")}}s(M,"startRemoteAttachHeartbeat");function b(r){const e=Buffer.from(r,"utf8");return e.byteLength<=123?r:e.subarray(0,123).toString("utf8")}s(b,"clampReason");function u(r,e,i,n,o){const a=JSON.stringify({error:{code:n,message:o}}),f=`HTTP/1.1 ${e} ${i}\r
 content-type: application/json; charset=utf-8\r
 content-length: ${Buffer.byteLength(a)}\r
 connection: close\r
 \r
-`+a;try{t.end(f)}catch{try{t.destroy()}catch{}}}s(u,"refuseUpgrade");function M(t){if(new URL(t.url??"/","http://127.0.0.1").searchParams.get("revive")==="0")return!0;const i=t.headers["x-crtr-attach-revive"];return(Array.isArray(i)?i[0]:i)==="0"}s(M,"reviveOptedOut");function J(t){return new URL(t.url??"/","http://127.0.0.1").searchParams.get("wakeParked")==="1"}s(J,"wakeParkedRequested");function W(t,e){if(!A(e)){try{t.close(1008,b(`invalid node id: ${e}`))}catch{}return}if(S(e)===null){try{t.close(1011,b(`no node ${e}`))}catch{}return}p(e,{link:"viewer\u2194crtrd"});const i=N(e),o=new B(T);let n=!1,a=!1,f,m=!1,h=!1,v=!1;i.on("connect",()=>{m=!0,!n&&v&&_(e,t),p(e,{link:"relay\u2194broker"})});const y=s((r,l)=>{if(!n){if(n=!0,U(e,t),f?.stop(),!i.destroyed)try{i.destroy()}catch{}try{t.close(r,b(l))}catch{}}},"teardown");f=V(t),i.on("data",r=>{f?.noteActivity();let l;try{l=o.push(r)}catch(c){const d=c instanceof x?`broker sent an oversized frame (${c.message})`:`failed to decode a broker frame for ${e}`;y(1009,d);return}for(const c of l)t.readyState===t.OPEN&&t.send(JSON.stringify(c))}),i.on("error",r=>{const l=k("relay\u2194broker",r);g(e,{link:"relay\u2194broker",op:"bridge socket",kind:l.kind,retry:{disposition:"manual"},message:r.message});const c=r.code==="ECONNREFUSED"||r.code==="ENOENT"?`no running broker for ${e}`:`view socket error for ${e}: ${r.message}`;y(1011,c)}),i.on("close",r=>{n||r||(p(e,{link:"relay\u2194broker"}),y(1e3,"broker socket closed"))}),t.on("close",(r,l)=>{const c=l.toString("utf8");if(n){r===1e3&&p(e,{link:"viewer\u2194crtrd"});return}if(r===1e3)p(e,{link:"viewer\u2194crtrd"});else if(!a){a=!0;const d=k("viewer\u2194crtrd",{code:r,reason:c});g(e,{link:"viewer\u2194crtrd",op:"remote attach websocket",kind:d.kind,retry:{disposition:"auto"},message:c||`remote attach closed (${r})`})}y(r,c||`remote attach closed (${r})`)}),t.on("error",()=>{if(!a){a=!0;const r=k("viewer\u2194crtrd",{code:1006,reason:"remote attach websocket error"});g(e,{link:"viewer\u2194crtrd",op:"remote attach websocket",kind:r.kind,retry:{disposition:"auto"},message:"remote attach websocket error"})}y(1011,"remote attach websocket error")}),t.on("message",r=>{if(n||i.destroyed)return;f?.noteActivity();const c=(Array.isArray(r)?Buffer.concat(r):Buffer.isBuffer(r)?r:Buffer.from(new Uint8Array(r))).toString("utf8");if(!h)try{const w=JSON.parse(c);w?.type==="hello"&&(h=!0,v=w.attends!==!1,v&&m&&_(e,t))}catch{}const d=c.endsWith(`
+`+a;try{r.end(f)}catch{try{r.destroy()}catch{}}}s(u,"refuseUpgrade");function J(r){if(new URL(r.url??"/","http://127.0.0.1").searchParams.get("revive")==="0")return!0;const i=r.headers["x-crtr-attach-revive"];return(Array.isArray(i)?i[0]:i)==="0"}s(J,"reviveOptedOut");function W(r){return new URL(r.url??"/","http://127.0.0.1").searchParams.get("wakeParked")==="1"}s(W,"wakeParkedRequested");function E(r){return r===1e3||r===1001||r===1005}s(E,"isCleanViewerClose");function j(r,e){if(!A(e)){try{r.close(1008,b(`invalid node id: ${e}`))}catch{}return}if(S(e)===null){try{r.close(1011,b(`no node ${e}`))}catch{}return}d(e,{link:"viewer\u2194crtrd"});const i=O(e),n=new x(T);let o=!1,a=!1,f,m=!1,h=!1,v=!1;i.on("connect",()=>{m=!0,!o&&v&&_(e,r),d(e,{link:"relay\u2194broker"})});const p=s((t,l)=>{if(!o){if(o=!0,D(e,r),f?.stop(),!i.destroyed)try{i.destroy()}catch{}try{r.close(t,b(l))}catch{}}},"teardown");f=M(r),i.on("data",t=>{f?.noteActivity();let l;try{l=n.push(t)}catch(c){const y=c instanceof B?