@north-light/cli 0.3.539 → 0.3.540

package/dist/builtin-memory/crouter-sdk/release-notes.md

@@ -11,6 +11,8 @@ Changes to `@north-light/sdk` that can change what an existing app sees. Newest
 
 ## 0.3.539
 
+`exchangeIdentity` now returns the verified identity when the directory's token answer also carries a runtime connection. It used to throw `oauth_exchange_mismatch`, so no member could sign in to an app held by a team with a runtime grant (the directory gives that app a connection on every sign-in). The SDK revokes the unneeded refresh token best-effort; revocation removes only that token, never the grant. `exchangeCode` still refuses a sign-in-only answer.
+
 A run started with no `kind` and no `model`, in a profile with no `default_kind` (every app's own default profile), now starts as the `general` kind on the `medium` rung. It used to start as `developer` on that kind's model (`openai/medium`). `profile.list` reports `general` as such a profile's `default_kind`. On an app-paid grant the run lands on the app's `medium` inference rung, where it used to land on `strong`. Pass `model` on `run.start` to keep another rung.
 
 Profiles name the machine environment they run on. Additive: no request or response an existing app sends or reads changes.

package/dist/builtin-memory/northlight-apps/concepts/apps-and-sign-in.md

@@ -76,7 +76,7 @@ Then set your own session for the person. The SDK does not manage your sessions.
 
 ### Scopes decide what comes back
 
-A sign-in that asks only for `openid`, optionally with `email` and `profile`, creates no connection. Finish it with `oauth.exchangeIdentity(...)`, which returns the verified `Identity` (`sub`, and `email`, `name` and `picture` when approved and present). A sign-in that asks for runtime scopes such as `crtr:llm` finishes with `exchangeCode`. Each method refuses the other's answer with `oauth_exchange_mismatch`.
+A sign-in that asks only for `openid`, optionally with `email` and `profile`, creates no connection. Finish it with `oauth.exchangeIdentity(...)`, which returns the verified `Identity` (`sub`, and `email`, `name` and `picture` when approved and present). A sign-in that asks for runtime scopes such as `crtr:llm` finishes with `exchangeCode`. `exchangeCode` refuses a sign-in-only answer with `oauth_exchange_mismatch`; `exchangeIdentity` accepts an answer that also carries a connection, returns the identity, and revokes the unneeded refresh token.
 
 ### When the directory refuses to sign someone in
 

package/dist/builtin-memory/northlight-apps/concepts/connections.md

@@ -119,7 +119,7 @@ It needs the app registered with the `app_token_for_user` operation, and an acti
 
 ## Signing in a visitor
 
-A person who only needs to be recognized, not connected, signs in with identity only: request `openid`, optionally with `email` and `profile`, and no runtime scope. Finish with `exchangeIdentity`, not `exchangeCode`. An `Identity` is not a connection: no runtime URL, grant or refresh token, nothing goes in the store, and you keep your own session. To act for that person later, send them through `authorizeUrl` again with the runtime scopes you need.
+A person who only needs to be recognized, not connected, signs in with identity only: request `openid`, optionally with `email` and `profile`, and no runtime scope. Finish with `exchangeIdentity`, not `exchangeCode`. An `Identity` is not a connection: no runtime URL, grant or refresh token (if the directory answers with one anyway, `exchangeIdentity` revokes the refresh token), nothing goes in the store, and you keep your own session. To act for that person later, send them through `authorizeUrl` again with the runtime scopes you need.
 
