@cmmd-center/forge 0.10.8 → 0.10.9

package/dist/bin.mjs

@@ -16520,7 +16520,7 @@ function makeNetServiceShape(createServer = Net.createServer) {
 }
 //#endregion
 //#region ../../packages/shared/src/releaseInfo.generated.ts
-const FORGE_RELEASE_VERSION = "0.10.5";
+const FORGE_RELEASE_VERSION = "0.10.6";
 //#endregion
 //#region ../../packages/shared/src/hostProcess.ts
 /**
@@ -65121,7 +65121,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.10.8";
+var version$1 = "0.10.9";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -93114,6 +93114,31 @@ function lifecycleIntentCommandId(runtimeId, threadId, requestedAt) {
 	return CommandId.make("lifecycle-intent:" + stableReplicaDigest(runtimeId, threadId, requestedAt));
 }
 //#endregion
+//#region src/runtimeReplication/replicaHydrationProjects.ts
+function activePathMatchedProjects(projects, index, summary) {
+	return projects.filter((project) => project.deletedAt === null && (project.id === summary.projectId || index.runtime.workspaceRoot !== null && project.workspaceRoot === index.runtime.workspaceRoot));
+}
+const resolveRepositoryMatchedProjects = fn$1("resolveRepositoryMatchedProjects")(function* (projects, replicaRepositoryFullName, dependencies) {
+	if (replicaRepositoryFullName === null) return [];
+	return yield* filter$1(projects.filter((project) => project.deletedAt === null), (project) => dependencies.resolveProjectRepositoryFullName(project.workspaceRoot).pipe(map$3((repositoryFullName) => repositoryFullName?.toLowerCase() === replicaRepositoryFullName)), { concurrency: 1 });
+});
+const resolveLocalReplicaProjects = fn$1("resolveLocalReplicaProjects")(function* (projects, index, summary, dependencies) {
+	const pathMatches = activePathMatchedProjects(projects, index, summary);
+	if (pathMatches.length > 0) return {
+		projects: pathMatches,
+		repositoryRemapped: false
+	};
+	return {
+		projects: yield* resolveRepositoryMatchedProjects(projects, index.runtime.githubRepoFullName?.toLowerCase() ?? null, dependencies),
+		repositoryRemapped: true
+	};
+});
+function replicaWorkspaceMatchesLocalProject(input) {
+	if (input.detail.runtime.workspaceRoot === input.localProject.workspaceRoot) return true;
+	const localRepository = input.localProjectRepositoryFullName?.toLowerCase() ?? null;
+	return localRepository !== null && input.detail.runtime.githubRepoFullName?.toLowerCase() === localRepository && input.detail.project.githubRepoFullName?.toLowerCase() === localRepository;
+}
+//#endregion
 //#region src/runtimeReplication/protocol.ts
 const EMPTY_RUNTIME_THREAD_HEAD_HASH = "sha256:47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU";
 const REPLICA_MESSAGE_ID_PREFIX = "replica-source-v1:";
@@ -93308,25 +93333,6 @@ function replicaSummaryMatchesDetail(summary, detail) {
 		[summary.lastActivityAt, detail.thread.lastActivityAt]
 	].every(([summaryValue, detailValue]) => summaryValue === detailValue);
 }
-function replicaSummaryPayload(summary) {
-	return {
-		conversationId: summary.conversationId,
-		project: {
-			projectId: summary.projectId,
-			title: summary.projectTitle,
-			githubRepoFullName: summary.projectGithubRepoFullName,
-			branch: summary.projectBranch
-		},
-		thread: {
-			threadId: summary.threadId,
-			title: summary.title,
-			status: summary.status,
-			model: summary.model,
-			branch: summary.branch,
-			lastActivityAt: summary.lastActivityAt
-		}
-	};
-}
 function hasValidReplicaGeneration(runtimeId, threadId, generationId, threadStatus, sourceEvents) {
 	const streamKey = "thread:" + threadId;
 	const base = runtimeThreadGenerationId(runtimeId, streamKey);
@@ -93467,30 +93473,11 @@ function threadDates(events, fallback) {
 		updatedAt: events.at(-1).occurredAt
 	};
 }
-function replicaWorkspaceMatchesLocalProject(input) {
-	if (input.detail.runtime.workspaceRoot === input.localProject.workspaceRoot) return true;
-	const localRepository = input.localProjectRepositoryFullName?.toLowerCase() ?? null;
-	return localRepository !== null && input.detail.runtime.githubRepoFullName?.toLowerCase() === localRepository && input.detail.project.githubRepoFullName?.toLowerCase() === localRepository;
-}
 function replicaToOrchestrationThread(input) {
-	const index = decodeReplicaThreadIndex({
-		data: {
-			runtime: input.indexRuntimePayload,
-			reachability: "unknown",
-			threads: [input.summaryPayload],
-			nextCursor: null
-		},
-		meta: {
-			domain: "runtimeThreadIndex",
-			version: "1.0",
-			timestamp: input.hydratedAt
-		}
-	});
+	const { indexRuntime, summary } = input;
 	const detail = decodeReplicaThreadDetail(input.replicaPayload);
-	if (index === null) return null;
-	const summary = index.threads[0];
 	const sourceEvents = detail?.events.map(replicaSourceEvent) ?? [];
