@north-light/sdk 0.3.630 → 0.3.631

package/dist/resources/inference-endpoint.d.ts

@@ -34,7 +34,7 @@ export interface InferenceEndpointOptions {
     issuer: string;
     /** The endpoint base URL the app registered, for example `https://context.northlight.ai/v1/inference`. The token's `aud` must equal it exactly; its path is where `handle` is mounted. The endpoint serves `POST <baseURL>/anthropic/v1/messages`. */
     baseURL: string;
-    /** The app's own principal, `app:<id>`; the token's actor chain must contain it. */
+    /** The app's own principal, `app:<id>`; it prefixes the vendor reference of a call the vendor gave no request id. */
     app: string;
     /** The app's Anthropic API key. It is used only for a call the directory admits as card-paid (no `pool` in the admission), and is never logged or returned. */
     apiKey: string;
@@ -54,7 +54,7 @@ export interface InferenceEndpointOptions {
  * that serves a person's runtime the Anthropic Messages API. Mount `handle` at the path of `baseURL`; call `sweep` on a timer.
  *
  * The request carries a directory token (`x-api-key` or `Authorization: Bearer`) that the handler verifies (issuer, `aud` =
- * `baseURL`, expiry, scope `crtr:llm`, the app in the actor chain); a token that does not hold is 401 and nothing is sent upstream.
+ * `baseURL`, expiry, scope `crtr:llm`); a token that does not hold is 401 and nothing is sent upstream.
  * A server-side tool or service tier is 400, a model outside `rungs` 404, a method other than POST 405. Otherwise the directory
  * decides, per call and from current state, whether the call is admitted: a refusal reaches the runtime as a 402 carrying the
  * directory's `payment` body, and a directory that cannot be reached or answers anything unexpected is 503 with nothing sent upstream.

package/dist/resources/inference-endpoint.js

@@ -144,7 +144,7 @@ function chargedBody(body, contentType, charge) {
  * that serves a person's runtime the Anthropic Messages API. Mount `handle` at the path of `baseURL`; call `sweep` on a timer.
  *
  * The request carries a directory token (`x-api-key` or `Authorization: Bearer`) that the handler verifies (issuer, `aud` =
- * `baseURL`, expiry, scope `crtr:llm`, the app in the actor chain); a token that does not hold is 401 and nothing is sent upstream.
+ * `baseURL`, expiry, scope `crtr:llm`); a token that does not hold is 401 and nothing is sent upstream.
  * A server-side tool or service tier is 400, a model outside `rungs` 404, a method other than POST 405. Otherwise the directory
  * decides, per call and from current state, whether the call is admitted: a refusal reaches the runtime as a 402 carrying the
  * directory's `payment` body, and a directory that cannot be reached or answers anything unexpected is 503 with nothing sent upstream.
@@ -269,7 +269,7 @@ export function inferenceEndpoint(options) {
         let sub;
         try {
             const verified = await verifyCallToken({ token, jwks, issuer: options.issuer, audience: options.baseURL });
-            if (!(verified.scope ?? '').split(' ').includes(INFERENCE_SCOPE) || !verified.chain.some((link) => link.sub === options.app))
+            if (!(verified.scope ?? '').split(' ').includes(INFERENCE_SCOPE))
                 throw new Error('scope');
             sub = verified.sub;
         }

package/dist/skill/northlight/SKILL.md

@@ -2,7 +2,7 @@
 name: northlight
 description: "Use when building, debugging or shipping an app that signs people in with Northlight, starts runs on their Northlight runtime, or calls Northlight providers (sms, search, integrations, context, device) with @north-light/sdk."
 metadata:
-  sdk-version: "0.3.630"
+  sdk-version: "0.3.631"
 ---
 
 # Building a Northlight app
@@ -27,7 +27,7 @@ Never text a person first: Comms refuses a send to anyone who has not texted you
 
 ## First: check this skill matches the SDK
 
-This skill is for SDK version `0.3.630`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. It needs no account. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
+This skill is for SDK version `0.3.631`. If the project has `node_modules/@north-light/sdk/package.json`, compare its `version` with that number. If they differ, run `npx @north-light/sdk skill` in the project, then read the rewritten `.agents/skills/northlight/SKILL.md` (or `.claude/skills/northlight/SKILL.md`) instead of this copy. It needs no account. A project that has no SDK yet starts with `npx @north-light/sdk@latest init <dir>`.
 
 ## Where things run
 

package/dist/version.d.ts

@@ -1,5 +1,5 @@
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export declare const SDK_VERSION = "0.3.630";
+export declare const SDK_VERSION = "0.3.631";
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the
  *  contract level existed (which only knows this header) refuses this SDK, while every later runtime accepts it. */
 export declare const LEGACY_FLOOR = "0.3.423";

package/dist/version.js

@@ -1,6 +1,6 @@
 // SDK_VERSION is written by scripts/release-version.mjs on every release; do not edit by hand.
 /** This SDK's release version. Informational only: compatibility is the contract level, not this number. */
-export const SDK_VERSION = '0.3.630';
+export const SDK_VERSION = '0.3.631';
 // LEGACY_FLOOR is written once by `scripts/contract.mjs release`, at the first release that carries the contract level
 // (the `0.0.0` placeholder is replaced there and never again); do not edit by hand.
 /** The release sent in `Crouter-Minimum-Runtime-Version` on every request. It is frozen, so a runtime from before the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/sdk",
-  "version": "0.3.630",
+  "version": "0.3.631",
   "crouterContract": "1.50",
   "description": "Typed Node and browser client for running crouter agents through the crtrd /v1 API.",
   "type": "module",
@@ -44,9 +44,9 @@
     "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'next') { console.error('@north-light/sdk publishes only with --tag next; scripts/promote-sdk.mjs is the only mover of latest.'); process.exit(1); }\""
   },
   "dependencies": {
-    "@north-light/api": "0.3.630",
-    "@north-light/identity": "0.3.630",
-    "@north-light/plugin": "0.3.630",
+    "@north-light/api": "0.3.631",
+    "@north-light/identity": "0.3.631",
+    "@north-light/plugin": "0.3.631",
     "jose": "^6.2.1"
   },
   "peerDependencies": {