`broker sent an oversized frame (${c.message})`:`failed to decode a broker frame for ${e}`;p(1009,y);return}for(const c of l)r.readyState===r.OPEN&&r.send(JSON.stringify(c))}),i.on("error",t=>{const l=k("relay\u2194broker",t);g(e,{link:"relay\u2194broker",op:"bridge socket",kind:l.kind,retry:{disposition:"manual"},message:t.message});const c=t.code==="ECONNREFUSED"||t.code==="ENOENT"?`no running broker for ${e}`:`view socket error for ${e}: ${t.message}`;p(1011,c)}),i.on("close",t=>{o||t||(d(e,{link:"relay\u2194broker"}),p(1e3,"broker socket closed"))}),r.on("close",(t,l)=>{const c=l.toString("utf8");if(o){E(t)&&d(e,{link:"viewer\u2194crtrd"});return}if(E(t))d(e,{link:"viewer\u2194crtrd"});else if(!a){a=!0;const y=k("viewer\u2194crtrd",{code:t,reason:c});g(e,{link:"viewer\u2194crtrd",op:"remote attach websocket",kind:y.kind,retry:{disposition:"auto"},message:c||`remote attach closed (${t})`})}p(t,c||`remote attach closed (${t})`)}),r.on("error",()=>{if(!a){a=!0;const t=k("viewer\u2194crtrd",{code:1006,reason:"remote attach websocket error"});g(e,{link:"viewer\u2194crtrd",op:"remote attach websocket",kind:t.kind,retry:{disposition:"auto"},message:"remote attach websocket error"})}p(1011,"remote attach websocket error")}),r.on("message",t=>{if(o||i.destroyed)return;f?.noteActivity();const c=(Array.isArray(t)?Buffer.concat(t):Buffer.isBuffer(t)?t:Buffer.from(new Uint8Array(t))).toString("utf8");if(!h)try{const w=JSON.parse(c);w?.type==="hello"&&(h=!0,v=w.attends!==!1,v&&m&&_(e,r))}catch{}const y=c.endsWith(`
 `)?c:c+`
-`;try{i.write(d)}catch{}})}s(W,"bridgeConnection");async function te(t,e,i,o){e.on("error",()=>{});try{if(!A(o)){u(e,400,"Bad Request","invalid_node_id",`invalid node id: ${o}`);return}if(S(o)===null){u(e,404,"Not Found","node_not_found",`no node ${o}`);return}if(M(t)){if(!await O(o,250)){u(e,409,"Conflict","node_dormant",`node ${o} is dormant and revive was opted out (?revive=0)`);return}}else{let n;try{const a=await C(o,{resume:!0,capacity:"refuse"},J(t));if(a.parked){u(e,409,"Conflict","node_dormant",`node ${o} is parked; attach with ?wakeParked=1 to wake it`);return}n=a.result.launch?.exited}catch(a){const f=a instanceof Error?a.message:String(a);u(e,409,"Conflict","attach_revive_failed",`attach revive failed: ${f}`);return}if(!await P(o,n)){u(e,409,"Conflict","broker_not_ready",`broker view socket for ${o} did not become listenable after revive`);return}}if(e.destroyed)return;D.handleUpgrade(t,e,i,n=>W(n,o))}catch(n){const a=n instanceof Error?n.message:String(n);if(F(n)){u(e,400,"Bad Request","invalid_request",a);return}u(e,500,"Internal Server Error","internal",`attach upgrade failed: ${a}`)}}s(te,"handleAttachUpgrade");export{L as REMOTE_ATTACH_HEARTBEAT_MS,H as REMOTE_ATTACH_QUIET_MS,te as handleAttachUpgrade,u as refuseUpgrade,V as startRemoteAttachHeartbeat};
+`;try{i.write(y)}catch{}})}s(j,"bridgeConnection");async function te(r,e,i,n){e.on("error",()=>{});try{if(!A(n)){u(e,400,"Bad Request","invalid_node_id",`invalid node id: ${n}`);return}if(S(n)===null){u(e,404,"Not Found","node_not_found",`no node ${n}`);return}if(J(r)){if(!await P(n,250)){u(e,409,"Conflict","node_dormant",`node ${n} is dormant and revive was opted out (?revive=0)`);return}}else{let o;try{const a=await N(n,{resume:!0,capacity:"refuse"},W(r));if(a.parked){u(e,409,"Conflict","node_dormant",`node ${n} is parked; attach with ?wakeParked=1 to wake it`);return}o=a.result.launch?.exited}catch(a){const f=a instanceof Error?a.message:String(a);u(e,409,"Conflict","attach_revive_failed",`attach revive failed: ${f}`);return}if(!await F(n,o)){u(e,409,"Conflict","broker_not_ready",`broker view socket for ${n} did not become listenable after revive`);return}}if(e.destroyed)return;L.handleUpgrade(r,e,i,o=>j(o,n))}catch(o){const a=o instanceof Error?o.message:String(o);if(U(o)){u(e,400,"Bad Request","invalid_request",a);return}u(e,500,"Internal Server Error","internal",`attach upgrade failed: ${a}`)}}s(te,"handleAttachUpgrade");export{V as REMOTE_ATTACH_HEARTBEAT_MS,H as REMOTE_ATTACH_QUIET_MS,te as handleAttachUpgrade,E as isCleanViewerClose,u as refuseUpgrade,M as startRemoteAttachHeartbeat};