 ## Checked and not checked
 

package/dist/builtin-memory/northlight-apps/errors.md

@@ -18,7 +18,7 @@ Codes the SDK raises itself are listed in `sdkErrorCodes`, and `CrouterError.cod
 | Code | Means | What to do |
 |---|---|---|
 | `id_token_invalid` | An ID token failed verification (signature, issuer, audience, expiry, missing or mismatched nonce), or a sign-in-only answer had no ID token. A JWKS that can't be fetched or is malformed is not this code: that error is thrown as is. | Restart the sign-in. |
-| `oauth_exchange_mismatch` | The wrong exchange call: `exchangeCode` on a sign-in-only answer, or `exchangeIdentity` on an answer that carries a connection. | Use the call that matches the scopes you requested ([[northlight-apps/guides/many-users]]). |
+| `oauth_exchange_mismatch` | `exchangeCode` got a sign-in-only answer (no connection). | Finish a sign-in-only request with `exchangeIdentity` ([[northlight-apps/guides/many-users]]). |
 | `oauth_nonce_missing` | `exchangeIdentity` was called without the `nonce` from `authorizeUrl`. | Save the nonce in the visitor's session and pass it back. |
 | `oauth_state_mismatch` | The callback's `state` was missing or differed from the saved one. | Refuse the callback. |
 | `not_connected` | `oauth.client(userId)` or a refresh found no stored connection for that person. | Show "sign in again". |

package/dist/builtin-memory/northlight-apps/guides/many-users.md

@@ -18,7 +18,7 @@ Keep the connection and refresh token on the server, never in a visitor's browse
 
