@north-light/cli 0.3.450 → 0.3.452

package/dist/api/contract.d.ts

@@ -1,5 +1,5 @@
 /** The contract level this build serves and requires. Written by `scripts/contract.mjs release`; never edit by hand. */
-export declare const CONTRACT_LEVEL = "1.2";
+export declare const CONTRACT_LEVEL = "1.3";
 /** Request header naming the one contract level the caller needs, e.g. `1.3`. Optional: absent means no check. */
 export declare const REQUIRED_CONTRACT_HEADER = "Crouter-Required-Contract";
 /** Response header listing the contract levels the server serves, comma-separated, one per major, e.g. `1.3`. */

package/dist/api/contract.js

@@ -1 +1 @@
-var c=Object.defineProperty;var e=(r,t)=>c(r,"name",{value:t,configurable:!0});const f="1.2",i="Crouter-Required-Contract",p="Crouter-Contract";function l(r){const t=/^(\d+)\.(\d+)$/.exec(r.trim());return t===null?null:{major:Number(t[1]),minor:Number(t[2])}}e(l,"parseContractLevel");function a(r){return r==null?[]:r.split(",").map(t=>l(t)).filter(t=>t!==null)}e(a,"parseServedContracts");function s(r,t){const n=l(r);return n===null?!1:(typeof t=="string"||t===null||t===void 0?a(t):t).some(u=>u.major===n.major&&u.minor>=n.minor)}e(s,"contractSatisfies");function C(r,t,n={}){if(r===void 0)return null;if(l(r)===null)return{status:400,code:"invalid_request",param:i,message:`${i} must be a contract level like 1.0.`};if(s(r,t))return null;const o=r.trim();return{status:426,code:"runtime_version_unsupported",message:t===null||a(t).length===0?`The runtime did not name its contract level; the caller requires contract ${o} or later. Roll the runtime forward.`:`The runtime serves contract ${t}; the caller requires contract ${o} or later within the same major. Roll the runtime forward, or pin an SDK whose crouterContract the runtime serves.`,details:{sdk_version:(n.legacyMinimum??"").trim(),runtime_version:n.runtimeVersion??null,required_contract:o,runtime_contract:t}}}e(C,"contractRefusal");export{p as CONTRACT_HEADER,f as CONTRACT_LEVEL,i as REQUIRED_CONTRACT_HEADER,C as contractRefusal,s as contractSatisfies,l as parseContractLevel,a as parseServedContracts};
+var c=Object.defineProperty;var e=(r,t)=>c(r,"name",{value:t,configurable:!0});const f="1.3",i="Crouter-Required-Contract",p="Crouter-Contract";function l(r){const t=/^(\d+)\.(\d+)$/.exec(r.trim());return t===null?null:{major:Number(t[1]),minor:Number(t[2])}}e(l,"parseContractLevel");function a(r){return r==null?[]:r.split(",").map(t=>l(t)).filter(t=>t!==null)}e(a,"parseServedContracts");function s(r,t){const n=l(r);return n===null?!1:(typeof t=="string"||t===null||t===void 0?a(t):t).some(u=>u.major===n.major&&u.minor>=n.minor)}e(s,"contractSatisfies");function C(r,t,n={}){if(r===void 0)return null;if(l(r)===null)return{status:400,code:"invalid_request",param:i,message:`${i} must be a contract level like 1.0.`};if(s(r,t))return null;const o=r.trim();return{status:426,code:"runtime_version_unsupported",message:t===null||a(t).length===0?`The runtime did not name its contract level; the caller requires contract ${o} or later. Roll the runtime forward.`:`The runtime serves contract ${t}; the caller requires contract ${o} or later within the same major. Roll the runtime forward, or pin an SDK whose crouterContract the runtime serves.`,details:{sdk_version:(n.legacyMinimum??"").trim(),runtime_version:n.runtimeVersion??null,required_contract:o,runtime_contract:t}}}e(C,"contractRefusal");export{p as CONTRACT_HEADER,f as CONTRACT_LEVEL,i as REQUIRED_CONTRACT_HEADER,C as contractRefusal,s as contractSatisfies,l as parseContractLevel,a as parseServedContracts};