package/docs/sdk/README.md

@@ -26,16 +26,16 @@ if (run.kind === 'result') console.log(run.output_parsed.root_cause);
 
 ## Go live with an app key
 
-Once you have installed the SDK and tried the local flow in [Getting started](./getting-started.md), build against production: [Build and register an app](./guides/apps-on-crouter-cloud.md#build-and-register-an-app) takes you from signing up at `https://account.northlight.ai` to a running app on your laptop, registering in the directory console. (`crtr cloud apps register` does the same from a machine joined to your account; production does not yet let a laptop join.) On a joined machine, generate the key and pull the settings with:
+Once you have installed the SDK and tried the local flow in [Getting started](./getting-started.md), build against production: [Build and register an app](./guides/apps-on-crouter-cloud.md#build-and-register-an-app) takes you from signing up at `https://account.northlight.ai` and joining your laptop (`crtr sys join`) to a running app on your laptop, registered with `crtr cloud apps register`. Generate the key and pull the settings with:
 
 ```bash
 npx @north-light/sdk keygen --app <client id>
 npx @north-light/sdk env --app <client id>
 ```
 
-`keygen` saves the private JWK to `local/app-key.json` (mode `0600`); keep that file out of git. With `--app`, it offers to add the public key to your registered app through your own `crtr`, as an additional key that never replaces the current one. Otherwise, click **Add key** on the app's **Sign-in** tab and paste the public JWK printed on stdout (or paste it under **Register an app** for a new app). An app authenticates only with its key; the directory issues no client secret.
+`keygen` saves the private JWK to `local/app-key.json` (mode `0600`); keep that file out of git. With `--app`, it offers to add the public key to your registered app through your own `crtr`, as an additional key that never replaces the current one. Otherwise, add the public JWK printed on stdout with `crtr cloud apps keys add --app-id <client id> --jwk '<public JWK>'`. An app authenticates only with its key; the directory issues no client secret.
 
-`env` reads the registration through `crtr cloud apps get` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN` into `local/app.env` (`--out` picks another file), keeping every other line. Both commands need this machine's `crtr` joined to your Northlight account; on a machine that isn't, they print a join step and exit 2. On a laptop against production, run `npx @north-light/sdk keygen --out local/app-key.json` without `--app`, paste the public JWK in the console, and write the env file by hand. An app is configured from four variables:
+`env` reads the registration through `crtr cloud apps get` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN` into `local/app.env` (`--out` picks another file), keeping every other line. Both commands need this machine's `crtr` joined to your Northlight account; on a machine that isn't, they print a join step and exit 2. An app is configured from four variables:
 
 | Variable | Value |
 |---|---|
@@ -83,7 +83,7 @@ The directory rejects the key until its public JWK is added to the app. To chang
 | [Docker environment](./docker.md) | `start()`, `attach()`, `connection()` from `@north-light/env-docker` |
 | [Testing your app](./testing.md) | `FakeCloud` from `@north-light/sdk/testing`: a fake directory and runtime your real `OAuth2Client` and `Crouter` talk to through `fetch` |
 | [Release notes](./release-notes.md) | Behavior changes an existing app must act on, newest first |
-| [Apps on crouter cloud](./guides/apps-on-crouter-cloud.md) | Building and registering an app against production (console registration, keys, env file, scopes, running locally, the `crtr cloud apps` commands); typed results from app runs with `runs.parse`, declines, bounding a run, `run_idle`, and waiting on a provider your app requires |
+| [Apps on crouter cloud](./guides/apps-on-crouter-cloud.md) | Building and registering an app against production (joining a laptop, `crtr cloud apps` registration, keys, env file, scopes, running locally, the `crtr cloud apps` commands); typed results from app runs with `runs.parse`, declines, bounding a run, `run_idle`, and waiting on a provider your app requires |
 | [Apps with many users](./guides/apps-with-many-users.md) | Per-person runtime connections, app-owned user access, privacy, and spending |
 
 ## Phases

package/docs/sdk/getting-started.md

@@ -20,12 +20,12 @@ That installs the `crtr` CLI and the `crtrd` daemon. You do not have to start th
 ## 2. Install the SDK in your application
 
 ```bash
-npm i @north-light/sdk
+npm i --save-exact @north-light/sdk@0.3.422
 ```
 
 One dependency. It re-exports every data type you need, so you do not also install `@north-light/api`.
 
-`@latest` always works against production: a release reaches `latest` only once production serves its contract level. The `next` tag carries every release the moment it is published and may need a newer runtime than production runs (see [Errors](./errors.md) for `RuntimeVersionError`). Pin an exact version in your app.
+`@latest` always works against production: a release reaches `latest` only once production serves its contract level. The `next` tag carries every release the moment it is published and may need a newer runtime than production runs (see [Errors](./errors.md) for `RuntimeVersionError`). Keep the exact pin: the compatibility gate protects the wire, not the TypeScript API. To move it, check `npm view @north-light/sdk dist-tags` and read the [release notes](./release-notes.md) first.
 
