@north-light/sdk 0.3.490 → 0.3.492

package/dist/client.d.ts

@@ -67,8 +67,12 @@ export interface CrouterOptions {
 /** The namespaces of `Crouter` that only the owner's own daemon serves. A person's app listener answers them `404 unknown operation`. */
 export type OwnerOnly = 'nodes' | 'bash' | 'canvas' | 'crons' | 'structuredRequests' | 'customObjects' | 'human' | 'models' | 'system' | 'auth';
 /** What an app reaches on a person's runtime (the app listener): `Crouter` without the owner-daemon namespaces, `files.download`
- *  only, and `profiles.list` only. `Crouter` is assignable to it, so a function that takes `AppClient` takes either. */
+ *  only, `profiles.list` only, `customObjects` register/publish/unregister and `canvas` watch/unwatch. `Crouter` is assignable to it, so a function that takes `AppClient` takes either. */
 export type AppClient = Omit<Crouter, OwnerOnly | 'files' | 'profiles'> & {
+    /** Register, publish to and unregister the custom objects the app owns (`receive` and `ack` are owner-daemon only). */
+    readonly customObjects: Pick<CustomObjects, 'register' | 'publish' | 'unregister'>;
+    /** Link nodes to the app's objects: `watch` and `unwatch` with `watcher` (and `watcher_machine` for a node of another machine), under `crtr:objects:link:node`. */
+    readonly canvas: Pick<Canvas, 'watch' | 'unwatch'>;
     /** Download a file the person's runtime holds (`files.download`); the other `files` calls are owner-daemon only. */
     readonly files: Pick<Files, 'download'>;
     /** The profiles the app may start runs with (`profiles.list`); `ensure` and `retrieve` are owner-daemon only. */

package/dist/error-codes.d.ts

@@ -2,6 +2,6 @@ export { errorCodes } from '@north-light/api';
 export type { ErrorCode, ErrorEnvelope, ErrorOrigin, ErrorType } from '@north-light/api';
 export { mapError } from './errors.js';
 /** Codes the SDK raises itself rather than reading from a daemon or directory response. */
-export declare const sdkErrorCodes: readonly ["crouter_error", "id_token_invalid", "oauth_nonce_missing", "oauth_state_mismatch", "oauth_exchange_mismatch", "not_connected", "refusal_handler_reentry", "run_idle", "waiting_on_user", "request_aborted", "request_timeout", "deadline_exceeded", "connection_error", "transport_error", "daemon_unavailable", "daemon_request_interrupted", "daemon_health_unavailable", "runtime_version_unsupported", "invalid_response", "stream_error", "stream_ended"];
+export declare const sdkErrorCodes: readonly ["crouter_error", "id_token_invalid", "oauth_nonce_missing", "oauth_state_mismatch", "oauth_exchange_mismatch", "not_connected", "refusal_handler_reentry", "run_idle", "waiting_on_user", "request_aborted", "request_timeout", "deadline_exceeded", "connection_error", "transport_error", "daemon_unavailable", "daemon_request_interrupted", "daemon_health_unavailable", "runtime_version_unsupported", "invalid_response", "stream_error", "stream_ended", "no_hosted_runtime", "not_granted"];
 /** A code the SDK raises itself. An `APIError`'s `code` is one of these or an `ErrorCode` from the contract. */
 export type SdkErrorCode = typeof sdkErrorCodes[number];

package/dist/error-codes.js

@@ -40,4 +40,8 @@ export const sdkErrorCodes = [
     /** An event stream failed, or ended before the reply or node it carried did. */
     'stream_error',
     'stream_ended',
+    /** `oauth.appClient(userId)`: the person has no hosted runtime (`NoHostedRuntimeError`). */
+    'no_hosted_runtime',
+    /** `oauth.appClient(userId)`: the person has no active grant for the app (`NotGrantedError`). */
+    'not_granted',
 ];