package/dist/builtin-memory/crouter-sdk/client.md

@@ -36,7 +36,7 @@ await store.save(connection);
 const client = await oauth.client(connection.userId);
 ```
 
-`oauth.client(userId)` loads the person's stored connection and returns a `ConnectedCrouter`: a `Crouter` on their runtime that refreshes its access token through the store, plus `userId` and `runtimeUrl` (the runtime it calls, as the stored connection names it). When nothing is stored for `userId` it throws `CrouterError` code `not_connected`: show "sign in again". `store` is required: `new OAuth2Client` without one throws a `CrouterError`.
+`oauth.client(userId)` loads the person's stored connection and returns a `ConnectedCrouter`: a client on their runtime that offers only what the app listener serves (`AppClient`: `runs`, `uploads`, `attachments`, `shares`, `questions`, `memory`, `providers`, `grant`, `usage`, `health`, `files.download`, `profiles.list` and `request`; the owner-daemon namespaces such as `crons`, `nodes`, `canvas`, `bash` and `files.read/write/list` are absent from its type and throw `CrouterError` if reached) and that refreshes its access token through the store, plus `userId` and `runtimeUrl` (the runtime it calls, as the stored connection names it). When nothing is stored for `userId` it throws `CrouterError` code `not_connected`: show "sign in again". `store` is required: `new OAuth2Client` without one throws a `CrouterError`.
 
 `exchangeCode` returns the person's `Connection` and is for a sign-in that requests runtime scopes. A sign-in-only request (`openid`, optionally with `email` and `profile`, and no runtime scope) gets no connection from the directory: finish it with `oauth.exchangeIdentity({code, codeVerifier, state, expectedState, nonce})`, which returns the verified `Identity` (`sub`, `email` when granted, `name`/`givenName`/`familyName` when `profile` was granted and the person has a name, `picture` (an https photo URL) when `profile` was granted and the account has a photo, and `claims`, typed `IdTokenClaims`, which the SDK also exports). When `scopes` is a literal list that includes `openid`, `authorizeUrl` types its `nonce` as `string`; a list held in a variable keeps its literal type only when declared `as const` (`const scopes = ['openid', 'email'] as const`). Pass `prompt: 'consent'` to `authorizeUrl` to show the directory's consent screen even when the person already approved these scopes. See [[crouter-sdk/guides/apps-with-many-users]]. `exchangeCode` given a sign-in-only answer throws `CrouterError` code `oauth_exchange_mismatch` and names `exchangeIdentity`.
 

package/dist/builtin-memory/crouter-sdk/getting-started.md

@@ -22,7 +22,7 @@ That installs the `crtr` CLI and the `crtrd` daemon. You do not have to start th
 ## 2. Install the SDK in your application
 