 ## 3. Node, on the owner's own daemon
 
@@ -174,7 +174,7 @@ An outcome is returned, never thrown — including a decline and a failure. Only
 
 ## Go live with an app key
 
-Build against production from your laptop: [Build and register an app](./guides/apps-on-crouter-cloud.md#build-and-register-an-app) walks the whole path. In short, sign up at `https://account.northlight.ai`, register the app in the directory console (`https://account.northlight.ai/console`) with a `http://localhost:<port>` origin and a `http://localhost:<port>/auth/callback` redirect URI while you develop, generate the key with `npx @north-light/sdk keygen --out local/app-key.json` and paste its public JWK, and write `local/app.env` by hand. Production does not yet let a laptop join as an additional machine, so `crtr cloud apps …`, `keygen --app` and `env` work today only on a machine joined to your account; your Northlight chat agent can run the `crtr cloud apps` commands for you ([how](./guides/apps-on-crouter-cloud.md#manage-an-app-with-crtr-cloud-apps)). If you do have a joined machine, generate the key and pull its settings with:
+Build against production from your laptop: [Build and register an app](./guides/apps-on-crouter-cloud.md#build-and-register-an-app) walks the whole path. In short, sign up at `https://account.northlight.ai`, create a join token at `https://account.northlight.ai/account/machines` and run `crtr sys join --directory https://account.northlight.ai --token <token>` on your laptop, register the app with `crtr cloud apps register` using a `http://localhost:<port>` origin and a `http://localhost:<port>/auth/callback` redirect URI while you develop, then generate the key and pull its settings with:
 
 ```bash
 npx @north-light/sdk keygen --app <client id>
@@ -185,7 +185,7 @@ npx @north-light/sdk env --app <client id>
 
 `env` runs `crtr cloud apps get --app-id <client id>` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID`, and `APP_ORIGIN` into `local/app.env` (`--out <path>` writes another file). It updates those three lines in place, keeps every other line and comment, and creates the file with mode `0600` when it doesn't exist. It never writes `CROUTER_KEY_FILE` or anything secret. It prints the values it set and the key file your app will read.
 
-Both commands reach your app through this machine's `crtr`, so the machine must be joined to your Northlight account. On one that isn't, they say so, print a join step and exit 2. Against production that join step does not work yet for a laptop: use `keygen` without `--app` and the console instead.
+Both commands reach your app through this machine's `crtr`, so the machine must be joined to your Northlight account. On one that isn't, they say so, print a join step and exit 2. Against production, [join your laptop](./guides/apps-on-crouter-cloud.md#1-account-and-join) first.
 
 An app built on the SDK is configured from four variables:
 

package/docs/sdk/guides/apps-on-crouter-cloud.md

@@ -5,7 +5,7 @@ description: When you are building and registering an app on Northlight, or an a
 
 # Apps on crouter cloud
 
-This page first walks through [building and registering an app](#build-and-register-an-app) against production, then covers [managing it with `crtr cloud apps`](#manage-an-app-with-crtr-cloud-apps), then runs.
+This page first walks through [building and registering an app](#build-and-register-an-app) against production with `crtr cloud apps`, then covers [managing it](#manage-an-app-with-crtr-cloud-apps), then runs.
 
 An app holding a person's connection starts runs on their runtime with `runs.start`, follows them with `runs.events` or `runs.reply`, and reads them with `runs.get`. This page covers getting data back from a run. For connections and per-person access, see [Apps with many users](./apps-with-many-users.md).
 
@@ -13,53 +13,100 @@ An app holding a person's connection starts runs on their runtime with `runs.sta
 
 This part takes you from nothing to an app running on your laptop against Northlight's production directory, `https://account.northlight.ai`. Your app server runs on `localhost`, you sign in to it through Northlight, and it calls your own runtime. There is no local Northlight stack to run.
 
-You register and manage the app in the directory console, and you write the app's environment file by hand. You do not need `crtr` on your laptop. The `crtr cloud apps …` commands that automate these steps need a machine joined to your Northlight account, and production does not yet let a laptop join as an additional machine. [Manage an app with `crtr cloud apps`](#manage-an-app-with-crtr-cloud-apps) covers the two ways to use them today.
+You do all of it from the command line. Your laptop joins your Northlight account as an extra machine, and `crtr cloud apps …` registers and manages the app as you.
 
 The example app texts you, so it asks for the `sms` provider's `sms:send` scope. You need Node.js 22.19 or later.
 
-### 1. Sign up
+### 1. Account and join
 
-Open `https://account.northlight.ai/signup` in a fresh browser session (a private window, or a browser profile you have not signed in to Northlight with) and create your account. Signup texts a confirmation code to your phone, and that text is sent over iMessage, so use a phone number that has iMessage. A number that cannot receive iMessage gets "We couldn't send the text", and retrying does not help. Finish the account: the console needs an account with a runtime, and the app you build calls that runtime.
+Open `https://account.northlight.ai/signup` and create your account. Signup texts a confirmation code to your phone, and that text is sent over iMessage, so use a phone number that has iMessage. A number that cannot receive iMessage gets "We couldn't send the text", and retrying does not help. One phone number belongs to one account.
 
-### 2. Install the SDK
+Install the CLI (`npm i -g @north-light/cli`). Joining needs `crtr` 0.3.422 or later; `crtr --version` shows yours.
+
+Then join your laptop to the account:
+
+1. Open `https://account.northlight.ai/account/machines` and choose **Create join token**. A token needs a sign-in within the last 10 minutes, so the page asks you to sign in again if yours is older.
+2. The page shows two commands, with the token filled in. On your laptop, run them: first `crtr sys daemon stop` (a running daemon makes the join answer `daemon_running`), then `crtr sys join --directory https://account.northlight.ai --token <token>`. Add `--name <label>` to name the machine on the page. The token works once and expires at the time the page shows; the page shows it only once.
+
+   ```bash
+   crtr sys daemon stop
+   crtr sys join --directory https://account.northlight.ai --token <token> --name my-laptop
+   ```
+
+   It answers with `registered: true`, the machine id (`runtime:<id>`) and your user id.
+3. Check it: `crtr cloud apps mine` lists the apps you manage. Before you have joined, it answers `not_joined` and prints these same steps.
+
+Things to know before you join:
 
+- **Joining rewrites your crtr home.** Everything in your everyday crtr home that belonged to the local user (`user:local`) becomes your Northlight user, the next time the daemon starts. If you would rather not do that to your everyday home, join from a home you can throw away.
+- **There is no unjoin.** The only undo is removing the machine on `/account/machines`.
+- **Removing the machine stops it.** Once you choose **Remove** next to a machine, it gets no new tokens at once and the ones it holds expire within 5 minutes. After that its `cloud` commands answer `machine_revoked`: "This machine was removed from your Northlight account." It stays that way until you create a new join token and run `crtr sys join` again. Files on the computer stay on it.
+- **Your hosted machine is unchanged.** `/account/machines` lists it as "Northlight (hosted)", the default. Your chat agent at `https://chat.northlight.ai` still runs `crtr cloud apps …` as before.
+
+### 2. Install the SDK
 