-	if (detail === null || summary === void 0 || index.runtime.id !== input.expectedRuntimeId || detail.runtime.id !== input.expectedRuntimeId || !replicaRuntimeMatches(index.runtime, detail.runtime) || !replicaSummaryMatchesDetail(summary, detail) || input.localProject.deletedAt !== null || input.localProject.defaultModelSelection === null || detail.runtime.workspaceRoot === null || !replicaWorkspaceMatchesLocalProject({
+	if (detail === null || indexRuntime.id !== input.expectedRuntimeId || detail.runtime.id !== input.expectedRuntimeId || !replicaRuntimeMatches(indexRuntime, detail.runtime) || !replicaSummaryMatchesDetail(summary, detail) || input.localProject.deletedAt !== null || input.localProject.defaultModelSelection === null || detail.runtime.workspaceRoot === null || !replicaWorkspaceMatchesLocalProject({
 		detail,
 		localProject: input.localProject,
 		localProjectRepositoryFullName: input.localProjectRepositoryFullName
@@ -93545,24 +93532,6 @@ function replicaHydrationFailure(detail, cause) {
 //#endregion
 //#region src/runtimeReplication/replicaHydration.ts
 const REPLICA_INDEX_PAGE_SIZE$1 = 100;
-function activePathMatchedProjects(state, index, summary) {
-	return state.initialModel.projects.filter((project) => project.deletedAt === null && (project.id === summary.projectId || index.runtime.workspaceRoot !== null && project.workspaceRoot === index.runtime.workspaceRoot));
-}
-const resolveRepositoryMatchedProjects = fn$1("resolveRepositoryMatchedProjects")(function* (state, replicaRepositoryFullName, dependencies) {
-	if (replicaRepositoryFullName === null) return [];
-	return yield* filter$1(state.initialModel.projects.filter((project) => project.deletedAt === null), (project) => dependencies.resolveProjectRepositoryFullName(project.workspaceRoot).pipe(map$3((repositoryFullName) => repositoryFullName?.toLowerCase() === replicaRepositoryFullName)), { concurrency: 1 });
-});
-const resolveLocalReplicaProjects = fn$1("resolveLocalReplicaProjects")(function* (state, index, summary, dependencies) {
-	const pathMatches = activePathMatchedProjects(state, index, summary);
-	if (pathMatches.length > 0) return {
-		projects: pathMatches,
-		repositoryRemapped: false
-	};
-	return {
-		projects: yield* resolveRepositoryMatchedProjects(state, index.runtime.githubRepoFullName?.toLowerCase() ?? null, dependencies),
-		repositoryRemapped: true
-	};
-});
 const readValidatedIndex = fn$1("readValidatedReplicaIndex")(function* (expectedRuntimeId, cursor, dependencies) {
 	const rawIndex = yield* dependencies.readIndex({
 		limit: REPLICA_INDEX_PAGE_SIZE$1,
@@ -93588,7 +93557,7 @@ const prepareReplicaSummary = fn$1("prepareReplicaSummary")(function* (expectedR
 		state.skippedQuarantined += 1;
 		return;
 	}
-	const localResolution = yield* resolveLocalReplicaProjects(state, index, summary, dependencies);
+	const localResolution = yield* resolveLocalReplicaProjects(state.initialModel.projects, index, summary, dependencies);
 	const localProjects = localResolution.projects;
 	if (localProjects.length !== 1) return yield* replicaHydrationFailure("replica project '" + summary.projectId + "' does not resolve to one active workspace");
 	const detail = yield* dependencies.readThread({ threadId: summary.threadId });
@@ -93599,8 +93568,8 @@ const prepareReplicaSummary = fn$1("prepareReplicaSummary")(function* (expectedR
 		localProject: localProjects[0],
 		localProjectRepositoryFullName: localResolution.repositoryRemapped ? index.runtime.githubRepoFullName : null,
 		replicaPayload: detail,
-		indexRuntimePayload: index.runtime,
-		summaryPayload: replicaSummaryPayload(summary)
+		indexRuntime: index.runtime,
+		summary
 	});
 	if (candidate === null) return yield* replicaHydrationFailure("thread '" + summary.threadId + "' failed identity or generation checks");
 	state.prepared.push({
@@ -99472,6 +99441,316 @@ function claudeWriteToken(env = process.env) {
 	return accessor.read(env);
 }
 //#endregion
+//#region src/egress/providerDeliveryReceipt.ts
+const PROVIDER_ACCOUNT_IDENTITY$2 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const RFC3339$1 = /^(\d{4})-(\d{2})-(\d{2})T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+const RECEIPT_KEYS = new Set([
+	"receiptId",
+	"runtimeId",
+	"machineId",
+	"credentialEpoch",
+	"identity",
+	"issuedAt",
+	"expiresAt"
+]);
+const BINDING_KEYS = new Set([
+	"runtimeId",
+	"machineId",
+	"credentialEpoch",
+	"identity"
+]);
+const CODEX_IDENTITY_KEYS = new Set([
+	"kind",
+	"provider",
+	"providerAccountIdentity"
+]);
+const CLAUDE_IDENTITY_KEYS = new Set([
+	"kind",
+	"provider",
+	"credentialGenerationId"
+]);
+function isRecord$13(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStrictRfc3339DateTime(value) {
