@cmmd-center/forge 0.13.11 → 0.13.13

package/dist/{runtimeControlAuthority-D_zKr_eI.mjs → runtimeControlAuthority-E_kdeD_P.mjs}

@@ -209,6 +209,16 @@ function exactMachineExpectationMatches(claims, expectations) {
 function runtimeTicketExpectationsMatch(claims, expectations) {
 	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId) && exactMachineExpectationMatches(claims, expectations);
 }
+/** Verify CMMD's signature and sealed runtime identity before reading purpose-specific claims. */
+function verifyCmmdScopedRuntimePayload(token, expectations, audience) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem, audience);
+	if (!payload) return null;
+	const claims = runtimeTicketClaims(payload, false);
+	return claims && runtimeTicketExpectationsMatch(claims, expectations) ? {
+		claims,
+		payload
+	} : null;
+}
 function verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, allowExpired) {
 	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem);
 	if (!payload) return null;
@@ -552,6 +562,6 @@ async function sendRuntimeControlHeartbeat(input) {
 	};
 }
 //#endregion
-export { verifyCmmdAuthRuntimeTicket as a, verifyCmmdRuntimeTicket as c, setRuntimeGrantToken as d, createReadOnceFileTokenAccessor as f, sendRuntimeControlHeartbeat as i, verifyCmmdRuntimeTicketRefreshProof as l, bootstrapRuntimeControlAuthorityFromNarrowGrant as n, verifyCmmdClaudeReadinessTicket as o, readRuntimeControlAuthority as r, verifyCmmdClaudeUsageTicket as s, bootstrapRuntimeControlAuthority as t, runtimeGrantToken as u };
+export { verifyCmmdAuthRuntimeTicket as a, verifyCmmdRuntimeTicket as c, runtimeGrantToken as d, setRuntimeGrantToken as f, sendRuntimeControlHeartbeat as i, verifyCmmdRuntimeTicketRefreshProof as l, bootstrapRuntimeControlAuthorityFromNarrowGrant as n, verifyCmmdClaudeReadinessTicket as o, createReadOnceFileTokenAccessor as p, readRuntimeControlAuthority as r, verifyCmmdClaudeUsageTicket as s, bootstrapRuntimeControlAuthority as t, verifyCmmdScopedRuntimePayload as u };
 
-//# sourceMappingURL=runtimeControlAuthority-D_zKr_eI.mjs.map
+//# sourceMappingURL=runtimeControlAuthority-E_kdeD_P.mjs.map

package/package.json

@@ -9,7 +9,7 @@
     "cmmd-forge": "dist/bin.mjs"
   },
   "type": "module",
-  "version": "0.13.11",
+  "version": "0.13.13",
   "engines": {
     "node": "^22.16 || ^23.11 || >=24.10"
   },

