@north-light/cli 0.3.494 → 0.3.496

package/packages/crouter-identity/dist/index.d.ts

@@ -1,14 +1,5 @@
 import { type JSONWebKeySet, type JWTPayload } from 'jose';
-export interface AccessTokenClaims extends JWTPayload {
-    sub: string;
-    grantee: string;
-    client_id: string;
-    grant: string;
-    /** The grant revision the directory minted against: a freshness floor, never authorization (contract 1). */
-    rev: number;
-    exp: number;
-}
-/** Thrown by `verifyAccessToken` for a signed token with no `rev` claim: the directory predates the claim. */
+/** Thrown by `verifyCallToken` for an `app:` link with a `grant` and no `rev`: the directory predates the claim. */
 export declare class MissingRevClaimError extends Error {
     constructor();
 }
@@ -67,81 +58,6 @@ export declare class JwksCache {
     private fetchKeys;
     forKid(kid: string | undefined): Promise<JSONWebKeySet>;
 }
-/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
-export declare function verifyAccessToken(options: {
-    token: string;
-    jwks: JSONWebKeySet | JwksCache;
-    issuer: string;
-    audience: string;
-}): Promise<AccessTokenClaims>;
-/** The claims of a machine token: one machine of an account calling another (or the account relay). It names the
- *  person and the calling machine and carries no grant, so it authorizes nothing on its own. */
-export interface MachineTokenClaims extends JWTPayload {
-    iss: string;
-    /** The single audience: a peer machine URL or the relay origin. */
-    aud: string;
-    /** The account's person, `user:<id>`. */
-    sub: string;
-    /** Always equal to `sub`. */
-    grantee: string;
-    client_id: string;
-    /** The calling machine, `runtime:<id>`. */
-    machine_id: string;
-    exp: number;
-}
-/**
- * Verifies a machine token: ES256 with typ `at+jwt`, signature against `jwks`, `iss` = `issuer`, `aud` a string equal
- * to `audience` (the sole audience), and `exp`. `sub` must be `user:<id>`, `grantee` must equal `sub`, `machine_id`
- * must be `runtime:<id>` and `client_id` a non-empty string. A token carrying a `grant`, `rev` or `scope` claim is
- * refused, so an app grant token never verifies here; `verifyAccessToken` requires an `app:` grantee, so a machine
- * token never verifies there.
- */
-/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
-export declare function verifyMachineToken(options: {
-    token: string;
-    jwks: JSONWebKeySet | JwksCache;
-    issuer: string;
-    audience: string;
-}): Promise<MachineTokenClaims>;
-/** One level of the outbound token's RFC 8693 `act` nesting: the actor, and the actor it acted for. */
-export interface OutboundActor {
-    sub: string;
-    act?: OutboundActor;
-}
-/** The claims of the outbound token the directory mints for one provider call (contract 3). */
-export interface OutboundTokenClaims extends JWTPayload {
-    iss: string;
-    aud: string;
-    /** The user the call is made for, `user:<id>`. */
-    sub: string;
-    /** The principal the grant was issued to, `app:<id>` or the user. */
-    grantee: string;
-    /** The runtime's registered OAuth client id. */
-    client_id: string;
-    /** The provider's `<provider>:<group>` strings the caller holds, space-separated; may be empty. */
-    scope: string;
-    initiating_app: string;
-    /** Audit only; nothing authorizes on it. */
-    act: OutboundActor;
-    iat: number;
-    exp: number;
-    jti: string;
-}
-/**
- * Verifies the outbound token a provider receives (contract 3 D3-TOK-12): ES256 or RS256 with
- * a `kid`, typ `at+jwt`, signature against `jwks` (a `JwksCache` refetches once on an unknown
- * `kid`), `iss` = `issuer`, `aud` exactly `audience` (a trailing-slash difference is refused),
- * and `exp`. `sub` must be a `user:` principal and `grantee` and `initiating_app`
- * an `app:` or `user:` principal; the remaining claims are checked for presence and type only; which of them gates a
- * call is the caller's rule (D3-TOK-13 gates on `scope` alone, and nothing gates on `act`).
