@north-light/cli 0.3.451 → 0.3.452

package/docs/sdk/client.md

@@ -34,7 +34,7 @@ await store.save(connection);
 const client = await oauth.client(connection.userId);
 ```
 
-`oauth.client(userId)` loads the person's stored connection and returns a `ConnectedCrouter`: a `Crouter` on their runtime that refreshes its access token through the store, plus `userId` and `runtimeUrl` (the runtime it calls, as the stored connection names it). When nothing is stored for `userId` it throws `CrouterError` code `not_connected`: show "sign in again". `store` is required: `new OAuth2Client` without one throws a `CrouterError`.
+`oauth.client(userId)` loads the person's stored connection and returns a `ConnectedCrouter`: a client on their runtime that offers only what the app listener serves (`AppClient`: `runs`, `uploads`, `attachments`, `shares`, `questions`, `memory`, `providers`, `grant`, `usage`, `health`, `files.download`, `profiles.list` and `request`; the owner-daemon namespaces such as `crons`, `nodes`, `canvas`, `bash` and `files.read/write/list` are absent from its type and throw `CrouterError` if reached) and that refreshes its access token through the store, plus `userId` and `runtimeUrl` (the runtime it calls, as the stored connection names it). When nothing is stored for `userId` it throws `CrouterError` code `not_connected`: show "sign in again". `store` is required: `new OAuth2Client` without one throws a `CrouterError`.
 
 `exchangeCode` returns the person's `Connection` and is for a sign-in that requests runtime scopes. A sign-in-only request (`openid`, optionally with `email` and `profile`, and no runtime scope) gets no connection from the directory: finish it with `oauth.exchangeIdentity({code, codeVerifier, state, expectedState, nonce})`, which returns the verified `Identity` (`sub`, `email` when granted, `name`/`givenName`/`familyName` when `profile` was granted and the person has a name, `picture` (an https photo URL) when `profile` was granted and the account has a photo, and `claims`, typed `IdTokenClaims`, which the SDK also exports). When `scopes` is a literal list that includes `openid`, `authorizeUrl` types its `nonce` as `string`; a list held in a variable keeps its literal type only when declared `as const` (`const scopes = ['openid', 'email'] as const`). Pass `prompt: 'consent'` to `authorizeUrl` to show the directory's consent screen even when the person already approved these scopes. See [Signing in a visitor](./guides/apps-with-many-users.md#signing-in-a-visitor). `exchangeCode` given a sign-in-only answer throws `CrouterError` code `oauth_exchange_mismatch` and names `exchangeIdentity`.
 

package/docs/sdk/getting-started.md

@@ -20,7 +20,7 @@ That installs the `crtr` CLI and the `crtrd` daemon. You do not have to start th
 ## 2. Install the SDK in your application
 