package/dist/client/assets/cmmdAuthRedirect-Bp1uQaQ9.js

@@ -1,2 +0,0 @@
-import{n as e,r as t}from"./rolldown-runtime-hePW80VL.js";import{Wa as n}from"./Stream-mUTFnSY9.js";import{a as r,c as i,l as a,n as o,o as s,r as c,s as l}from"./atomRegistry-C1yW8tyM.js";import{B as ee,On as te}from"./src-BL-mOkT1.js";var u=t(n(),1),d=new WeakMap;function ne(e,t){let n=d.get(e);n===void 0&&(n=new WeakMap,d.set(e,n));let i=n.get(t);if(i!==void 0)return i;let a={subscribe(n){return e.subscribe(t,n)},snapshot(){return e.get(t)},getServerSnapshot(){return r(t,e)}};return n.set(t,a),a}function f(e,t){let n=ne(e,t);return u.useSyncExternalStore(n.subscribe,n.snapshot,n.getServerSnapshot)}var p=(e,t)=>{let n=u.useContext(c);return t?f(n,u.useMemo(()=>i(e,t),[e,t])):f(n,e)},re=(e,t,n)=>{let r=u.useContext(c);u.useEffect(()=>r.subscribe(e,t,n),[r,e,t,n?.immediate])},ie=new Set([`localhost`,`127.0.0.1`,`::1`]);function ae(e){return e.trim().toLowerCase().replace(/^\[(.*)\]$/,`$1`)}function m(e){let t=ae(e);return ie.has(t)||t.endsWith(`.localhost`)}function oe(e){try{return m(new URL(e).hostname)}catch{return!1}}function se(e){let t=e.split(`.`).map(e=>Number(e));if(t.length!==4||t.some(e=>!Number.isInteger(e)||e<0||e>255))return!1;let[n,r]=t;return n===10||n===172&&r>=16&&r<=31||n===192&&r===168}var ce=`/api/dev/local-web/bootstrap`,le=3e3,h=null,g=null,_=null;function v(){return _!==null&&Date.now()-_<le}function ue(e){try{return te(ee)(e)}catch{return null}}function de(){return!1}function y(){return typeof window>`u`?null:window.desktopBridge?.getLocalEnvironmentBootstrap()??h}async function fe(){if(!de()||window.desktopBridge)return h=null,y();let e;try{e=await fetch(new URL(ce,window.location.origin),{credentials:`include`})}catch{return h=null,_=Date.now(),null}if(e.status===204||e.status===404||!e.ok)return h=null,_=Date.now(),null;let t=ue(await e.json().catch(()=>null));return h=t,_=null,t}async function pe(){let e=typeof window>`u`?null:window.desktopBridge?.getLocalEnvironmentBootstrap();return e?(h=null,e):h||(v()?null:g||(g=fe().finally(()=>{g=null}),g))}function b(){return y()}var me=`forge_backend_mode`,he=`forge_apex_url`;function x(){return b()}function S(e){return new URL(e,window.location.origin).toString()}function ge(e,t){let n=new URL(e);return`${n.pathname.endsWith(`/`)?n.pathname.slice(0,-1):n.pathname}${t.startsWith(`/`)?t:`/${t}`}`}function C(e){let t;try{t=new URL(window.location.href)}catch{return e}let n=new URL(e);return(t.protocol===`http:`||t.protocol===`https:`)&&t.port!==``&&n.port!==``&&t.origin!==n.origin&&m(t.hostname)&&m(n.hostname),e}function _e(){return null}function ve(){let e=S(window.location.origin),t=new URL(e);if(t.protocol===`http:`)t.protocol=`ws:`;else if(t.protocol===`https:`)t.protocol=`wss:`;else throw Error(`Unsupported HTTP base URL protocol: ${t.protocol}`);return t.pathname=`/ws`,{source:`window-origin`,target:{httpBaseUrl:e,wsBaseUrl:t.toString()}}}function ye(){try{if(localStorage.getItem(me)!==`apex`)return null;let e=localStorage.getItem(he)?.trim()??void 0??``;if(!e)return null;let t=S(e),n=new URL(t);return n.protocol=t.startsWith(`https:`)?`wss:`:`ws:`,{source:`configured`,target:{httpBaseUrl:t,wsBaseUrl:n.toString()}}}catch{return null}}function be(){let e=x();return!e||e.primaryMode!==`cloud`||!e.bearerToken?null:{source:`paired-bearer`,target:{httpBaseUrl:S(e.httpBaseUrl),wsBaseUrl:S(e.wsBaseUrl)},bearerToken:e.bearerToken}}function xe(){let e=x();if(!e||e.primaryMode===`cloud`||!e.httpBaseUrl&&!e.wsBaseUrl)return null;if(!e.httpBaseUrl||!e.wsBaseUrl)throw Error(`Desktop bootstrap must provide both httpBaseUrl and wsBaseUrl for the local environment.`);return{source:`desktop-managed`,target:{httpBaseUrl:S(e.httpBaseUrl),wsBaseUrl:S(e.wsBaseUrl)},...e.bearerToken?{bearerToken:e.bearerToken}:{}}}function w(e,t){let n=T();if(!n)throw Error(`Unable to resolve the primary environment HTTP base URL.`);let r=new URL(C(n.target.httpBaseUrl));return r.pathname=ge(r.toString(),e),t&&(r.search=new URLSearchParams(t).toString()),r.toString()}function T(){return be()??ye()??xe()??_e()??ve()}function E(e={}){let t=T(),n=t?.bearerToken;return!t||!n||!D(t)?e:{...e,credentials:`omit`,headers:{...e.headers,Authorization:`Bearer ${n}`}}}function D(e){if(e.source!==`desktop-managed`||typeof window>`u`)return!0;try{return new URL(C(e.target.httpBaseUrl)).origin!==window.location.origin}catch{return!0}}async function O(e,t){return await e.text()||t}async function k(){let e=w(`/api/auth/logout`),t=await fetch(e,E({credentials:`include`,method:`POST`}));if(!t.ok)throw Error(await O(t,`Failed to logout authenticated session (${t.status}).