 ```bash
 mkdir my-app && cd my-app
 npm init -y
-npm i @north-light/sdk@latest
+npm i --save-exact @north-light/sdk@0.3.422
 ```
 
-If a call fails with `426 runtime_version_unsupported`, the SDK is newer than the Northlight runtimes. This can happen briefly right after a new SDK release, until production runtimes are upgraded. Install the previous version (`npm i @north-light/sdk@<previous version>`) or wait, and tell Northlight at support@northlight.ai.
+`0.3.422` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [release notes](../release-notes.md) for the versions in between, and install the new exact version the same way.
 
-### 3. Generate the signing key
+Pin an exact version of `@north-light/sdk` rather than a range or `latest`. A compatibility gate between the SDK and Northlight's runtimes protects the wire, so an SDK that is too new for the runtime is refused cleanly. It does not protect the TypeScript API: a later SDK release can change a type or a method your code uses, and an unpinned install picks that up on its next `npm i`. 
+If a call fails with `426 runtime_version_unsupported`, the SDK is newer than the Northlight runtimes. This can happen briefly right after a new SDK release, until production runtimes are upgraded. Install the previous version or wait, and tell Northlight at support@northlight.ai.
 
-An app signs in with a key, not a client secret. From your app's folder:
+### 3. Register the app
 