+	if (typeof value !== "string") return false;
+	const match = RFC3339$1.exec(value);
+	if (!match || !Number.isFinite(Date.parse(value))) return false;
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	const day = Number(match[3]);
+	return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth$1(year, month);
+}
+function daysInMonth$1(year, month) {
+	if (month === 2) return year % 400 === 0 || year % 4 === 0 && year % 100 !== 0 ? 29 : 28;
+	return [
+		4,
+		6,
+		9,
+		11
+	].includes(month) ? 30 : 31;
+}
+function hasExactKeys$2(value, keys) {
+	return Object.keys(value).every((key) => keys.has(key)) && Object.keys(value).length === keys.size;
+}
+function parseDeliveryIdentity(value, provider) {
+	if (!isRecord$13(value)) return null;
+	if (provider === "openai") return parseCodexDeliveryIdentity(value);
+	if (provider === "anthropic") return parseClaudeDeliveryIdentity(value);
+	return null;
+}
+function parseCodexDeliveryIdentity(value) {
+	if (!hasExactKeys$2(value, CODEX_IDENTITY_KEYS) || value.kind !== "provider_account" || value.provider !== "codex" || typeof value.providerAccountIdentity !== "string" || !PROVIDER_ACCOUNT_IDENTITY$2.test(value.providerAccountIdentity)) return null;
+	return {
+		kind: "provider_account",
+		provider: "codex",
+		providerAccountIdentity: value.providerAccountIdentity
+	};
+}
+function parseClaudeDeliveryIdentity(value) {
+	if (!hasExactKeys$2(value, CLAUDE_IDENTITY_KEYS) || value.kind !== "credential_generation" || value.provider !== "claude" || typeof value.credentialGenerationId !== "string" || !UUID.test(value.credentialGenerationId)) return null;
+	return {
+		kind: "credential_generation",
+		provider: "claude",
+		credentialGenerationId: value.credentialGenerationId
+	};
+}
+function parseProviderRuntimeDeliveryReceipt(value, expected) {
+	if (!isRecord$13(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
+	const identity = parseDeliveryIdentity(value.identity, expected.provider);
+	if (!identity || typeof value.receiptId !== "string" || value.receiptId.length === 0 || value.receiptId.length > 256 || value.runtimeId !== expected.runtimeId || value.machineId !== expected.machineId || value.credentialEpoch !== expected.credentialEpoch || !Number.isInteger(value.credentialEpoch) || value.credentialEpoch < 0 || !isStrictRfc3339DateTime(value.issuedAt) || value.expiresAt !== expected.expiresAt || value.expiresAt !== null && !isStrictRfc3339DateTime(value.expiresAt)) return null;
+	return {
+		receiptId: value.receiptId,
+		runtimeId: expected.runtimeId,
+		machineId: expected.machineId,
+		credentialEpoch: expected.credentialEpoch,
+		identity,
+		issuedAt: value.issuedAt,
+		expiresAt: value.expiresAt
+	};
+}
+function providerDeliveryBindingFromReceipt(receipt) {
+	return {
+		runtimeId: receipt.runtimeId,
+		machineId: receipt.machineId,
+		credentialEpoch: receipt.credentialEpoch,
+		identity: receipt.identity
+	};
+}
+function readProviderDeliveryBinding(value) {
+	if (!isRecord$13(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
+	const identityProvider = isRecord$13(value.identity) ? value.identity.provider : void 0;
+	const tokenProvider = identityProvider === "codex" ? "openai" : identityProvider === "claude" ? "anthropic" : null;
+	if (!tokenProvider) return null;
+	const identity = parseDeliveryIdentity(value.identity, tokenProvider);
+	if (!identity || typeof value.runtimeId !== "string" || value.runtimeId.length === 0 || typeof value.machineId !== "string" || value.machineId.length === 0 || !Number.isInteger(value.credentialEpoch) || value.credentialEpoch < 0) return null;
+	return {
+		runtimeId: value.runtimeId,
+		machineId: value.machineId,
+		credentialEpoch: value.credentialEpoch,
+		identity
+	};
+}
+function providerDeliveryBindingsEqual(left, right) {
+	if (left.runtimeId !== right.runtimeId || left.machineId !== right.machineId || left.credentialEpoch !== right.credentialEpoch || left.identity.kind !== right.identity.kind || left.identity.provider !== right.identity.provider) return false;
+	if (left.identity.kind === "provider_account" && right.identity.kind === "provider_account") return left.identity.providerAccountIdentity === right.identity.providerAccountIdentity;
+	return left.identity.kind === "credential_generation" && right.identity.kind === "credential_generation" && left.identity.credentialGenerationId === right.identity.credentialGenerationId;
+}
+//#endregion
+//#region src/provider/claudeReadinessReason.ts
+/**
+* The reason literals Forge has copy for, confirmed against CMMD-36441's
+* readiness service. If the route renames one, the rename lands here as a
+* fall-through to the generic sentence, never as a wrong sentence.