package/dist/errors.d.ts

@@ -26,6 +26,12 @@ export interface RuntimeVersionDetails {
     required_contract?: string;
     runtime_contract?: string | null;
 }
+/** `oauth.appClient(userId)`: the person has no hosted runtime for the app to act on (directory `invalid_grant` "user has no runtime"). `code` is `no_hosted_runtime`, `status` 409; not retryable. */
+export declare class NoHostedRuntimeError extends APIError {
+}
+/** `oauth.appClient(userId)`: the person has no active grant for this app (directory `invalid_grant` "no active grant"), so they have not signed in to it. `code` is `not_granted`, `status` 409; not retryable. */
+export declare class NotGrantedError extends APIError {
+}
 /** The daemon rejected the request: HTTP 400. */
 export declare class BadRequestError extends APIError {
 }

package/dist/errors.js

@@ -20,6 +20,12 @@ export class RuntimeVersionError extends APIError {
     /** The version the runtime named in `Crouter-Runtime-Version`, or `null` when it sent none (a runtime from before the header existed). */
     get runtimeVersion() { return this.details.runtime_version; }
 }
+/** `oauth.appClient(userId)`: the person has no hosted runtime for the app to act on (directory `invalid_grant` "user has no runtime"). `code` is `no_hosted_runtime`, `status` 409; not retryable. */
+export class NoHostedRuntimeError extends APIError {
+}
+/** `oauth.appClient(userId)`: the person has no active grant for this app (directory `invalid_grant` "no active grant"), so they have not signed in to it. `code` is `not_granted`, `status` 409; not retryable. */
+export class NotGrantedError extends APIError {
+}
 /** The daemon rejected the request: HTTP 400. */
 export class BadRequestError extends APIError {
 }

package/dist/index.d.ts

@@ -33,7 +33,7 @@ export type { RunNotice, VerifyRunNoticeOptions } from './resources/run-notice.j
 export type { NodeStreamEvent, NodeStreamEventListener, NodeStreamEventType } from './resources/node-stream.js';
 export { describeToolDefault, followActivity } from './resources/activity.js';
 export type { ActivityStep, DescribeTool } from './resources/activity.js';
-export { APIError, APIConnectionError, APIConnectionTimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConflictError, CrouterError, DeadlineExceededError, InternalServerError, NotFoundError, PermissionDeniedError, RateLimitError, RuntimeVersionError, UnprocessableEntityError, mapError, } from './errors.js';
+export { APIError, APIConnectionError, APIConnectionTimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConflictError, CrouterError, DeadlineExceededError, InternalServerError, NoHostedRuntimeError, NotGrantedError, NotFoundError, PermissionDeniedError, RateLimitError, RuntimeVersionError, UnprocessableEntityError, mapError, } from './errors.js';
 export type { DeadlineDetails, RuntimeVersionDetails } from './errors.js';
 export { SDK_VERSION } from './version.js';
 export { setupLink } from './setup-link.js';

package/dist/index.js

@@ -12,7 +12,7 @@ export { parsePrivateJwk, privateKeyFromFile } from './oauth/keygen.js';
 export { cursorFromRequest, forwardRunEvents } from './resources/forward.js';
 export { RUN_NOTICE_SCOPE, RunNoticeError, verifyRunNotice } from './resources/run-notice.js';
 export { describeToolDefault, followActivity } from './resources/activity.js';
-export { APIError, APIConnectionError, APIConnectionTimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConflictError, CrouterError, DeadlineExceededError, InternalServerError, NotFoundError, PermissionDeniedError, RateLimitError, RuntimeVersionError, UnprocessableEntityError, mapError, } from './errors.js';
+export { APIError, APIConnectionError, APIConnectionTimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConflictError, CrouterError, DeadlineExceededError, InternalServerError, NoHostedRuntimeError, NotGrantedError, NotFoundError, PermissionDeniedError, RateLimitError, RuntimeVersionError, UnprocessableEntityError, mapError, } from './errors.js';
 export { SDK_VERSION } from './version.js';
 export { setupLink } from './setup-link.js';
 export { sdkErrorCodes } from './error-codes.js';

