@north-light/sdk 0.3.611 → 0.3.613

package/dist/oauth/index.d.ts

@@ -263,6 +263,19 @@ export declare class OAuth2Client {
      * token request's: `invalid_client` is a 401 `unauthorized` naming the key, a directory 5xx or a 429 has `retryable` true.
      */
     directoryToken(rejected?: string): Promise<string>;
+    /**
+     * Whether `userId` (`user:<id>`) is on the team that holds this app, and their role on it (`GET /v1/apps/self/members/:user_id`
+     * as the app itself, bearer `directoryToken()`). For an app's own staff pages: the directory answers from its current
+     * relations and the SDK caches nothing, so someone removed from the team is refused at their next call. An unknown
+     * user is `{member: false}`. A 401 re-mints the directory token once. A directory 5xx or 429 throws with `retryable` true;
+     * the deadline is `timeoutMs` (`DeadlineExceededError`).
+     */
+    appMember(userId: string): Promise<{
+        member: true;
+        role: 'admin' | 'member';
+    } | {
+        member: false;
+    }>;
     /**
      * Follow the app's background runs until each comes to rest, and hand each ending to `onEnded` (see
      * `RunWatchOptions`). Runs are opened with `client(userId)`, so refusals reach `onRefusal`. Call `start()`.

package/dist/oauth/index.js

@@ -480,6 +480,42 @@ export class OAuth2Client {
     directoryToken(rejected) {
         return this.directoryApiTokens.get('directory', rejected).then((token) => token.accessToken);
     }
+    /**
+     * Whether `userId` (`user:<id>`) is on the team that holds this app, and their role on it (`GET /v1/apps/self/members/:user_id`
+     * as the app itself, bearer `directoryToken()`). For an app's own staff pages: the directory answers from its current
+     * relations and the SDK caches nothing, so someone removed from the team is refused at their next call. An unknown
+     * user is `{member: false}`. A 401 re-mints the directory token once. A directory 5xx or 429 throws with `retryable` true;
+     * the deadline is `timeoutMs` (`DeadlineExceededError`).
+     */
+    async appMember(userId) {
+        if (!/^user:[^:]+$/.test(userId))
+            throw new CrouterError(`appMember needs a Northlight user id (user:<id>), got ${JSON.stringify(userId)}`);
+        const url = `${this.issuer.replace(/\/$/, '')}/v1/apps/self/members/${encodeURIComponent(userId)}`;
+        const deadlineAt = Date.now() + this.timeoutMs;
+        const ask = async (token) => this.bounded(url, { headers: { authorization: `Bearer ${token}` } }, deadlineAt, async (response) => ({ response, body: await response.json().catch(() => undefined) }));
+        const mint = async (rejected) => {
+            try {
+                return await withinDeadline(this.directoryToken(rejected), deadlineAt);
+            }
+            catch (error) {
+                throw error instanceof APIError ? mapError(error) : error;
+            }
+        };
+        const token = await mint();
+        let { response, body } = await ask(token);
+        if (response.status === 401)
+            ({ response, body } = await ask(await mint(token)));
+        const answer = body;
+        if (response.ok) {
+            if (answer?.member === false)
+                return { member: false };
+            if (answer?.member === true && (answer.role === 'admin' || answer.role === 'member'))
+                return { member: true, role: answer.role };
+            throw new CrouterError('Directory returned an invalid membership answer');
+        }
+        const error = answer?.error;
+        throw mapError(new APIError(response.status, typeof error?.code === 'string' ? error.code : 'directory_error', typeof error?.message === 'string' ? error.message : `Directory membership read returned ${response.status}`, undefined, response.headers, { origin: 'directory', ...(typeof error?.type === 'string' ? { type: error.type } : {}), retryable: response.status >= 500 || response.status === 429 }));
+    }
     /**
      * Follow the app's background runs until each comes to rest, and hand each ending to `onEnded` (see
      * `RunWatchOptions`). Runs are opened with `client(userId)`, so refusals reach `onRefusal`. Call `start()`.

package/dist/skill/northlight/SKILL.md

@@ -2,7 +2,7 @@
 name: northlight
 description: "Use when building, debugging or shipping an app that signs people in with Northlight, starts runs on their Northlight runtime, or calls Northlight providers (sms, search, integrations, context, device) with @north-light/sdk."
 metadata:
-  sdk-version: "0.3.611"
+  sdk-version: "0.3.613"
 ---
 
 # Building a Northlight app
@@ -27,7 +27,7 @@ Never text a person first: Comms refuses a send to anyone who has not texted you
 
 ## First: check this skill matches the SDK
 
-This skill is for SDK version `0.3.611`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. It needs no account. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
+This skill is for SDK version `0.3.613`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. It needs no account. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
 
 ## Where things run
 

package/dist/version.d.ts

@@ -1,5 +1,5 @@
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export declare const SDK_VERSION = "0.3.611";
+export declare const SDK_VERSION = "0.3.613";
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the
  *  contract level existed (which only knows this header) refuses this SDK, while every later runtime accepts it. */
 export declare const LEGACY_FLOOR = "0.3.423";

package/dist/version.js

@@ -1,6 +1,6 @@
 // SDK_VERSION is written by scripts/release-version.mjs on every release; do not edit by hand.
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export const SDK_VERSION = '0.3.611';
+export const SDK_VERSION = '0.3.613';
 // LEGACY_FLOOR is written once by `scripts/contract.mjs release`, at the first release that carries the contract level
 // (the `0.0.0` placeholder is replaced there and never again); do not edit by hand.
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@north-light/sdk",
-  "version": "0.3.611",
-  "crouterContract": "1.46",
+  "version": "0.3.613",
+  "crouterContract": "1.47",
   "description": "Typed Node and browser client for running crouter agents through the crtrd /v1 API.",
   "type": "module",
   "main": "./dist/index.js",
@@ -44,9 +44,9 @@
     "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'next') { console.error('@north-light/sdk publishes only with --tag next; scripts/promote-sdk.mjs is the only mover of latest.'); process.exit(1); }\""
   },
   "dependencies": {
-    "@north-light/api": "0.3.611",
-    "@north-light/identity": "0.3.611",
-    "@north-light/plugin": "0.3.611",
+    "@north-light/api": "0.3.613",
+    "@north-light/identity": "0.3.613",
+    "@north-light/plugin": "0.3.613",
     "jose": "^6.2.1"
   },
   "peerDependencies": {