+*
+* Reading the reason is what makes `stale` legible. CMMD-36441 answers
+* `credential_reconnect_required` on a `stale` answer that still reports
+* `connected: true`, and the older `credential_generation_not_applied` on a
+* `stale` answer that simply has not landed yet. Those want opposite
+* sentences, and both used to get "Reconnect Claude in Settings" because the
+* guard read only the delivery status.
+*/
+const CODE_BY_UPSTREAM_REASON$1 = {
+	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
+	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
+	runtime_unavailable: "RUNTIME_UNAVAILABLE"
+};
+const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
+/**
+* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
+* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
+* time is the only part of that sentence Forge repeats.
+*/
+const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
+function claudeReadinessReasonCode(reason) {
+	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
+	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
+}
+function expiredAtFromReadinessMessage(message) {
+	if (typeof message !== "string") return null;
+	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
+}
+function claudeCredentialExpiredTurnCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
+}
+function claudeCredentialExpiredCardCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
+}
+/**
+* The last allowlisted readiness reason this process saw.
+*
+* A server process serves exactly one runtime, so one slot is the whole store.
+* It holds a reason code and a timestamp, never credential bytes. The provider
+* catalog reads a local credential file and cannot tell an expired snapshot
+* from a blank one, so without this the card can only offer the generic
+* sentence while the guard already knows better.
+*/
+let latestVerdict = null;
+/**
+* Remember, or clear, what the readiness answer said.
+*
+* An answer carrying no allowlisted reason clears the slot, which is what makes
+* the card go back to the generic sentence the moment CMMD applies a
+* credential: an applied answer carries no reason.
+*/
+function recordClaudeReadinessVerdict(readiness) {
+	const code = claudeReadinessReasonCode(readiness.reason);
+	latestVerdict = code === null ? null : {
+		code,
+		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
+	};
+}
+/**
+* What the provider status card says about a delivered credential it cannot
+* use. Names the expiry only when a readiness answer supplied the time; a
+* guessed time would be worse than the generic sentence.
+*/
+function claudeNativeCredentialUnusableMessage() {
+	const verdict = latestVerdict;
+	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
+	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
+}
+//#endregion
+//#region src/provider/providerReadiness.ts
+const GENERATION_HASH_PATTERN$1 = /^[a-f0-9]{64}$/;
+const STILL_APPLYING_STATUSES = new Set([
+	"pending",
+	"claimed",
+	"activating"
+]);
+const OAUTH_SECRET_FIELDS = ["accessToken", "refreshToken"];
+var ProviderReadinessFetchError = class extends Error {
+	constructor(failure) {
+		super(failure);
+		this.failure = failure;
+		this.name = "ProviderReadinessFetchError";
+	}
+};
+async function queryProviderReadiness(input) {
+	if (input.sprite !== null && input.environmentId !== input.sprite.environmentId) return {
+		kind: "query_failed",
+		failure: "wrong_environment"
+	};
+	if (input.provider !== "claudeAgent" || input.sprite === null) return {
+		kind: "ready",
+		binding: null
+	};
+	const sprite = input.sprite;
+	if (!GENERATION_HASH_PATTERN$1.test(sprite.localGenerationHash)) return {
+		kind: "not_ready",
+		reason: "generation_mismatch"
+	};
+	let snapshot;
+	try {
+		snapshot = await input.claude.fetch(sprite.runtimeId);
+	} catch (cause) {
+		if (cause instanceof ProviderReadinessFetchError) return {
+			kind: "query_failed",
+			failure: cause.failure
+		};
+		return {
+			kind: "query_failed",
+			failure: "cmmd_unavailable"
+		};
+	}
+	return classifyClaudeSnapshot(snapshot, sprite);