package/dist/oauth/app-token.d.ts

@@ -0,0 +1,25 @@
+/** What the directory answers an app's `client_credentials` request for `sub=user:<id>` with. */
+export interface AppTokenResponse {
+    access_token?: unknown;
+    runtimeUrl?: unknown;
+    expires_in?: unknown;
+}
+/** An app token for one person's runtime. */
+export interface AppToken {
+    accessToken: string;
+    runtimeUrl: string;
+    expiresAt: number;
+}
+/** Reads the directory's answer into an `AppToken`; `expiresAt` is the token's own `exp`, else `expires_in` from now. */
+export declare function appTokenFrom(response: AppTokenResponse, now?: number): AppToken;
+/** A token stays usable until this long before its expiry. */
+export declare const APP_TOKEN_SKEW_MS = 60000;
+/** One minted app token per person, shared by every client of that person and by concurrent callers (one mint in flight per person). */
+export declare class AppTokenCache {
+    private readonly mint;
+    private readonly tokens;
+    private readonly minting;
+    constructor(mint: (userId: string) => Promise<AppToken>);
+    /** The cached token while it has more than a minute left, else a fresh mint. `rejected` is the token a runtime just answered 401 to: it is never served again. */
+    get(userId: string, rejected?: string): Promise<AppToken>;
+}

package/dist/oauth/app-token.js

@@ -0,0 +1,41 @@
+import { decodeJwt } from 'jose';
+import { CrouterError } from '../errors.js';
+/** Reads the directory's answer into an `AppToken`; `expiresAt` is the token's own `exp`, else `expires_in` from now. */
+export function appTokenFrom(response, now = Date.now()) {
+    if (typeof response.access_token !== 'string' || !response.access_token || typeof response.runtimeUrl !== 'string' || !response.runtimeUrl) {
+        throw new CrouterError('Directory returned an incomplete app token (access_token and runtimeUrl are required)');
+    }
+    const exp = decodeJwt(response.access_token).exp;
+    const expiresAt = typeof exp === 'number' ? exp * 1_000
+        : typeof response.expires_in === 'number' ? now + response.expires_in * 1_000
+            : undefined;
+    if (expiresAt === undefined)
+        throw new CrouterError('Directory returned an app token with no expiry');
+    return { accessToken: response.access_token, runtimeUrl: response.runtimeUrl, expiresAt };
+}
+/** A token stays usable until this long before its expiry. */
+export const APP_TOKEN_SKEW_MS = 60_000;
+/** One minted app token per person, shared by every client of that person and by concurrent callers (one mint in flight per person). */
+export class AppTokenCache {
+    mint;
+    tokens = new Map();
+    minting = new Map();
+    constructor(mint) {
+        this.mint = mint;
+    }
+    /** The cached token while it has more than a minute left, else a fresh mint. `rejected` is the token a runtime just answered 401 to: it is never served again. */
+    get(userId, rejected) {
+        const cached = this.tokens.get(userId);
+        if (cached && cached.accessToken !== rejected && cached.expiresAt - Date.now() > APP_TOKEN_SKEW_MS)
+            return Promise.resolve(cached);
+        const pending = this.minting.get(userId);
+        if (pending)
+            return pending;
+        const minted = this.mint(userId).then((token) => { this.tokens.set(userId, token); return token; });
+        this.minting.set(userId, minted);
+        const done = () => { if (this.minting.get(userId) === minted)
+            this.minting.delete(userId); };
+        minted.then(done, done);
+        return minted;
+    }
+}