 ```bash
-npx @north-light/sdk keygen --out local/app-key.json
+crtr cloud apps register \
+  --name "Texty" \
+  --origin http://localhost:3000 \
+  --logo https://example.com/logo.png \
+  --justification "Texts you a summary of your day." \
+  --redirect-uri http://localhost:3000/auth/callback
 ```
 
-Run it **without `--app`**: that is the form that needs no `crtr`. It writes the private key to `local/app-key.json` (mode `0600`; keep it out of git) and prints the public JWK, one line of JSON like `{"kty":"EC","x":"…","y":"…","crv":"P-256","kid":"…","alg":"ES256","use":"sig"}`. Keep that line for step 4. Never paste the private key anywhere.
+| Flag | Value |
+|---|---|
+| `--name` | Shown to people on the consent page and in their account. |
+| `--origin` | Where your app runs. `http://localhost:<port>` and `http://127.0.0.1:<port>` are accepted for development. |
+| `--logo` | Required. The URL of a square image. |
+| `--justification` | One sentence, quoted on the consent page as your words. |
+| `--redirect-uri` | Repeat the flag for each URI. Sign-in returns only to a URI listed here, matched exactly, so `localhost` and `127.0.0.1` are different URIs and the port counts. |
 
-### 4. Register the app in the console
+The answer is the registration: the app id (`app:<client id>`), `verified: false` and `testing: true` (see [Who can sign in: testing mode](#who-can-sign-in-testing-mode)), `key: {"source":"none"}` and an `env` block with `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN`. The client id is the part of the app id after `app:`. `crtr cloud apps get --app-id <client id>` shows it again. Until a key is added, `exchangeCode` throws an `AuthenticationError`.
 
-Open `https://account.northlight.ai/console`, choose **Register an app**, and fill in:
+`--app-id` takes `app:<client id>` or the bare client id everywhere.
 
-| Field | Value |
-|---|---|
-| Name | Shown to people on the consent page and in their account. |
-| Origin URL | Where your app runs, for example `http://localhost:3000`. `http://localhost:<port>` and `http://127.0.0.1:<port>` are accepted for development. |
-| Logo URL | Required. A square image. |
-| Why your app needs access | One sentence, quoted on the consent page as your words. |
-| Redirect URIs | One per line, for example `http://localhost:3000/auth/callback`. Sign-in returns only to a URI listed here, matched exactly, so `localhost` and `127.0.0.1` are different URIs and the port counts. |
-| Public key | Paste the public JWK from step 3. It is optional here; if you leave it empty, add it later with **Add key** on the app's **Sign-in** tab. |
+### 4. Generate the signing key and add it
 
-Choose **Register app**. The app page shows the **Client ID**: copy it. Until the public key is added, `exchangeCode` throws an `AuthenticationError`.
+An app signs in with a key, not a client secret. From your app's folder:
+
+```bash
+npx @north-light/sdk keygen --app <client id> --yes
+```
+
+This writes the private key to `local/app-key.json` (mode `0600`; keep it out of git) and adds its public key to the app through your own `crtr` (`crtr cloud apps keys add`). Without `--yes` it asks first. The answer is "Added key <kid> to <client id> as an additional key. Your current key still works."; `crtr cloud apps keys list --app-id <client id>` then shows the key as `active`. Never paste the private key anywhere.
 
 ### 5. Say what the app asks for
 
-On the app page, open **What it asks for**. The app starts with `crtr:llm` and `crtr:act` ticked and can only ask for what is ticked. Tick **Send you text messages from Northlight's number** (under "Tools from providers", scope `sms:send`), then save. Production does not tick it for you, and without it the consent page does not offer it and `providers.call` for `sms` is refused. The consent sentence and the scope string appear together on each row; take scope strings from that page and do not invent them.
+An app can only ask for scopes it has been given. It starts with `crtr:llm` and `crtr:act`. See what else it may ask for, then set the list:
+
+```bash
+crtr cloud apps asks --app-id <client id> --source sms
+crtr cloud apps set-scopes --app-id <client id> --scope crtr:llm --scope crtr:act --scope sms:send
+```
+
+`asks` lists, per source, what the app may ask for and whether it asks now; `sms:send` is under providers, with the consent sentence "Send you text messages from Northlight's number". `set-scopes` replaces the whole list, so repeat `--scope` for every scope you want (`crtr:act` needs `crtr:llm`). Without `sms:send` the consent page does not offer it and `providers.call` for `sms` is refused. Take scope strings from `asks` and do not invent them.
+
+If your app does not work without a provider being set up first (Doppel needs Context), name it:
+
+```bash
+crtr cloud apps set-requires --app-id <client id> --provider context
+```
+
+The person is then taken through that provider's setup page the first time they sign in to your app. Context asks for a profile URL, and its state stays `pending` for a few minutes afterwards; see [Waiting on a provider your app requires](#waiting-on-a-provider-your-app-requires).
 
 #### What each scope gates
 
@@ -75,17 +122,19 @@ A run you start can only do what the grant holds and the run's own `scopes` list
 
 #### Who can sign in: testing mode
 
-A new app is in testing: it is registered as `verified: false`, only you and up to 100 testers can sign in to it, and it is not shown in the marketplace. You can sign in as yourself with no setup. To let someone else in, add them by the email or phone number on their Northlight account: `crtr cloud apps testers add --app-id <id> --email them@example.com` (or `--phone +15551234567`). An email matches only while it is verified on that account. They can sign in right away; nobody gets a message, so tell them. `testers list` shows who is on the list and `testers remove` takes someone off.
-
-Anyone else who tries sees "<app> is still in testing", and your app's callback receives `error=access_denied` with `error_description=app_in_testing` instead of a `code`. [When sign-in is refused: apps in testing](../client.md#when-sign-in-is-refused-apps-in-testing) shows how to read it and what to show the person. Removing a tester stops their access at once, including their refresh tokens, and keeps their data; adding them back and signing in again restores it.
+A new app is in testing: it is registered as `verified: false`, only you and up to 100 testers can sign in to it, and it is not shown in the marketplace. You can sign in as yourself with no setup. To let someone else in, add them by the email or phone number on their Northlight account: `crtr cloud apps testers add --app-id <id> --email them@example.com` (or `--phone +15551234567`). An email matches only while it is verified on that account. They can sign in right away; nobody gets a message, so tell them. (Specified behavior: adding a tester, and everything below about a second person signing in, being refused or being removed, has not been run on production yet.) `crtr cloud apps testers list --app-id <id>` shows who is on the list and `testers remove` takes someone off. A testing app is also left out of the marketplace listing, even once you set `--listed true`.
 
-The `testers` leaves are `cloud` leaves like the rest, so they need a joined machine or your hosted chat agent (see [Manage an app with `crtr cloud apps`](#manage-an-app-with-crtr-cloud-apps)): a laptop cannot join production yet. Ask your chat agent to run the command, for example `crtr cloud apps testers add --app-id <id> --email them@example.com`.
+Per the testing-mode specification, anyone else who tries sees "<app> is still in testing", and your app's callback receives `error=access_denied` with `error_description=app_in_testing` instead of a `code`. [When sign-in is refused: apps in testing](../client.md#when-sign-in-is-refused-apps-in-testing) shows how to read it and what to show the person. Removing a tester stops their access at once, including their refresh tokens, and keeps their data; adding them back and signing in again restores it.
 
 When you are ready for everyone, email `support@northlight.ai` to have the app verified. Only Northlight staff can verify an app; registering never sets `verified: true`. Apps that existed before testing mode are already verified.
 
 ### 6. Write the environment file
 
-Create `local/app.env` by hand with the Client ID from step 4:
+```bash
+npx @north-light/sdk env --app <client id>
+```
+
+This reads the registration through `crtr cloud apps get` and writes `CROUTER_ISSUER`, `CROUTER_CLIENT_ID` and `APP_ORIGIN` into `local/app.env`, keeping every other line and comment in the file. `--out <path>` writes another file. It never writes `CROUTER_KEY_FILE` or anything secret. Add the key path yourself:
 