+}
+function isAppliedClaudeSnapshot(snapshot) {
+	return snapshot.connected === true && snapshot.deliveryStatus === "applied" && snapshot.nativeExecutable === true && typeof snapshot.generationId === "string" && snapshot.generationId.trim().length > 0;
+}
+function classifyUnappliedClaudeSnapshot(snapshot) {
+	const code = claudeReadinessReasonCode(snapshot.reason);
+	if (code === "RUNTIME_UNAVAILABLE") return {
+		kind: "not_ready",
+		reason: "environment_unavailable"
+	};
+	if (code === "CREDENTIAL_EXPIRED_REFRESHING" || code === "CREDENTIAL_GENERATION_NOT_APPLIED") return {
+		kind: "not_ready",
+		reason: "still_applying"
+	};
+	if (code === "CREDENTIAL_RECONNECT_REQUIRED") return {
+		kind: "not_ready",
+		reason: "credential_unusable"
+	};
+	if (STILL_APPLYING_STATUSES.has(snapshot.deliveryStatus)) return {
+		kind: "not_ready",
+		reason: "still_applying"
+	};
+	if (snapshot.deliveryStatus === "failed") return {
+		kind: "not_ready",
+		reason: "apply_failed"
+	};
+	return {
+		kind: "not_ready",
+		reason: "credential_unusable"
+	};
+}
+function classifyClaudeSnapshot(snapshot, sprite) {
+	if (!isAppliedClaudeSnapshot(snapshot)) return classifyUnappliedClaudeSnapshot(snapshot);
+	const generationId = snapshot.generationId.trim();
+	if (createHash("sha256").update(generationId).digest("hex") !== sprite.localGenerationHash) return {
+		kind: "not_ready",
+		reason: "generation_mismatch"
+	};
+	const deliveryReceipt = parseProviderRuntimeDeliveryReceipt(snapshot.deliveryReceipt, {
+		provider: "anthropic",
+		runtimeId: sprite.runtimeId,
+		machineId: sprite.machineId,
+		credentialEpoch: sprite.credentialEpoch,
+		expiresAt: snapshot.deliveryReceipt?.expiresAt ?? null
+	});
+	if (deliveryReceipt?.identity.kind !== "credential_generation" || deliveryReceipt.identity.credentialGenerationId !== generationId) return {
+		kind: "not_ready",
+		reason: "sprite_identity_drift"
+	};
+	return {
+		kind: "ready",
+		binding: providerDeliveryBindingFromReceipt(deliveryReceipt)
+	};
+}
+/**
+* A Claude.ai subscription blob is usable when claudeAiOauth holds at least one
+* non-empty secret. Metadata without tokens is how production showed Connected
+* (max) for three days while every turn failed to refresh.
+*/
+function hasUsableClaudeCredentialBlob(credentialJson) {
+	try {
+		const parsed = JSON.parse(credentialJson);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return false;
+		const oauth = parsed.claudeAiOauth;
+		if (typeof oauth !== "object" || oauth === null || Array.isArray(oauth)) return false;
+		return OAUTH_SECRET_FIELDS.some((field) => {
+			const value = oauth[field];
+			return typeof value === "string" && value.trim().length > 0;
+		});
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/providerAuth/ClaudeDeviceAuth.ts
 const AUTHORIZE_URL_PATTERN = /https:\/\/[^\s]*\/oauth\/authorize\?[^\s]+/u;
 const ANSI_ESCAPE_PATTERN$1 = new RegExp(String.raw`\x1B\[[0-?]*[ -/]*[@-~]`, "gu");
@@ -99753,21 +100032,7 @@ function resolveLocalClaudeCredentialPath(homePath) {
 * an API-key config. Claude Code stores the subscription OAuth under a
 * `claudeAiOauth` object; require that marker. Mirrors CMMD's
 * validateClaudeCredentialJson.
-*/
-function isClaudeSubscriptionCredential(credentialJson) {
-	try {
-		const parsed = JSON.parse(credentialJson);
-		if (typeof parsed !== "object" || parsed === null) return false;
-		const oauth = parsed.claudeAiOauth;
-		if (typeof oauth !== "object" || oauth === null) return false;
-		return hasUsableOauthSecrets(oauth);
-	} catch {
-		return false;
-	}
-}
-/** Either of these alone is enough to authenticate. */
-const OAUTH_SECRET_FIELDS = ["accessToken", "refreshToken"];
-/**
+*
 * Require AT LEAST ONE usable token before uploading anything.
 *
 * This gate used to end at "claudeAiOauth is an object", and in production that
@@ -99794,11 +100059,8 @@ const OAUTH_SECRET_FIELDS = ["accessToken", "refreshToken"];
 * schema Anthropic might ship, and fields they add, rename or drop around these
 * two keep flowing through untouched.
