@north-light/cli 0.3.491 → 0.3.492

package/dist/core/graph/access.d.ts

@@ -15,6 +15,9 @@ export declare function isShipped(db: DatabaseSync, object: ObjectRow): boolean;
 export declare function toolApps(db: DatabaseSync, reader: Reader): ObjectRow[];
 /** May `reader` use any of `app`'s tool groups? v0: every run may use every installed plugin's tools. */
 export declare function mayUseTools(_db: DatabaseSync, _reader: Reader, app: ObjectRow): boolean;
+/** Whether `scopes` hold a provider-group scope `<provider>:<group>` of `app`: what a run needs to call that app's provider commands
+ *  (`requireGroup`). The provider id is the app's client id. */
+export declare function holdsProviderGroup(db: DatabaseSync, scopes: readonly string[], app: ObjectRow): boolean;
 /** Whether this reader may register, publish or watch as an object owned by `owner`. */
 export declare function mayActAs(db: DatabaseSync, reader: Reader, owner: ObjectRow): boolean;
 /** Run confinement for a node acting on a custom object of its app (Silas, 2026-09-30):

package/dist/core/graph/access.js

@@ -1,8 +1,8 @@
-var O=Object.defineProperty;var s=(e,t)=>O(e,"name",{value:t,configurable:!0});import{prepared as a}from"../sqlite-statements.js";import{covers as R}from"@north-light/identity";import{objectPlace as N,runPlace as L,runsSeeEachOther as g}from"../runs/confinement.js";import{missingOwnMemoryScope as E}from"./spaces/own-memory.js";import{SPACES as x,identityOf as f}from"./spaces/index.js";import{insideRepo as C}from"./spaces/repo.js";function T(e,t){return a(e,`WITH RECURSIVE chain(rowid, depth) AS (
+var R=Object.defineProperty;var s=(n,t)=>R(n,"name",{value:t,configurable:!0});import{prepared as f}from"../sqlite-statements.js";import{covers as O}from"@north-light/identity";import{objectPlace as x,runPlace as N,runsSeeEachOther as g}from"../runs/confinement.js";import{missingOwnMemoryScope as E}from"./spaces/own-memory.js";import{SPACES as L,identityOf as u}from"./spaces/index.js";import{insideRepo as C}from"./spaces/repo.js";function T(n,t){return f(n,`WITH RECURSIVE chain(rowid, depth) AS (
       SELECT owner, 1 FROM objects WHERE rowid = ? AND owner IS NOT NULL
       UNION ALL
       SELECT o.owner, c.depth + 1 FROM objects o JOIN chain c ON o.rowid = c.rowid WHERE o.owner IS NOT NULL
-    ) SELECT o.* FROM chain c CROSS JOIN objects o WHERE o.rowid = c.rowid ORDER BY c.depth`).all(t.rowid)}s(T,"ownerChain");function v(e,t){return c(e,t).space}s(v,"spaceOf");function c(e,t){const n=T(e,t),p=n.length?n[n.length-1]:t,o=x[p.type];if(!o)throw new Error(`${t.type} ${t.id} has no space: its owner chain ends at ${p.type} ${p.id}`);const r=n.length?[...n.slice(0,-1).reverse(),t]:[];return{space:p,path:r,impl:o}}s(c,"locate");function m(e,t){return t.type!=="document"?!1:a(e,"SELECT source_path FROM documents WHERE object = ?").get(t.rowid)?.source_path!=null}s(m,"isShipped");function J(e,t){return a(e,`SELECT a.* FROM objects a WHERE a.type = 'app' AND a.deleted_at IS NULL AND EXISTS (
+    ) SELECT o.* FROM chain c CROSS JOIN objects o WHERE o.rowid = c.rowid ORDER BY c.depth`).all(t.rowid)}s(T,"ownerChain");function J(n,t){return c(n,t).space}s(J,"spaceOf");function c(n,t){const e=T(n,t),p=e.length?e[e.length-1]:t,o=L[p.type];if(!o)throw new Error(`${t.type} ${t.id} has no space: its owner chain ends at ${p.type} ${p.id}`);const r=e.length?[...e.slice(0,-1).reverse(),t]:[];return{space:p,path:r,impl:o}}s(c,"locate");function m(n,t){return t.type!=="document"?!1:f(n,"SELECT source_path FROM documents WHERE object = ?").get(t.rowid)?.source_path!=null}s(m,"isShipped");function B(n,t){return f(n,`SELECT a.* FROM objects a WHERE a.type = 'app' AND a.deleted_at IS NULL AND EXISTS (