- */
-/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
-export declare function verifyOutboundToken(options: {
-    token: string;
-    jwks: JSONWebKeySet | JwksCache;
-    issuer: string;
-    audience: string;
-}): Promise<OutboundTokenClaims>;
 /** One link of a call token's actor chain. `grant` and `rev` appear only on an `app:` link. */
 export interface CallLink {
     sub: string;
@@ -157,10 +73,10 @@ export interface CallTokenClaims extends JWTPayload {
     client_id: string;
     exp: number;
     iat: number;
-    /** The RFC 8693 actor chain as signed; absent on the legacy shapes. */
+    /** The RFC 8693 actor chain as signed. */
     act?: unknown;
     scope?: string;
-    /** Legacy same-account machine token (removed at the flag flip). */
+    /** Only on a peer token minted while the directory still wrote it (until its flag flip); when present it names the presenter. */
     machine_id?: string;
     grantee?: string;
     initiating_app?: string;
@@ -172,7 +88,7 @@ export interface CallToken {
     /** `user:<id>`. */
     sub: string;
     aud: string;
-    /** The actor chain, index 0 = the presenter. Legacy shapes are normalized to the same form. */
+    /** The actor chain, index 0 = the presenter. */
     chain: CallLink[];
     /** Present only on provider tokens. */
     scope?: string;
@@ -182,10 +98,10 @@ export interface CallToken {
  * Verifies a call token of any use (peer, app access, outbound provider, run notice) and returns its actor chain,
  * presenter first. Checks in order: header `typ` `at+jwt`, `alg` ES256 or RS256, non-empty `kid`; signature; `iss`;
  * `aud` a string equal to `audience`; `exp` and `iat` numbers; `sub` = `user:<id>`; `client_id` non-empty; `scope`
- * a string when present; then the chain. Without `act` the legacy machine token (`machine_id`, `grantee` = `sub`)
- * and the legacy app token (`app:` `grantee` + `grant` + `rev`) are normalized to a one-link chain; with `act` any
- * `machine_id` must equal the first link, any top-level `grant` an app link's, and, on a token without `scope`, any `grantee`
- * and `rev` the app link's (or, with no app link, `grantee` = `sub` and no `rev`). It authorizes nothing.
+ * a string when present; then the chain. A token with no `act` is refused: the legacy machine and app shapes are not
+ * accepted. Any `machine_id` must equal the first link, any top-level `grant` an app link's, and, on a token without
+ * `scope`, any `grantee` and `rev` the app link's (or, with no app link, `grantee` = `sub` and no `rev`). It authorizes
+ * nothing.
  * Throws `MissingRevClaimError` for an `app:` link carrying `grant` and no `rev`.
  */
 export declare function verifyCallToken(options: {

package/packages/crouter-identity/dist/index.js

@@ -1,5 +1,5 @@
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
-/** Thrown by `verifyAccessToken` for a signed token with no `rev` claim: the directory predates the claim. */
+/** Thrown by `verifyCallToken` for an `app:` link with a `grant` and no `rev`: the directory predates the claim. */
 export class MissingRevClaimError extends Error {
     constructor() { super('access token has no rev claim: the directory is older than this runtime'); this.name = 'MissingRevClaimError'; }
 }
@@ -215,85 +215,9 @@ function validatePrincipal(value, kind) {
 function keySet(jwks, kid) {
     return jwks instanceof JwksCache ? jwks.forKid(kid) : Promise.resolve(jwks);
 }
-/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
-export async function verifyAccessToken(options) {
-    const header = decodeProtectedHeader(options.token);
-    if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
-        throw new Error('Invalid access token header');
-    const keys = await keySet(options.jwks, header.kid);
-    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
-        issuer: options.issuer, audience: options.audience, algorithms: ['ES256'], typ: 'at+jwt',
-    });
-    if (payload.aud !== options.audience || !validatePrincipal(payload.sub, 'user') || !validatePrincipal(payload.grantee, 'app') ||
-        typeof payload.client_id !== 'string' || !id.test(payload.client_id) || typeof payload.grant !== 'string' ||
-        typeof payload.exp !== 'number') {
-        throw new Error('Invalid access token claims');
-    }
-    if (payload.rev === undefined)
-        throw new MissingRevClaimError();
-    if (typeof payload.rev !== 'number' || !Number.isInteger(payload.rev) || payload.rev < 1)
-        throw new Error('Invalid access token claims');
-    return payload;
-}
-/**
- * Verifies a machine token: ES256 with typ `at+jwt`, signature against `jwks`, `iss` = `issuer`, `aud` a string equal
- * to `audience` (the sole audience), and `exp`. `sub` must be `user:<id>`, `grantee` must equal `sub`, `machine_id`
- * must be `runtime:<id>` and `client_id` a non-empty string. A token carrying a `grant`, `rev` or `scope` claim is
- * refused, so an app grant token never verifies here; `verifyAccessToken` requires an `app:` grantee, so a machine
- * token never verifies there.
