@north-light/sdk 0.3.539 → 0.3.541

package/dist/error-codes.js

@@ -11,7 +11,7 @@ export const sdkErrorCodes = [
     'oauth_nonce_missing',
     /** The callback's `state` was missing or differed from the saved one. */
     'oauth_state_mismatch',
-    /** `exchangeCode` got a sign-in-only answer, or `exchangeIdentity` got one carrying a connection. */
+    /** `exchangeCode` got a sign-in-only answer (no connection); finish such a sign-in with `exchangeIdentity`. */
     'oauth_exchange_mismatch',
     /** `oauth.client(userId)` or `refresh` found no stored connection for the person: they must sign in again. */
     'not_connected',

package/dist/oauth/index.d.ts

@@ -188,11 +188,12 @@ export declare class OAuth2Client {
         nonce?: string;
     }): Promise<Connection>;
     /**
-     * Finish a sign-in-only request (`authorizeUrl` with scopes `openid` or `openid email`) and return the
-     * person's verified identity. There is no connection, refresh token, or runtime access on this path.
-     * `nonce` is the value `authorizeUrl` returned and is required. A response without an ID token, or with
-     * one that fails verification, throws `id_token_invalid`; a response carrying a runtime connection (the
-     * request asked for runtime scopes) throws `oauth_exchange_mismatch` and must be finished with `exchangeCode`.
+     * Finish a sign-in-only request (`authorizeUrl` with scopes `openid`, optionally with `email` and `profile`) and
+     * return the person's verified identity. The app gets no connection, refresh token, or runtime access on this path.
+     * `nonce` is the value `authorizeUrl` returned and is required. A response without an ID token, or with one that
+     * fails verification, throws `id_token_invalid`. The directory may still answer with a runtime connection (it gives
+     * one on every sign-in to an app held by a team with a runtime grant); the identity is returned all the same, and
+     * the unneeded refresh token is revoked best-effort. Revocation removes only that token, never the grant.
      */
     exchangeIdentity({ code, codeVerifier, state, expectedState, nonce }: {
         code: string;
@@ -271,6 +272,7 @@ export declare class OAuth2Client {
         nonce?: string;
     }): Promise<IdTokenClaims>;
     revoke(connection: Connection): Promise<boolean>;
+    private revokeRefreshToken;
     /** A token request. `deadlineAt` is the whole operation's deadline (discovery included); without one it starts now. */
     private tokenResponse;
     private connectionFrom;