 */
-function hasUsableOauthSecrets(oauth) {
-	return OAUTH_SECRET_FIELDS.some((field) => {
-		const value = oauth[field];
-		return typeof value === "string" && value.trim().length > 0;
-	});
+function isClaudeSubscriptionCredential(credentialJson) {
+	return hasUsableClaudeCredentialBlob(credentialJson);
 }
 const EMAIL_FIELD_NAMES = new Set([
 	"email",
@@ -146345,12 +146607,12 @@ function decodeProviderKind(providerName, operation) {
 		detail: `Unknown persisted provider '${providerName}'.`
 	}));
 }
-function isRecord$13(value) {
+function isRecord$12(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeRuntimePayload(existing, next) {
 	if (next === void 0) return existing ?? null;
-	if (isRecord$13(existing) && isRecord$13(next)) return {
+	if (isRecord$12(existing) && isRecord$12(next)) return {
 		...existing,
 		...next
 	};
@@ -147936,123 +148198,6 @@ function buildCodexCredentialModelScope(input) {
 	return providerEgressModelScope(input.selectedModel, catalog);
 }
 //#endregion
-//#region src/egress/providerDeliveryReceipt.ts
-const PROVIDER_ACCOUNT_IDENTITY$2 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const RFC3339$1 = /^(\d{4})-(\d{2})-(\d{2})T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
-const RECEIPT_KEYS = new Set([
-	"receiptId",
-	"runtimeId",
-	"machineId",
-	"credentialEpoch",
-	"identity",
-	"issuedAt",
-	"expiresAt"
-]);
-const BINDING_KEYS = new Set([
-	"runtimeId",
-	"machineId",
-	"credentialEpoch",
-	"identity"
-]);
-const CODEX_IDENTITY_KEYS = new Set([
-	"kind",
-	"provider",
-	"providerAccountIdentity"
-]);
-const CLAUDE_IDENTITY_KEYS = new Set([
-	"kind",
-	"provider",
-	"credentialGenerationId"
-]);
-function isRecord$12(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isStrictRfc3339DateTime(value) {
-	if (typeof value !== "string") return false;
-	const match = RFC3339$1.exec(value);
-	if (!match || !Number.isFinite(Date.parse(value))) return false;
-	const year = Number(match[1]);
-	const month = Number(match[2]);
-	const day = Number(match[3]);
-	return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth$1(year, month);
-}
-function daysInMonth$1(year, month) {
-	if (month === 2) return year % 400 === 0 || year % 4 === 0 && year % 100 !== 0 ? 29 : 28;
-	return [
-		4,
-		6,
-		9,
-		11
-	].includes(month) ? 30 : 31;
-}
-function hasExactKeys$2(value, keys) {
-	return Object.keys(value).every((key) => keys.has(key)) && Object.keys(value).length === keys.size;
-}
-function parseDeliveryIdentity(value, provider) {
-	if (!isRecord$12(value)) return null;
-	if (provider === "openai") return parseCodexDeliveryIdentity(value);
-	if (provider === "anthropic") return parseClaudeDeliveryIdentity(value);
-	return null;
-}
-function parseCodexDeliveryIdentity(value) {
-	if (!hasExactKeys$2(value, CODEX_IDENTITY_KEYS) || value.kind !== "provider_account" || value.provider !== "codex" || typeof value.providerAccountIdentity !== "string" || !PROVIDER_ACCOUNT_IDENTITY$2.test(value.providerAccountIdentity)) return null;
-	return {
-		kind: "provider_account",
-		provider: "codex",
-		providerAccountIdentity: value.providerAccountIdentity
-	};
-}
-function parseClaudeDeliveryIdentity(value) {
-	if (!hasExactKeys$2(value, CLAUDE_IDENTITY_KEYS) || value.kind !== "credential_generation" || value.provider !== "claude" || typeof value.credentialGenerationId !== "string" || !UUID.test(value.credentialGenerationId)) return null;
-	return {
-		kind: "credential_generation",
-		provider: "claude",
-		credentialGenerationId: value.credentialGenerationId
-	};
-}
-function parseProviderRuntimeDeliveryReceipt(value, expected) {
-	if (!isRecord$12(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
-	const identity = parseDeliveryIdentity(value.identity, expected.provider);
-	if (!identity || typeof value.receiptId !== "string" || value.receiptId.length === 0 || value.receiptId.length > 256 || value.runtimeId !== expected.runtimeId || value.machineId !== expected.machineId || value.credentialEpoch !== expected.credentialEpoch || !Number.isInteger(value.credentialEpoch) || value.credentialEpoch < 0 || !isStrictRfc3339DateTime(value.issuedAt) || value.expiresAt !== expected.expiresAt || value.expiresAt !== null && !isStrictRfc3339DateTime(value.expiresAt)) return null;
-	return {
-		receiptId: value.receiptId,
-		runtimeId: expected.runtimeId,
-		machineId: expected.machineId,
-		credentialEpoch: expected.credentialEpoch,
-		identity,
-		issuedAt: value.issuedAt,
-		expiresAt: value.expiresAt
-	};
-}
-function providerDeliveryBindingFromReceipt(receipt) {
-	return {
-		runtimeId: receipt.runtimeId,
-		machineId: receipt.machineId,
-		credentialEpoch: receipt.credentialEpoch,