- */
-/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
-export async function verifyMachineToken(options) {
-    const header = decodeProtectedHeader(options.token);
-    if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
-        throw new Error('Invalid machine token header');
-    const keys = await keySet(options.jwks, header.kid);
-    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
-        issuer: options.issuer, audience: options.audience, algorithms: ['ES256'], typ: 'at+jwt', requiredClaims: ['exp'],
-    });
-    if (payload.aud !== options.audience || !validatePrincipal(payload.sub, 'user') || payload.grantee !== payload.sub ||
-        !validatePrincipal(payload.machine_id, 'runtime') || !nonEmptyString(payload.client_id) || typeof payload.exp !== 'number' ||
-        payload.grant !== undefined || payload.rev !== undefined || payload.scope !== undefined) {
-        throw new Error('Invalid machine token claims');
-    }
-    return payload;
-}
 function nonEmptyString(value) {
     return typeof value === 'string' && value !== '';
 }
-function appOrUser(value) {
-    return validatePrincipal(value, 'app') || validatePrincipal(value, 'user');
-}
-function isActor(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value) && nonEmptyString(value.sub);
-}
-/**
- * Verifies the outbound token a provider receives (contract 3 D3-TOK-12): ES256 or RS256 with
- * a `kid`, typ `at+jwt`, signature against `jwks` (a `JwksCache` refetches once on an unknown
- * `kid`), `iss` = `issuer`, `aud` exactly `audience` (a trailing-slash difference is refused),
- * and `exp`. `sub` must be a `user:` principal and `grantee` and `initiating_app`
- * an `app:` or `user:` principal; the remaining claims are checked for presence and type only; which of them gates a
- * call is the caller's rule (D3-TOK-13 gates on `scope` alone, and nothing gates on `act`).
- */
-/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
-export async function verifyOutboundToken(options) {
-    const header = decodeProtectedHeader(options.token);
-    if (header.typ !== 'at+jwt' || (header.alg !== 'ES256' && header.alg !== 'RS256'))
-        throw new Error('Invalid outbound token header');
-    if (!nonEmptyString(header.kid))
-        throw new Error('Outbound token has no key id');
-    const keys = await keySet(options.jwks, header.kid);
-    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
-        issuer: options.issuer, audience: options.audience, algorithms: ['ES256', 'RS256'], typ: 'at+jwt', requiredClaims: ['exp'],
-    });
-    if (payload.aud !== options.audience || typeof payload.exp !== 'number' || typeof payload.iat !== 'number' ||
-        !validatePrincipal(payload.sub, 'user') || !appOrUser(payload.grantee) || !nonEmptyString(payload.client_id) ||
-        typeof payload.scope !== 'string' || !appOrUser(payload.initiating_app) || !isActor(payload.act) ||
-        !nonEmptyString(payload.jti)) {
-        throw new Error('Invalid outbound token claims');
-    }
-    return payload;
-}
 const MAX_CHAIN_DEPTH = 8;
 const DEVELOPER_CREDENTIAL_LINK = /^developer-credential:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function isDeveloperCredential(value) {
@@ -319,17 +243,8 @@ function chainOf(payload) {
             return bad();
         return { sub, grant, rev };
     };
-    if (p.act === undefined) {
-        if (p.machine_id !== undefined) {
-            if (!validatePrincipal(p.machine_id, 'runtime') || p.grantee !== p.sub ||
-                p.grant !== undefined || p.rev !== undefined || p.scope !== undefined)
-                return bad();
-            return [{ sub: p.machine_id }];
-        }
-        if (validatePrincipal(p.grantee, 'app') && typeof p.grant === 'string')
-            return [appLink(p.grantee, p.grant, p.rev)];
+    if (p.act === undefined)
         return bad();
-    }
     const chain = [];