 ## Signing in a visitor
 
-A visitor who only needs to be recognized, not connected, signs in with identity only. Request `openid`, adding `email` for their email and `profile` for their name and photo, and no runtime scope. The directory shows one line ("Know who you are on Northlight"), writes no grant, and answers with an ID token and an access token usable only at `/userinfo`: no refresh token, grant or runtime URL. Finish that sign-in with `exchangeIdentity`, not `exchangeCode`:
+A visitor who only needs to be recognized, not connected, signs in with identity only. Request `openid`, adding `email` for their email and `profile` for their name and photo, and no runtime scope. The directory shows one line ("Know who you are on Northlight"), writes no grant, and answers with an ID token and an access token usable only at `/userinfo`: no refresh token, grant or runtime URL. (An app held by a team with a runtime grant gets a connection on every sign-in; `exchangeIdentity` still returns only the identity and revokes the unneeded refresh token.) Finish that sign-in with `exchangeIdentity`, not `exchangeCode`:
 
 ```ts
 const {url, codeVerifier, state, nonce} = await oauth.authorizeUrl({scopes: ['openid', 'email', 'profile'], state: sessionState});
@@ -36,7 +36,7 @@ visitor.picture;       // an https URL, present only when 'profile' was approved
 
 The SDK checks the ID token's ES256 signature against the directory's JWKS, its issuer, that `aud` is your client id, that it has not expired, and that its `nonce` equals the one `authorizeUrl` returned. `nonce` is required. Any failure throws `CrouterError` code `id_token_invalid`. If the directory's JWKS can't be fetched or is malformed, that error is thrown as is.
 
-An `Identity` is not a connection. Nothing is stored in a `ConnectionStore` and nothing refreshes; your app keeps its own session for the visitor, and the visitor's runtime can't be called on their behalf. To act for the visitor later, send them through `authorizeUrl` again with the runtime scopes you need and finish with `exchangeCode`, which returns a `Connection`. Each call refuses the other's answer with code `oauth_exchange_mismatch`. If `exchangeIdentity` refuses an answer that carries a connection, the directory has already recorded that grant; it shows in the person's approved apps until they or your app revoke it.
+An `Identity` is not a connection. Nothing is stored in a `ConnectionStore` and nothing refreshes; your app keeps its own session for the visitor, and the visitor's runtime can't be called on their behalf. To act for the visitor later, send them through `authorizeUrl` again with the runtime scopes you need and finish with `exchangeCode`, which returns a `Connection`. `exchangeCode` refuses a sign-in-only answer with code `oauth_exchange_mismatch`.
 
 ## Whose action a call records
 

package/docs/apps/concepts/apps-and-sign-in.md

@@ -49,7 +49,7 @@ Then set your own session for the person. The SDK does not manage your sessions.
 
 ### Scopes decide what comes back
 
-A sign-in that asks only for `openid`, optionally with `email` and `profile`, creates no connection. Finish it with `oauth.exchangeIdentity(...)`, which returns the verified `Identity` (`sub`, and `email`, `name` and `picture` when approved and present). A sign-in that asks for runtime scopes such as `crtr:llm` finishes with `exchangeCode`. Each method refuses the other's answer with `oauth_exchange_mismatch`.
+A sign-in that asks only for `openid`, optionally with `email` and `profile`, creates no connection. Finish it with `oauth.exchangeIdentity(...)`, which returns the verified `Identity` (`sub`, and `email`, `name` and `picture` when approved and present). A sign-in that asks for runtime scopes such as `crtr:llm` finishes with `exchangeCode`. `exchangeCode` refuses a sign-in-only answer with `oauth_exchange_mismatch`; `exchangeIdentity` accepts an answer that also carries a connection, returns the identity, and revokes the unneeded refresh token.
 
 ### When the directory refuses to sign someone in
 

package/docs/apps/concepts/connections.md

@@ -116,7 +116,7 @@ It needs the app registered with the `app_token_for_user` operation, and an acti
 
 ## Signing in a visitor
 
-A person who only needs to be recognized, not connected, signs in with identity only: request `openid`, optionally with `email` and `profile`, and no runtime scope. Finish with `exchangeIdentity`, not `exchangeCode`. An `Identity` is not a connection: no runtime URL, grant or refresh token, nothing goes in the store, and you keep your own session. To act for that person later, send them through `authorizeUrl` again with the runtime scopes you need.
+A person who only needs to be recognized, not connected, signs in with identity only: request `openid`, optionally with `email` and `profile`, and no runtime scope. Finish with `exchangeIdentity`, not `exchangeCode`. An `Identity` is not a connection: no runtime URL, grant or refresh token (if the directory answers with one anyway, `exchangeIdentity` revokes the refresh token), nothing goes in the store, and you keep your own session. To act for that person later, send them through `authorizeUrl` again with the runtime scopes you need.
 
 ## Checked and not checked
 

package/docs/apps/errors.md

@@ -16,7 +16,7 @@ Codes the SDK raises itself are listed in `sdkErrorCodes`, and `CrouterError.cod
 | Code | Means | What to do |
 |---|---|---|
 | `id_token_invalid` | An ID token failed verification (signature, issuer, audience, expiry, missing or mismatched nonce), or a sign-in-only answer had no ID token. A JWKS that can't be fetched or is malformed is not this code: that error is thrown as is. | Restart the sign-in. |
-| `oauth_exchange_mismatch` | The wrong exchange call: `exchangeCode` on a sign-in-only answer, or `exchangeIdentity` on an answer that carries a connection. | Use the call that matches the scopes you requested ([Many users](/docs/guides/many-users#signing-in-a-visitor)). |
+| `oauth_exchange_mismatch` | `exchangeCode` got a sign-in-only answer (no connection). | Finish a sign-in-only request with `exchangeIdentity` ([Many users](/docs/guides/many-users#signing-in-a-visitor)). |
 | `oauth_nonce_missing` | `exchangeIdentity` was called without the `nonce` from `authorizeUrl`. | Save the nonce in the visitor's session and pass it back. |
 | `oauth_state_mismatch` | The callback's `state` was missing or differed from the saved one. | Refuse the callback. |
 | `not_connected` | `oauth.client(userId)` or a refresh found no stored connection for that person. | Show "sign in again". |

package/docs/apps/guides/many-users.md

@@ -16,7 +16,7 @@ Keep the connection and refresh token on the server, never in a visitor's browse
 
 ## Signing in a visitor
 
-A visitor who only needs to be recognized, not connected, signs in with identity only. Request `openid`, adding `email` for their email and `profile` for their name and photo, and no runtime scope. The directory shows one line ("Know who you are on Northlight"), writes no grant, and answers with an ID token and an access token usable only at `/userinfo`: no refresh token, grant or runtime URL. Finish that sign-in with `exchangeIdentity`, not `exchangeCode`:
+A visitor who only needs to be recognized, not connected, signs in with identity only. Request `openid`, adding `email` for their email and `profile` for their name and photo, and no runtime scope. The directory shows one line ("Know who you are on Northlight"), writes no grant, and answers with an ID token and an access token usable only at `/userinfo`: no refresh token, grant or runtime URL. (An app held by a team with a runtime grant gets a connection on every sign-in; `exchangeIdentity` still returns only the identity and revokes the unneeded refresh token.) Finish that sign-in with `exchangeIdentity`, not `exchangeCode`:
 