-		identity: receipt.identity
-	};
-}
-function readProviderDeliveryBinding(value) {
-	if (!isRecord$12(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
-	const identityProvider = isRecord$12(value.identity) ? value.identity.provider : void 0;
-	const tokenProvider = identityProvider === "codex" ? "openai" : identityProvider === "claude" ? "anthropic" : null;
-	if (!tokenProvider) return null;
-	const identity = parseDeliveryIdentity(value.identity, tokenProvider);
-	if (!identity || typeof value.runtimeId !== "string" || value.runtimeId.length === 0 || typeof value.machineId !== "string" || value.machineId.length === 0 || !Number.isInteger(value.credentialEpoch) || value.credentialEpoch < 0) return null;
-	return {
-		runtimeId: value.runtimeId,
-		machineId: value.machineId,
-		credentialEpoch: value.credentialEpoch,
-		identity
-	};
-}
-function providerDeliveryBindingsEqual(left, right) {
-	if (left.runtimeId !== right.runtimeId || left.machineId !== right.machineId || left.credentialEpoch !== right.credentialEpoch || left.identity.kind !== right.identity.kind || left.identity.provider !== right.identity.provider) return false;
-	if (left.identity.kind === "provider_account" && right.identity.kind === "provider_account") return left.identity.providerAccountIdentity === right.identity.providerAccountIdentity;
-	return left.identity.kind === "credential_generation" && right.identity.kind === "credential_generation" && left.identity.credentialGenerationId === right.identity.credentialGenerationId;
-}
-//#endregion
 //#region src/egress/providerEgressToken.ts
 var ProviderEgressTokenError = class extends TaggedError("ProviderEgressTokenError") {};
 const PROVIDER_EGRESS_TOKEN_TIMEOUT_MS = 1e4;
@@ -208395,82 +208540,6 @@ const makeProviderAuthProvenance = (input) => {
 	};
 };
 //#endregion
-//#region src/provider/claudeReadinessReason.ts
-/**
-* The reason literals Forge has copy for, confirmed against CMMD-36441's
-* readiness service. If the route renames one, the rename lands here as a
-* fall-through to the generic sentence, never as a wrong sentence.
-*
-* Reading the reason is what makes `stale` legible. CMMD-36441 answers
-* `credential_reconnect_required` on a `stale` answer that still reports
-* `connected: true`, and the older `credential_generation_not_applied` on a
-* `stale` answer that simply has not landed yet. Those want opposite
-* sentences, and both used to get "Reconnect Claude in Settings" because the
-* guard read only the delivery status.
-*/
-const CODE_BY_UPSTREAM_REASON$1 = {
-	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
-	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
-	runtime_unavailable: "RUNTIME_UNAVAILABLE"
-};
-const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
-/**
-* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
-* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
-* time is the only part of that sentence Forge repeats.
-*/
-const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
-function claudeReadinessReasonCode(reason) {
-	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
-	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
-}
-function expiredAtFromReadinessMessage(message) {
-	if (typeof message !== "string") return null;
-	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
-}
-function claudeCredentialExpiredTurnCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
-}
-function claudeCredentialExpiredCardCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
-}
-/**
-* The last allowlisted readiness reason this process saw.
-*
-* A server process serves exactly one runtime, so one slot is the whole store.
-* It holds a reason code and a timestamp, never credential bytes. The provider
-* catalog reads a local credential file and cannot tell an expired snapshot
-* from a blank one, so without this the card can only offer the generic
-* sentence while the guard already knows better.
-*/
-let latestVerdict = null;
-/**
-* Remember, or clear, what the readiness answer said.
-*
-* An answer carrying no allowlisted reason clears the slot, which is what makes
-* the card go back to the generic sentence the moment CMMD applies a
-* credential: an applied answer carries no reason.
-*/
-function recordClaudeReadinessVerdict(readiness) {
-	const code = claudeReadinessReasonCode(readiness.reason);
-	latestVerdict = code === null ? null : {
-		code,
-		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
-	};
-}
-/**
-* What the provider status card says about a delivered credential it cannot
-* use. Names the expiry only when a readiness answer supplied the time; a
-* guessed time would be worse than the generic sentence.