       SELECT 1 FROM objects o JOIN documents d ON d.object = o.rowid
       WHERE o.owner = a.rowid AND o.type = 'document' AND o.deleted_at IS NULL AND d.source_path IS NOT NULL)
-    ORDER BY a.name = 'crtr', a.name`).all().filter(p=>h(e,t,p))}s(J,"toolApps");function h(e,t,n){return n.type==="app"}s(h,"mayUseTools");function A(e,t,n){return t.class==="person"?!0:t.class==="object"?t.owner.rowid===n.rowid:t.class==="app"?t.app.rowid===n.rowid||n.type==="profile"&&n.owner===t.app.rowid:t.app.rowid===n.rowid||n.type==="profile"&&t.profile?.rowid===n.rowid||n.type==="repo"&&C(e,t,n,"rw")}s(A,"mayActAs");function I(e,t,n){if(t.class!=="node"&&!(t.class==="app"&&t.place!==void 0))return!0;const p=t.class==="app"?t.place:L(t.node.id,e);if(p===null)return!0;const o=N(n.rowid,e);return o===null?!p.isolated:g(p,o)}s(I,"customReachable");const w=s(e=>e.type.includes("."),"isCustom");function P(e,t,n){return y(e,c(e,t),t,n)}s(P,"objectsTargets");function y(e,{space:t,path:n},p,o){const r=[];if(t.type==="person")r.push("user");else if(t.type==="app"&&n.length>0){const i=n[0];if(i.type==="profile")n.length>1&&r.push(`profile:${f(e,i).external_id}`);else if(i.type==="node"||w(i)){const u=f(e,t).external_id;u!==o&&r.push(u)}}return p.type==="node"&&r.push("node"),r}s(y,"targetsOf");function l(e,t,n,p,o){if(t.class==="person"||t.scopes===null)return!1;const r=t.scopes;if(r.length===0||p.space.type==="app"&&t.app.rowid===p.space.rowid)return!1;const i=f(e,t.app).external_id;return y(e,p,o,i).some(u=>{const S=`crtr:objects:${n}:${u}`;return r.some(d=>R(d,S))})}s(l,"holdsInLocated");function M(e,t,n,p){return t.class==="person"||t.scopes===null?!1:l(e,t,n,c(e,p),p)}s(M,"holdsObjectsScope");function B(e,t,n,p,o){const r=p.owner===null?null:e.prepare("SELECT * FROM objects WHERE rowid = ?").get(p.owner)??null;if(r===null)return!1;const i={class:"app",app:t,scopes:n??[]};return A(e,i,r)?n===null||M(e,i,"link",o):!1}s(B,"linkAuthorizes");function Y(e,t,n){return _(e,n)(t)}s(Y,"canRead");function _(e,t){let n=null,p=null;return o=>{if(o.class==="person")return!0;if(n??=c(e,t),n.space.type==="app"&&n.path.length>0){if(p??=m(e,t),p&&h(e,o,n.space))return!0;if(w(t)){if(o.app.rowid===n.space.rowid&&!I(e,o,t))return!1;if(t.privacy==="public"&&o.app.rowid!==n.space.rowid&&o.scopes!==null&&h(e,o,n.space))return!0}}return l(e,o,"read",n,t)||o.class==="object"&&w(o.object)&&l(e,o,"watch",n,t)?!0:n.impl.canRead(e,o,n.space,n.path,t)}}s(_,"readCheck");function z(e,t,n){if(m(e,n))return!1;const p=c(e,n);if(l(e,t,"write",p,n))return!0;const{space:o,path:r,impl:i}=p;return i.canChange(e,t,o,r,n)}s(z,"canChange");function V(e,t,n,p){if(t.class==="person")return null;const{space:o,path:r}=c(e,n);return o.type==="app"&&t.app.rowid===o.rowid?E(e,t,o,r,n,p):null}s(V,"missingMemoryScope");function X(e,t,n,p){if(t.class==="person")return null;const o=c(e,n),{space:r}=o;return r.type!=="app"||t.app.rowid!==r.rowid?null:E(e,t,r,o.path.length===0?[n]:[...o.path],null,p)}s(X,"missingMemoryScopeUnder");export{z as canChange,Y as canRead,I as customReachable,M as holdsObjectsScope,m as isShipped,B as linkAuthorizes,A as mayActAs,h as mayUseTools,V as missingMemoryScope,X as missingMemoryScopeUnder,P as objectsTargets,T as ownerChain,_ as readCheck,v as spaceOf,J as toolApps};