 ```bash
 CROUTER_ISSUER=https://account.northlight.ai
@@ -97,11 +146,11 @@ CROUTER_KEY_FILE=local/app-key.json
 | Variable | Value |
 |---|---|
 | `CROUTER_ISSUER` | `https://account.northlight.ai` |
-| `CROUTER_CLIENT_ID` | The Client ID from the app page |
-| `APP_ORIGIN` | The Origin URL you registered. The redirect URI is `${APP_ORIGIN}/auth/callback` by convention; it must match a registered redirect URI exactly. |
-| `CROUTER_KEY_FILE` | Path to the private key from step 3. Default `local/app-key.json` |
+| `CROUTER_CLIENT_ID` | The client id of your app |
+| `APP_ORIGIN` | The origin you registered. The redirect URI is `${APP_ORIGIN}/auth/callback` by convention; it must match a registered redirect URI exactly. |
+| `CROUTER_KEY_FILE` | Path to the private key from step 4. Default `local/app-key.json` |
 
-The file holds no secret, but keep it out of git with the key. On a machine joined to your account, `npx @north-light/sdk env --app <client id>` writes the first three for you.
+The file holds no secret, but keep it out of git with the key.
 
 ### 7. Run it locally
 
@@ -186,12 +235,9 @@ Test your app with `FakeCloud` from `@north-light/sdk/testing`. Your real `OAuth
 
 ## Manage an app with `crtr cloud apps`
 
-Everything in the console has a `crtr cloud apps` command: they are leaves of Northlight's `cloud` provider, and they run as you. Two things to know today:
-
-- **A laptop cannot run them yet.** The `cloud` commands appear on a machine joined to your Northlight account, and production does not yet let a laptop join as an additional machine. That is coming. Until it ships, do the steps above in the console and write the env file by hand. Do not follow older instructions to open `/account/machines` or to run `crtr sys join` against production: that page does not exist yet. `keygen --app` and `npx @north-light/sdk env` need the same joined machine, so use `keygen` without `--app`, as in step 3.
-- **Your Northlight chat agent can run them.** Open `https://chat.northlight.ai`, and ask your chat agent to run the command. It runs as you on your hosted runtime and prints the real output. Verified on production: `register`, `set-scopes`, `keys add`, `get`, `mine`, `asks`, `set-listing`, `set-requires` and `update`. For `keys add`, generate the key on your laptop as in step 3 and give the agent only the public JWK. Never ask it to generate your key: it would live on the hosted disk. If a command fails once with `launcher refused launch_failed`, run it again.
+Everything above is a `crtr cloud apps` command, and so is the rest of managing an app. They are leaves of Northlight's `cloud` provider, they run as you, and they need a machine joined to your account ([step 1](#1-account-and-join)).
 
-For example, ask the agent: "Run `crtr cloud apps register --name Texty --origin http://localhost:3000 --logo https://example.com/logo.png --justification "Texts you a summary of your day." --redirect-uri http://localhost:3000/auth/callback` and show me the raw output." Then `set-scopes --app-id <id> --scope crtr:llm --scope crtr:act --scope sms:send` and `keys add --app-id <id> --jwk '<public JWK>'`.
+Your Northlight chat agent at `https://chat.northlight.ai` can run the same commands as you, on your hosted runtime. Ask it to run a command and show you the raw output. It can list and change an app (`mine` and `set-scopes` were checked on production). It cannot delete one: see [Deleting an app](#deleting-an-app). Generate keys on your laptop and give an agent only a public JWK, never the private key.
 
 `--app-id` takes `app:<client id>` or the bare client id. The leaves:
 
@@ -205,24 +251,50 @@ For example, ask the agent: "Run `crtr cloud apps register --name Texty --origin
 | `crtr cloud apps asks --app-id <id>` | Lists what an app may ask for, with whether it asks now. Large sources such as `integrations` print as a count. Narrow it with `--query sms:send`, `--source sms`, `--group providers\|apps\|agents\|space`, or `--query <text>`; for example `crtr cloud apps asks --app-id <id> --source sms`. |
 | `crtr cloud apps set-scopes --app-id <id> --scope …` | Replaces the scope list. Repeat `--scope` for every scope; `--clear` empties it; `crtr:act` needs `crtr:llm`. |
 | `crtr cloud apps set-requires --app-id <id> --provider …` | Names providers your app does not work without (for example `context`); `--clear` empties it. |
-| `crtr cloud apps keys add --app-id <id> --jwk '<public JWK>'` | Adds a signing key beside any existing one. Answers `created: false` if that key is already on the app. |
-| `crtr cloud apps set-listing --app-id <id> --login-start-url … --text-welcome …` (also `--listed`, `--price`) | Sets the listing fields; pass at least one. A loopback `--login-start-url` is accepted. `--listed true` was not run during this guide's checks. |
-| `crtr cloud apps testers add --app-id <id> --email …` (or `--phone …`) | Lets that person sign in while the app is in testing; at most 100. |
+| `crtr cloud apps keys add --app-id <id> --jwk '<public JWK>'` | Adds a signing key beside any existing one. Answers `created: false` if that key is already on the app. `keygen --app` calls it for you. |
+| `crtr cloud apps keys list --app-id <id>` | Lists the keys with their `kid` and `active` or `retired` status. |
+| `crtr cloud apps keys retire --app-id <id> --kid <kid>` | Retires a key so it no longer signs in. |
+| `crtr cloud apps set-listing --app-id <id> --login-start-url … --text-welcome …` (also `--listed`, `--price`) | Sets the listing fields; pass at least one. A loopback `--login-start-url` is accepted. `--listed true --price free` lists the app, so `cloud apps install` finds it; while the app is in testing it still stays out of the marketplace list. |
+| `crtr cloud apps install --app-id <id>` | Texts an install link to the signed-in person. If they already hold a grant it answers `status: already_have` and the install URL instead of texting. The app must be listed. |
+| `crtr cloud apps testers add --app-id <id> --email …` (or `--phone …`) | Lets that person sign in while the app is in testing; at most 100. Not yet run on production. |
 | `crtr cloud apps testers list --app-id <id>` | Lists the testers. |
-| `crtr cloud apps testers remove --app-id <id> --email …` (or `--phone …`) | Removes a tester and revokes their grants for the app. |
+| `crtr cloud apps testers remove --app-id <id> --email …` (or `--phone …`) | Removes a tester and revokes their grants for the app. Not yet run on production. |
 | `crtr cloud apps delete --app-id <id> --confirm <client id>` | Deletes the app and removes every person's grant for it. Only you at a joined machine's terminal can run it: an agent, including your chat agent, is refused with `provider_refused`. |
 