package/dist/oauth/index.js

@@ -265,23 +265,26 @@ export class OAuth2Client {
         return connection;
     }
     /**
-     * Finish a sign-in-only request (`authorizeUrl` with scopes `openid` or `openid email`) and return the
-     * person's verified identity. There is no connection, refresh token, or runtime access on this path.
-     * `nonce` is the value `authorizeUrl` returned and is required. A response without an ID token, or with
-     * one that fails verification, throws `id_token_invalid`; a response carrying a runtime connection (the
-     * request asked for runtime scopes) throws `oauth_exchange_mismatch` and must be finished with `exchangeCode`.
+     * Finish a sign-in-only request (`authorizeUrl` with scopes `openid`, optionally with `email` and `profile`) and
+     * return the person's verified identity. The app gets no connection, refresh token, or runtime access on this path.
+     * `nonce` is the value `authorizeUrl` returned and is required. A response without an ID token, or with one that
+     * fails verification, throws `id_token_invalid`. The directory may still answer with a runtime connection (it gives
+     * one on every sign-in to an app held by a team with a runtime grant); the identity is returned all the same, and
+     * the unneeded refresh token is revoked best-effort. Revocation removes only that token, never the grant.
      */
     async exchangeIdentity({ code, codeVerifier, state, expectedState, nonce }) {
         assertState(state, expectedState);
         if (typeof nonce !== 'string' || !nonce)
             throw new CrouterError('exchangeIdentity requires the nonce authorizeUrl returned', 'oauth_nonce_missing');
         const response = await this.tokenResponse({ grant_type: 'authorization_code', code, redirect_uri: this.options.redirectUri, code_verifier: codeVerifier });
-        if (response.refresh_token !== undefined || response.runtimeUrl !== undefined) {
-            throw new CrouterError('The directory answered with a runtime connection, so the request asked for runtime scopes; finish it with exchangeCode(), or request only openid or openid email for a sign-in-only visitor', 'oauth_exchange_mismatch');
-        }
         if (typeof response.id_token !== 'string' || !response.id_token)
             throw new CrouterError('Directory returned no ID token for a sign-in-only request', 'id_token_invalid');
         const claims = await this.verifyIdToken(response.id_token, { nonce });
+        if (typeof response.refresh_token === 'string' && response.refresh_token) {
+            // The directory gave a connection this sign-in does not use: drop its refresh token. Best-effort, because the
+            // identity is already verified and the token is unusable without the app's key.
+            await this.revokeRefreshToken(response.refresh_token).catch(() => undefined);
+        }
         return {
             sub: claims.sub,
             ...(typeof claims['email'] === 'string' ? { email: claims['email'] } : {}),
@@ -523,11 +526,14 @@ export class OAuth2Client {
         return claims;
     }
     async revoke(connection) {
+        return await this.revokeRefreshToken(connection.refreshToken);
+    }
+    async revokeRefreshToken(refreshToken) {
         const deadlineAt = Date.now() + this.timeoutMs;
         const metadata = await this.discoveryWithin(deadlineAt);
         if (!metadata.revocation_endpoint)
             return false;
-        await this.post(metadata.revocation_endpoint, { token: connection.refreshToken, token_type_hint: 'refresh_token' }, true, deadlineAt);
+        await this.post(metadata.revocation_endpoint, { token: refreshToken, token_type_hint: 'refresh_token' }, true, deadlineAt);
         return true;
     }
     /** A token request. `deadlineAt` is the whole operation's deadline (discovery included); without one it starts now. */

package/dist/skill/northlight/SKILL.md

@@ -2,7 +2,7 @@
 name: northlight
 description: "Use when building, debugging or shipping an app that signs people in with Northlight, starts runs on their Northlight runtime, or calls Northlight providers (sms, search, integrations, context, device) with @north-light/sdk."
 metadata:
-  sdk-version: "0.3.539"
+  sdk-version: "0.3.541"
 ---
 
 # Building a Northlight app
@@ -11,7 +11,7 @@ An app on Northlight signs people in with their Northlight account, then starts
 
 ## First: check this skill matches the SDK
 
-This skill is for SDK version `0.3.539`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. That command needs no account and no crtr. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
+This skill is for SDK version `0.3.541`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. That command needs no account and no crtr. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
 
 ## Where things run
 

package/dist/version.d.ts

@@ -1,5 +1,5 @@
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export declare const SDK_VERSION = "0.3.539";
+export declare const SDK_VERSION = "0.3.541";
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the
  *  contract level existed (which only knows this header) refuses this SDK, while every later runtime accepts it. */
 export declare const LEGACY_FLOOR = "0.3.423";

package/dist/version.js

@@ -1,6 +1,6 @@
 // SDK_VERSION is written by scripts/release-version.mjs on every release; do not edit by hand.
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export const SDK_VERSION = '0.3.539';
+export const SDK_VERSION = '0.3.541';
 // LEGACY_FLOOR is written once by `scripts/contract.mjs release`, at the first release that carries the contract level
 // (the `0.0.0` placeholder is replaced there and never again); do not edit by hand.
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/sdk",
-  "version": "0.3.539",
+  "version": "0.3.541",
   "crouterContract": "1.28",
   "description": "Typed Node and browser client for running crouter agents through the crtrd /v1 API.",
   "type": "module",
@@ -44,8 +44,8 @@
     "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'next') { console.error('@north-light/sdk publishes only with --tag next; scripts/promote-sdk.mjs is the only mover of latest.'); process.exit(1); }\""
   },
   "dependencies": {
-    "@north-light/api": "0.3.539",
-    "@north-light/identity": "0.3.539",
+    "@north-light/api": "0.3.541",
+    "@north-light/identity": "0.3.541",
     "jose": "^6.2.1"
   },
   "peerDependencies": {