-*/
-function claudeNativeCredentialUnusableMessage() {
-	const verdict = latestVerdict;
-	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
-	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
-}
-//#endregion
 //#region src/provider/personalClaudeInVm.ts
 /**
 * CMMD writes this marker when it activates a personal Claude subscription
@@ -208538,18 +208607,6 @@ function supportsFable51ClaudeCli(version) {
 function modelsForClaudeCliVersion(models, version) {
 	return supportsFable51ClaudeCli(version) ? models : models.filter((model) => model.slug !== "claude-fable-5-1");
 }
-function hasUsableNativeClaudeCredential(value) {
-	try {
-		const parsed = JSON.parse(value);
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return false;
-		const oauth = parsed.claudeAiOauth;
-		if (typeof oauth !== "object" || oauth === null || Array.isArray(oauth)) return false;
-		const record = oauth;
-		return [record.accessToken, record.refreshToken].some((token) => typeof token === "string" && token.trim().length > 0);
-	} catch {
-		return false;
-	}
-}
 function getClaudeModelCapabilities(model) {
 	return getProviderModelCapabilities(PROVIDER$12, model) ?? DEFAULT_CLAUDE_MODEL_CAPABILITIES;
 }
@@ -209002,7 +209059,7 @@ function claudeVersionProbeTimeoutProvider(input) {
 const nativeClaudeProviderStatus = fn$1("nativeClaudeProviderStatus")(function* (input) {
 	const nativeConfigPath = input.configPath ?? join(homedir(), ".claude");
 	const nativeCredential = yield* tryPromise(() => readFile$1(join(nativeConfigPath, ".credentials.json"), "utf8")).pipe(option);
-	const usable = isSome(nativeCredential) ? hasUsableNativeClaudeCredential(nativeCredential.value) : false;
+	const usable = isSome(nativeCredential) ? hasUsableClaudeCredentialBlob(nativeCredential.value) : false;
 	return buildServerProvider({
 		provider: PROVIDER$12,
 		enabled: input.enabled,
@@ -227159,44 +227216,40 @@ function readinessFailureIssue(readiness) {
 	if (readiness.connected === false || readiness.deliveryStatus === "stale" || readiness.deliveryStatus === "not_connected") return CLAUDE_READINESS_COPY.invalid;
 	return CLAUDE_READINESS_COPY.unavailable;
 }
-function generationHash(generationId) {
-	return createHash("sha256").update(generationId).digest("hex");
-}
 async function assertNativeClaudeRuntimeReady(input) {
 	if (!GENERATION_HASH_PATTERN.test(input.localGenerationHash)) throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.unavailable);
+	const environmentId = EnvironmentId.make(`cmmd-runtime:${input.runtimeId}`);
+	const sprite = {
+		environmentId,
+		runtimeId: input.runtimeId,
+		machineId: input.machineId,
+		credentialEpoch: input.credentialEpoch,
+		localGenerationHash: input.localGenerationHash
+	};
 	return await withReadinessRetry(async () => {
 		const readiness = decodeClaudeRuntimeReadiness(await input.fetchReadiness(input.runtimeId));
 		recordClaudeReadinessVerdict(readiness);
-		return verifiedClaudeDeliveryBinding(readiness, input);
-	});
-}
-function verifiedClaudeDeliveryBinding(readiness, authority) {
-	const generationId = appliedClaudeGeneration(readiness);
-	if (generationHash(generationId) !== authority.localGenerationHash) throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.generationMismatch);
-	const deliveryReceipt = parseProviderRuntimeDeliveryReceipt(readiness.deliveryReceipt, {
-		provider: "anthropic",
-		runtimeId: authority.runtimeId,
-		machineId: authority.machineId,
-		credentialEpoch: authority.credentialEpoch,
-		expiresAt: readiness.deliveryReceipt?.expiresAt ?? null
+		return bindingFromProviderReadiness(await queryProviderReadiness({
+			environmentId,
+			provider: "claudeAgent",
+			sprite,
+			claude: { fetch: async () => readiness }
+		}), readiness);
 	});
-	if (!isMatchingClaudeReceipt(deliveryReceipt, generationId)) throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.unavailable);
-	return providerDeliveryBindingFromReceipt(deliveryReceipt);
 }
-function appliedClaudeGeneration(readiness) {
-	if (readiness.connected !== true || readiness.deliveryStatus !== "applied" || readiness.nativeExecutable !== true || typeof readiness.generationId !== "string" || readiness.generationId.trim().length === 0) {
-		const refreshing = isCredentialRefreshInFlight(readiness);
-		const retryable = !isRuntimeUnavailable(readiness) && (refreshing || [
-			"pending",
-			"claimed",
-			"activating"
-		].includes(readiness.deliveryStatus));
-		throw new ClaudeRuntimeReadinessError(readinessFailureIssue(readiness), retryable, refreshing ? "credentialRefresh" : "default");
+function bindingFromProviderReadiness(result, snapshot) {
+	if (result.kind === "ready") {
+		if (result.binding === null) throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.unavailable);
+		return result.binding;
 	}
-	return readiness.generationId;
-}
-function isMatchingClaudeReceipt(receipt, generationId) {
-	return receipt?.identity.kind === "credential_generation" && receipt.identity.credentialGenerationId === generationId;
+	if (result.kind === "query_failed") throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.unavailable);
+	const refreshing = isCredentialRefreshInFlight(snapshot);
+	const retryable = !isRuntimeUnavailable(snapshot) && (refreshing || [
+		"pending",
+		"claimed",
+		"activating"
+	].includes(snapshot.deliveryStatus));
+	throw new ClaudeRuntimeReadinessError(result.reason === "generation_mismatch" ? CLAUDE_READINESS_COPY.generationMismatch : result.reason === "sprite_identity_drift" ? CLAUDE_READINESS_COPY.unavailable : readinessFailureIssue(snapshot), retryable, refreshing ? "credentialRefresh" : "default");
 }
 function readinessData(value) {
 	if (typeof value !== "object" || value === null || !("data" in value)) throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.unavailable);
@@ -291510,7 +291563,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "ce557b7ba4e4d217f25ff499adb104f8cd18a703";
+	return "e94d1f3729cdbbc5b3f87cc2368279c7ef20aec8";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;