 ```bash
-npm i --save-exact @north-light/sdk@0.3.422
+npm i --save-exact @north-light/sdk@0.3.451
 ```
 
 One dependency. It re-exports every data type you need, so you do not also install `@north-light/api`.

package/dist/builtin-memory/crouter-sdk/guides/apps-on-northlight.md

@@ -51,10 +51,10 @@ Things to know before you join:
 ```bash
 mkdir my-app && cd my-app
 npm init -y
-npm i --save-exact @north-light/sdk@0.3.422
+npm i --save-exact @north-light/sdk@0.3.451
 ```
 
-`0.3.422` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [[crouter-sdk/release-notes]] for the versions in between, and install the new exact version the same way.
+`0.3.451` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [[crouter-sdk/release-notes]] for the versions in between, and install the new exact version the same way.
 
 Pin an exact version of `@north-light/sdk` rather than a range or `latest`. A compatibility gate between the SDK and Northlight's runtimes protects the wire, so an SDK that is too new for the runtime is refused cleanly. It does not protect the TypeScript API: a later SDK release can change a type or a method your code uses, and an unpinned install picks that up on its next `npm i`. 
 If a call fails with `426 runtime_version_unsupported`, the SDK is newer than the Northlight runtimes. This can happen briefly right after a new SDK release, until production runtimes are upgraded. Install the previous version or wait, and tell Northlight at support@northlight.ai.

package/dist/builtin-memory/crouter-sdk/release-notes.md

@@ -9,6 +9,12 @@ when-and-why-to-read: When you need Release notes, this knowledge should be read
 
 Changes to `@north-light/sdk` that can change what an existing app sees. Newest first.
 
+## 0.3.452
+
+### `oauth.client(userId)` no longer offers methods the runtime does not serve (type change)
+
+`ConnectedCrouter` exposed every `Crouter` namespace, but a person's app listener serves only the app operations. `client.crons.*`, `client.files.read/write/list`, `client.nodes.*`, `client.canvas.*`, `client.bash`, `client.human`, `client.models`, `client.customObjects`, `client.structuredRequests`, `client.system`, `client.auth` and `client.profiles.ensure/retrieve` compiled and then failed with `404 unknown operation`. They are now absent from the type, and reading one throws `CrouterError`. `files.download` and `profiles.list` stay. Nothing that worked changes. To schedule work, call `runs.start` from your own timer; a run's agent may use `crtr cron add` under `crtr:schedule`. `new Crouter({baseURL, token})` on the owner's daemon is unchanged.
+
 ## 0.3.445
 
 ### Peer requests between an account's machines (additive, no app change)

package/dist/builtin-memory/crouter-sdk/resources.md

@@ -39,7 +39,7 @@ Every namespace exported by the client. Namespaces are camelCase. Verbs are `cre
 | `grant` | `get` (`wait`, `since`: hold until `version` changes) | `GET /v1/grant` |
 | `health` | `get` | `GET /v1/health` |
 
-`runs`, `uploads`, `attachments`, `shares`, `questions` and the app side of `grant` and `providers` are the application-facing API an app reaches through the app listener; see [[crouter-sdk/guides/apps-on-northlight]] and [[crouter-sdk/guides/apps-with-many-users]]. `memory` is the person's `public` documents ([[crouter-sdk/memory]]). `system.health` (`/healthz`) is the daemon's liveness check; `health.get` is the app listener's.
+`runs`, `uploads`, `attachments`, `shares`, `questions` and the app side of `grant` and `providers` are the application-facing API an app reaches through the app listener; `oauth.client(userId)` returns a client typed to exactly that set (`AppClient`); `nodes`, `bash`, `canvas`, `crons`, `human`, `models`, `customObjects`, `structuredRequests`, `system`, `auth`, `files.read/write/list` and `profiles.ensure/retrieve` are the owner's own daemon and are not served to an app. An app schedules work with its own timer calling `runs.start`, or a run's agent runs `crtr cron add` under `crtr:schedule`. See [[crouter-sdk/guides/apps-on-northlight]] and [[crouter-sdk/guides/apps-with-many-users]]. `memory` is the person's `public` documents ([[crouter-sdk/memory]]). `system.health` (`/healthz`) is the daemon's liveness check; `health.get` is the app listener's.
 
 Action methods keep the product's literal name (`fork`, `revive`, `promote`, `yield`) rather than being renamed into a generic verb. Every request-capable method takes `RequestOptions` as its final argument after its path, body, or query arguments. `RequestOptions` is `{ headers?, signal?, timeout?, maxRetries? }`; stream event options exclude `timeout` and add `after`.
 

package/docs/ci-runner.md

@@ -26,10 +26,10 @@ A pull request from a fork always runs on `macos-latest`, whatever the variable
 
 Isolation, per instance `~/ci-runners/crouter-N/`:
 
-- its own runner directory and `_work` checkout;
+- its own runner directory, and its own **short** work directory `/Users/Shared/ci/N` (checkout and `_temp`; override with `CI_RUNNER_WORK`). Short is a requirement: the suite binds unix sockets under `$RUNNER_TEMP/t` (the workflow sets `TMPDIR` there), and macOS refuses a socket path over 104 bytes with `listen EINVAL`. The longest test socket adds ~76 bytes, so the work dir plus `/_temp/t` must stay under ~27 (hosted runners use `/Users/runner/work/_temp/t`, 26). Do not put the work dir under the account's home;
 - its own `HOME` (`~/ci-runners/crouter-N/home`), never the account's. The suite refuses to start if `$HOME/.crouter` exists, so the account's own crouter install (`~/.crouter`, the selected runtime, `~/.local/bin/crtr`, any running `crtrd`) is neither read nor written;
 - a minimal `PATH` (Homebrew + system) that does not include the account's crtr or npm globals;
-- `hook-job-started.sh` / `hook-job-completed.sh` (`ACTIONS_RUNNER_HOOK_JOB_*`), which kill every process whose environment or command line points into that instance's directory (brokers, `crtrd`, test tmux servers, orphaned node processes) and wipe `home/.crouter*` and `_temp`. They match only that instance's path, so one instance's cleanup cannot touch another's job or the account's processes.
+- `hook-job-started.sh` / `hook-job-completed.sh` (`ACTIONS_RUNNER_HOOK_JOB_*`), which kill every process whose environment or command line points into that instance's directory (brokers, `crtrd`, test tmux servers, orphaned node processes) and wipe `home/.crouter*` and the work dir's `_temp`. They match only that instance's path, so one instance's cleanup cannot touch another's job or the account's processes.
 
 The tests bind unix sockets under per-test temp dirs and tmux servers under the per-test `HOME`, with no fixed TCP ports, so instances do not collide.
 

package/docs/sdk/client.md

@@ -34,7 +34,7 @@ await store.save(connection);
 const client = await oauth.client(connection.userId);
 ```
 
