@north-light/sdk 0.3.486 → 0.3.487

package/dist/resources/run-notice.d.ts

@@ -29,6 +29,6 @@ export interface VerifyRunNoticeOptions {
     fetch?: typeof fetch;
 }
 /** Verify a runtime→app run notice: the bearer is a directory-signed outbound token for `runNoticeUrl`
- *  (signature, `iss`, `aud`, `exp`), scope exactly `crtr:run_notice`, `grantee` the app's own principal;
+ *  (signature, `iss`, `aud`, `exp`; `verifyCallToken`), scope exactly `crtr:run_notice`, `grantee` the app's own principal;
  *  the body is `{run_id, latest_sequence}`. Throws `RunNoticeError` (answer 401) on any failure. */
 export declare function verifyRunNotice(request: Request, options: VerifyRunNoticeOptions): Promise<RunNotice>;

package/dist/resources/run-notice.js

@@ -1,4 +1,4 @@
-import { JwksCache, verifyOutboundToken } from '@north-light/identity';
+import { JwksCache, verifyCallToken } from '@north-light/identity';
 /** The scope a run-notice token carries. */
 export const RUN_NOTICE_SCOPE = 'crtr:run_notice';
 /** A run notice that failed verification. An app maps it to HTTP 401 and stores nothing. */
@@ -6,6 +6,7 @@ export class RunNoticeError extends Error {
     status = 401;
     constructor(message) { super(message); this.name = 'RunNoticeError'; }
 }
+const isAppOrUser = (value) => typeof value === 'string' && /^(app|user):[A-Za-z0-9_-]{1,64}$/.test(value);
 const jwksUrl = (issuer) => `${issuer.replace(/\/+$/, '')}/.well-known/jwks.json`;
 // One cache per issuer for the global fetch, and one per (issuer, fetch) pair for a caller's fetch: a cache built on
 // one fetch must never answer for another (an unknown kid is re-fetched at most every 30 s).
@@ -33,7 +34,7 @@ function cacheFor(issuer, fetcher) {
     return cache;
 }
 /** Verify a runtime→app run notice: the bearer is a directory-signed outbound token for `runNoticeUrl`
- *  (signature, `iss`, `aud`, `exp`), scope exactly `crtr:run_notice`, `grantee` the app's own principal;
+ *  (signature, `iss`, `aud`, `exp`; `verifyCallToken`), scope exactly `crtr:run_notice`, `grantee` the app's own principal;
  *  the body is `{run_id, latest_sequence}`. Throws `RunNoticeError` (answer 401) on any failure. */
 export async function verifyRunNotice(request, options) {
     const match = /^Bearer ([^\s]+)$/.exec(request.headers.get('authorization') ?? '');
@@ -41,16 +42,20 @@ export async function verifyRunNotice(request, options) {
         throw new RunNoticeError('The request carries no bearer token.');
     let claims;
     try {
-        claims = await verifyOutboundToken({ token: match[1], jwks: options.jwks ?? cacheFor(options.issuer, options.fetch), issuer: options.issuer, audience: options.runNoticeUrl });
+        claims = await verifyCallToken({ token: match[1], jwks: options.jwks ?? cacheFor(options.issuer, options.fetch), issuer: options.issuer, audience: options.runNoticeUrl });
     }
     catch {
         throw new RunNoticeError('The bearer token is not a valid directory token for this endpoint.');
     }
     if (claims.scope !== RUN_NOTICE_SCOPE)
         throw new RunNoticeError('The token scope is not crtr:run_notice.');
-    if (claims.grantee !== options.grantee)
+    const { grantee, initiating_app: initiatingApp, jti, act } = claims.claims;
+    // The outbound-token claims a run notice has always carried; `verifyCallToken` does not require them.
+    if (!isAppOrUser(grantee) || !isAppOrUser(initiatingApp) || typeof jti !== 'string' || jti === '' || typeof act !== 'object' || act === null || Array.isArray(act) || typeof act.sub !== 'string' || act.sub === '')
+        throw new RunNoticeError('The bearer token is not a valid directory token for this endpoint.');
+    if (grantee !== options.grantee)
         throw new RunNoticeError('The token was minted for another app.');
-    const runtime = claims.act.sub;
+    const runtime = claims.chain[0]?.sub;
     if (typeof runtime !== 'string' || !runtime.startsWith('runtime:'))
         throw new RunNoticeError('The token names no runtime.');
     let body;

package/dist/skill/northlight/SKILL.md

@@ -2,7 +2,7 @@
 name: northlight
 description: "Use when building, debugging or shipping an app that signs people in with Northlight, starts runs on their Northlight runtime, or calls Northlight providers (sms, search, integrations, context, device) with @north-light/sdk."
 metadata:
-  sdk-version: "0.3.486"
+  sdk-version: "0.3.487"
 ---
 
 # Building a Northlight app
@@ -11,7 +11,7 @@ An app on Northlight signs people in with their Northlight account, then starts
 
 ## First: check this skill matches the SDK
 
-This skill is for SDK version `0.3.486`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. That command needs no account and no crtr. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
+This skill is for SDK version `0.3.487`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. That command needs no account and no crtr. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
 
 ## Where things run
 

package/dist/version.d.ts

@@ -1,5 +1,5 @@
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export declare const SDK_VERSION = "0.3.486";
+export declare const SDK_VERSION = "0.3.487";
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the
  *  contract level existed (which only knows this header) refuses this SDK, while every later runtime accepts it. */
 export declare const LEGACY_FLOOR = "0.3.423";

package/dist/version.js

@@ -1,6 +1,6 @@
 // SDK_VERSION is written by scripts/release-version.mjs on every release; do not edit by hand.
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export const SDK_VERSION = '0.3.486';
+export const SDK_VERSION = '0.3.487';
 // LEGACY_FLOOR is written once by `scripts/contract.mjs release`, at the first release that carries the contract level
 // (the `0.0.0` placeholder is replaced there and never again); do not edit by hand.
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/sdk",
-  "version": "0.3.486",
+  "version": "0.3.487",
   "crouterContract": "1.11",
   "description": "Typed Node and browser client for running crouter agents through the crtrd /v1 API.",
   "type": "module",
@@ -44,8 +44,8 @@
     "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'next') { console.error('@north-light/sdk publishes only with --tag next; scripts/promote-sdk.mjs is the only mover of latest.'); process.exit(1); }\""
   },
   "dependencies": {
-    "@north-light/api": "0.3.486",
-    "@north-light/identity": "0.3.486",
+    "@north-light/api": "0.3.487",
+    "@north-light/identity": "0.3.487",
     "jose": "^6.2.1"
   },
   "peerDependencies": {