package/dist/oauth/index.d.ts

@@ -108,8 +108,9 @@ export interface OAuth2Options {
 declare const AppCrouter: new (options: CrouterOptions) => AppClient;
 /** A runtime client on one person's stored connection (`oauth.client(userId)`): an `AppClient` that refreshes its
  *  token through the `OAuth2Client`'s store, plus whose connection it is and the runtime it calls. It offers only what
- *  the person's app listener serves. The owner-daemon namespaces (`nodes`, `crons`, `canvas`, …) are absent from its
- *  type and throw `CrouterError` if reached anyway; `files` is `download` only and `profiles` is `list` only.
+ *  the person's app listener serves. The owner-daemon namespaces (`nodes`, `crons`, …) are absent from its
+ *  type and throw `CrouterError` if reached anyway; `files` is `download` only, `profiles` is `list` only, `customObjects` is
+ *  `register`, `publish` and `unregister`, and `canvas` is `watch` and `unwatch`.
  *  `request` still sends any route. */
 export declare class ConnectedCrouter extends AppCrouter {
     /** The person whose connection this client uses (`user:<id>`). */
@@ -126,6 +127,7 @@ export declare class OAuth2Client {
     private readonly fetcher;
     private readonly timeoutMs;
     private readonly store;
+    private readonly appTokens;
     private jwks?;
     private discoveryPromise?;
     /** One refresh per (user, refresh token) in this process; a client holding a newer token never joins an older refusal. */
@@ -228,6 +230,18 @@ export declare class OAuth2Client {
      * `refusal_handler_reentry`.
      */
     client(userId: string): Promise<ConnectedCrouter>;
+    /**
+     * A runtime client for the app itself acting on `userId`'s hosted runtime, with no sign-in of theirs and no stored connection:
+     * the app signs a `client_credentials` request for `sub=user:<id>` and the directory answers a token for the person's runtime
+     * (`runtimeUrl` on the client). It needs the app registered with the `app_token_for_user` operation and an active grant from
+     * the person. Tokens are cached per person until a minute before they expire; the client mints again on expiry and once on a 401.
+     *
+     * Throws `NoHostedRuntimeError` (`no_hosted_runtime`) when the person has no hosted runtime, `NotGrantedError` (`not_granted`)
+     * when they have no active grant for the app; a runtime still provisioning (503), a directory 5xx or a 429 throws an error with
+     * `retryable` true; `invalid_client` is a 401 `unauthorized` naming the key.
+     */
+    appClient(userId: string): Promise<ConnectedCrouter>;
+    private mintAppToken;
     /**
      * Follow the app's background runs until each comes to rest, and hand each ending to `onEnded` (see
      * `RunWatchOptions`). Runs are opened with `client(userId)`, so refusals reach `onRefusal`. Call `start()`.