+    ORDER BY a.name = 'crtr', a.name`).all().filter(p=>h(n,t,p))}s(B,"toolApps");function h(n,t,e){return e.type==="app"}s(h,"mayUseTools");const A=s(n=>n.class!=="app"||n.place!==void 0,"isRun");function I(n,t,e){const p=`${u(n,e).external_id.replace(/^app:/,"")}:`;return t.some(o=>o.startsWith(p)&&!o.slice(p.length).includes(":"))}s(I,"holdsProviderGroup");function _(n,t,e){return t.class==="person"?!0:t.class==="object"?t.owner.rowid===e.rowid:t.class==="app"?t.app.rowid===e.rowid||e.type==="profile"&&e.owner===t.app.rowid:t.app.rowid===e.rowid||e.type==="profile"&&t.profile?.rowid===e.rowid||e.type==="repo"&&C(n,t,e,"rw")}s(_,"mayActAs");function M(n,t,e){if(t.class!=="node"&&!(t.class==="app"&&t.place!==void 0))return!0;const p=t.class==="app"?t.place:N(t.node.id,n);if(p===null)return!0;const o=x(e.rowid,n);return o===null?!p.isolated:g(p,o)}s(M,"customReachable");const w=s(n=>n.type.includes("."),"isCustom");function Y(n,t,e){return d(n,c(n,t),t,e)}s(Y,"objectsTargets");function d(n,{space:t,path:e},p,o){const r=[];if(t.type==="person")r.push("user");else if(t.type==="app"&&e.length>0){const i=e[0];if(i.type==="profile")e.length>1&&r.push(`profile:${u(n,i).external_id}`);else if(i.type==="node"||w(i)){const l=u(n,t).external_id;l!==o&&r.push(l)}}return p.type==="node"&&r.push("node"),r}s(d,"targetsOf");function a(n,t,e,p,o){if(t.class==="person"||t.scopes===null)return!1;const r=t.scopes;if(r.length===0||p.space.type==="app"&&t.app.rowid===p.space.rowid)return!1;const i=u(n,t.app).external_id;return d(n,p,o,i).some(l=>{const y=`crtr:objects:${e}:${l}`;return r.some(S=>O(S,y))})}s(a,"holdsInLocated");function U(n,t,e,p){return t.class==="person"||t.scopes===null?!1:a(n,t,e,c(n,p),p)}s(U,"holdsObjectsScope");function z(n,t,e,p,o){const r=p.owner===null?null:n.prepare("SELECT * FROM objects WHERE rowid = ?").get(p.owner)??null;if(r===null)return!1;const i={class:"app",app:t,scopes:e??[]};return _(n,i,r)?e===null||U(n,i,"link",o):!1}s(z,"linkAuthorizes");function G(n,t,e){return W(n,e)(t)}s(G,"canRead");function W(n,t){let e=null,p=null;return o=>{if(o.class==="person")return!0;if(e??=c(n,t),e.space.type==="app"&&e.path.length>0){if(p??=m(n,t),p&&h(n,o,e.space))return!0;if(w(t)){if(o.app.rowid===e.space.rowid&&!M(n,o,t))return!1;if(o.app.rowid!==e.space.rowid&&o.scopes!==null&&h(n,o,e.space)&&(t.privacy==="public"||A(o)&&I(n,o.scopes,e.space)))return!0}}return a(n,o,"read",e,t)||o.class==="object"&&w(o.object)&&a(n,o,"watch",e,t)?!0:e.impl.canRead(n,o,e.space,e.path,t)}}s(W,"readCheck");function V(n,t,e){if(m(n,e))return!1;const p=c(n,e);if(a(n,t,"write",p,e))return!0;const{space:o,path:r,impl:i}=p;return i.canChange(n,t,o,r,e)}s(V,"canChange");function X(n,t,e,p){if(t.class==="person")return null;const{space:o,path:r}=c(n,e);return o.type==="app"&&t.app.rowid===o.rowid?E(n,t,o,r,e,p):null}s(X,"missingMemoryScope");function q(n,t,e,p){if(t.class==="person")return null;const o=c(n,e),{space:r}=o;return r.type!=="app"||t.app.rowid!==r.rowid?null:E(n,t,r,o.path.length===0?[e]:[...o.path],null,p)}s(q,"missingMemoryScopeUnder");export{V as canChange,G as canRead,M as customReachable,U as holdsObjectsScope,I as holdsProviderGroup,m as isShipped,z as linkAuthorizes,_ as mayActAs,h as mayUseTools,X as missingMemoryScope,q as missingMemoryScopeUnder,Y as objectsTargets,T as ownerChain,W as readCheck,J as spaceOf,B as toolApps};