 ### Deleting an app
 
-The console has no control for deleting an app. `crtr cloud apps delete` is the way, and it runs only from a joined machine's terminal, which a laptop cannot be yet. Until then, email `support@northlight.ai` with the client id: Northlight staff can delete an app with an operator command. Deleting removes every person's grant for the app, so each runtime deletes the app's runs, space and schedules, and the app's next refresh for them fails with `invalid_grant`. It cannot be undone, and apps that hold the provider role cannot be deleted. Reusing an app for tests is usually simpler: change its redirect URIs and keys instead.
+```bash
+crtr cloud apps delete --app-id <client id> --confirm <client id>
+```
+
+It answers `deleted: true` and `removed_grants`, the number of people's grants it removed. Each runtime deletes the app's runs, space and schedules, and the app's next refresh fails with `invalid_grant`. The app's key stops working, the app's page answers 404 and `mine` no longer lists it. It cannot be undone, and apps that hold the provider role cannot be deleted.
+
+Only you can delete: run it yourself in the terminal of your joined machine. An agent, including your chat agent, is refused with `provider_refused`: "Only you can delete an app. Ask the person to run `crtr cloud apps delete` in their terminal." Reusing an app for tests is often simpler: change its redirect URIs and keys instead.
 
 ### Let people find and install it
 
-`login_start_url` is where Northlight starts sign-in for a person who installs your app from a link. In the console, open **Profile**, and under **Marketplace** set **Sign-in start URL**, **Text welcome** (one or two plain sentences, at most 120 characters, no links) and **Listed in the marketplace**. Your `/auth/login` route from step 7 is a valid start URL. Agents can install an app for people by text only while it is listed.
+`login_start_url` is where Northlight starts sign-in for a person who installs your app from a texted link (specified behavior: pressing the texted link was not run on production, only the text send was). Your `/auth/login` route from step 7 is a valid start URL, and a loopback one is accepted:
+
+```bash
+crtr cloud apps set-listing --app-id <client id> --listed true --price free \
+  --login-start-url http://localhost:3000/auth/login \
+  --text-welcome "Texts you a summary of your day."
+```
+
+`--text-welcome` is one or two plain sentences, at most 120 characters, with no links. Agents can install an app for people by text only while it is listed (`--listed true`). `crtr cloud apps install --app-id <client id>` sends the signed-in person a text with the install link. Run it only for yourself or for a person who asked: it sends a real text.
 
 ### Rotate keys
 
-Add a new key beside the old one, switch, verify with a real sign-in, then retire the old key. Use `keygen --out local/app-key-next.json` without `--app`, paste its public JWK with **Add key** on the **Sign-in** tab, and retire the old one there. [Rotating your key](../getting-started.md#rotating-your-key) has the full sequence.
+Add a new key beside the old one, switch, verify with a real sign-in, then retire the old key:
+
+```bash
+npx @north-light/sdk keygen --out local/app-key.next.json --app <client id> --yes
+# point CROUTER_KEY_FILE at local/app-key.next.json, restart, and sign in once
+crtr cloud apps keys list --app-id <client id>
+crtr cloud apps keys retire --app-id <client id> --kid <old kid>
+```
+
+The old key keeps working until you retire it, and your app's refreshes keep working after. [Rotating your key](../getting-started.md#rotating-your-key) has the full sequence.
 
 ## Getting a result back from a run
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.425",
+  "version": "0.3.427",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -137,7 +137,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.425",
+    "@north-light/identity": "0.3.427",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.425",
+  "version": "0.3.427",
   "description": "crouter cloud access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.425",
+  "version": "0.3.427",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.425",
+      "version": "0.3.427",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.425",
+        "@north-light/identity": "0.3.427",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12095,17 +12095,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.425",
+      "version": "0.3.427",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.425",
+      "version": "0.3.427",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.425",
+      "version": "0.3.427",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12113,20 +12113,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.425",
+      "version": "0.3.427",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.425",
-        "@north-light/identity": "0.3.425"
+        "@north-light/api": "0.3.427",
+        "@north-light/identity": "0.3.427"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.425",
+      "version": "0.3.427",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.425",
-        "@north-light/identity": "0.3.425",
+        "@north-light/api": "0.3.427",
+        "@north-light/identity": "0.3.427",
         "jose": "^6.2.1"
       },
       "bin": {