`))}var A=1e3,j=2,M=64e3,Se=Object.freeze({attemptCount:0,closeCode:null,closeReason:null,connectedAt:null,disconnectedAt:null,hasConnected:!1,lastError:null,lastErrorAt:null,nextRetryAt:null,online:typeof navigator>`u`||navigator.onLine!==!1,phase:`idle`,reconnectAttemptCount:0,reconnectMaxAttempts:11,reconnectPhase:`idle`,socketUrl:null}),N=l(Se).pipe(s,a(`ws-connection-status`)),P=Object.freeze({status:`ok`}),F=l(P).pipe(s,a(`cloud-auth-failure`));function Ce(e){o.get(F).status!==`expired`&&o.set(F,{status:`expired`,detectedAt:new Date().toISOString(),source:e})}function I(){o.set(F,P)}function we(){return o.get(F)}function L(){return new Date().toISOString()}function R(e){let t=e(z());return o.set(N,t),t}function z(){return o.get(N)}function Te(e){return e.phase===`connected`||e.hasConnected&&e.disconnectedAt===null&&e.phase===`connecting`?`connected`:!e.online&&(e.disconnectedAt!==null||e.phase===`disconnected`)?`offline`:e.hasConnected?`reconnecting`:e.phase===`disconnected`?`error`:`connecting`}function Ee(e){return R(t=>({...t,attemptCount:t.attemptCount+1,nextRetryAt:null,phase:`connecting`,reconnectAttemptCount:t.phase===`connected`?1:t.reconnectAttemptCount+1,reconnectPhase:`attempting`,socketUrl:e}))}function De(){return R(e=>({...e,closeCode:null,closeReason:null,connectedAt:L(),disconnectedAt:null,hasConnected:!0,nextRetryAt:null,phase:`connected`,reconnectAttemptCount:0,reconnectPhase:`idle`}))}function Oe(e){return R(t=>V(t,{lastError:e?.trim()?e:t.lastError,lastErrorAt:L()}))}function ke(e){return R(t=>t.hasConnected&&Ae(e)?t:V(t,{closeCode:e?.code??t.closeCode,closeReason:e?.reason?.trim()?e.reason:t.closeReason}))}function Ae(e){return(e?.reason?.trim()??``).length===0&&(e?.code===1e3||e?.code===1001)}function je(e){return R(t=>({...t,online:e}))}function Me(){return R(e=>({...e,nextRetryAt:null,reconnectAttemptCount:0,reconnectPhase:`idle`}))}function Ne(){return p(N)}function B(e){return!Number.isInteger(e)||e<0||e>=10?null:Math.min(Math.round(A*j**e),M)}function V(e,t){let n=e.disconnectedAt??L(),r=e.nextRetryAt!==null||e.reconnectPhase===`exhausted`?null:B(Math.max(0,e.reconnectAttemptCount-1));return{...e,...t,disconnectedAt:n,nextRetryAt:r===null?e.nextRetryAt:new Date(Date.now()+r).toISOString(),phase:`disconnected`,reconnectPhase:e.reconnectPhase===`waiting`||e.reconnectPhase===`exhausted`?e.reconnectPhase:r===null?`exhausted`:`waiting`}}var H=class extends Error{constructor(e=`Session has expired. Please re-login.`){super(e),this.name=`ForgeAuthExpiredError`}};function Pe(e){return e instanceof H||e instanceof Error&&e.name===`ForgeAuthExpiredError`}var U=`forge_auth_expired_reason`,Fe=`session-expired`,W=`reason`,G=`cmmd-auth-expired`,K={"session-expired":`Session has expired. Please re-login.`,"desktop-session-required":`Forge Desktop needs a CMMD sign-in before this device can host or control runtimes.`,"desktop-principal-mismatch":`Forge Desktop and the local Forge session are signed in to different CMMD accounts. Sign in again to reconcile them.`,"desktop-state-unavailable":`Forge Desktop could not verify its native CMMD session. Restart Forge or sign in again.`};function Ie(e){if(!(e===null||!(e in K)))return K[e]}function q(e){if(!(typeof window>`u`))try{window.sessionStorage.setItem(U,e)}catch{}}function J(){if(typeof window>`u`)return null;try{return new URL(window.location.href).searchParams.getAll(W).includes(G)?Fe:null}catch{return null}}function Y(){if(!(typeof window>`u`))try{let e=new URL(window.location.href),t=e.searchParams.getAll(W);if(!t.includes(G))return;e.searchParams.delete(W);for(let n of t)n!==G&&e.searchParams.append(W,n);window.history.replaceState({},typeof document>`u`?``:document.title,e.toString())}catch{}}function X(){let e=J();return e!==null&&Y(),e}function Le(){if(!(typeof window>`u`)){try{window.sessionStorage.removeItem(U)}catch{}Y()}}function Re(){if(typeof window>`u`)return null;try{let e=window.sessionStorage.getItem(U);return Y(),e}catch{return Y(),null}}function ze(){if(typeof window>`u`)return null;try{let e=window.sessionStorage.getItem(U);return e===null?X():(window.sessionStorage.removeItem(U),Y(),e)}catch{return X()}}async function Z(){await k().catch(()=>void 0),I(),q(`session-expired`);let e=new URL(w(`/login`));window.location.assign(e.toString())}var Be=e({handleCmmdAuthExpired:()=>$}),Q=null;async function $(e){if((e===void 0||e===401)&&!(typeof window>`u`))return Q||(Q=Z().finally(()=>{Q=null}),Q)}export{b as A,je as C,E as D,k as E,re as F,p as I,m as M,oe as N,T as O,se as P,Me as S,Ne as T,B as _,Le as a,Oe as b,Z as c,ze as d,I as f,Te as g,z as h,H as i,pe as j,w as k,Ie as l,we as m,$ as n,Pe as o,F as p,U as r,Re as s,Be as t,q as u,Ee as v,Ce as w,De as x,ke as y};
-//# sourceMappingURL=cmmdAuthRedirect-Bp1uQaQ9.js.map