package/dist/core/plugin-objects-manifest.d.ts

@@ -1,21 +1,7 @@
 import type { DeclLeaf, DeclNode } from '../api/command-manifest/schema.js';
+import { KIND, LOCAL, RESERVED_KIND_ROOTS, MAX_KIND_EVENTS, MIN_EVENT_LEVEL, MAX_EVENT_LEVEL, eventCatalogReasons, objectBlocksShapeReasons, objectKindReadReasons } from '../api/command-manifest/object-kinds.js';
 import type { PluginManifest } from '../types.js';
-/**
- * The `object_kinds` and `scopes` blocks of a plugin manifest (`plugin.json`, `bundle.json`) and the one
- * validator every install, update, enable, provider-bundle and reconcile path shares. Canvas-free by
- * design: the CLI and the bundle parser import it, so it must not reach `node:sqlite` or the canvas.
- */
-export declare const KIND: RegExp;
-export declare const LOCAL: RegExp;
-/** A kind's first segment may not be one of the built-in object types. */
-export declare const RESERVED_KIND_ROOTS: readonly string[];
-export declare const MAX_KIND_EVENTS = 64;
-export declare const MIN_EVENT_LEVEL = 1;
-export declare const MAX_EVENT_LEVEL = 10;
-/** Reasons a catalog (`events` map) is invalid; shared with `registerCustomObject`. */
-export declare function eventCatalogReasons(events: unknown, where: string): string[];
-/** The JSON shape of both blocks of a raw manifest record, independent of the plugin's name and commands. */
-export declare function objectBlocksShapeReasons(record: Record<string, unknown>): string[];
+export { KIND, LOCAL, RESERVED_KIND_ROOTS, MAX_KIND_EVENTS, MIN_EVENT_LEVEL, MAX_EVENT_LEVEL, eventCatalogReasons, objectBlocksShapeReasons, objectKindReadReasons };
 /**
  * The full check. `leafPaths` holds the space-joined path of every leaf below the plugin's root command
  * (`page read` for plugin `search`'s leaf `search page read`); `streamingLeafPaths` holds those declared `rest.streaming: true`.