-`oauth.client(userId)` loads the person's stored connection and returns a `ConnectedCrouter`: a `Crouter` on their runtime that refreshes its access token through the store, plus `userId` and `runtimeUrl` (the runtime it calls, as the stored connection names it). When nothing is stored for `userId` it throws `CrouterError` code `not_connected`: show "sign in again". `store` is required: `new OAuth2Client` without one throws a `CrouterError`.
+`oauth.client(userId)` loads the person's stored connection and returns a `ConnectedCrouter`: a client on their runtime that offers only what the app listener serves (`AppClient`: `runs`, `uploads`, `attachments`, `shares`, `questions`, `memory`, `providers`, `grant`, `usage`, `health`, `files.download`, `profiles.list` and `request`; the owner-daemon namespaces such as `crons`, `nodes`, `canvas`, `bash` and `files.read/write/list` are absent from its type and throw `CrouterError` if reached) and that refreshes its access token through the store, plus `userId` and `runtimeUrl` (the runtime it calls, as the stored connection names it). When nothing is stored for `userId` it throws `CrouterError` code `not_connected`: show "sign in again". `store` is required: `new OAuth2Client` without one throws a `CrouterError`.
 
 `exchangeCode` returns the person's `Connection` and is for a sign-in that requests runtime scopes. A sign-in-only request (`openid`, optionally with `email` and `profile`, and no runtime scope) gets no connection from the directory: finish it with `oauth.exchangeIdentity({code, codeVerifier, state, expectedState, nonce})`, which returns the verified `Identity` (`sub`, `email` when granted, `name`/`givenName`/`familyName` when `profile` was granted and the person has a name, `picture` (an https photo URL) when `profile` was granted and the account has a photo, and `claims`, typed `IdTokenClaims`, which the SDK also exports). When `scopes` is a literal list that includes `openid`, `authorizeUrl` types its `nonce` as `string`; a list held in a variable keeps its literal type only when declared `as const` (`const scopes = ['openid', 'email'] as const`). Pass `prompt: 'consent'` to `authorizeUrl` to show the directory's consent screen even when the person already approved these scopes. See [Signing in a visitor](./guides/apps-with-many-users.md#signing-in-a-visitor). `exchangeCode` given a sign-in-only answer throws `CrouterError` code `oauth_exchange_mismatch` and names `exchangeIdentity`.
 

package/docs/sdk/getting-started.md

@@ -20,7 +20,7 @@ That installs the `crtr` CLI and the `crtrd` daemon. You do not have to start th
 ## 2. Install the SDK in your application
 
 ```bash
-npm i --save-exact @north-light/sdk@0.3.422
+npm i --save-exact @north-light/sdk@0.3.451
 ```
 
 One dependency. It re-exports every data type you need, so you do not also install `@north-light/api`.

package/docs/sdk/guides/apps-on-northlight.md

@@ -47,10 +47,10 @@ Things to know before you join:
 ```bash
 mkdir my-app && cd my-app
 npm init -y
-npm i --save-exact @north-light/sdk@0.3.422
+npm i --save-exact @north-light/sdk@0.3.451
 ```
 
-`0.3.422` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [release notes](../release-notes.md) for the versions in between, and install the new exact version the same way.
+`0.3.451` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [release notes](../release-notes.md) for the versions in between, and install the new exact version the same way.
 
