@north-light/cli 0.3.485 → 0.3.487

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.485",
+  "version": "0.3.487",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -137,7 +137,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.485",
+    "@north-light/identity": "0.3.487",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/dist/index.d.ts

@@ -22,7 +22,7 @@ export interface IdTokenClaims extends JWTPayload {
     family_name?: string;
     picture?: string;
 }
-export type Scope = 'crtr:llm' | 'crtr:act' | 'crtr:schedule' | `crtr:memory:${'read' | 'rw'}:user${'' | `:${string}`}` | 'crtr:memory:manage:user' | `crtr:memory:${'read' | 'rw'}:app:${string}` | `crtr:files:${'read' | 'rw'}:${'user' | `app:${string}`}:${string}` | 'crtr:files:share' | `crtr:${'conversations' | 'objects'}:read:app:${string}` | `crtr:objects:${'message' | 'spawn'}:app:${string}` | `crtr:objects:${'read' | 'watch' | 'link' | 'write'}:${'user' | 'node' | `profile:${string}` | `app:${string}`}` | `crtr:peer:${string}` | `${string}:${string}`;
+export type Scope = 'crtr:llm' | 'crtr:act' | 'crtr:schedule' | `crtr:memory:${'read' | 'rw'}:user${'' | `:${string}`}` | 'crtr:memory:manage:user' | 'crtr:memory:read_private:user' | `crtr:memory:${'read' | 'rw'}:app:${string}` | `crtr:files:${'read' | 'rw'}:${'user' | `app:${string}`}:${string}` | 'crtr:files:share' | `crtr:${'conversations' | 'objects'}:read:app:${string}` | `crtr:objects:${'message' | 'spawn'}:app:${string}` | `crtr:objects:${'read' | 'watch' | 'link' | 'write'}:${'user' | 'node' | `profile:${string}` | `app:${string}`}` | `crtr:peer:${string}` | `${string}:${string}`;
 /** App-memory form keys omit the app id. */
 export declare const ENFORCED: ReadonlySet<string>;
 export declare function parseScope(value: string, grantee?: string): Scope;
@@ -67,6 +67,7 @@ export declare class JwksCache {
     private fetchKeys;
     forKid(kid: string | undefined): Promise<JSONWebKeySet>;
 }
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export declare function verifyAccessToken(options: {
     token: string;
     jwks: JSONWebKeySet | JwksCache;
@@ -95,6 +96,7 @@ export interface MachineTokenClaims extends JWTPayload {
  * refused, so an app grant token never verifies here; `verifyAccessToken` requires an `app:` grantee, so a machine
  * token never verifies there.
  */
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export declare function verifyMachineToken(options: {
     token: string;
     jwks: JSONWebKeySet | JwksCache;
@@ -133,12 +135,65 @@ export interface OutboundTokenClaims extends JWTPayload {
  * an `app:` or `user:` principal; the remaining claims are checked for presence and type only; which of them gates a
  * call is the caller's rule (D3-TOK-13 gates on `scope` alone, and nothing gates on `act`).
  */
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export declare function verifyOutboundToken(options: {
     token: string;
     jwks: JSONWebKeySet | JwksCache;
     issuer: string;
     audience: string;
 }): Promise<OutboundTokenClaims>;
+/** One link of a call token's actor chain. `grant` and `rev` appear only on an `app:` link. */
+export interface CallLink {
+    sub: string;
+    grant?: string;
+    rev?: number;
+}
+/** The verified payload of a call token. Fields beyond `sub`/`aud`/`client_id` are present on some uses only. */
+export interface CallTokenClaims extends JWTPayload {
+    iss: string;
+    aud: string;
+    /** The caller's person, `user:<id>`. */
+    sub: string;
+    client_id: string;
+    exp: number;
+    iat: number;
+    /** The RFC 8693 actor chain as signed; absent on the legacy shapes. */
+    act?: unknown;
+    scope?: string;
+    /** Legacy same-account machine token (removed at the flag flip). */
+    machine_id?: string;
+    grantee?: string;
+    initiating_app?: string;
+    grant?: string;
+    rev?: number;
+}
+/** A verified call token. The verifier authorizes nothing: the caller decides authority from `chain`. */
+export interface CallToken {
+    /** `user:<id>`. */
+    sub: string;
+    aud: string;
+    /** The actor chain, index 0 = the presenter. Legacy shapes are normalized to the same form. */
+    chain: CallLink[];
+    /** Present only on provider tokens. */
+    scope?: string;
+    claims: CallTokenClaims;
+}
+/**
+ * Verifies a call token of any use (peer, app access, outbound provider, run notice) and returns its actor chain,
+ * presenter first. Checks in order: header `typ` `at+jwt`, `alg` ES256 or RS256, non-empty `kid`; signature; `iss`;
+ * `aud` a string equal to `audience`; `exp` and `iat` numbers; `sub` = `user:<id>`; `client_id` non-empty; `scope`
+ * a string when present; then the chain. Without `act` the legacy machine token (`machine_id`, `grantee` = `sub`)
+ * and the legacy app token (`app:` `grantee` + `grant` + `rev`) are normalized to a one-link chain; with `act` any
+ * `machine_id` must equal the first link, any top-level `grant` an app link's, and, on a token without `scope`, any `grantee`
+ * and `rev` the app link's (or, with no app link, `grantee` = `sub` and no `rev`). It authorizes nothing.
+ * Throws `MissingRevClaimError` for an `app:` link carrying `grant` and no `rev`.
+ */
+export declare function verifyCallToken(options: {
+    token: string;
+    jwks: JSONWebKeySet | JwksCache;
+    issuer: string;
+    audience: string;
+}): Promise<CallToken>;
 export interface SyncNoticeClaims extends JWTPayload {
     purpose: 'grant_sync';
     iat: number;