package/dist/oauth/index.js

@@ -1,11 +1,12 @@
 import { calculateJwkThumbprint, decodeJwt, decodeProtectedHeader, exportJWK, importJWK, importPKCS8, SignJWT } from 'jose';
 import { boundedFetch, FetchDeadlineError, JwksCache, parseScope, verifyIdToken } from '@north-light/identity';
 import { deadlineExceeded, sleepWithin } from '@north-light/api';
-import { APIError, CrouterError, mapError } from '../errors.js';
+import { APIError, CrouterError, NoHostedRuntimeError, NotGrantedError, mapError } from '../errors.js';
 import { Crouter } from '../client.js';
 import { withinDeadline } from '../resources/request.js';
 import { RunWatcher } from '../resources/run-watcher.js';
 import { GrantWatcher } from '../resources/grant-watcher.js';
+import { AppTokenCache, appTokenFrom } from './app-token.js';
 import { attachRefusal, isRefusalCode, refusalKindOf } from './refusal.js';
 export { authorizationRefusalOf, refusalOf } from './refusal.js';
 /** A connection store for one process (local development and tests): its lock does not reach other processes. */
@@ -62,13 +63,15 @@ function httpsUrl(value) {
         return undefined;
     }
 }
-const OWNER_ONLY = ['nodes', 'bash', 'canvas', 'crons', 'structuredRequests', 'customObjects', 'human', 'models', 'system', 'auth'];
+/** The owner-daemon namespaces a person's runtime does not serve to an app. `canvas` and `customObjects` are narrowed below, not absent. */
+const OWNER_ONLY = ['nodes', 'bash', 'crons', 'structuredRequests', 'human', 'models', 'system', 'auth'];
 /** The class `ConnectedCrouter` extends: `Crouter`'s implementation under the type of what a person's app listener serves. */
 const AppCrouter = Crouter;
 /** A runtime client on one person's stored connection (`oauth.client(userId)`): an `AppClient` that refreshes its
  *  token through the `OAuth2Client`'s store, plus whose connection it is and the runtime it calls. It offers only what
- *  the person's app listener serves. The owner-daemon namespaces (`nodes`, `crons`, `canvas`, …) are absent from its
- *  type and throw `CrouterError` if reached anyway; `files` is `download` only and `profiles` is `list` only.
+ *  the person's app listener serves. The owner-daemon namespaces (`nodes`, `crons`, …) are absent from its
+ *  type and throw `CrouterError` if reached anyway; `files` is `download` only, `profiles` is `list` only, `customObjects` is
+ *  `register`, `publish` and `unregister`, and `canvas` is `watch` and `unwatch`.
  *  `request` still sends any route. */
 export class ConnectedCrouter extends AppCrouter {
     /** The person whose connection this client uses (`user:<id>`). */
@@ -87,6 +90,9 @@ export class ConnectedCrouter extends AppCrouter {
         const { files, profiles } = this;
         Object.defineProperty(this, 'files', { value: { download: files.download.bind(files) } });
         Object.defineProperty(this, 'profiles', { value: { list: profiles.list } });
+        const { customObjects, canvas } = this;
+        Object.defineProperty(this, 'customObjects', { value: { register: customObjects.register.bind(customObjects), publish: customObjects.publish.bind(customObjects), unregister: customObjects.unregister.bind(customObjects) } });
+        Object.defineProperty(this, 'canvas', { value: { watch: canvas.watch.bind(canvas), unwatch: canvas.unwatch.bind(canvas) } });
     }
 }
 /** The default deadline of one directory operation (`OAuth2Options.timeoutMs`): a discovery read is forgotten when it passes. */
@@ -106,6 +112,7 @@ export class OAuth2Client {
     fetcher;
     timeoutMs;
     store;
+    appTokens = new AppTokenCache((userId) => this.mintAppToken(userId));
     jwks;
     discoveryPromise;
     /** One refresh per (user, refresh token) in this process; a client holding a newer token never joins an older refusal. */
@@ -422,6 +429,30 @@ export class OAuth2Client {
             ...(this.options.fetch ? { fetch: this.options.fetch } : {}),
         });
     }
+    /**
+     * A runtime client for the app itself acting on `userId`'s hosted runtime, with no sign-in of theirs and no stored connection:
+     * the app signs a `client_credentials` request for `sub=user:<id>` and the directory answers a token for the person's runtime
+     * (`runtimeUrl` on the client). It needs the app registered with the `app_token_for_user` operation and an active grant from
+     * the person. Tokens are cached per person until a minute before they expire; the client mints again on expiry and once on a 401.
+     *
+     * Throws `NoHostedRuntimeError` (`no_hosted_runtime`) when the person has no hosted runtime, `NotGrantedError` (`not_granted`)
+     * when they have no active grant for the app; a runtime still provisioning (503), a directory 5xx or a 429 throws an error with
+     * `retryable` true; `invalid_client` is a 401 `unauthorized` naming the key.
+     */
+    async appClient(userId) {
+        if (!/^user:[^:]+$/.test(userId))
+            throw new CrouterError(`appClient needs a Northlight user id (user:<id>), got ${JSON.stringify(userId)}`);
+        const { runtimeUrl } = await this.appTokens.get(userId);
+        let used;
+        return new ConnectedCrouter({ userId, runtimeUrl }, {
+            tokenSource: async () => { used = (await this.appTokens.get(userId)).accessToken; return used; },
+            onUnauthorized: async () => { await this.appTokens.get(userId, used); },
+            ...(this.options.fetch ? { fetch: this.options.fetch } : {}),
+        });
+    }
+    async mintAppToken(userId) {
+        return appTokenFrom(await this.tokenResponse({ grant_type: 'client_credentials', sub: userId }));
+    }
     /**
      * Follow the app's background runs until each comes to rest, and hand each ending to `onEnded` (see
      * `RunWatchOptions`). Runs are opened with `client(userId)`, so refusals reach `onRefusal`. Call `start()`.
@@ -550,7 +581,8 @@ export class OAuth2Client {
             // invalid_grant carries the directory's reason as its error_description; a reason it does not name is grant_revoked.
             const description = refusal.error_description ?? '';
             const code = refusal.error === 'invalid_grant'
-                ? description === 'runtime_provisioning' || isRefusalCode(description) ? description : 'grant_revoked'
+                ? description === 'runtime_provisioning' || isRefusalCode(description) ? description
+                    : description === 'user has no runtime' ? 'no_hosted_runtime' : description === 'no active grant' ? 'not_granted' : 'grant_revoked'
                 : refusal.error === 'invalid_client' ? 'unauthorized' : 'invalid_request';
             const reconnect = isRefusalCode(code);
             if (code === 'runtime_provisioning' && attempt < 2) {
@@ -565,11 +597,14 @@ export class OAuth2Client {
                 continue;
             }
             const message = refusal.error_description ?? refusal.error ?? 'Directory token request failed';
+            if (code === 'no_hosted_runtime' || code === 'not_granted') {
+                throw new (code === 'no_hosted_runtime' ? NoHostedRuntimeError : NotGrantedError)(409, code, message, undefined, response.headers, { origin: 'directory', type: 'invalid_request_error', retryable: false });
+            }
             const keyHint = code === 'unauthorized' ? await describeSigningKey(key, kid) : undefined;
             // mapError gives the refusal its status class (401 → AuthenticationError) as errors.md documents.
             throw mapError(new APIError(code === 'runtime_provisioning' ? 503 : reconnect || code === 'unauthorized' ? 401 : response.status, code, keyHint ? `${message}: ${keyHint.hint}` : message, code === 'invalid_request' ? { oauth_error: refusal.error }
                 : keyHint ? { oauth_error: 'invalid_client', kid: keyHint.kid, ...(keyHint.thumbprint ? { key_thumbprint: keyHint.thumbprint } : {}) } : undefined, response.headers, { origin: 'directory', type: code === 'runtime_provisioning' ? 'server_error' : code === 'invalid_request' ? 'invalid_request_error' : 'authentication_error',
-                retryable: code === 'runtime_provisioning', user_action: reconnect ? 'reconnect' : undefined }));
+                retryable: code === 'runtime_provisioning' || response.status >= 500 || response.status === 429, user_action: reconnect ? 'reconnect' : undefined }));
         }
     }
 }