 ```ts
 const {url, codeVerifier, state, nonce} = await oauth.authorizeUrl({scopes: ['openid', 'email', 'profile'], state: sessionState});
@@ -34,7 +34,7 @@ visitor.picture;       // an https URL, present only when 'profile' was approved
 
 The SDK checks the ID token's ES256 signature against the directory's JWKS, its issuer, that `aud` is your client id, that it has not expired, and that its `nonce` equals the one `authorizeUrl` returned. `nonce` is required. Any failure throws `CrouterError` code `id_token_invalid`. If the directory's JWKS can't be fetched or is malformed, that error is thrown as is.
 
-An `Identity` is not a connection. Nothing is stored in a `ConnectionStore` and nothing refreshes; your app keeps its own session for the visitor, and the visitor's runtime can't be called on their behalf. To act for the visitor later, send them through `authorizeUrl` again with the runtime scopes you need and finish with `exchangeCode`, which returns a `Connection`. Each call refuses the other's answer with code `oauth_exchange_mismatch`. If `exchangeIdentity` refuses an answer that carries a connection, the directory has already recorded that grant; it shows in the person's approved apps until they or your app revoke it.
+An `Identity` is not a connection. Nothing is stored in a `ConnectionStore` and nothing refreshes; your app keeps its own session for the visitor, and the visitor's runtime can't be called on their behalf. To act for the visitor later, send them through `authorizeUrl` again with the runtime scopes you need and finish with `exchangeCode`, which returns a `Connection`. `exchangeCode` refuses a sign-in-only answer with code `oauth_exchange_mismatch`.
 
 ## Whose action a call records
 

package/docs/sdk/release-notes.md

@@ -9,6 +9,8 @@ Changes to `@north-light/sdk` that can change what an existing app sees. Newest
 
 ## 0.3.539
 
+`exchangeIdentity` now returns the verified identity when the directory's token answer also carries a runtime connection. It used to throw `oauth_exchange_mismatch`, so no member could sign in to an app held by a team with a runtime grant (the directory gives that app a connection on every sign-in). The SDK revokes the unneeded refresh token best-effort; revocation removes only that token, never the grant. `exchangeCode` still refuses a sign-in-only answer.
+
 A run started with no `kind` and no `model`, in a profile with no `default_kind` (every app's own default profile), now starts as the `general` kind on the `medium` rung. It used to start as `developer` on that kind's model (`openai/medium`). `profile.list` reports `general` as such a profile's `default_kind`. On an app-paid grant the run lands on the app's `medium` inference rung, where it used to land on `strong`. Pass `model` on `run.start` to keep another rung.
 
 Profiles name the machine environment they run on. Additive: no request or response an existing app sends or reads changes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.539",
+  "version": "0.3.540",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -140,7 +140,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.539",
+    "@north-light/identity": "0.3.540",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.539",
+  "version": "0.3.540",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.539",
+  "version": "0.3.540",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.539",
+      "version": "0.3.540",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -24,7 +24,7 @@
         "@milkdown/preset-gfm": "^7.22.3",
         "@milkdown/prose": "^7.22.3",
         "@milkdown/utils": "^7.22.3",
-        "@north-light/identity": "0.3.539",
+        "@north-light/identity": "0.3.540",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12455,17 +12455,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.539",
+      "version": "0.3.540",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.539",
+      "version": "0.3.540",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.539",
+      "version": "0.3.540",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12473,20 +12473,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.539",
+      "version": "0.3.540",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.539",
-        "@north-light/identity": "0.3.539"
+        "@north-light/api": "0.3.540",
+        "@north-light/identity": "0.3.540"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.539",
+      "version": "0.3.540",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.539",
-        "@north-light/identity": "0.3.539",
+        "@north-light/api": "0.3.540",
+        "@north-light/identity": "0.3.540",
         "jose": "^6.2.1"
       },
       "bin": {