package/packages/crouter-identity/dist/index.js

@@ -21,6 +21,9 @@ function selector(value) {
         return { kind: 'share', value };
     if (value === 'crtr:memory:manage:user')
         return { kind: 'memory', access: 'manage', holder: 'user' };
+    // Read-only access to the person's `public` and `private` memory (never `friends`). It names no document path.
+    if (value === 'crtr:memory:read_private:user')
+        return { kind: 'memory', access: 'read_private', holder: 'user' };
     let match = /^crtr:memory:(read|rw):user(?::(.+))?$/.exec(value);
     if (match && (match[2] === undefined || validPath(match[2])))
         return { kind: 'memory', access: match[1], holder: 'user', path: match[2] };
@@ -212,6 +215,7 @@ function validatePrincipal(value, kind) {
 function keySet(jwks, kid) {
     return jwks instanceof JwksCache ? jwks.forKid(kid) : Promise.resolve(jwks);
 }
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export async function verifyAccessToken(options) {
     const header = decodeProtectedHeader(options.token);
     if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
@@ -238,6 +242,7 @@ export async function verifyAccessToken(options) {
  * refused, so an app grant token never verifies here; `verifyAccessToken` requires an `app:` grantee, so a machine
  * token never verifies there.
  */
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export async function verifyMachineToken(options) {
     const header = decodeProtectedHeader(options.token);
     if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
@@ -270,6 +275,7 @@ function isActor(value) {
  * an `app:` or `user:` principal; the remaining claims are checked for presence and type only; which of them gates a
  * call is the caller's rule (D3-TOK-13 gates on `scope` alone, and nothing gates on `act`).
  */
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export async function verifyOutboundToken(options) {
     const header = decodeProtectedHeader(options.token);
     if (header.typ !== 'at+jwt' || (header.alg !== 'ES256' && header.alg !== 'RS256'))
@@ -288,6 +294,120 @@ export async function verifyOutboundToken(options) {
     }
     return payload;
 }
+const MAX_CHAIN_DEPTH = 8;
+const DEVELOPER_CREDENTIAL_LINK = /^developer-credential:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function isDeveloperCredential(value) {
+    return typeof value === 'string' && DEVELOPER_CREDENTIAL_LINK.test(value);
+}
+/** The only envelope a `developer-credential:<uuid>` link may sit in: the token the directory's developer login mints for
+ *  `cloud:developer`, whose grantee and initiating app are the person themself and which carries no machine, grant or revision. */
+function isDeveloperCredentialEnvelope(p) {
+    return p.client_id === 'developer-credential' && p.scope === 'cloud:developer' && p.grantee === p.sub && p.initiating_app === p.sub &&
+        p.machine_id === undefined && p.grant === undefined && p.rev === undefined;
+}
+function chainOf(payload) {
+    const p = payload;
+    const bad = () => { throw new Error('Invalid call token claims'); };
+    const appLink = (sub, grant, rev) => {
+        if (grant === undefined)
+            return { sub };
+        if (typeof grant !== 'string' || grant === '')
+            return bad();
+        if (rev === undefined)
+            throw new MissingRevClaimError();
+        if (typeof rev !== 'number' || !Number.isInteger(rev) || rev < 1)
+            return bad();
+        return { sub, grant, rev };
+    };
+    if (p.act === undefined) {
+        if (p.machine_id !== undefined) {
+            if (!validatePrincipal(p.machine_id, 'runtime') || p.grantee !== p.sub ||
+                p.grant !== undefined || p.rev !== undefined || p.scope !== undefined)
+                return bad();
+            return [{ sub: p.machine_id }];
+        }
+        if (validatePrincipal(p.grantee, 'app') && typeof p.grant === 'string')
+            return [appLink(p.grantee, p.grant, p.rev)];
+        return bad();
+    }
+    const chain = [];
+    let node = p.act;
+    while (node !== undefined) {
+        if (chain.length >= MAX_CHAIN_DEPTH)
+            return bad();
+        if (typeof node !== 'object' || node === null || Array.isArray(node))
+            return bad();
+        const link = node;
+        if (isDeveloperCredential(link.sub)) {
+            // The one restricted actor beyond runtime/app/user: the directory's developer-CLI token. It verifies and grants nothing else.
+            if (chain.length !== 0 || Object.keys(node).length !== 1 || !isDeveloperCredentialEnvelope(p))
+                return bad();
+            chain.push({ sub: link.sub });
+            break;
+        }
+        if (!(validatePrincipal(link.sub, 'runtime') || validatePrincipal(link.sub, 'app') || validatePrincipal(link.sub, 'user')))
+            return bad();
+        if (link.sub.startsWith('app:'))
+            chain.push(appLink(link.sub, link.grant, link.rev));
+        else if (link.grant !== undefined || link.rev !== undefined)