package/dist/skill/northlight/SKILL.md

@@ -2,7 +2,7 @@
 name: northlight
 description: "Use when building, debugging or shipping an app that signs people in with Northlight, starts runs on their Northlight runtime, or calls Northlight providers (sms, search, integrations, context, device) with @north-light/sdk."
 metadata:
-  sdk-version: "0.3.490"
+  sdk-version: "0.3.492"
 ---
 
 # Building a Northlight app
@@ -11,7 +11,7 @@ An app on Northlight signs people in with their Northlight account, then starts
 
 ## First: check this skill matches the SDK
 
-This skill is for SDK version `0.3.490`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. That command needs no account and no crtr. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
+This skill is for SDK version `0.3.492`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. That command needs no account and no crtr. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
 
 ## Where things run
 

package/dist/version.d.ts

@@ -1,5 +1,5 @@
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export declare const SDK_VERSION = "0.3.490";
+export declare const SDK_VERSION = "0.3.492";
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the
  *  contract level existed (which only knows this header) refuses this SDK, while every later runtime accepts it. */
 export declare const LEGACY_FLOOR = "0.3.423";

package/dist/version.js

@@ -1,6 +1,6 @@
 // SDK_VERSION is written by scripts/release-version.mjs on every release; do not edit by hand.
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export const SDK_VERSION = '0.3.490';
+export const SDK_VERSION = '0.3.492';
 // LEGACY_FLOOR is written once by `scripts/contract.mjs release`, at the first release that carries the contract level
 // (the `0.0.0` placeholder is replaced there and never again); do not edit by hand.
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@north-light/sdk",
-  "version": "0.3.490",
-  "crouterContract": "1.12",
+  "version": "0.3.492",
+  "crouterContract": "1.13",
   "description": "Typed Node and browser client for running crouter agents through the crtrd /v1 API.",
   "type": "module",
   "main": "./dist/index.js",
@@ -44,8 +44,8 @@
     "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'next') { console.error('@north-light/sdk publishes only with --tag next; scripts/promote-sdk.mjs is the only mover of latest.'); process.exit(1); }\""
   },
   "dependencies": {
-    "@north-light/api": "0.3.490",
-    "@north-light/identity": "0.3.490",
+    "@north-light/api": "0.3.492",
+    "@north-light/identity": "0.3.492",
     "jose": "^6.2.1"
   },
   "peerDependencies": {