package/dist/core/plugin-objects-manifest.js

@@ -1 +1 @@
-var b=Object.defineProperty;var d=(e,n)=>b(e,"name",{value:n,configurable:!0});import{parseScope as y}from"@north-light/identity";const k=/^[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*$/,$=/^[a-z][a-z0-9-]*$/,g=["report","notice","node","job","document","person","app","repo","profile","action"],u=64,l=1,h=10,j=new Set(["description","events","read"]),O=new Set(["level","supersedes"]),S=/^crtr:objects:(?:read|watch|link|write):/;function f(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}d(f,"isRecord");function N(e,n){if(!f(e))return[`${n} events must be an object`];const s=[],i=Object.entries(e);i.length>u&&s.push(`${n} declares more than ${u} events`);for(const[c,t]of i){const r=`${n} event ${JSON.stringify(c)}`;if($.test(c)||s.push(`${r} is not a valid event name`),!f(t)){s.push(`${r} must be an object { level, supersedes? }`);continue}for(const a of Object.keys(t))O.has(a)||s.push(`${r} has unknown key ${JSON.stringify(a)}`);const o=t.level;(typeof o!="number"||!Number.isInteger(o)||o<l||o>h)&&s.push(`${r} level must be an integer ${l}-${h}`),t.supersedes!==void 0&&typeof t.supersedes!="boolean"&&s.push(`${r} supersedes must be a boolean`)}return s}d(N,"eventCatalogReasons");function _(e){const n=[],s=e.object_kinds;if(s!==void 0)if(!f(s))n.push("object_kinds must be an object keyed by kind name");else for(const[c,t]of Object.entries(s)){const r=`object_kinds ${JSON.stringify(c)}`;if(k.test(c)?g.includes(c.split(".")[0])&&n.push(`${r} uses a reserved first segment`):n.push(`${r} is not a valid kind name (<plugin>.<name>, lowercase)`),!f(t)){n.push(`${r} must be an object { description, events, read? }`);continue}for(const a of Object.keys(t))j.has(a)||n.push(`${r} has unknown key ${JSON.stringify(a)}`);(typeof t.description!="string"||t.description.trim()==="")&&n.push(`${r} description must be non-empty text`),n.push(...N(t.events,r));const o=t.read;if(o!==void 0){const a=f(o)?o.command:void 0;!f(o)||Object.keys(o).some(p=>p!=="command")?n.push(`${r} read must be { command: [leaf path] }`):(!Array.isArray(a)||a.length===0||a.some(p=>typeof p!="string"||p===""))&&n.push(`${r} read.command must be a non-empty array of command names`)}}const i=e.scopes;return i!==void 0&&(!Array.isArray(i)||i.some(c=>typeof c!="string"))&&n.push("scopes must be an array of scope strings"),n}d(_,"objectBlocksShapeReasons");function v(e,n){const s=_(e);if(s.length>0)return s;const{name:i,leafPaths:c,streamingLeafPaths:t}=n;for(const[o,a]of Object.entries(e.object_kinds??{})){o.split(".")[0]!==i&&s.push(`object_kinds ${JSON.stringify(o)} must start with the plugin name "${i}."`);const p=a.read?.command;p!==void 0&&!c.has(p.join(" "))?s.push(`object_kinds ${JSON.stringify(o)} read.command "${p.join(" ")}" is not a leaf of plugin "${i}"`):p!==void 0&&t.has(p.join(" "))&&s.push(`object_kinds ${JSON.stringify(o)} read.command "${p.join(" ")}" streams; a read is one {markdown} answer`)}const r=e.scopes??[];e.scopes!==void 0&&e.provider!==void 0&&s.push("scopes is for local plugins; a provider gets its scopes from directory consent");for(const o of r){try{y(o)}catch{s.push(`scope ${JSON.stringify(o)} is not a recognized scope`);continue}S.test(o)?o.endsWith(`:app:${i}`)&&s.push(`scope ${JSON.stringify(o)} names the plugin's own space; an app needs no scope for its own objects`):s.push(`scope ${JSON.stringify(o)} must be crtr:objects:<read|watch|link|write>:<target>`)}return s}d(v,"objectBlocksReasons");function x(e){return e.object_kinds!==void 0||e.scopes!==void 0}d(x,"declaresObjectBlocks");function A(e){return e.provider!==void 0?!1:Object.keys(e.object_kinds??{}).length>0||(e.scopes?.length??0)>0||e.transport?.kind==="http"}d(A,"needsAppToken");function J(e,n){return m(e,n,()=>!0)}d(J,"leafPathsBelowRoot");function R(e,n){return m(e,n,s=>"rest"in s&&s.rest.streaming===!0)}d(R,"streamingLeafPathsBelowRoot");function m(e,n,s){const i=new Set,c=d((t,r)=>{if(t.kind==="leaf")s(t)&&i.add([...r,t.name].join(" "));else for(const o of t.children)c(o,[...r,t.name])},"walk");for(const t of n)if(t.name===e&&t.kind==="branch")for(const r of t.children)c(r,[]);return i}d(m,"collectLeafPaths");export{k as KIND,$ as LOCAL,h as MAX_EVENT_LEVEL,u as MAX_KIND_EVENTS,l as MIN_EVENT_LEVEL,g as RESERVED_KIND_ROOTS,x as declaresObjectBlocks,N as eventCatalogReasons,J as leafPathsBelowRoot,A as needsAppToken,v as objectBlocksReasons,_ as objectBlocksShapeReasons,R as streamingLeafPathsBelowRoot};
+var l=Object.defineProperty;var r=(e,n)=>l(e,"name",{value:n,configurable:!0});import{parseScope as h}from"@north-light/identity";import{KIND as g,LOCAL as k,RESERVED_KIND_ROOTS as b,MAX_KIND_EVENTS as E,MIN_EVENT_LEVEL as j,MAX_EVENT_LEVEL as _,eventCatalogReasons as S,objectBlocksShapeReasons as a,objectKindReadReasons as f}from"../api/command-manifest/object-kinds.js";const w=/^crtr:objects:(?:read|watch|link|write):/;function L(e,n){const t=a(e);if(t.length>0)return t;const{name:c,leafPaths:p,streamingLeafPaths:s}=n;for(const[o,u]of Object.entries(e.object_kinds??{}))o.split(".")[0]!==c&&t.push(`object_kinds ${JSON.stringify(o)} must start with the plugin name "${c}."`),t.push(...f(o,u,c,p,s));const i=e.scopes??[];e.scopes!==void 0&&e.provider!==void 0&&t.push("scopes is for local plugins; a provider gets its scopes from directory consent");for(const o of i){try{h(o)}catch{t.push(`scope ${JSON.stringify(o)} is not a recognized scope`);continue}w.test(o)?o.endsWith(`:app:${c}`)&&t.push(`scope ${JSON.stringify(o)} names the plugin's own space; an app needs no scope for its own objects`):t.push(`scope ${JSON.stringify(o)} must be crtr:objects:<read|watch|link|write>:<target>`)}return t}r(L,"objectBlocksReasons");function m(e){return e.object_kinds!==void 0||e.scopes!==void 0}r(m,"declaresObjectBlocks");function y(e){return e.provider!==void 0?!1:Object.keys(e.object_kinds??{}).length>0||(e.scopes?.length??0)>0||e.transport?.kind==="http"}r(y,"needsAppToken");function P(e,n){return d(e,n,()=>!0)}r(P,"leafPathsBelowRoot");function V(e,n){return d(e,n,t=>"rest"in t&&t.rest.streaming===!0)}r(V,"streamingLeafPathsBelowRoot");function d(e,n,t){const c=new Set,p=r((s,i)=>{if(s.kind==="leaf")t(s)&&c.add([...i,s.name].join(" "));else for(const o of s.children)p(o,[...i,s.name])},"walk");for(const s of n)if(s.name===e&&s.kind==="branch")for(const i of s.children)p(i,[]);return c}r(d,"collectLeafPaths");export{g as KIND,k as LOCAL,_ as MAX_EVENT_LEVEL,E as MAX_KIND_EVENTS,j as MIN_EVENT_LEVEL,b as RESERVED_KIND_ROOTS,m as declaresObjectBlocks,S as eventCatalogReasons,P as leafPathsBelowRoot,y as needsAppToken,L as objectBlocksReasons,a as objectBlocksShapeReasons,f as objectKindReadReasons,V as streamingLeafPathsBelowRoot};