+            return bad();
+        else
+            chain.push({ sub: link.sub });
+        node = link.act;
+    }
+    if (p.machine_id !== undefined && p.machine_id !== chain[0].sub)
+        return bad();
+    if (p.grant !== undefined && !chain.some((l) => l.sub.startsWith('app:') && l.grant === p.grant))
+        return bad();
+    // A superset token's other legacy fields must say what its chain says, or the old and new verifiers authorize different
+    // identities from one signed token. Provider tokens (`scope`) are exempt: their `grantee` is the person or app the call
+    // runs for, not a link of the chain.
+    if (p.scope === undefined) {
+        const appLinks = chain.filter((l) => l.sub.startsWith('app:'));
+        const appLink = appLinks.find((l) => l.grant !== undefined && l.grant === p.grant) ?? appLinks[0];
+        if (appLink !== undefined) {
+            if (p.grantee !== undefined && p.grantee !== appLink.sub)
+                return bad();
+            if (p.rev !== undefined && p.rev !== appLink.rev)
+                return bad();
+        }
+        else if (chain[0].sub.startsWith('runtime:')) {
+            if (p.grantee !== undefined && p.grantee !== p.sub)
+                return bad();
+            if (p.rev !== undefined)
+                return bad();
+        }
+    }
+    return chain;
+}
+/**
+ * Verifies a call token of any use (peer, app access, outbound provider, run notice) and returns its actor chain,
+ * presenter first. Checks in order: header `typ` `at+jwt`, `alg` ES256 or RS256, non-empty `kid`; signature; `iss`;
+ * `aud` a string equal to `audience`; `exp` and `iat` numbers; `sub` = `user:<id>`; `client_id` non-empty; `scope`
+ * a string when present; then the chain. Without `act` the legacy machine token (`machine_id`, `grantee` = `sub`)
+ * and the legacy app token (`app:` `grantee` + `grant` + `rev`) are normalized to a one-link chain; with `act` any
+ * `machine_id` must equal the first link, any top-level `grant` an app link's, and, on a token without `scope`, any `grantee`
+ * and `rev` the app link's (or, with no app link, `grantee` = `sub` and no `rev`). It authorizes nothing.
+ * Throws `MissingRevClaimError` for an `app:` link carrying `grant` and no `rev`.
+ */
+export async function verifyCallToken(options) {
+    const header = decodeProtectedHeader(options.token);
+    if (header.typ !== 'at+jwt' || (header.alg !== 'ES256' && header.alg !== 'RS256'))
+        throw new Error('Invalid call token header');
+    if (!nonEmptyString(header.kid))
+        throw new Error('Call token has no key id');
+    const keys = await keySet(options.jwks, header.kid);
+    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
+        issuer: options.issuer, audience: options.audience, algorithms: ['ES256', 'RS256'], typ: 'at+jwt', requiredClaims: ['exp'],
+    });
+    if (payload.aud !== options.audience || typeof payload.exp !== 'number' || typeof payload.iat !== 'number' ||
+        !validatePrincipal(payload.sub, 'user') || !nonEmptyString(payload.client_id) ||
+        (payload.scope !== undefined && typeof payload.scope !== 'string')) {
+        throw new Error('Invalid call token claims');
+    }
+    const chain = chainOf(payload);
+    return { sub: payload.sub, aud: payload.aud, chain, ...(payload.scope === undefined ? {} : { scope: payload.scope }), claims: payload };
+}
 /** The directory's grant-sync notice: ES256 with the directory signing key named
  *  by `kid`, no `typ`, `aud` = the runtime's registered URL, a lifetime of at most
  *  five minutes, and a `jti` the runtime uses to answer replays without a sync. */

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.485",
+  "version": "0.3.487",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.485",
+  "version": "0.3.487",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.485",
+      "version": "0.3.487",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.485",
+        "@north-light/identity": "0.3.487",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12116,17 +12116,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.485",
+      "version": "0.3.487",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.485",
+      "version": "0.3.487",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.485",
+      "version": "0.3.487",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12134,20 +12134,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.485",
+      "version": "0.3.487",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.485",
-        "@north-light/identity": "0.3.485"
+        "@north-light/api": "0.3.487",
+        "@north-light/identity": "0.3.487"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.485",
+      "version": "0.3.487",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.485",
-        "@north-light/identity": "0.3.485",
+        "@north-light/api": "0.3.487",
+        "@north-light/identity": "0.3.487",
         "jose": "^6.2.1"
       },
       "bin": {