 ```bash
-npm i --save-exact @north-light/sdk@0.3.422
+npm i --save-exact @north-light/sdk@0.3.451
 ```
 
 One dependency. It re-exports every data type you need, so you do not also install `@north-light/api`.

package/docs/sdk/guides/apps-on-northlight.md

@@ -47,10 +47,10 @@ Things to know before you join:
 ```bash
 mkdir my-app && cd my-app
 npm init -y
-npm i --save-exact @north-light/sdk@0.3.422
+npm i --save-exact @north-light/sdk@0.3.451
 ```
 
-`0.3.422` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [release notes](../release-notes.md) for the versions in between, and install the new exact version the same way.
+`0.3.451` is the version this guide was last checked against on production. To move on purpose, run `npm view @north-light/sdk dist-tags`, read the [release notes](../release-notes.md) for the versions in between, and install the new exact version the same way.
 
 Pin an exact version of `@north-light/sdk` rather than a range or `latest`. A compatibility gate between the SDK and Northlight's runtimes protects the wire, so an SDK that is too new for the runtime is refused cleanly. It does not protect the TypeScript API: a later SDK release can change a type or a method your code uses, and an unpinned install picks that up on its next `npm i`. 
 If a call fails with `426 runtime_version_unsupported`, the SDK is newer than the Northlight runtimes. This can happen briefly right after a new SDK release, until production runtimes are upgraded. Install the previous version or wait, and tell Northlight at support@northlight.ai.

package/docs/sdk/release-notes.md

@@ -7,6 +7,12 @@ description: Behavior changes in @north-light/sdk that an app must act on, newes
 
 Changes to `@north-light/sdk` that can change what an existing app sees. Newest first.
 
+## 0.3.452
+
+### `oauth.client(userId)` no longer offers methods the runtime does not serve (type change)
+
+`ConnectedCrouter` exposed every `Crouter` namespace, but a person's app listener serves only the app operations. `client.crons.*`, `client.files.read/write/list`, `client.nodes.*`, `client.canvas.*`, `client.bash`, `client.human`, `client.models`, `client.customObjects`, `client.structuredRequests`, `client.system`, `client.auth` and `client.profiles.ensure/retrieve` compiled and then failed with `404 unknown operation`. They are now absent from the type, and reading one throws `CrouterError`. `files.download` and `profiles.list` stay. Nothing that worked changes. To schedule work, call `runs.start` from your own timer; a run's agent may use `crtr cron add` under `crtr:schedule`. `new Crouter({baseURL, token})` on the owner's daemon is unchanged.
+
 ## 0.3.445
 
 ### Peer requests between an account's machines (additive, no app change)

package/docs/sdk/resources.md

@@ -37,7 +37,7 @@ Every namespace exported by the client. Namespaces are camelCase. Verbs are `cre
 | `grant` | `get` (`wait`, `since`: hold until `version` changes) | `GET /v1/grant` |
 | `health` | `get` | `GET /v1/health` |
 
-`runs`, `uploads`, `attachments`, `shares`, `questions` and the app side of `grant` and `providers` are the application-facing API an app reaches through the app listener; see [Apps on Northlight](./guides/apps-on-northlight.md) and [Apps with many users](./guides/apps-with-many-users.md). `memory` is the person's `public` documents ([Memory](./memory.md)). `system.health` (`/healthz`) is the daemon's liveness check; `health.get` is the app listener's.
+`runs`, `uploads`, `attachments`, `shares`, `questions` and the app side of `grant` and `providers` are the application-facing API an app reaches through the app listener; `oauth.client(userId)` returns a client typed to exactly that set (`AppClient`); `nodes`, `bash`, `canvas`, `crons`, `human`, `models`, `customObjects`, `structuredRequests`, `system`, `auth`, `files.read/write/list` and `profiles.ensure/retrieve` are the owner's own daemon and are not served to an app. An app schedules work with its own timer calling `runs.start`, or a run's agent runs `crtr cron add` under `crtr:schedule`. See [Apps on Northlight](./guides/apps-on-northlight.md) and [Apps with many users](./guides/apps-with-many-users.md). `memory` is the person's `public` documents ([Memory](./memory.md)). `system.health` (`/healthz`) is the daemon's liveness check; `health.get` is the app listener's.
 
 Action methods keep the product's literal name (`fork`, `revive`, `promote`, `yield`) rather than being renamed into a generic verb. Every request-capable method takes `RequestOptions` as its final argument after its path, body, or query arguments. `RequestOptions` is `{ headers?, signal?, timeout?, maxRetries? }`; stream event options exclude `timeout` and add `after`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.451",
+  "version": "0.3.452",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -137,7 +137,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.451",
+    "@north-light/identity": "0.3.452",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.451",
+  "version": "0.3.452",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.451",
+  "version": "0.3.452",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.451",
+      "version": "0.3.452",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.451",
+        "@north-light/identity": "0.3.452",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12095,17 +12095,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.451",
+      "version": "0.3.452",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.451",
+      "version": "0.3.452",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.451",
+      "version": "0.3.452",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12113,20 +12113,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.451",
+      "version": "0.3.452",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.451",
-        "@north-light/identity": "0.3.451"
+        "@north-light/api": "0.3.452",
+        "@north-light/identity": "0.3.452"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.451",
+      "version": "0.3.452",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.451",
-        "@north-light/identity": "0.3.451",
+        "@north-light/api": "0.3.452",
+        "@north-light/identity": "0.3.452",
         "jose": "^6.2.1"
       },
       "bin": {