     let node = p.act;
     while (node !== undefined) {
@@ -359,9 +274,9 @@ function chainOf(payload) {
         return bad();
     if (p.grant !== undefined && !chain.some((l) => l.sub.startsWith('app:') && l.grant === p.grant))
         return bad();
-    // A superset token's other legacy fields must say what its chain says, or the old and new verifiers authorize different
-    // identities from one signed token. Provider tokens (`scope`) are exempt: their `grantee` is the person or app the call
-    // runs for, not a link of the chain.
+    // A token's top-level claims (kept for providers pinned to an older `@north-light/plugin`, which read them instead of
+    // `act`) must say what its chain says, or the old and new verifiers authorize different identities from one signed token.
+    // Provider tokens (`scope`) are exempt: their `grantee` is the person or app the call runs for, not a link of the chain.
     if (p.scope === undefined) {
         const appLinks = chain.filter((l) => l.sub.startsWith('app:'));
         const appLink = appLinks.find((l) => l.grant !== undefined && l.grant === p.grant) ?? appLinks[0];
@@ -384,10 +299,10 @@ function chainOf(payload) {
  * Verifies a call token of any use (peer, app access, outbound provider, run notice) and returns its actor chain,
  * presenter first. Checks in order: header `typ` `at+jwt`, `alg` ES256 or RS256, non-empty `kid`; signature; `iss`;
  * `aud` a string equal to `audience`; `exp` and `iat` numbers; `sub` = `user:<id>`; `client_id` non-empty; `scope`
- * a string when present; then the chain. Without `act` the legacy machine token (`machine_id`, `grantee` = `sub`)
- * and the legacy app token (`app:` `grantee` + `grant` + `rev`) are normalized to a one-link chain; with `act` any
- * `machine_id` must equal the first link, any top-level `grant` an app link's, and, on a token without `scope`, any `grantee`
- * and `rev` the app link's (or, with no app link, `grantee` = `sub` and no `rev`). It authorizes nothing.
+ * a string when present; then the chain. A token with no `act` is refused: the legacy machine and app shapes are not
+ * accepted. Any `machine_id` must equal the first link, any top-level `grant` an app link's, and, on a token without
+ * `scope`, any `grantee` and `rev` the app link's (or, with no app link, `grantee` = `sub` and no `rev`). It authorizes
+ * nothing.
  * Throws `MissingRevClaimError` for an `app:` link carrying `grant` and no `rev`.
  */
 export async function verifyCallToken(options) {

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.494",
+  "version": "0.3.496",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.494",
+  "version": "0.3.496",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.494",
+      "version": "0.3.496",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.494",
+        "@north-light/identity": "0.3.496",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12116,17 +12116,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.494",
+      "version": "0.3.496",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.494",
+      "version": "0.3.496",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.494",
+      "version": "0.3.496",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12134,20 +12134,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.494",
+      "version": "0.3.496",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.494",
-        "@north-light/identity": "0.3.494"
+        "@north-light/api": "0.3.496",
+        "@north-light/identity": "0.3.496"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.494",
+      "version": "0.3.496",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.494",
-        "@north-light/identity": "0.3.494",
+        "@north-light/api": "0.3.496",
+        "@north-light/identity": "0.3.496",
         "jose": "^6.2.1"
       },
       "bin": {