package/docs/sdk/release-notes.md

@@ -58,7 +58,7 @@ Plugins can now declare canvas object kinds and act on the canvas, and an app to
 - `app:<x>`: nodes and custom objects of another app `x`. An app never needs a scope for its own objects, and a plugin may not declare its own `app:<plugin>` space.
 - `node`: any node, including the stub of a node on another of the account's machines.
 
-`read` lets the holder read objects of the target, `write` change them, and `link` (below) make a node watch an object the holder owns. `watch` lets a custom object that watches an object of the target read it. Holding a scope never lifts run confinement inside the owning app, and a revoked grant holds nothing. A public custom object is readable by any app that may use the owning app's tools, with no scope. The app listener now serves the canvas operations (`objects.*`, `custom-objects.*`, `docs.*`) to an app grant token under its resolved scopes; those rows answered `unknown operation` there before.
+`read` lets the holder read objects of the target, `write` change them, and `link` (below) make a node watch an object the holder owns. `watch` lets a custom object that watches an object of the target read it. Holding a scope never lifts run confinement inside the owning app, and a revoked grant holds nothing. A public custom object is readable by any app that may use the owning app's tools, with no scope. A `friends` or `private` instance is readable, with no read scope, only by a run (a node, or a node of another machine) that holds one of the owning app's provider-group scopes `<app>:<group>`, the scopes a call to that app's provider commands needs; another app's server reads it only through a held `crtr:objects:read:app:<app>` scope. The app listener now serves the canvas operations (`objects.*`, `custom-objects.*`, `docs.*`) to an app grant token under its resolved scopes; those rows answered `unknown operation` there before.
 
 ### The `crtr_app_` credential and its socket fetch (additive)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.491",
+  "version": "0.3.492",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -138,7 +138,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.491",
+    "@north-light/identity": "0.3.492",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.491",
+  "version": "0.3.492",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.491",
+  "version": "0.3.492",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.491",
+      "version": "0.3.492",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.491",
+        "@north-light/identity": "0.3.492",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12116,17 +12116,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.491",
+      "version": "0.3.492",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.491",
+      "version": "0.3.492",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.491",
+      "version": "0.3.492",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12134,20 +12134,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.491",
+      "version": "0.3.492",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.491",
-        "@north-light/identity": "0.3.491"
+        "@north-light/api": "0.3.492",
+        "@north-light/identity": "0.3.492"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.491",
+      "version": "0.3.492",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.491",
-        "@north-light/identity": "0.3.491",
+        "@north-light/api": "0.3.492",
+        "@north-light/identity": "0.3.492",
         "jose": "^6.2.1"
       },
       "bin": {