Quick setup

npx @north-light/sdk@latest init my-app

npx @north-light/sdk@latest init my-app
cd my-app

{"kty":"EC","x":"…","y":"…","crv":"P-256","kid":"…","alg":"ES256","use":"sig"}

npx @north-light/sdk env --client-id <client id>

Set in local/app.env:
  CROUTER_ISSUER=https://account.northlight.ai
  CROUTER_CLIENT_ID=<client id>
  APP_ORIGIN=http://localhost:3000
Key file: local/app-key.json (set CROUTER_KEY_FILE to change it).

npm i
node --env-file=local/app.env --import tsx server.ts

// The server `npx @north-light/sdk init` writes as server.ts: sign a person in with Northlight, then start a run on
// their runtime and send them a text. It keeps sign-in state in memory, so it is a sketch for one process, not production.
import {createServer, type IncomingMessage, type ServerResponse} from 'node:http';
import {randomBytes} from 'node:crypto';
import {readFile} from 'node:fs/promises';
import {MemoryConnectionStore, OAuth2Client, authorizationRefusalOf} from '@north-light/sdk';

const origin = process.env.APP_ORIGIN ?? 'http://localhost:3000';

const store = new MemoryConnectionStore(); // one process only; use a persistent ConnectionStore in production
const oauth = new OAuth2Client({
  clientId: process.env.CROUTER_CLIENT_ID ?? '',
  issuer: process.env.CROUTER_ISSUER ?? 'https://account.northlight.ai',
  redirectUri: `${origin}/auth/callback`,
  privateKey: JSON.parse(await readFile(process.env.CROUTER_KEY_FILE ?? 'local/app-key.json', 'utf8')),
  store,
});

const pending = new Map<string, {codeVerifier: string; nonce: string}>(); // sign-ins in flight, keyed by state
const sessions = new Map<string, string>(); // session id -> userId; use a real session store in production

const escapeHtml = (text: string) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
const page = (res: ServerResponse, status: number, body: string) => {
  res.writeHead(status, {'content-type': 'text/html; charset=utf-8'}).end(`<!doctype html><meta charset="utf-8"><title>Northlight app</title><body style="font-family:system-ui;max-width:40rem;margin:3rem auto">${body}`);
};
const userOf = (req: IncomingMessage) => {
  const sid = /(?:^|; )sid=([\w-]+)/.exec(req.headers.cookie ?? '')?.[1];
  return sid ? sessions.get(sid) : undefined;
};

const server = createServer(async (req, res) => {
  const url = new URL(req.url ?? '/', origin);
  try {
    if (!process.env.CROUTER_CLIENT_ID) {
      return page(res, 200, '<h1>One step left</h1><p>Register the app in the console, then run <code>npx @north-light/sdk env --client-id &lt;client id&gt;</code> and restart this server.</p>');
    }

    if (url.pathname === '/auth/login') {
      const {url: authorizeUrl, codeVerifier, state, nonce} = await oauth.authorizeUrl({
        scopes: ['openid', 'profile', 'crtr:llm', 'crtr:act', 'sms:send'],
        state: randomBytes(16).toString('base64url'),
      });
      pending.set(state, {codeVerifier, nonce});
      return void res.writeHead(303, {location: authorizeUrl}).end();
    }

    if (url.pathname === '/auth/callback') {
      if (authorizationRefusalOf(url)?.code === 'app_in_testing') {
        return page(res, 403, '<h1>This app is still in testing</h1><p>Ask its owner to add you on the Testers tab in the console.</p>');
      }
      const state = url.searchParams.get('state') ?? '';
      const code = url.searchParams.get('code');
      const saved = pending.get(state);
      if (!saved || !code) return page(res, 400, '<p>Start sign-in again at <a href="/auth/login">/auth/login</a>.</p>');
      pending.delete(state);
      const connection = await oauth.exchangeCode({code, codeVerifier: saved.codeVerifier, state, expectedState: state, nonce: saved.nonce});
      await store.save(connection);
      const sid = randomBytes(16).toString('base64url');
      sessions.set(sid, connection.userId);
      return void res.writeHead(303, {location: '/', 'set-cookie': `sid=${sid}; HttpOnly; SameSite=Lax; Path=/`}).end();
    }

    const userId = userOf(req);
    if (!userId) return page(res, 200, '<h1>Northlight app</h1><p><a href="/auth/login">Sign in with Northlight</a></p>');

    if (url.pathname === '/run' && req.method === 'POST') {
      const runtime = await oauth.client(userId); // a client on this person's runtime, from their stored connection
      const started = await runtime.runs.start({prompt: 'Reply with exactly the word: pong', scopes: ['crtr:llm', 'crtr:act']});
      const run = await runtime.runs.wait(started.run_id); // status is 'idle' once the reply is done
      // Texts the signed-in person's own verified phone through the sms provider (50 per person per UTC day).
      const sent = await runtime.providers.call({provider: 'sms', tool: 'send', arguments: {body: 'Hello from my first Northlight app.'}});
      return page(res, 200, `<h1>Done</h1><p>The run finished with status <code>${escapeHtml(run.status)}</code>. A text is on its way to your phone.</p><pre>${escapeHtml(JSON.stringify({run: run.run_id, outcome: run.outcome, report: run.last_report, text: sent}, null, 2))}</pre><p><a href="/">Back</a></p>`);
    }
    return page(res, 200, `<h1>Signed in</h1><p>You are <code>${escapeHtml(userId)}</code>.</p><form method="post" action="/run"><button>Start a run and send me a text</button></form>`);
  } catch (error) {
    console.error(error);
    return page(res, 500, `<h1>Something failed</h1><pre>${escapeHtml(error instanceof Error ? error.message : String(error))}</pre>`);
  }
});

server.listen(Number(new URL(origin).port) || 3000, () => console.log(`Listening on ${origin}`));