 Pin an exact version of `@north-light/sdk` rather than a range or `latest`. A compatibility gate between the SDK and Northlight's runtimes protects the wire, so an SDK that is too new for the runtime is refused cleanly. It does not protect the TypeScript API: a later SDK release can change a type or a method your code uses, and an unpinned install picks that up on its next `npm i`. 
 If a call fails with `426 runtime_version_unsupported`, the SDK is newer than the Northlight runtimes. This can happen briefly right after a new SDK release, until production runtimes are upgraded. Install the previous version or wait, and tell Northlight at support@northlight.ai.

package/docs/sdk/release-notes.md

@@ -7,6 +7,12 @@ description: Behavior changes in @north-light/sdk that an app must act on, newes
 
 Changes to `@north-light/sdk` that can change what an existing app sees. Newest first.
 
+## 0.3.452
+
+### `oauth.client(userId)` no longer offers methods the runtime does not serve (type change)
+
+`ConnectedCrouter` exposed every `Crouter` namespace, but a person's app listener serves only the app operations. `client.crons.*`, `client.files.read/write/list`, `client.nodes.*`, `client.canvas.*`, `client.bash`, `client.human`, `client.models`, `client.customObjects`, `client.structuredRequests`, `client.system`, `client.auth` and `client.profiles.ensure/retrieve` compiled and then failed with `404 unknown operation`. They are now absent from the type, and reading one throws `CrouterError`. `files.download` and `profiles.list` stay. Nothing that worked changes. To schedule work, call `runs.start` from your own timer; a run's agent may use `crtr cron add` under `crtr:schedule`. `new Crouter({baseURL, token})` on the owner's daemon is unchanged.
+
 ## 0.3.445
 
 ### Peer requests between an account's machines (additive, no app change)

package/docs/sdk/resources.md

@@ -37,7 +37,7 @@ Every namespace exported by the client. Namespaces are camelCase. Verbs are `cre
 | `grant` | `get` (`wait`, `since`: hold until `version` changes) | `GET /v1/grant` |
 | `health` | `get` | `GET /v1/health` |
 
-`runs`, `uploads`, `attachments`, `shares`, `questions` and the app side of `grant` and `providers` are the application-facing API an app reaches through the app listener; see [Apps on Northlight](./guides/apps-on-northlight.md) and [Apps with many users](./guides/apps-with-many-users.md). `memory` is the person's `public` documents ([Memory](./memory.md)). `system.health` (`/healthz`) is the daemon's liveness check; `health.get` is the app listener's.
+`runs`, `uploads`, `attachments`, `shares`, `questions` and the app side of `grant` and `providers` are the application-facing API an app reaches through the app listener; `oauth.client(userId)` returns a client typed to exactly that set (`AppClient`); `nodes`, `bash`, `canvas`, `crons`, `human`, `models`, `customObjects`, `structuredRequests`, `system`, `auth`, `files.read/write/list` and `profiles.ensure/retrieve` are the owner's own daemon and are not served to an app. An app schedules work with its own timer calling `runs.start`, or a run's agent runs `crtr cron add` under `crtr:schedule`. See [Apps on Northlight](./guides/apps-on-northlight.md) and [Apps with many users](./guides/apps-with-many-users.md). `memory` is the person's `public` documents ([Memory](./memory.md)). `system.health` (`/healthz`) is the daemon's liveness check; `health.get` is the app listener's.
 
 Action methods keep the product's literal name (`fork`, `revive`, `promote`, `yield`) rather than being renamed into a generic verb. Every request-capable method takes `RequestOptions` as its final argument after its path, body, or query arguments. `RequestOptions` is `{ headers?, signal?, timeout?, maxRetries? }`; stream event options exclude `timeout` and add `after`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.450",
+  "version": "0.3.452",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -137,7 +137,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.450",
+    "@north-light/identity": "0.3.452",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.450",
+  "version": "0.3.452",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.450",
+  "version": "0.3.452",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.450",
+      "version": "0.3.452",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.450",
+        "@north-light/identity": "0.3.452",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12095,17 +12095,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.450",
+      "version": "0.3.452",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.450",
+      "version": "0.3.452",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.450",
+      "version": "0.3.452",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12113,20 +12113,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.450",
+      "version": "0.3.452",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.450",
-        "@north-light/identity": "0.3.450"
+        "@north-light/api": "0.3.452",
+        "@north-light/identity": "0.3.452"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.450",
+      "version": "0.3.452",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.450",
-        "@north-light/identity": "0.3.450",
+        "@north-light/api": "0.3.452",
+        "@north-light/identity": "0.3.452",
         "jose": "^6.2.1"
       },
       "bin": {